codify-plugin-lib 1.0.177 → 1.0.179

package/dist/messages/sender.d.ts

@@ -4,6 +4,7 @@
 declare class CodifyCliSenderImpl {
     private readonly validateIpcMessageV2;
     requestPressKeyToContinuePrompt(message?: string): Promise<void>;
+    getCodifyCliCredentials(): Promise<string>;
     private sendAndWaitForResponse;
 }
 export declare const CodifyCliSender: CodifyCliSenderImpl;

package/dist/messages/sender.js

@@ -17,6 +17,16 @@ class CodifyCliSenderImpl {
             }
         });
     }
+    async getCodifyCliCredentials() {
+        const data = await this.sendAndWaitForResponse({
+            cmd: MessageCmd.CODIFY_CREDENTIALS_REQUEST,
+            data: {},
+        });
+        if (typeof data.data !== 'string') {
+            throw new Error('Expected string back from credentials request');
+        }
+        return data.data;
+    }
     async sendAndWaitForResponse(message) {
         return new Promise((resolve) => {
             const requestId = nanoid(8);

package/dist/plan/change-set.d.ts

@@ -1,5 +1,6 @@
 import { ParameterOperation, ResourceOperation, StringIndexedObject } from 'codify-schemas';
 import { ParsedParameterSetting } from '../resource/parsed-resource-settings.js';
+import { ResourceSettings } from '../resource/resource-settings.js';
 /**
  * A parameter change describes a parameter level change to a resource.
  */
@@ -20,6 +21,10 @@ export interface ParameterChange<T extends StringIndexedObject> {
      * The new value of the resource (the desired value)
      */
     newValue: any | null;
+    /**
+     * Whether the parameter is sensitive
+     */
+    isSensitive: boolean;
 }
 export declare class ChangeSet<T extends StringIndexedObject> {
     operation: ResourceOperation;
@@ -28,9 +33,9 @@ export declare class ChangeSet<T extends StringIndexedObject> {
     get desiredParameters(): T;
     get currentParameters(): T;
     static empty<T extends StringIndexedObject>(): ChangeSet<T>;
-    static create<T extends StringIndexedObject>(desired: Partial<T>): ChangeSet<T>;
-    static noop<T extends StringIndexedObject>(parameters: Partial<T>): ChangeSet<T>;
-    static destroy<T extends StringIndexedObject>(current: Partial<T>): ChangeSet<T>;
+    static create<T extends StringIndexedObject>(desired: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T>;
+    static noop<T extends StringIndexedObject>(parameters: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T>;
+    static destroy<T extends StringIndexedObject>(current: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T>;
     static calculateModification<T extends StringIndexedObject>(desired: Partial<T>, current: Partial<T>, parameterSettings?: Partial<Record<keyof T, ParsedParameterSetting>>): ChangeSet<T>;
     /**
      * Calculates the differences between the desired and current parameters,

package/dist/plan/change-set.js

@@ -24,33 +24,36 @@ export class ChangeSet {
     static empty() {
         return new ChangeSet(ResourceOperation.NOOP, []);
     }
-    static create(desired) {
+    static create(desired, settings) {
         const parameterChanges = Object.entries(desired)
             .map(([k, v]) => ({
             name: k,
             operation: ParameterOperation.ADD,
             previousValue: null,
             newValue: v ?? null,
+            isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
         }));
         return new ChangeSet(ResourceOperation.CREATE, parameterChanges);
     }
-    static noop(parameters) {
+    static noop(parameters, settings) {
         const parameterChanges = Object.entries(parameters)
             .map(([k, v]) => ({
             name: k,
             operation: ParameterOperation.NOOP,
             previousValue: v ?? null,
             newValue: v ?? null,
+            isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
         }));
         return new ChangeSet(ResourceOperation.NOOP, parameterChanges);
     }
-    static destroy(current) {
+    static destroy(current, settings) {
         const parameterChanges = Object.entries(current)
             .map(([k, v]) => ({
             name: k,
             operation: ParameterOperation.REMOVE,
             previousValue: v ?? null,
             newValue: null,
+            isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
         }));
         return new ChangeSet(ResourceOperation.DESTROY, parameterChanges);
     }
@@ -98,6 +101,7 @@ export class ChangeSet {
                     previousValue: current[k] ?? null,
                     newValue: desired[k] ?? null,
                     operation: ParameterOperation.NOOP,
+                    isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
                 });
                 continue;
             }
@@ -107,6 +111,7 @@ export class ChangeSet {
                     previousValue: current[k] ?? null,
                     newValue: null,
                     operation: ParameterOperation.REMOVE,
+                    isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
                 });
                 continue;
             }
@@ -116,6 +121,7 @@ export class ChangeSet {
                     previousValue: null,
                     newValue: desired[k] ?? null,
                     operation: ParameterOperation.ADD,
+                    isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
                 });
                 continue;
             }
@@ -124,6 +130,7 @@ export class ChangeSet {
                 previousValue: current[k] ?? null,
                 newValue: desired[k] ?? null,
                 operation: ParameterOperation.MODIFY,
+                isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
             });
         }
         return parameterChangeSet;

