feat(dremio): stop returning oauth client secret on get/list dremio(s)

docs/data-sources/dremio_instance.md

@@ -62,7 +62,6 @@ Read-Only:
 
 - `authority_url` (String) The Azure AD authority URL.
 - `client_id` (String) The Azure AD client ID.
-- `client_secret` (String, Sensitive) The Azure AD client secret.
 - `redirect_url` (String) The Azure AD redirect URL.
 
 
@@ -78,7 +77,6 @@ Read-Only:
 
 - `authority_url` (String) The Issuer location URI, where the OIDC provider configuration can be found.
 - `client_id` (String) The client ID assigned by the Identity Provider.
-- `client_secret` (String, Sensitive) The client secret generated by the Identity Provider.
 - `jwt_claims` (Attributes) Maps fields from the JWT token to fields Dremio requires. (see [below for nested schema](#nestedatt--authentication--oauth--jwt_claims))
 - `redirect_url` (String) The URL where the Dremio instance is hosted. The URL must match the redirect URL set in the Identity Provider.
 

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/stackitcloud/stackit-sdk-go/services/cdn v1.18.0
 	github.com/stackitcloud/stackit-sdk-go/services/certificates v1.8.0
 	github.com/stackitcloud/stackit-sdk-go/services/dns v0.21.0
-	github.com/stackitcloud/stackit-sdk-go/services/dremio v0.3.0
+	github.com/stackitcloud/stackit-sdk-go/services/dremio v0.4.0
 	github.com/stackitcloud/stackit-sdk-go/services/edge v0.12.0
 	github.com/stackitcloud/stackit-sdk-go/services/git v0.14.0
 	github.com/stackitcloud/stackit-sdk-go/services/iaas v1.12.0

go.sum

@@ -680,8 +680,8 @@ github.com/stackitcloud/stackit-sdk-go/services/certificates v1.8.0 h1:bINitVHAy
 github.com/stackitcloud/stackit-sdk-go/services/certificates v1.8.0/go.mod h1:eJpB3/pukz+KzVPVHQ4g3DVtQkxGga18VbFBhq9ugdY=
 github.com/stackitcloud/stackit-sdk-go/services/dns v0.21.0 h1:ZVkptfVCAqpaPWkE+WIopM9XdzqgbVcwmX5L1jZqqx8=
 github.com/stackitcloud/stackit-sdk-go/services/dns v0.21.0/go.mod h1:FiYSv3D9rzgEVzi8Mpq5oYZBosrasa5uUYqVdEIbM1U=
-github.com/stackitcloud/stackit-sdk-go/services/dremio v0.3.0 h1:LKreLAR425+EMYbKrPIAzeoTEQlDF8EpIMTVBpOhjmA=
-github.com/stackitcloud/stackit-sdk-go/services/dremio v0.3.0/go.mod h1:iMoiM8fM1mXC1Nz8FBiiQ08Yh+0C3yN0GPCdAbOlRXo=
+github.com/stackitcloud/stackit-sdk-go/services/dremio v0.4.0 h1:kAWRUptc9g6lA9XCgB4Fw8oQYOhDuV0mp+eZhpiyJ+Y=
+github.com/stackitcloud/stackit-sdk-go/services/dremio v0.4.0/go.mod h1:iMoiM8fM1mXC1Nz8FBiiQ08Yh+0C3yN0GPCdAbOlRXo=
 github.com/stackitcloud/stackit-sdk-go/services/edge v0.12.0 h1:qPhNo5m0K9ZKMnUx7e23fmvBmhOCxIFRzobwFhSHWUY=
 github.com/stackitcloud/stackit-sdk-go/services/edge v0.12.0/go.mod h1:Ylse6gqGJtsd5TVmvha+hoLd1QQHLKvhY5dO15+q5kg=
 github.com/stackitcloud/stackit-sdk-go/services/git v0.14.0 h1:VZBneGprCmHqckcSMPs3puBlK8rBpLMtYKmBktwdoVE=

stackit/internal/services/dremio/dremio_acc_test.go

@@ -26,11 +26,15 @@ var resourceDremioInstanceMin string
 //go:embed testdata/resource-max.tf
 var resourceDremioInstanceMax string
 
-const dremioInstanceResource = "stackit_dremio_instance.example"
-const dremioInstanceDataResource = "data.stackit_dremio_instance.example"
+const (
+	dremioInstanceResource     = "stackit_dremio_instance.example"
+	dremioInstanceDataResource = "data.stackit_dremio_instance.example"
+)
 
-const dremioUserResource = "stackit_dremio_user.example"
-const dremioUserDataResource = "data.stackit_dremio_user.example"
+const (
+	dremioUserResource     = "stackit_dremio_user.example"
+	dremioUserDataResource = "data.stackit_dremio_user.example"
+)
 
 var testDremioConfigVarsMin = config.Variables{
 	"project_id": config.StringVariable(testutil.ProjectId),
@@ -432,6 +436,7 @@ func TestAccDremioInstanceMax(t *testing.T) {
 
 					return fmt.Sprintf("%s,%s,%s", testutil.ProjectId, testutil.Region, instanceId), nil
 				},
+				ImportStateVerifyIgnore: []string{"authentication.oauth.client_secret"},
 			},
 			{
 				ConfigVariables:   testDremioConfigVarsMax,

stackit/internal/services/dremio/instance/datasource.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 
 	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/conversion"
@@ -26,6 +27,40 @@ var (
 
