Allow DBA password to be updated via Terraform

internal/framework/generic_resource.go

@@ -62,8 +62,10 @@ type ResourceState interface {
 	Reset()
 
 	// CheckReady returns an error if the resource is not in the desired
-	// state according to its spec, based on the local state.
-	CheckReady() error
+	// state according to its spec, based on the local state. The supplied
+	// client can be used to request additional readiness information from
+	// the server.
+	CheckReady(ctx context.Context, client openapi.ClientInterface) error
 
 	// Create creates the resource in the backend based on the local state
 	// and waits for it to satisfy IsReady().
@@ -319,7 +321,7 @@ func (r *GenericResource) AwaitReady(ctx context.Context, state ResourceState, o
 	defer cancel()
 	for {
 		// Check if resource is ready
-		readyErr := state.CheckReady()
+		readyErr := state.CheckReady(ctx, r.client.Client)
 		if readyErr == nil {
 			return nil
 		}

internal/provider/database/resource.go

@@ -39,7 +39,8 @@ func (state *DatabaseResourceModel) DbaPasswordMatches(other *DatabaseResourceMo
 	return true
 }
 
-func (state *DatabaseResourceModel) CheckReady() error {
+func (state *DatabaseResourceModel) CheckReady(ctx context.Context, client openapi.ClientInterface) error {
+	// Check that database is either Available or Stopped based on maintenance.isDisabled value
 	if state.Status == nil || state.Status.State == nil {
 		return fmt.Errorf("Database %s/%s/%s has no status information", state.Organization, state.Project, state.Name)
 	}
@@ -51,6 +52,18 @@ func (state *DatabaseResourceModel) CheckReady() error {
 		return fmt.Errorf("Database %s/%s/%s has an unexpected state: expected=%s, found=%s",
 			state.Organization, state.Project, state.Name, expectedState, *state.Status.State)
 	}
+	// Check that DBA password is up-to-date if password update is supported
+	resp, err := state.UpdateDbaPassword(ctx, client, nil)
+	if IsDbaPasswordUpdateUnsupportedError(resp, err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("DBA password for database %s/%s/%s has not been updated",
+			state.Organization, state.Project, state.Name)
+	}
 	return nil
 }
 
@@ -93,24 +106,28 @@ func IsDbaPasswordUpdateUnsupportedError(resp *http.Response, err error) bool {
 	return false
 }
 
+func (state *DatabaseResourceModel) UpdateDbaPassword(ctx context.Context, client openapi.ClientInterface, target *string) (*http.Response, error) {
+	request := openapi.UpdateDbaPasswordModel{
+		Current: *state.DbaPassword,
+		Target:  target,
+	}
+	resp, err := client.UpdateDbaPassword(ctx, state.Organization, state.Project, state.Name, nil, request)
+	if err != nil {
+		return resp, err
+	}
+	// Decode the response and check that there is no error
+	return resp, helper.ParseResponse(resp, nil)
+}
+
 func (state *DatabaseResourceModel) Update(ctx context.Context, client openapi.ClientInterface, currentState framework.ResourceState) error {
 	// Try to update DBA password if it was changed in config
 	currentDatabase, _ := currentState.(*DatabaseResourceModel)
 	if !state.DbaPasswordMatches(currentDatabase) {
-		request := openapi.UpdateDbaPasswordModel{
-			Current: *currentDatabase.DbaPassword,
-			Target:  state.DbaPassword,
-		}
-		resp, err := client.UpdateDbaPassword(ctx, state.Organization, state.Project, state.Name, nil, request)
-		if err != nil {
-			return err
+		resp, err := currentDatabase.UpdateDbaPassword(ctx, client, state.DbaPassword)
+		if IsDbaPasswordUpdateUnsupportedError(resp, err) {
+			return fmt.Errorf(DBA_PASSWORD_CHANGE_UNSUPPORTED_MSG)
 		}
-		// Decode the response and check that there is no error
-		err = helper.ParseResponse(resp, nil)
 		if err != nil {
-			if IsDbaPasswordUpdateUnsupportedError(resp, err) {
-				return fmt.Errorf(DBA_PASSWORD_CHANGE_UNSUPPORTED_MSG)
-			}
 			return err
 		}
 	}

internal/provider/project/resource.go

@@ -29,7 +29,7 @@ func (state *ProjectResourceModel) Reset() {
 	*state = ProjectResourceModel{}
 }
 
-func (state *ProjectResourceModel) CheckReady() error {
+func (state *ProjectResourceModel) CheckReady(ctx context.Context, client openapi.ClientInterface) error {
 	if state.Status == nil || state.Status.State == nil {
 		return fmt.Errorf("Project %s/%s has no status information", state.Organization, state.Name)
 	}

internal/provider_test/integration_test.go

@@ -1011,9 +1011,27 @@ func TestImmutableAttributeChange(t *testing.T) {
 		t.Run("dbaPasswordChange", func(t *testing.T) {
 			// Change DBA password and run `terraform apply`
 			vars.database.DbaPassword = ptr("updated")
+			// Expect readiness check to fail due to DBA password
+			// not being updated and specify small timeout
+			if vars.providerCfg.Timeouts == nil {
+				vars.providerCfg.Timeouts = map[string]framework.OperationTimeouts{
+					"database": {
+						Update: ptr("2s"),
+					},
+				}
+			}
 			tf.WriteConfigT(t, vars.builder.Build())
 			out, err := tf.Apply()
-			require.NoError(t, err)
+			if IsE2E() {
+				// E2E tests disable readiness check completely
+				require.NoError(t, err)
+			} else {
+				// Check that readiness check failed due to DBA password
+				require.Error(t, err)
+
+				// TODO: Figure out how to check error messages despite Terraform line wrapping
+				require.Contains(t, string(out), "DBA password for database org/proj/db")
+			}
 			require.Contains(t, string(out), "0 to add, 1 to change, 0 to destroy.")
 		})
 	}