feat: Secrets datasource

MIGRATION_GUIDE.md

@@ -7,6 +7,20 @@ across different versions.
 > [!TIP]
 > We highly recommend upgrading the versions one by one instead of bulk upgrades.
 
+## v0.97.0 ➞ v0.98.0
+
+### *(new feature)* Secret resources
+Added a new secrets resources for managing secrets.
+We decided to split each secret flow into individual resources. 
+This segregation was based on the secret flows in CREATE SECRET. i.e.:
+- `snowflake_secret_with_client_credentials`
+- `snowflake_secret_with_authorization_code_grant`
+- `snowflake_secret_with_basic_authentication`
+- `snowflake_secret_with_generic_string`
+
+
+See reference [docs](https://docs.snowflake.com/en/sql-reference/sql/create-secret).
+
 ## v0.96.0 ➞ v0.97.0
 
 ### *(new feature)* snowflake_stream_on_table, snowflake_stream_on_external_table resource
@@ -50,16 +64,6 @@ resource "snowflake_stream_on_table" "stream" {
 
 Then, follow our [Resource migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/resource_migration.md).
 
-### *(new feature)* Secret resources
-Added a new secrets resources for managing secrets.
-We decided to split each secret flow into individual resources, i.e.:
-- `snowflake_secret_with_client_credentials`
-- `snowflake_secret_with_authorization_code_grant`
-- `snowflake_secret_with_basic_authentication`
-- `snowflake_secret_with_generic_string`
-
-See reference [docs](https://docs.snowflake.com/en/sql-reference/sql/create-secret). 
-
 ### *(new feature)* new snowflake_service_user and snowflake_legacy_service_user resources
 
 Release v0.95.0 introduced reworked `snowflake_user` resource. As [noted](#note-user-types), the new `SERVICE` and `LEGACY_SERVICE` user types were not supported.

docs/data-sources/secrets.md

@@ -5,11 +5,62 @@ description: |-
   Datasource used to get details of filtered secrets. Filtering is aligned with the current possibilities for SHOW SECRETS https://docs.snowflake.com/en/sql-reference/sql/show-secrets query. The results of SHOW and DESCRIBE are encapsulated in one output collection secrets.
 ---
 
+!> **V1 release candidate** This data source is a release candidate for the V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the data source if needed. Any errors reported will be resolved with a higher priority. We encourage checking this data source out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0970--v0980) to use it.
+
 # snowflake_secrets (Data Source)
 
 Datasource used to get details of filtered secrets. Filtering is aligned with the current possibilities for [SHOW SECRETS](https://docs.snowflake.com/en/sql-reference/sql/show-secrets) query. The results of SHOW and DESCRIBE are encapsulated in one output collection `secrets`.
 
-
+## Example Usage
+
+```terraform
+# Simple usage
+data "snowflake_secrets" "simple" {
+}
+
+output "simple_output" {
+  value = data.snowflake_secrets.simple.secrets
+}
+
+# Filtering (like)
+data "snowflake_secrets" "like" {
+  like = "secret-name"
+}
+
+output "like_output" {
+  value = data.snowflake_secrets.like.secrets
+}
+
+# Filtering by prefix (like)
+data "snowflake_secrets" "like_prefix" {
+  like = "prefix%"
+}
+
+output "like_prefix_output" {
+  value = data.snowflake_secrets.like_prefix.secrets
+}
+
+# Filtering (in)
+data "snowflake_secrets" "in" {
+  in {
+    schema = "schema_fully_qualified_name"
+  }
+}
+
+output "in_output" {
+  value = data.snowflake_secrets.in.secrets
+}
+
+# Without additional data (to limit the number of calls make for every found secret)
+data "snowflake_secrets" "only_show" {
+  # with_describe is turned on by default and it calls DESCRIBE SECRET for every secret found and attaches its output to secrets.*.describe_output field
+  with_describe = false
+}
+
+output "only_show_output" {
+  value = data.snowflake_secrets.only_show.secrets
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema

docs/resources/secret_with_authorization_code_grant.md

@@ -5,7 +5,7 @@ description: |-
   Resource used to manage secret objects with OAuth Authorization Code Grant. For more information, check secret documentation https://docs.snowflake.com/en/sql-reference/sql/create-secret.
 ---
 
-!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0960--v0970) to use it.
+!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0970--v0980) to use it.
 
 # snowflake_secret_with_authorization_code_grant (Resource)
 

docs/resources/secret_with_basic_authentication.md

@@ -5,7 +5,7 @@ description: |-
   Resource used to manage secret objects with Basic Authentication. For more information, check secret documentation https://docs.snowflake.com/en/sql-reference/sql/create-secret.
 ---
 
-!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0960--v0970) to use it.
+!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0970--v0980) to use it.
 
 # snowflake_secret_with_basic_authentication (Resource)
 
@@ -45,7 +45,7 @@ resource "snowflake_secret_with_basic_authentication" "test" {
 - `name` (String) String that specifies the identifier (i.e. name) for the secret, must be unique in your schema. Due to technical limitations (read more [here](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/identifiers_rework_design_decisions.md#known-limitations-and-identifier-recommendations)), avoid using the following characters: `|`, `.`, `(`, `)`, `"`
 - `password` (String, Sensitive) Specifies the password value to store in the secret. External changes for this field won't be detected. In case you want to apply external changes, you can re-create the resource manually using "terraform taint".
 - `schema` (String) The schema in which to create the secret. Due to technical limitations (read more [here](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/identifiers_rework_design_decisions.md#known-limitations-and-identifier-recommendations)), avoid using the following characters: `|`, `.`, `(`, `)`, `"`
-- `username` (String) Specifies the username value to store in the secret.
+- `username` (String, Sensitive) Specifies the username value to store in the secret.
 