 type InstanceDataSourceModel struct {
 	Model
+
+	Authentication *AuthenticationDatasourceModel `tfsdk:"authentication"`
+}
+
+// AuthenticationModel maps the nested authentication block.
+type AuthenticationDatasourceModel struct {
+	// Required Fields
+	Type types.String `tfsdk:"type"`
+
+	// Optional Fields
+	AzureAD *AzureADDatasourceModel `tfsdk:"azuread"`
+	OAuth   *OAuthDatasourceModel   `tfsdk:"oauth"`
+}
+
+type AzureADDatasourceModel struct {
+	// Required Fields
+	AuthorityUrl types.String `tfsdk:"authority_url"`
+	ClientId     types.String `tfsdk:"client_id"`
+
+	RedirectUrl types.String `tfsdk:"redirect_url"`
+}
+
+type OAuthDatasourceModel struct {
+	// Required Fields
+	AuthorityUrl types.String    `tfsdk:"authority_url"`
+	ClientId     types.String    `tfsdk:"client_id"`
+	JwtClaims    *JwtClaimsModel `tfsdk:"jwt_claims"`
+
+	// Optional Fields
+	Scope      types.String         `tfsdk:"scope"`
+	Parameters []AuthParameterModel `tfsdk:"parameters"`
+
+	// Read-only Fields
+	RedirectUrl types.String `tfsdk:"redirect_url"`
 }
 
 type instanceDataSource struct {
@@ -64,6 +99,81 @@ func (d *instanceDataSource) Configure(ctx context.Context, req datasource.Confi
 	tflog.Info(ctx, "Dremio instance client configured for data source")
 }
 
+func mapDatasourceFields(instanceResp *dremioSdk.DremioResponse, model *InstanceDataSourceModel, region string) error {
+	if instanceResp == nil {
+		return fmt.Errorf("response input is nil")
+	}
+	if model == nil {
+		return fmt.Errorf("model input is nil")
+	}
+
+	err := mapModelFields(instanceResp, &model.Model, region)
+	if err != nil {
+		return fmt.Errorf("failed to map Model fields")
+	}
+
+	if model.Authentication == nil {
+		model.Authentication = new(AuthenticationDatasourceModel)
+	}
+	err = mapDatasourceAuthentication(instanceResp, model.Authentication)
+	if err != nil {
+		return fmt.Errorf("failed to map Authentication fields")
+	}
+
+	return nil
+}
+
+func mapDatasourceAuthentication(instanceResp *dremioSdk.DremioResponse, auth *AuthenticationDatasourceModel) error {
+	if instanceResp == nil {
+		return fmt.Errorf("response input is nil")
+	}
+	if auth == nil {
+		return fmt.Errorf("auth input is nil")
+	}
+
+	auth.Type = types.StringValue(string(instanceResp.Authentication.Type))
+
+	if instanceResp.Authentication.Azuread != nil {
+		if auth.AzureAD == nil {
+			auth.AzureAD = new(AzureADDatasourceModel)
+		}
+
+		azureADResp := instanceResp.Authentication.Azuread
+		azureADModel := auth.AzureAD
+
+		azureADModel.AuthorityUrl = types.StringValue(azureADResp.AuthorityUrl)
+		azureADModel.ClientId = types.StringValue(azureADResp.ClientId)
+		azureADModel.RedirectUrl = types.StringPointerValue(azureADResp.RedirectUrl)
+	}
+
+	if instanceResp.Authentication.Oauth != nil {
+		if auth.OAuth == nil {
+			auth.OAuth = new(OAuthDatasourceModel)
+		}
+		oauthResp := instanceResp.Authentication.Oauth
+		oauthModel := auth.OAuth
+
+		oauthModel.AuthorityUrl = types.StringValue(oauthResp.AuthorityUrl)
+		oauthModel.ClientId = types.StringValue(oauthResp.ClientId)
+		oauthModel.Scope = types.StringPointerValue(oauthResp.Scope)
+		oauthModel.RedirectUrl = types.StringPointerValue(oauthResp.RedirectUrl)
+		oauthModel.JwtClaims = &JwtClaimsModel{UserName: types.StringValue(oauthResp.JwtClaims.UserName)}
+
+		if len(oauthResp.Parameters) > 0 {
+			var params []AuthParameterModel
+			for _, p := range oauthResp.Parameters {
+				params = append(params, AuthParameterModel{
+					Name:  types.StringValue(p.Name),
+					Value: types.StringValue(p.Value),
+				})
+			}
+			oauthModel.Parameters = params
+		}
+	}
+
+	return nil
+}
+
 // Schema should return the schema for this data source.
 func (d *instanceDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
 	resp.Schema = schema.Schema{
@@ -133,11 +243,6 @@ func (d *instanceDataSource) Schema(_ context.Context, _ datasource.SchemaReques
 								Description: descriptions["azuread_client_id"],
 								Computed:    true,
 							},
-							"client_secret": schema.StringAttribute{
-								Description: descriptions["azuread_client_secret"],
-								Computed:    true,
-								Sensitive:   true,
-							},
 							"redirect_url": schema.StringAttribute{
 								Description: descriptions["azuread_redirect_url"],
 								Computed:    true,
@@ -157,11 +262,6 @@ func (d *instanceDataSource) Schema(_ context.Context, _ datasource.SchemaReques
 								Description: descriptions["oauth_client_id"],
 								Computed:    true,
 							},
-							"client_secret": schema.StringAttribute{
-								Description: descriptions["oauth_client_secret"],
-								Computed:    true,
-								Sensitive:   true,
-							},
 							"scope": schema.StringAttribute{
 								Description: descriptions["oauth_scope"],
 								Optional:    true,
@@ -244,7 +344,7 @@ func (d *instanceDataSource) Read(ctx context.Context, req datasource.ReadReques
 
 	ctx = core.LogResponse(ctx)
 
-	err = mapFields(instanceResp, &model.Model, region)
+	err = mapDatasourceFields(instanceResp, &model, region)
 	if err != nil {
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error reading Dremio instance", fmt.Sprintf("Processing API payload: %v", err))
 		return