codify-plugin-lib 1.0.178 → 1.0.180

package/dist/entities/resource.js

@@ -0,0 +1,303 @@
+import { Ajv } from 'ajv';
+import { ParameterOperation, ResourceOperation, } from 'codify-schemas';
+import { setsEqual, splitUserConfig } from '../utils/utils.js';
+import { Plan } from './plan.js';
+import { ResourceOptionsParser } from './resource-options.js';
+export class Resource {
+    typeId;
+    statefulParameters;
+    transformParameters;
+    resourceParameters;
+    statefulParameterOrder;
+    transformParameterOrder;
+    dependencies;
+    parameterOptions;
+    options;
+    defaultValues;
+    ajv;
+    schemaValidator;
+    constructor(options) {
+        this.typeId = options.type;
+        this.dependencies = options.dependencies ?? [];
+        this.options = options;
+        if (this.options.schema) {
+            this.ajv = new Ajv({
+                allErrors: true,
+                strict: true,
+                strictRequired: false,
+            });
+            this.schemaValidator = this.ajv.compile(this.options.schema);
+        }
+        const parser = new ResourceOptionsParser(options);
+        this.statefulParameters = parser.statefulParameters;
+        this.transformParameters = parser.transformParameters;
+        this.resourceParameters = parser.resourceParameters;
+        this.parameterOptions = parser.changeSetParameterOptions;
+        this.defaultValues = parser.defaultValues;
+        this.statefulParameterOrder = parser.statefulParameterOrder;
+        this.transformParameterOrder = parser.transformParameterOrder;
+    }
+    async onInitialize() { }
+    async validate(parameters, resourceMetaData) {
+        if (this.schemaValidator) {
+            const isValid = this.schemaValidator(parameters);
+            if (!isValid) {
+                return {
+                    isValid: false,
+                    resourceName: resourceMetaData.name,
+                    resourceType: resourceMetaData.type,
+                    schemaValidationErrors: this.schemaValidator?.errors ?? [],
+                };
+            }
+        }
+        let isValid = true;
+        let customValidationErrorMessage;
+        try {
+            await this.customValidation(parameters);
+        }
+        catch (error) {
+            isValid = false;
+            customValidationErrorMessage = error.message;
+        }
+        if (!isValid) {
+            return {
+                customValidationErrorMessage,
+                isValid: false,
+                resourceName: resourceMetaData.name,
+                resourceType: resourceMetaData.type,
+                schemaValidationErrors: this.schemaValidator?.errors ?? [],
+            };
+        }
+        return {
+            isValid: true,
+            resourceName: resourceMetaData.name,
+            resourceType: resourceMetaData.type,
+            schemaValidationErrors: [],
+        };
+    }
+    async plan(desiredConfig, currentConfig = null, statefulMode = false) {
+        this.validatePlanInputs(desiredConfig, currentConfig, statefulMode);
+        const planOptions = {
+            parameterOptions: this.parameterOptions,
+            statefulMode,
+        };
+        this.addDefaultValues(desiredConfig);
+        await this.applyTransformParameters(desiredConfig);
+        const parsedConfig = new ConfigParser(desiredConfig, currentConfig, this.statefulParameters, this.transformParameters);
+        const { desiredParameters, nonStatefulParameters, resourceMetadata, statefulParameters, } = parsedConfig;
+        const currentParameters = await this.refreshNonStatefulParameters(nonStatefulParameters);
+        if (currentParameters === null || currentParameters === undefined) {
+            return Plan.create(desiredParameters, null, resourceMetadata, planOptions);
+        }
+        const statefulCurrentParameters = await this.refreshStatefulParameters(statefulParameters, planOptions.statefulMode);
+        return Plan.create(desiredParameters, { ...currentParameters, ...statefulCurrentParameters }, resourceMetadata, planOptions);
+    }
+    async apply(plan) {
+        if (plan.getResourceType() !== this.typeId) {
+            throw new Error(`Internal error: Plan set to wrong resource during apply. Expected ${this.typeId} but got: ${plan.getResourceType()}`);
+        }
+        switch (plan.changeSet.operation) {
+            case ResourceOperation.CREATE: {
+                return this._applyCreate(plan);
+            }
+            case ResourceOperation.MODIFY: {
+                return this._applyModify(plan);
+            }
+            case ResourceOperation.RECREATE: {
