diff --git a/acceptance/bundle/invariant/continue_293/test.toml b/acceptance/bundle/invariant/continue_293/test.toml index 7bee328d23..b4a79c097d 100644 --- a/acceptance/bundle/invariant/continue_293/test.toml +++ b/acceptance/bundle/invariant/continue_293/test.toml @@ -1,5 +1,4 @@ Cloud = false -Slow = true # $resources references to permissions and grants are not supported on v0.293.0 EnvMatrixExclude.no_permission_ref = ["INPUT_CONFIG=job_permission_ref.yml.tmpl"] diff --git a/bundle/direct/dresources/all.go b/bundle/direct/dresources/all.go index 6a7381a3fc..27d065508d 100644 --- a/bundle/direct/dresources/all.go +++ b/bundle/direct/dresources/all.go @@ -40,7 +40,7 @@ var SupportedResources = map[string]any{ "database_instances.permissions": (*ResourcePermissions)(nil), "postgres_projects.permissions": (*ResourcePermissions)(nil), "experiments.permissions": (*ResourcePermissions)(nil), - "models.permissions": (*ResourcePermissions)(nil), + "models.permissions": (*ResourceModelPermissions)(nil), "sql_warehouses.permissions": (*ResourcePermissions)(nil), "secret_scopes.permissions": (*ResourceSecretScopeAcls)(nil), "model_serving_endpoints.permissions": (*ResourcePermissions)(nil), diff --git a/bundle/direct/dresources/permissions.go b/bundle/direct/dresources/permissions.go index 40d4de5487..0efd8ab433 100644 --- a/bundle/direct/dresources/permissions.go +++ b/bundle/direct/dresources/permissions.go @@ -228,6 +228,26 @@ func (r *ResourcePermissions) DoCreate(ctx context.Context, newState *Permission return newState.ObjectID, nil, nil } +// ResourceModelPermissions extends ResourcePermissions with DoUpdateWithID. +// Model permissions object_id changed from /registered-models/MODEL_NAME to +// /registered-models/NUMERIC_ID. DoUpdateWithID ensures the state entry ID +// is updated when the object_id changes (e.g. migrating from v0.293 state). +type ResourceModelPermissions struct { + ResourcePermissions +} + +func (*ResourceModelPermissions) New(client *databricks.WorkspaceClient) *ResourceModelPermissions { + return &ResourceModelPermissions{ResourcePermissions: ResourcePermissions{client: client}} +} + +func (r *ResourceModelPermissions) DoUpdateWithID(ctx context.Context, _ string, newState *PermissionsState) (string, *PermissionsState, error) { + _, err := r.DoUpdate(ctx, "", newState, nil) + if err != nil { + return "", nil, err + } + return newState.ObjectID, nil, nil +} + // DoUpdate calls https://docs.databricks.com/api/workspace/jobs/setjobpermissions. func (r *ResourcePermissions) DoUpdate(ctx context.Context, _ string, newState *PermissionsState, _ *PlanEntry) (*PermissionsState, error) { extractedType, extractedID, err := parsePermissionsID(newState.ObjectID) diff --git a/bundle/direct/dresources/resources.yml b/bundle/direct/dresources/resources.yml index e71d8745c3..2a94ac9c48 100644 --- a/bundle/direct/dresources/resources.yml +++ b/bundle/direct/dresources/resources.yml @@ -399,6 +399,13 @@ resources: - field: initial_manage_principal reason: immutable + # Model permissions object_id changed from /registered-models/MODEL_NAME to + # /registered-models/NUMERIC_ID. UpdateWithID ensures the state entry ID is updated. + models.permissions: + update_id_on_changes: + - field: object_id + reason: id_changes + # Permissions for secret scopes use ResourceSecretScopeAcls. secret_scopes.permissions: update_id_on_changes: