Fixed TF<>API mapping for nested_query fine-grained resources (#16591)

Author: melinath

mmv1/api/resource.go

@@ -54,6 +54,14 @@ type Resource struct {
 	// organization variant, however most resources do not need it.
 	ApiVariantPatterns []string `yaml:"api_variant_patterns,omitempty"`
 
+	// ApiResourceField indicates what field on the API resource is managed by a resource.
+	// This is generally relevant for fine-grained resources. For example,
+	// google_compute_router_nat manages the `nat` field on the `Router` resource. Can be
+	// set to "." to indicate explicitly that the resource's fields aren't
+	// "nested", even if the resource uses NestedQuery. This is useful for resources that
+	// use "list" instead of "get" as the read endpoint.
+	ApiResourceField string `yaml:"api_resource_field,omitempty"`
+
 	// [Required] A description of the resource that's surfaced in provider
 	// documentation.
 	Description string
@@ -323,11 +331,6 @@ type Resource struct {
 	// The version name provided by the user through CI
 	TargetVersionName string `yaml:"-"`
 
-	// ApiResourceField indicates what field on the API resource is managed by a resource.
-	// This is generally relevant for fine-grained resources. For example,
-	// google_compute_router_nat manages the `nat` field on the `Router` resource.
-	ApiResourceField string `yaml:"api_resource_field,omitempty"`
-
 	ImportPath     string `yaml:"-"`
 	SourceYamlFile string `yaml:"-"`
 

mmv1/api/type.go

@@ -579,8 +579,19 @@ func (t Type) Lineage() []string {
 // include the field on the API resource that the fine-grained resource manages.
 func (t Type) ApiLineage() []string {
 	if t.ParentMetadata == nil {
-		if !t.UrlParamOnly && t.ResourceMetadata.ApiResourceField != "" {
-			return []string{t.ResourceMetadata.ApiResourceField, t.ApiName}
+		// The special value "." indicates that the resource's shouldn't be considered "nested"
+		// even if it has NestedQuery set.
+		if !t.UrlParamOnly && t.ResourceMetadata.ApiResourceField != "." {
+			if t.ResourceMetadata.ApiResourceField != "" {
+				return []string{t.ResourceMetadata.ApiResourceField, t.ApiName}
+			} else if t.ResourceMetadata.NestedQuery != nil {
+				// Handle `items` as a special case since that's a common container field name for a list endpoint,
+				// not a fine-grained field name within a resource.
+				keys := t.ResourceMetadata.NestedQuery.Keys
+				if len(keys) > 1 || keys[0] != "items" {
+					return append(t.ResourceMetadata.NestedQuery.Keys, t.ApiName)
+				}
+			}
 		}
 		return []string{t.ApiName}
 	}

mmv1/products/accesscontextmanager/AccessLevelCondition.yaml

@@ -255,3 +255,4 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true

mmv1/products/accesscontextmanager/EgressPolicy.yaml

@@ -80,3 +80,4 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true

mmv1/products/accesscontextmanager/IngressPolicy.yaml

@@ -80,3 +80,4 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true

mmv1/products/accesscontextmanager/ServicePerimeterDryRunEgressPolicy.yaml

@@ -232,6 +232,7 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true
   - name: 'etag'
     type: String
     output: true

mmv1/products/accesscontextmanager/ServicePerimeterDryRunIngressPolicy.yaml

@@ -231,6 +231,7 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true
   - name: 'etag'
     type: String
     output: true

mmv1/products/accesscontextmanager/ServicePerimeterDryRunResource.yaml

@@ -108,6 +108,7 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true
   - name: 'etag'
     type: String
     output: true

mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml

@@ -230,6 +230,7 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true
   - name: 'etag'
     type: String
     output: true

mmv1/products/accesscontextmanager/ServicePerimeterIngressPolicy.yaml

@@ -233,6 +233,7 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+    client_side: true
   - name: 'etag'
     type: String
     output: true