+                await this._applyDestroy(plan);
+                return this._applyCreate(plan);
+            }
+            case ResourceOperation.DESTROY: {
+                return this._applyDestroy(plan);
+            }
+        }
+    }
+    async _applyCreate(plan) {
+        await this.applyCreate(plan);
+        const statefulParameterChanges = plan.changeSet.parameterChanges
+            .filter((pc) => this.statefulParameters.has(pc.name))
+            .sort((a, b) => this.statefulParameterOrder.get(a.name) - this.statefulParameterOrder.get(b.name));
+        for (const parameterChange of statefulParameterChanges) {
+            const statefulParameter = this.statefulParameters.get(parameterChange.name);
+            await statefulParameter.applyAdd(parameterChange.newValue, plan);
+        }
+    }
+    async _applyModify(plan) {
+        const parameterChanges = plan
+            .changeSet
+            .parameterChanges
+            .filter((c) => c.operation !== ParameterOperation.NOOP);
+        const statelessParameterChanges = parameterChanges
+            .filter((pc) => !this.statefulParameters.has(pc.name));
+        for (const pc of statelessParameterChanges) {
+            await this.applyModify(pc, plan);
+        }
+        const statefulParameterChanges = parameterChanges
+            .filter((pc) => this.statefulParameters.has(pc.name))
+            .sort((a, b) => this.statefulParameterOrder.get(a.name) - this.statefulParameterOrder.get(b.name));
+        for (const parameterChange of statefulParameterChanges) {
+            const statefulParameter = this.statefulParameters.get(parameterChange.name);
+            switch (parameterChange.operation) {
+                case ParameterOperation.ADD: {
+                    await statefulParameter.applyAdd(parameterChange.newValue, plan);
+                    break;
+                }
+                case ParameterOperation.MODIFY: {
+                    await statefulParameter.applyModify(parameterChange.newValue, parameterChange.previousValue, false, plan);
+                    break;
+                }
+                case ParameterOperation.REMOVE: {
+                    await statefulParameter.applyRemove(parameterChange.previousValue, plan);
+                    break;
+                }
+            }
+        }
+    }
+    async _applyDestroy(plan) {
+        if (this.options.callStatefulParameterRemoveOnDestroy) {
+            const statefulParameterChanges = plan.changeSet.parameterChanges
+                .filter((pc) => this.statefulParameters.has(pc.name))
+                .sort((a, b) => this.statefulParameterOrder.get(a.name) - this.statefulParameterOrder.get(b.name));
+            for (const parameterChange of statefulParameterChanges) {
+                const statefulParameter = this.statefulParameters.get(parameterChange.name);
+                await statefulParameter.applyRemove(parameterChange.previousValue, plan);
+            }
+        }
+        await this.applyDestroy(plan);
+    }
+    validateRefreshResults(refresh, desired) {
+        if (!refresh) {
+            return;
+        }
+        const desiredKeys = new Set(Object.keys(refresh));
+        const refreshKeys = new Set(Object.keys(refresh));
+        if (!setsEqual(desiredKeys, refreshKeys)) {
+            throw new Error(`Resource ${this.typeId}
+refresh() must return back exactly the keys that were provided
+Missing: ${[...desiredKeys].filter((k) => !refreshKeys.has(k))};
+Additional: ${[...refreshKeys].filter(k => !desiredKeys.has(k))};`);
+        }
+    }
+    async applyTransformParameters(desired) {
+        if (!desired) {
+            return;
+        }
+        const transformParameters = [...this.transformParameters.entries()]
+            .sort(([keyA], [keyB]) => this.transformParameterOrder.get(keyA) - this.transformParameterOrder.get(keyB));
+        for (const [key, transformParameter] of transformParameters) {
+            if (desired[key] === undefined) {
+                continue;
+            }
+            const transformedValue = await transformParameter.transform(desired[key]);
+            if (Object.keys(transformedValue).some((k) => desired[k] !== undefined)) {
+                throw new Error(`Transform parameter ${key} is attempting to override existing values ${JSON.stringify(transformedValue, null, 2)}`);
+            }
+            delete desired[key];
+            for (const [tvKey, tvValue] of Object.entries(transformedValue)) {
+                desired[tvKey] = tvValue;
+            }
+        }
+    }
+    addDefaultValues(desired) {
+        if (!desired) {
+            return;
+        }
