validate on new create too and add tests

Author: dsa0x

internal/terraform/context_apply_identity_test.go

@@ -22,8 +22,10 @@ func TestContext2Apply_identity(t *testing.T) {
 		prevRunState    *states.State
 		requiresReplace []cty.Path
 		plannedIdentity cty.Value
+		appliedIdentity cty.Value
 
-		expectedIdentity cty.Value
+		expectedIdentity  cty.Value
+		expectDiagnostics tfdiags.Diagnostics
 	}{
 		"create": {
 			plannedIdentity: cty.ObjectVal(map[string]cty.Value{
@@ -33,6 +35,17 @@ func TestContext2Apply_identity(t *testing.T) {
 				"id": cty.StringVal("foo"),
 			}),
 		},
+		"create - invalid applied identity schema": {
+			plannedIdentity: cty.ObjectVal(map[string]cty.Value{
+				"id": cty.StringVal("foo"),
+			}),
+			appliedIdentity: cty.ObjectVal(map[string]cty.Value{
+				"id": cty.BoolVal(false),
+			}),
+			expectDiagnostics: tfdiags.Diagnostics{
+				tfdiags.Sourceless(tfdiags.Error, "Provider produced an identity that doesn't match the schema", "Provider \"registry.terraform.io/hashicorp/test\" returned an identity for test_resource.test that doesn't match the identity schema: .id: string required, but received bool. \n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker."),
+			},
+		},
 
 		"update": {
 			prevRunState: states.BuildState(func(s *states.SyncState) {
@@ -165,10 +178,23 @@ func TestContext2Apply_identity(t *testing.T) {
 				}
 			}
 
+			if !tc.appliedIdentity.IsNull() {
+				p.ApplyResourceChangeFn = func(req providers.ApplyResourceChangeRequest) providers.ApplyResourceChangeResponse {
+					resp := providers.ApplyResourceChangeResponse{}
+					resp.NewState = req.PlannedState
+					resp.NewIdentity = tc.appliedIdentity
+					return resp
+				}
+			}
+
 			plan, diags := ctx.Plan(m, tc.prevRunState, &PlanOpts{Mode: tc.mode})
 			tfdiags.AssertNoDiagnostics(t, diags)
 
 			state, diags := ctx.Apply(plan, m, nil)
+			if tc.expectDiagnostics.HasErrors() {
+				tfdiags.AssertDiagnosticsMatch(t, diags, tc.expectDiagnostics)
+				return
+			}
 			tfdiags.AssertNoDiagnostics(t, diags)
 
 			if !tc.expectedIdentity.IsNull() {

internal/terraform/context_plan_identity_test.go

@@ -437,6 +437,14 @@ func TestContext2Plan_resource_identity_plan(t *testing.T) {
 				"id": cty.StringVal("foo"),
 			}),
 		},
+		"create - invalid planned identity schema": {
+			plannedIdentity: cty.ObjectVal(map[string]cty.Value{
+				"id": cty.BoolVal(false),
+			}),
+			expectDiagnostics: tfdiags.Diagnostics{
+				tfdiags.Sourceless(tfdiags.Error, "Provider produced an identity that doesn't match the schema", "Provider \"registry.terraform.io/hashicorp/test\" returned an identity for test_resource.test that doesn't match the identity schema: .id: string required, but received bool. \n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker."),
+			},
+		},
 		"update": {
 			prevRunState: states.BuildState(func(s *states.SyncState) {
 				s.SetResourceInstanceCurrent(

internal/terraform/node_resource_abstract_instance.go

@@ -1115,11 +1115,11 @@ func (n *NodeAbstractResourceInstance) plan(
 			// If the identity is not known we can not validate it did not change
 			if !diags.HasErrors() {
 				diags = diags.Append(n.validateIdentityDidNotChange(currentState, plannedIdentity))
-				diags = diags.Append(n.validateIdentityMatchesSchema(plannedIdentity, schema.Identity))
 			}
 		}
 
 		diags = diags.Append(n.validateIdentity(plannedIdentity))
+		diags = diags.Append(n.validateIdentityMatchesSchema(plannedIdentity, schema.Identity))
 	}
 	if diags.HasErrors() {
 		return nil, nil, deferred, keyData, diags
@@ -2946,7 +2946,7 @@ func (n *NodeAbstractResourceInstance) validateIdentityMatchesSchema(newIdentity
 	currentType := identitySchema.ImpliedType()
 	if errs := newType.TestConformance(currentType); len(errs) > 0 {
 		for _, err := range errs {
-			diags = diags.Append(tfdiags.Sourceless(
+			diags = diags.AppendWithoutDuplicates(tfdiags.Sourceless(
 				tfdiags.Error,
 				"Provider produced an identity that doesn't match the schema",
 				fmt.Sprintf(