package/dist/plan/plan.js

@@ -68,15 +68,15 @@ export class Plan {
         }
         // CREATE
         if (!filteredCurrentParameters && desired) {
-            return new Plan(uuidV4(), ChangeSet.create(desired), core, isStateful);
+            return new Plan(uuidV4(), ChangeSet.create(desired, settings), core, isStateful);
         }
         // DESTROY
         if (filteredCurrentParameters && !desired) {
             // We can manually override destroys. If a resource cannot be destroyed (for instance the npm resource relies on NodeJS being created and destroyed)
             if (!settings.canDestroy) {
-                return new Plan(uuidV4(), ChangeSet.noop(filteredCurrentParameters), core, isStateful);
+                return new Plan(uuidV4(), ChangeSet.noop(filteredCurrentParameters, settings), core, isStateful);
             }
-            return new Plan(uuidV4(), ChangeSet.destroy(filteredCurrentParameters), core, isStateful);
+            return new Plan(uuidV4(), ChangeSet.destroy(filteredCurrentParameters, settings), core, isStateful);
         }
         // NO-OP, MODIFY or RE-CREATE
         const changeSet = ChangeSet.calculateModification(desired, filteredCurrentParameters, settings.parameterSettings);
@@ -88,7 +88,10 @@ export class Plan {
             throw new Error('Data is empty');
         }
         addDefaultValues();
-        return new Plan(uuidV4(), new ChangeSet(data.operation, data.parameters), {
+        return new Plan(uuidV4(), new ChangeSet(data.operation, data.parameters.map((p) => ({
+            ...p,
+            isSensitive: p.isSensitive ?? false,
+        }))), {
             type: data.resourceType,
             name: data.resourceName,
         }, data.isStateful);

package/dist/plugin/plugin.d.ts

@@ -11,7 +11,7 @@ export declare class Plugin {
     constructor(name: string, resourceControllers: Map<string, ResourceController<ResourceConfig>>);
     static create(name: string, resources: Resource<any>[]): Plugin;
     initialize(data: InitializeRequestData): Promise<InitializeResponseData>;
-    getResourceInfo(data: GetResourceInfoRequestData): Promise<GetResourceInfoResponseData>;
+    getResourceInfo(data: GetResourceInfoRequestData): GetResourceInfoResponseData;
     match(data: MatchRequestData): Promise<MatchResponseData>;
     import(data: ImportRequestData): Promise<ImportResponseData>;
     validate(data: ValidateRequestData): Promise<ValidateResponseData>;