+        for (const [key, defaultValue] of Object.entries(this.defaultValues)) {
+            if (defaultValue !== undefined && desired[key] === undefined) {
+                desired[key] = defaultValue;
+            }
+        }
+    }
+    async refreshNonStatefulParameters(resourceParameters) {
+        const currentParameters = await this.refresh(resourceParameters);
+        this.validateRefreshResults(currentParameters, resourceParameters);
+        return currentParameters;
+    }
+    async refreshStatefulParameters(statefulParametersConfig, isStatefulMode) {
+        const currentParameters = {};
+        const sortedEntries = Object.entries(statefulParametersConfig)
+            .sort(([key1], [key2]) => this.statefulParameterOrder.get(key1) - this.statefulParameterOrder.get(key2));
+        for (const [key, desiredValue] of sortedEntries) {
+            const statefulParameter = this.statefulParameters.get(key);
+            if (!statefulParameter) {
+                throw new Error(`Stateful parameter ${key} was not found`);
+            }
+            let currentValue = await statefulParameter.refresh(desiredValue ?? null);
+            if (Array.isArray(currentValue)
+                && Array.isArray(desiredValue)
+                && !isStatefulMode
+                && !statefulParameter.options.disableStatelessModeArrayFiltering) {
+                currentValue = currentValue.filter((c) => desiredValue?.some((d) => {
+                    const parameterOptions = statefulParameter.options;
+                    if (parameterOptions && parameterOptions.isElementEqual) {
+                        return parameterOptions.isElementEqual(d, c);
+                    }
+                    return d === c;
+                }));
+            }
+            currentParameters[key] = currentValue;
+        }
+        return currentParameters;
+    }
+    validatePlanInputs(desired, current, statefulMode) {
+        if (!desired && !current) {
+            throw new Error('Desired config and current config cannot both be missing');
+        }
+        if (!statefulMode && !desired) {
+            throw new Error('Desired config must be provided in non-stateful mode');
+        }
+    }
+    async customValidation(parameters) { }
+    ;
+    async applyModify(pc, plan) { }
+    ;
+}
+class ConfigParser {
+    desiredConfig;
+    currentConfig;
+    statefulParametersMap;
+    transformParametersMap;
+    constructor(desiredConfig, currentConfig, statefulParameters, transformParameters) {
+        this.desiredConfig = desiredConfig;
+        this.currentConfig = currentConfig;
+        this.statefulParametersMap = statefulParameters;
+        this.transformParametersMap = transformParameters;
+    }
+    get resourceMetadata() {
+        const desiredMetadata = this.desiredConfig ? splitUserConfig(this.desiredConfig).resourceMetadata : undefined;
+        const currentMetadata = this.currentConfig ? splitUserConfig(this.currentConfig).resourceMetadata : undefined;
+        if (!desiredMetadata && !currentMetadata) {
+            throw new Error(`Unable to parse resource metadata from ${this.desiredConfig}, ${this.currentConfig}`);
+        }
+        if (currentMetadata && desiredMetadata && (Object.keys(desiredMetadata).length !== Object.keys(currentMetadata).length
+            || Object.entries(desiredMetadata).some(([key, value]) => currentMetadata[key] !== value))) {
+            throw new Error(`The metadata for the current config does not match the desired config. 
+Desired metadata:
+${JSON.stringify(desiredMetadata, null, 2)}
+
+Current metadata:
+${JSON.stringify(currentMetadata, null, 2)}`);
+        }
+        return desiredMetadata ?? currentMetadata;
+    }
+    get desiredParameters() {
+        if (!this.desiredConfig) {
+            return null;
+        }
+        const { parameters } = splitUserConfig(this.desiredConfig);
+        return parameters;
+    }
+    get parameters() {
+        const desiredParameters = this.desiredConfig ? splitUserConfig(this.desiredConfig).parameters : undefined;
+        const currentParameters = this.currentConfig ? splitUserConfig(this.currentConfig).parameters : undefined;
+        return { ...desiredParameters, ...currentParameters };
+    }
+    get nonStatefulParameters() {
+        const { parameters } = this;
+        return Object.fromEntries(Object.entries(parameters).filter(([key]) => !(this.statefulParametersMap.has(key) || this.transformParametersMap.has(key))));
+    }
+    get statefulParameters() {
+        const { parameters } = this;
+        return Object.fromEntries(Object.entries(parameters).filter(([key]) => this.statefulParametersMap.has(key)));
+    }
+}

