auth0_action runtime cannot be assigned "node18-actions"

[whoward]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of this provider and the issue still persists.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

When upgrading the runtime of actions via the Auth0 UI the runtime is set to "node18-actions". However, when attempting to set the value to this string in terraform the provider responds with the following error message:

Error: expected runtime to be one of ["node12" "node16" "node18"], got node18-actions

When using the "node18" value the Auth0 UI displays the runtime as:

Runtime: Node 18 BETA (Not Recommended)

which is likely not ideal

Expectation

it should be possible to set the runtime value to "node18-actions"

Reproduction

Given you have a auth0_action resource
When you set the runtime attribute to "node18-actions"
Then terraform should be able to apply the change

Auth0 Terraform Provider version

1.6.1

Terraform version

1.9.6

[whoward]

I closed this ticket prematurely as I had only upgrade the provider to the latest version 1.6.1 but I had suspected a state change in 1.0.0 might have resolved my issue. It did not. In a fully up to date version of the provider with updated state this error still occurs.

[cdsre]

Can you show your terraform code. The error suggests your passing an invalid value that doesn't match the validation

terraform-provider-auth0/internal/auth0/action/resource.go

Line 88 in 94db0ac

ValidateFunc: validation.StringInSlice([]string{

[whoward]

Yes the value I'm providing is not in the enumeration you've linked to above. However, the value I'm providing is valid - this is the value that is assigned to actions created manually via the UI with the latest runtime. Here is the runtime for a manually created Action in one of my tenants (retrieved directly from the Management API):

The terraform code that would match this action however, looks something like this:

resource "auth0_action" "session_timeout_override" {
  name = "Session Timeout Override"
  deploy = true
  runtime = "node18-actions"
  code = file("${path.module}/template/actions/login/session_timeout_override.js")

  supported_triggers {
    id = "post-login"
    version = "v3"
  }
}

The latest provider version however treats this as invalid.

[cdsre]

Yeah I see what you mean, I have just tested creating an action via the API using node18-actions as the run time and the API created it with no issue. It also allows you to create with node18.

So I take your point on if the API supports it should the provider support it. I am not sure the answer to that as I am not sure whats the difference between node18 and node18-actions. I guess my question is have you tested creating an action with terraform with the node18 runtime and did it have different behaviour?

[whoward]

Well I can't really comment much on Auth0 internals, but there must have been enough of a reason to provide a separate value for this "actions" variant runtime. There surely must be some differences though they don't seem to have obvious documentation. The UI however does suggest that the node18 runtime is considered "BETA" and is not recommended. This is what appears for an action with the node18 runtime:

An action created with the node18-actions runtime is labelled as "recommended":

The lack of support for the node18-actions value also complicates the import workflow - where an action created by the UI would be imported with the node18-actions value and would require the user change to node18 in order to manage the runtime attribute of that imported resource.

[cdsre]

This post from a auth0 employee suggests terraform should support it.

https://community.auth0.com/t/trying-to-create-or-update-actions-to-runtime-node-18-recommended/116844

If I get the chance tonight I will raise a PR to add it to the enumeration validation then it will be up to the maintainers to accept it or not.

[cdsre]

Ok no need for a PR, it seems the provider is silently changing this before invoking the API. When creating the actions resource before invoking the API it will call the expandAction function

https://github.com/auth0/terraform-provider-auth0/blob/main/internal/auth0/action/resource.go#L136

func createAction(ctx context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
	api := meta.(*config.Config).GetAPI()

	action := expandAction(data)

	if err := api.Action.Create(ctx, action); err != nil {
		return diag.FromErr(err)
	}

If we look in the expand function we can see that if the runtime is node18, it will switch it out to node18-actions
https://github.com/auth0/terraform-provider-auth0/blob/main/internal/auth0/action/expand.go#L35

	if action.GetRuntime() == "node18" {
		action.Runtime = auth0.String("node18-actions")
	}

It also does the reverse in the flatten function when its reads data from the API and stores it in the state

	if action.GetRuntime() == "node18-actions" {
		result = multierror.Append(result, data.Set("runtime", "node18"))
	}

So the provider is masking this and switching them out when calling the API or reading data back. I have tested this using your example with terraform but with the runtime as node18

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # auth0_action.session_timeout_override will be created
  + resource "auth0_action" "session_timeout_override" {
      + code       = "exports.onExecutePostLogin = async (event, api) => {};"
      + deploy     = true
      + id         = (known after apply)
      + name       = "Session Timeout Override"
      + runtime    = "node18"
      + version_id = (known after apply)

      + supported_triggers {
          + id      = "post-login"
          + version = "v3"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.
auth0_action.session_timeout_override: Creating...
auth0_action.session_timeout_override: Creation complete after 2s [id=868cd089-9b4c-425c-ae11-5c11a1df4c7c]

If i then check the get an action API I can see that in the backend it is set as node18-actions and hows in the UI correctly. So i think this issue can be closed. Althought it would be nice if the docs were a bit clearer on this.

[whoward]

Is it possible this is unreleased provider code you're working with? My experience applying "node18" has been that it hasn't transparently changed the value to node18-actions but has kept it assigned as node18.

To expand on my exact situation we've been upgrading from old runtimes (node12, node16) as they're now deprecated to node18. In our pre-production environment I upgraded via the UI which caused drift as the runtime was assigned node18-actions, we then applied terraform and it was 'downgraded' to node18. For our production environment the runtime was upgraded to node18, not node18-actions. This leads me to wonder if the code you're referencing is unreleased, or perhaps these use cases are not covered by it.

[cdsre]

This change was over 1 year ago as part of a dev ex PR for runtime actions and has been in the provider since v1.0.0

ec4924c