package/dist/plugin/plugin.js

@@ -33,10 +33,13 @@ export class Plugin {
                 .map((r) => ({
                 dependencies: r.dependencies,
                 type: r.typeId,
+                sensitiveParameters: Object.entries(r.settings.parameterSettings ?? {})
+                    .filter(([, v]) => v?.isSensitive)
+                    .map(([k]) => k),
             }))
         };
     }
-    async getResourceInfo(data) {
+    getResourceInfo(data) {
         if (!this.resourceControllers.has(data.type)) {
             throw new Error(`Cannot get info for resource ${data.type}, resource doesn't exist`);
         }
@@ -48,6 +51,9 @@ export class Plugin {
             ?? undefined);
         const allowMultiple = resource.settings.allowMultiple !== undefined
             && resource.settings.allowMultiple !== false;
+        const sensitiveParameters = Object.entries(resource.settings.parameterSettings ?? {})
+            .filter(([, v]) => v?.isSensitive)
+            .map(([k]) => k);
         return {
             plugin: this.name,
             type: data.type,
@@ -60,6 +66,7 @@ export class Plugin {
             import: {
                 requiredParameters: requiredPropertyNames,
             },
+            sensitiveParameters,
             allowMultiple
         };
     }

package/dist/resource/resource-controller.d.ts

@@ -24,7 +24,7 @@ export declare class ResourceController<T extends StringIndexedObject> {
     private applyModify;
     private applyDestroy;
     private validateRefreshResults;
-    private applyTransformParameters;
+    private applyTransformations;
     private addDefaultValues;
     private removeDefaultValues;
     private refreshNonStatefulParameters;

package/dist/resource/resource-controller.js

@@ -33,7 +33,7 @@ export class ResourceController {
     }
     async validate(core, parameters) {
         const originalParameters = structuredClone(parameters);
-        await this.applyTransformParameters(parameters);
+        await this.applyTransformations(parameters, undefined, true);
         this.addDefaultValues(parameters);
         if (this.schemaValidator) {
             // Schema validator uses pre transformation parameters
@@ -103,9 +103,9 @@ export class ResourceController {
             const originalParams = structuredClone(resource.parameters);
             const paramsToMatch = structuredClone(resourceToMatch.parameters);
             this.addDefaultValues(originalParams);
-            await this.applyTransformParameters(originalParams);
+            await this.applyTransformations(originalParams);
             this.addDefaultValues(paramsToMatch);
-            await this.applyTransformParameters(paramsToMatch);
+            await this.applyTransformations(paramsToMatch);
             const match = parameterMatcher(originalParams, paramsToMatch);
             if (match) {
                 return resourceToMatch;
@@ -120,9 +120,9 @@ export class ResourceController {
             originalDesiredConfig: structuredClone(desired),
         };
         this.addDefaultValues(desired);
-        await this.applyTransformParameters(desired);
+        await this.applyTransformations(desired);
         this.addDefaultValues(state);
-        await this.applyTransformParameters(state);
+        await this.applyTransformations(state);
         // Parse data from the user supplied config
         const parsedConfig = new ConfigParser(desired, state, this.parsedSettings.statefulParameters);
         const { allParameters, allNonStatefulParameters, allStatefulParameters, } = parsedConfig;
@@ -156,7 +156,7 @@ export class ResourceController {
     }
     async planDestroy(core, parameters) {
         this.addDefaultValues(parameters);
-        await this.applyTransformParameters(parameters);
+        await this.applyTransformations(parameters);
         // Use refresh parameters if specified, otherwise try to refresh as many parameters as possible here
         const parametersToRefresh = this.settings.importAndDestroy?.refreshKeys
             ? {
@@ -211,7 +211,7 @@ export class ResourceController {
             return results.filter(Boolean).flat();
         }
         this.addDefaultValues(parameters);
-        await this.applyTransformParameters(parameters);
+        await this.applyTransformations(parameters);
         // Use refresh parameters if specified, otherwise try to refresh as many parameters as possible here
         const parametersToRefresh = this.getParametersToRefreshForImport(parameters, context);
         // Parse data from the user supplied config
@@ -227,7 +227,7 @@ export class ResourceController {
         const resultParametersArray = currentParametersArray
             ?.map((r, idx) => ({ ...r, ...statefulCurrentParameters[idx] }));
         for (const result of resultParametersArray) {
-            await this.applyTransformParameters(result, { original: context.originalDesiredConfig });
+            await this.applyTransformations(result, { original: context.originalDesiredConfig });
             this.removeDefaultValues(result, parameters);
         }
         return resultParametersArray?.map((r) => ({ core, parameters: r }));
@@ -292,7 +292,7 @@ ${JSON.stringify(refresh, null, 2)}
 `);
         }
     }
-    async applyTransformParameters(config, reverse) {
+    async applyTransformations(config, reverse, skipConfigTransformation = false) {
         if (!config) {
             return;
         }
@@ -304,7 +304,7 @@ ${JSON.stringify(refresh, null, 2)}
                 ? await inputTransformation.from(config[key], reverse.original?.[key])
                 : await inputTransformation.to(config[key]);
         }
-        if (this.settings.transformation) {
+        if (this.settings.transformation && !skipConfigTransformation) {
             const transformed = reverse
                 ? await this.settings.transformation.from({ ...config }, reverse.original)
                 : await this.settings.transformation.to({ ...config });

package/dist/resource/resource-settings.d.ts

@@ -167,6 +167,12 @@ export interface DefaultParameterSetting {
      * is mainly used to determine the equality method when performing diffing.
      */
     type?: ParameterSettingType;
+    /**
+     * Mark the field as sensitive. Defaults to false. This has two side effects:
+     * 1. When displaying this field in the plan, it will be replaced with asterisks
+     * 2. When importing, resources with sensitive fields will be skipped unless the user explicitly allows it.
+     */
+    isSensitive?: boolean;
     /**
      * Default value for the parameter. If a value is not provided in the config, then this value will be used.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codify-plugin-lib",
-  "version": "1.0.177",
+  "version": "1.0.179",
   "description": "Library plugin library",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
@@ -16,7 +16,7 @@
   "dependencies": {
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
-    "codify-schemas": "1.0.76",
+    "codify-schemas": "1.0.83",
     "@npmcli/promise-spawn": "^7.0.1",
     "@homebridge/node-pty-prebuilt-multiarch": "^0.12.0-beta.5",
     "uuid": "^10.0.0",

package/src/messages/sender.ts

@@ -21,6 +21,19 @@ class CodifyCliSenderImpl {
     })
   }
 
+  async getCodifyCliCredentials(): Promise<string> {
+    const data = await this.sendAndWaitForResponse(<IpcMessageV2>{
+      cmd: MessageCmd.CODIFY_CREDENTIALS_REQUEST,
+      data: {},
+    })
+
+    if (typeof data.data !== 'string') {
+      throw new Error('Expected string back from credentials request');
+    }
+
+    return data.data;
+  }
+
   private async sendAndWaitForResponse(message: IpcMessageV2): Promise<IpcMessageV2> {
     return new Promise((resolve) => {
       const requestId = nanoid(8);

package/src/plan/change-set.test.ts

@@ -87,7 +87,7 @@ describe('Change set tests', () => {
   it('Correctly diffs two resource configs (destory)', () => {
     const cs = ChangeSet.destroy({
       propA: 'prop',
-      propB: 'propB'
+      propB: 'propB',
     });
 
     expect(cs.parameterChanges.length).to.eq(2);

package/src/plan/change-set.ts

@@ -1,6 +1,7 @@
 import { ParameterOperation, ResourceOperation, StringIndexedObject } from 'codify-schemas';
 
 import { ParsedParameterSetting } from '../resource/parsed-resource-settings.js';
+import { ResourceSettings } from '../resource/resource-settings.js';
 
 /**
  * A parameter change describes a parameter level change to a resource.
@@ -25,6 +26,11 @@ export interface ParameterChange<T extends StringIndexedObject> {
    * The new value of the resource (the desired value)
    */
   newValue: any | null;
+
+  /**
+   * Whether the parameter is sensitive
+   */
+  isSensitive: boolean;
 }
 
 // Change set will coerce undefined values to null because undefined is not valid JSON
@@ -60,37 +66,40 @@ export class ChangeSet<T extends StringIndexedObject> {
     return new ChangeSet<T>(ResourceOperation.NOOP, []);
   }
 