package/dist/entities/stateful-parameter.d.ts

@@ -0,0 +1,29 @@
+import { Plan } from './plan.js';
+import { StringIndexedObject } from 'codify-schemas';
+export interface StatefulParameterOptions<V> {
+    isEqual?: (desired: any, current: any) => boolean;
+    disableStatelessModeArrayFiltering?: boolean;
+    default?: V;
+}
+export interface ArrayStatefulParameterOptions<V> extends StatefulParameterOptions<V> {
+    isEqual?: (desired: any[], current: any[]) => boolean;
+    isElementEqual?: (desired: any, current: any) => boolean;
+}
+export declare abstract class StatefulParameter<T extends StringIndexedObject, V extends T[keyof T]> {
+    readonly options: StatefulParameterOptions<V>;
+    constructor(options?: StatefulParameterOptions<V>);
+    abstract refresh(desired: V | null): Promise<V | null>;
+    abstract applyAdd(valueToAdd: V, plan: Plan<T>): Promise<void>;
+    abstract applyModify(newValue: V, previousValue: V, allowDeletes: boolean, plan: Plan<T>): Promise<void>;
+    abstract applyRemove(valueToRemove: V, plan: Plan<T>): Promise<void>;
+}
+export declare abstract class ArrayStatefulParameter<T extends StringIndexedObject, V> extends StatefulParameter<T, any> {
+    options: ArrayStatefulParameterOptions<V>;
+    constructor(options?: ArrayStatefulParameterOptions<V>);
+    applyAdd(valuesToAdd: V[], plan: Plan<T>): Promise<void>;
+    applyModify(newValues: V[], previousValues: V[], allowDeletes: boolean, plan: Plan<T>): Promise<void>;
+    applyRemove(valuesToRemove: V[], plan: Plan<T>): Promise<void>;
+    abstract refresh(desired: V[] | null): Promise<V[] | null>;
+    abstract applyAddItem(item: V, plan: Plan<T>): Promise<void>;
+    abstract applyRemoveItem(item: V, plan: Plan<T>): Promise<void>;
+}

package/dist/entities/stateful-parameter.js

@@ -0,0 +1,46 @@
+export class StatefulParameter {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+}
+export class ArrayStatefulParameter extends StatefulParameter {
+    options;
+    constructor(options = {}) {
+        super(options);
+        this.options = options;
+    }
+    async applyAdd(valuesToAdd, plan) {
+        for (const value of valuesToAdd) {
+            await this.applyAddItem(value, plan);
+        }
+    }
+    async applyModify(newValues, previousValues, allowDeletes, plan) {
+        const options = this.options;
+        const valuesToAdd = newValues.filter((n) => !previousValues.some((p) => {
+            if (options.isElementEqual) {
+                return options.isElementEqual(n, p);
+            }
+            return n === p;
+        }));
+        const valuesToRemove = previousValues.filter((p) => !newValues.some((n) => {
+            if (options.isElementEqual) {
+                return options.isElementEqual(n, p);
+            }
+            return n === p;
+        }));
+        for (const value of valuesToAdd) {
+            await this.applyAddItem(value, plan);
+        }
+        if (allowDeletes) {
+            for (const value of valuesToRemove) {
+                await this.applyRemoveItem(value, plan);
+            }
+        }
+    }
+    async applyRemove(valuesToRemove, plan) {
+        for (const value of valuesToRemove) {
+            await this.applyRemoveItem(value, plan);
+        }
+    }
+}

package/dist/entities/transform-parameter.d.ts

@@ -0,0 +1,4 @@
+import { StringIndexedObject } from 'codify-schemas';
+export declare abstract class TransformParameter<T extends StringIndexedObject> {
+    abstract transform(value: any): Promise<Partial<T>>;
+}