 ### Optional
 

docs/resources/secret_with_client_credentials.md

@@ -5,7 +5,7 @@ description: |-
   Resource used to manage secret objects with OAuth Client Credentials. For more information, check secret documentation https://docs.snowflake.com/en/sql-reference/sql/create-secret.
 ---
 
-!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0960--v0970) to use it.
+!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0970--v0980) to use it.
 
 # snowflake_secret_with_client_credentials (Resource)
 

docs/resources/secret_with_generic_string.md

@@ -5,7 +5,7 @@ description: |-
   Resource used to manage secret objects with Generic String. For more information, check secret documentation https://docs.snowflake.com/en/sql-reference/sql/create-secret.
 ---
 
-!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0960--v0970) to use it.
+!> **V1 release candidate** This resource is a release candidate for the V1. It is on the list of remaining GA objects for V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the [migration guide](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#v0970--v0980) to use it.
 
 # snowflake_secret_with_generic_string (Resource)
 

examples/data-sources/snowflake_secrets/data-source.tf

@@ -0,0 +1,46 @@
+# Simple usage
+data "snowflake_secrets" "simple" {
+}
+
+output "simple_output" {
+  value = data.snowflake_secrets.simple.secrets
+}
+
+# Filtering (like)
+data "snowflake_secrets" "like" {
+  like = "secret-name"
+}
+
+output "like_output" {
+  value = data.snowflake_secrets.like.secrets
+}
+
+# Filtering by prefix (like)
+data "snowflake_secrets" "like_prefix" {
+  like = "prefix%"
+}
+
+output "like_prefix_output" {
+  value = data.snowflake_secrets.like_prefix.secrets
+}
+
+# Filtering (in)
+data "snowflake_secrets" "in" {
+  in {
+    schema = "schema_fully_qualified_name"
+  }
+}
+
+output "in_output" {
+  value = data.snowflake_secrets.in.secrets
+}
+
+# Without additional data (to limit the number of calls make for every found secret)
+data "snowflake_secrets" "only_show" {
+  # with_describe is turned on by default and it calls DESCRIBE SECRET for every secret found and attaches its output to secrets.*.describe_output field
+  with_describe = false
+}
+
+output "only_show_output" {
+  value = data.snowflake_secrets.only_show.secrets
+}

pkg/acceptance/bettertestspoc/README.md

@@ -325,6 +325,7 @@ it will result in:
 - Add support for datasource tests (assertions and config builders).
 - Consider overriding the assertions when invoking same check multiple times with different params (e.g. `Warehouse(...).HasType(X).HasType(Y)`; it could use the last-check-wins approach, to more easily reuse complex checks between the test steps).
 - Consider not adding the check for `show_output` presence on creation (same with `parameters`). The majority of the use cases need it to be present but there are a few others (like conditional presence in the datasources). Currently, it seems that they should be always present in the resources, so no change is made. Later, with adding the support for the datasource tests, consider simple destructive implementation like:
+- Add support for `set` so that assertions like e.g. `oauth_scopes.*` could be done.
 ```go
 func (w *WarehouseDatasourceShowOutputAssert) IsEmpty() {
     w.assertions = make([]resourceAssertion, 0)

pkg/acceptance/bettertestspoc/assert/resourceshowoutputassert/secrets_datasource_show_output_ext.go

@@ -0,0 +1,18 @@
+package resourceshowoutputassert
+
+import (
+	"testing"
+
+	"github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/acceptance/bettertestspoc/assert"
+)
+
+// SecretsDatasourceShowOutput is a temporary workaround to have better show output assertions in data source acceptance tests.
+func SecretsDatasourceShowOutput(t *testing.T, name string) *SecretShowOutputAssert {
+	t.Helper()
+
+	s := SecretShowOutputAssert{
+		ResourceAssert: assert.NewDatasourceAssert("data."+name, "show_output", "secrets.0."),
+	}
+	s.AddAssertion(assert.ValueSet("show_output.#", "1"))
+	return &s
+}

pkg/acceptance/check_destroy.go

@@ -15,6 +15,20 @@ import (
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 )
 
+func ComposeCheckDestroy(t *testing.T, resources ...resources.Resource) func(*terraform.State) error {
+	t.Helper()
+
+	return func(s *terraform.State) error {
+		for _, resource := range resources {
+			checkFunc := CheckDestroy(t, resource)
+			if err := checkFunc(s); err != nil {
+				return fmt.Errorf("error checking destruction for resource %s: %w", resource, err)
+			}
+		}
+		return nil
+	}
+}
+
 func CheckDestroy(t *testing.T, resource resources.Resource) func(*terraform.State) error {
 	t.Helper()
 	// TODO [SNOW-1653619]: use TestClient() here

pkg/datasources/secrets.go

@@ -104,15 +104,15 @@ func Secrets() *schema.Resource {
 
 func ReadSecrets(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
 	client := meta.(*provider.Context).Client
-	req := sdk.NewShowSecretRequest()
+	req := *sdk.NewShowSecretRequest()
 
 	handleLike(d, &req.Like)
 	err := handleExtendedIn(d, &req.In)
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	secrets, err := client.Secrets.Show(ctx, req)
+	secrets, err := client.Secrets.Show(ctx, &req)
 	if err != nil {
 		return diag.FromErr(err)
 	}