-  static create<T extends StringIndexedObject>(desired: Partial<T>): ChangeSet<T> {
+  static create<T extends StringIndexedObject>(desired: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T> {
     const parameterChanges = Object.entries(desired)
       .map(([k, v]) => ({
         name: k,
         operation: ParameterOperation.ADD,
         previousValue: null,
         newValue: v ?? null,
+        isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
       }))
 
     return new ChangeSet(ResourceOperation.CREATE, parameterChanges);
   }
 
-  static noop<T extends StringIndexedObject>(parameters: Partial<T>): ChangeSet<T> {
+  static noop<T extends StringIndexedObject>(parameters: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T> {
     const parameterChanges = Object.entries(parameters)
       .map(([k, v]) => ({
         name: k,
         operation: ParameterOperation.NOOP,
         previousValue: v ?? null,
         newValue: v ?? null,
+        isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
       }))
 
     return new ChangeSet(ResourceOperation.NOOP, parameterChanges);
   }
 
-  static destroy<T extends StringIndexedObject>(current: Partial<T>): ChangeSet<T> {
+  static destroy<T extends StringIndexedObject>(current: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T> {
     const parameterChanges = Object.entries(current)
       .map(([k, v]) => ({
         name: k,
         operation: ParameterOperation.REMOVE,
         previousValue: v ?? null,
         newValue: null,
+        isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
       }))
 
     return new ChangeSet(ResourceOperation.DESTROY, parameterChanges);
@@ -160,6 +169,7 @@ export class ChangeSet<T extends StringIndexedObject> {
           previousValue: current[k] ?? null,
           newValue: desired[k] ?? null,
           operation: ParameterOperation.NOOP,
+          isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
         })
 
         continue;
@@ -171,6 +181,7 @@ export class ChangeSet<T extends StringIndexedObject> {
           previousValue: current[k] ?? null,
           newValue: null,
           operation: ParameterOperation.REMOVE,
+          isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
         })
 
         continue;
@@ -182,6 +193,7 @@ export class ChangeSet<T extends StringIndexedObject> {
           previousValue: null,
           newValue: desired[k] ?? null,
           operation: ParameterOperation.ADD,
+          isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
         })
 
         continue;
@@ -192,6 +204,7 @@ export class ChangeSet<T extends StringIndexedObject> {
         previousValue: current[k] ?? null,
         newValue: desired[k] ?? null,
         operation: ParameterOperation.MODIFY,
+        isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
       })
     }
 

package/src/plan/plan.ts

@@ -118,7 +118,7 @@ export class Plan<T extends StringIndexedObject> {
     if (!filteredCurrentParameters && desired) {
       return new Plan(
         uuidV4(),
-        ChangeSet.create(desired),
+        ChangeSet.create(desired, settings),
         core,
         isStateful,
       )
@@ -130,7 +130,7 @@ export class Plan<T extends StringIndexedObject> {
       if (!settings.canDestroy) {
         return new Plan(
           uuidV4(),
-          ChangeSet.noop(filteredCurrentParameters),
+          ChangeSet.noop(filteredCurrentParameters, settings),
           core,
           isStateful,
         )
@@ -138,7 +138,7 @@ export class Plan<T extends StringIndexedObject> {
 
       return new Plan(
         uuidV4(),
-        ChangeSet.destroy(filteredCurrentParameters),
+        ChangeSet.destroy(filteredCurrentParameters, settings),
         core,
         isStateful,
       )
@@ -171,7 +171,10 @@ export class Plan<T extends StringIndexedObject> {
       uuidV4(),
       new ChangeSet<T>(
         data.operation,
-        data.parameters
+        data.parameters.map((p) => ({
+          ...p,
+          isSensitive: p.isSensitive ?? false,
+        })),
       ),
       {
         type: data.resourceType,

package/src/plugin/plugin.ts

@@ -62,11 +62,14 @@ export class Plugin {
         .map((r) => ({
           dependencies: r.dependencies,
           type: r.typeId,
+          sensitiveParameters: Object.entries(r.settings.parameterSettings ?? {})
+            .filter(([, v]) => v?.isSensitive)
+            .map(([k]) => k),
         }))
     }
   }
 