package/dist/entities/transform-parameter.js

@@ -0,0 +1,2 @@
+export class TransformParameter {
+}

package/dist/plan/change-set.d.ts

@@ -1,5 +1,6 @@
 import { ParameterOperation, ResourceOperation, StringIndexedObject } from 'codify-schemas';
 import { ParsedParameterSetting } from '../resource/parsed-resource-settings.js';
+import { ResourceSettings } from '../resource/resource-settings.js';
 /**
  * A parameter change describes a parameter level change to a resource.
  */
@@ -20,6 +21,10 @@ export interface ParameterChange<T extends StringIndexedObject> {
      * The new value of the resource (the desired value)
      */
     newValue: any | null;
+    /**
+     * Whether the parameter is sensitive
+     */
+    isSensitive: boolean;
 }
 export declare class ChangeSet<T extends StringIndexedObject> {
     operation: ResourceOperation;
@@ -28,9 +33,9 @@ export declare class ChangeSet<T extends StringIndexedObject> {
     get desiredParameters(): T;
     get currentParameters(): T;
     static empty<T extends StringIndexedObject>(): ChangeSet<T>;
-    static create<T extends StringIndexedObject>(desired: Partial<T>): ChangeSet<T>;
-    static noop<T extends StringIndexedObject>(parameters: Partial<T>): ChangeSet<T>;
-    static destroy<T extends StringIndexedObject>(current: Partial<T>): ChangeSet<T>;
+    static create<T extends StringIndexedObject>(desired: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T>;
+    static noop<T extends StringIndexedObject>(parameters: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T>;
+    static destroy<T extends StringIndexedObject>(current: Partial<T>, settings?: ResourceSettings<T>): ChangeSet<T>;
     static calculateModification<T extends StringIndexedObject>(desired: Partial<T>, current: Partial<T>, parameterSettings?: Partial<Record<keyof T, ParsedParameterSetting>>): ChangeSet<T>;
     /**
      * Calculates the differences between the desired and current parameters,

package/dist/plan/change-set.js

@@ -24,33 +24,36 @@ export class ChangeSet {
     static empty() {
         return new ChangeSet(ResourceOperation.NOOP, []);
     }
-    static create(desired) {
+    static create(desired, settings) {
         const parameterChanges = Object.entries(desired)
             .map(([k, v]) => ({
             name: k,
             operation: ParameterOperation.ADD,
             previousValue: null,
             newValue: v ?? null,
+            isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
         }));
         return new ChangeSet(ResourceOperation.CREATE, parameterChanges);
     }
-    static noop(parameters) {
+    static noop(parameters, settings) {
         const parameterChanges = Object.entries(parameters)
             .map(([k, v]) => ({
             name: k,
             operation: ParameterOperation.NOOP,
             previousValue: v ?? null,
             newValue: v ?? null,
+            isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
         }));
         return new ChangeSet(ResourceOperation.NOOP, parameterChanges);
     }
-    static destroy(current) {
+    static destroy(current, settings) {
         const parameterChanges = Object.entries(current)
             .map(([k, v]) => ({
             name: k,
             operation: ParameterOperation.REMOVE,
             previousValue: v ?? null,
             newValue: null,
+            isSensitive: settings?.parameterSettings?.[k]?.isSensitive ?? false,
         }));
         return new ChangeSet(ResourceOperation.DESTROY, parameterChanges);
     }
@@ -98,6 +101,7 @@ export class ChangeSet {
                     previousValue: current[k] ?? null,
                     newValue: desired[k] ?? null,
                     operation: ParameterOperation.NOOP,
+                    isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
                 });
                 continue;
             }
@@ -107,6 +111,7 @@ export class ChangeSet {
                     previousValue: current[k] ?? null,
                     newValue: null,
                     operation: ParameterOperation.REMOVE,
+                    isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
                 });
                 continue;
             }
@@ -116,6 +121,7 @@ export class ChangeSet {
                     previousValue: null,
                     newValue: desired[k] ?? null,
                     operation: ParameterOperation.ADD,
+                    isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
                 });
                 continue;
             }
@@ -124,6 +130,7 @@ export class ChangeSet {
                 previousValue: current[k] ?? null,
                 newValue: desired[k] ?? null,
                 operation: ParameterOperation.MODIFY,
+                isSensitive: parameterOptions?.[k]?.isSensitive ?? false,
             });
         }
         return parameterChangeSet;