-  async getResourceInfo(data: GetResourceInfoRequestData): Promise<GetResourceInfoResponseData> {
+  getResourceInfo(data: GetResourceInfoRequestData): GetResourceInfoResponseData {
     if (!this.resourceControllers.has(data.type)) {
       throw new Error(`Cannot get info for resource ${data.type}, resource doesn't exist`);
     }
@@ -84,6 +87,10 @@ export class Plugin {
     const allowMultiple = resource.settings.allowMultiple !== undefined
       && resource.settings.allowMultiple !== false;
 
+    const sensitiveParameters = Object.entries(resource.settings.parameterSettings ?? {})
+      .filter(([, v]) => v?.isSensitive)
+      .map(([k]) => k);
+
     return {
       plugin: this.name,
       type: data.type,
@@ -96,6 +103,7 @@ export class Plugin {
       import: {
         requiredParameters: requiredPropertyNames,
       },
+      sensitiveParameters,
       allowMultiple
     }
   }

package/src/resource/resource-controller-stateful-mode.test.ts

@@ -142,19 +142,23 @@ describe('Resource tests for stateful plans', () => {
             name: "propA",
             newValue: "propA",
             previousValue: "propA",
-            operation: ParameterOperation.NOOP
+            operation: ParameterOperation.NOOP,
+            isSensitive: false,
+
           },
           {
             name: "propB",
             newValue: 10,
             previousValue: null,
-            operation: ParameterOperation.ADD
+            operation: ParameterOperation.ADD,
+            isSensitive: false,
           },
           {
             name: "propC",
             newValue: 'propC',
             previousValue: 'propC',
-            operation: ParameterOperation.NOOP
+            operation: ParameterOperation.NOOP,
+            isSensitive: false,
           },
         ])
       },
@@ -214,25 +218,29 @@ describe('Resource tests for stateful plans', () => {
             name: "propA",
             newValue: "propA",
             previousValue: "propA",
-            operation: ParameterOperation.NOOP
+            operation: ParameterOperation.NOOP,
+            isSensitive: false,
           },
           {
             name: "propB",
             newValue: 10,
             previousValue: null,
-            operation: ParameterOperation.ADD
+            operation: ParameterOperation.ADD,
+            isSensitive: false,
           },
           {
             name: "propC",
             newValue: 'propC',
             previousValue: 'propC',
-            operation: ParameterOperation.NOOP
+            operation: ParameterOperation.NOOP,
+            isSensitive: false,
           },
           {
             name: "propD",
             newValue: 'propD',
             previousValue: null,
-            operation: ParameterOperation.ADD
+            operation: ParameterOperation.ADD,
+            isSensitive: false,
           },
         ])
       },

package/src/resource/resource-controller.test.ts

@@ -80,13 +80,15 @@ describe('Resource tests', () => {
       name: 'propA',
       previousValue: 'propABefore',
       newValue: 'propA',
-      operation: 'modify'
+      operation: 'modify',
+      isSensitive: false,
     })
     expect(result.changeSet.parameterChanges[1]).to.deep.eq({
       name: 'propB',
       previousValue: 10,
       newValue: 10,
-      operation: 'noop'
+      operation: 'noop',
+      isSensitive: false,
     })
   })
 

package/src/resource/resource-controller.ts

@@ -59,7 +59,7 @@ export class ResourceController<T extends StringIndexedObject> {
     parameters: Partial<T>,
   ): Promise<ValidateResponseData['resourceValidations'][0]> {
     const originalParameters = structuredClone(parameters);
-    await this.applyTransformParameters(parameters);
+    await this.applyTransformations(parameters, undefined, true);
     this.addDefaultValues(parameters);
 
     if (this.schemaValidator) {
@@ -143,10 +143,10 @@ export class ResourceController<T extends StringIndexedObject> {
       const paramsToMatch = structuredClone(resourceToMatch.parameters) as Partial<T>;
 
       this.addDefaultValues(originalParams);
-      await this.applyTransformParameters(originalParams);
+      await this.applyTransformations(originalParams);
 
       this.addDefaultValues(paramsToMatch);
-      await this.applyTransformParameters(paramsToMatch);
+      await this.applyTransformations(paramsToMatch);
 
       const match = parameterMatcher(originalParams, paramsToMatch);
       if (match) {
@@ -170,10 +170,10 @@ export class ResourceController<T extends StringIndexedObject> {
     };
 
     this.addDefaultValues(desired);
-    await this.applyTransformParameters(desired);
+    await this.applyTransformations(desired);
 
     this.addDefaultValues(state);
-    await this.applyTransformParameters(state);
+    await this.applyTransformations(state);
 
     // Parse data from the user supplied config
     const parsedConfig = new ConfigParser(desired, state, this.parsedSettings.statefulParameters)
@@ -221,7 +221,7 @@ export class ResourceController<T extends StringIndexedObject> {
     parameters: Partial<T>
   ): Promise<Plan<T>> {
     this.addDefaultValues(parameters);
-    await this.applyTransformParameters(parameters);
+    await this.applyTransformations(parameters);
 
     // Use refresh parameters if specified, otherwise try to refresh as many parameters as possible here
     const parametersToRefresh = this.settings.importAndDestroy?.refreshKeys
@@ -298,7 +298,7 @@ export class ResourceController<T extends StringIndexedObject> {
     }
 
     this.addDefaultValues(parameters);
-    await this.applyTransformParameters(parameters);
+    await this.applyTransformations(parameters);
 
     // Use refresh parameters if specified, otherwise try to refresh as many parameters as possible here
     const parametersToRefresh = this.getParametersToRefreshForImport(parameters, context);
@@ -325,7 +325,7 @@ export class ResourceController<T extends StringIndexedObject> {
       ?.map((r, idx) => ({ ...r, ...statefulCurrentParameters[idx] }))
 
     for (const result of resultParametersArray) {
-      await this.applyTransformParameters(result, { original: context.originalDesiredConfig });
+      await this.applyTransformations(result, { original: context.originalDesiredConfig });
       this.removeDefaultValues(result, parameters);
     }
 
@@ -408,9 +408,9 @@ ${JSON.stringify(refresh, null, 2)}
     }
   }
 
-  private async applyTransformParameters(config: Partial<T> | null, reverse?: {
+  private async applyTransformations(config: Partial<T> | null, reverse?: {
     original: Partial<T> | null
-  }): Promise<void> {
+  }, skipConfigTransformation = false): Promise<void> {
     if (!config) {
       return;
     }
@@ -425,7 +425,7 @@ ${JSON.stringify(refresh, null, 2)}
         : await inputTransformation.to(config[key]);
     }
 
-    if (this.settings.transformation) {
+    if (this.settings.transformation && !skipConfigTransformation) {
       const transformed = reverse
         ? await this.settings.transformation.from({ ...config }, reverse.original)
         : await this.settings.transformation.to({ ...config })

package/src/resource/resource-settings.test.ts

@@ -717,12 +717,14 @@ describe('Resource parameter tests', () => {
           operation: ParameterOperation.NOOP,
           previousValue: null,
           newValue: 'setting',
+          isSensitive: false,
         },
         {
           name: 'propB',
           operation: ParameterOperation.NOOP,
           previousValue: 64,
           newValue: 64,
+          isSensitive: false,
         }
       ])
     )

package/src/resource/resource-settings.ts

@@ -163,7 +163,7 @@ export interface ResourceSettings<T extends StringIndexedObject> {
      * @param input
      * @param context
      */
-    refreshMapper?: (input: Partial<T>, context: RefreshContext<T>) => Partial<T>
+    refreshMapper?: (input: Partial<T>, context: RefreshContext<T>) => Partial<T>;
   }
 }
 
@@ -207,6 +207,13 @@ export interface DefaultParameterSetting {
    */
   type?: ParameterSettingType;
 
+  /**
+   * Mark the field as sensitive. Defaults to false. This has two side effects:
+   * 1. When displaying this field in the plan, it will be replaced with asterisks
+   * 2. When importing, resources with sensitive fields will be skipped unless the user explicitly allows it.
+   */
+  isSensitive?: boolean;
+
   /**
    * Default value for the parameter. If a value is not provided in the config, then this value will be used.
    */