package/dist/plan/plan.js

@@ -68,15 +68,15 @@ export class Plan {
         }
         // CREATE
         if (!filteredCurrentParameters && desired) {
-            return new Plan(uuidV4(), ChangeSet.create(desired), core, isStateful);
+            return new Plan(uuidV4(), ChangeSet.create(desired, settings), core, isStateful);
         }
         // DESTROY
         if (filteredCurrentParameters && !desired) {
             // We can manually override destroys. If a resource cannot be destroyed (for instance the npm resource relies on NodeJS being created and destroyed)
             if (!settings.canDestroy) {
-                return new Plan(uuidV4(), ChangeSet.noop(filteredCurrentParameters), core, isStateful);
+                return new Plan(uuidV4(), ChangeSet.noop(filteredCurrentParameters, settings), core, isStateful);
             }
-            return new Plan(uuidV4(), ChangeSet.destroy(filteredCurrentParameters), core, isStateful);
+            return new Plan(uuidV4(), ChangeSet.destroy(filteredCurrentParameters, settings), core, isStateful);
         }
         // NO-OP, MODIFY or RE-CREATE
         const changeSet = ChangeSet.calculateModification(desired, filteredCurrentParameters, settings.parameterSettings);
@@ -88,7 +88,10 @@ export class Plan {
             throw new Error('Data is empty');
         }
         addDefaultValues();
-        return new Plan(uuidV4(), new ChangeSet(data.operation, data.parameters), {
+        return new Plan(uuidV4(), new ChangeSet(data.operation, data.parameters.map((p) => ({
+            ...p,
+            isSensitive: p.isSensitive ?? false,
+        }))), {
             type: data.resourceType,
             name: data.resourceName,
         }, data.isStateful);

package/dist/plugin/plugin.d.ts

@@ -11,7 +11,7 @@ export declare class Plugin {
     constructor(name: string, resourceControllers: Map<string, ResourceController<ResourceConfig>>);
     static create(name: string, resources: Resource<any>[]): Plugin;
     initialize(data: InitializeRequestData): Promise<InitializeResponseData>;
-    getResourceInfo(data: GetResourceInfoRequestData): Promise<GetResourceInfoResponseData>;
+    getResourceInfo(data: GetResourceInfoRequestData): GetResourceInfoResponseData;
     match(data: MatchRequestData): Promise<MatchResponseData>;
     import(data: ImportRequestData): Promise<ImportResponseData>;
     validate(data: ValidateRequestData): Promise<ValidateResponseData>;

package/dist/plugin/plugin.js

@@ -30,13 +30,25 @@ export class Plugin {
         }
         return {
             resourceDefinitions: [...this.resourceControllers.values()]
-                .map((r) => ({
-                dependencies: r.dependencies,
-                type: r.typeId,
-            }))
+                .map((r) => {
+                const sensitiveParameters = Object.entries(r.settings.parameterSettings ?? {})
+                    .filter(([, v]) => v?.isSensitive)
+                    .map(([k]) => k);
+                // Here we add '*' if the resource is sensitive but no sensitive parameters are found. This works because the import
+                // sensitivity check only checks for the existance of a sensitive parameter whereas the parameter blocking one blocks
+                // on a specific sensitive parameter.
+                if (r.settings.isSensitive && sensitiveParameters.length === 0) {
+                    sensitiveParameters.push('*');
+                }
+                return {
+                    dependencies: r.dependencies,
+                    type: r.typeId,
+                    sensitiveParameters,
+                };
+            })
         };
     }
-    async getResourceInfo(data) {
+    getResourceInfo(data) {
         if (!this.resourceControllers.has(data.type)) {
             throw new Error(`Cannot get info for resource ${data.type}, resource doesn't exist`);
         }
@@ -48,6 +60,15 @@ export class Plugin {
             ?? undefined);
         const allowMultiple = resource.settings.allowMultiple !== undefined
             && resource.settings.allowMultiple !== false;
+        // Here we add '*' if the resource is sensitive but no sensitive parameters are found. This works because the import
+        // sensitivity check only checks for the existance of a sensitive parameter whereas the parameter blocking one blocks
+        // on a specific sensitive parameter.
+        const sensitiveParameters = Object.entries(resource.settings.parameterSettings ?? {})
+            .filter(([, v]) => v?.isSensitive)
+            .map(([k]) => k);
+        if (resource.settings.isSensitive && sensitiveParameters.length === 0) {
+            sensitiveParameters.push('*');
+        }
         return {
             plugin: this.name,
             type: data.type,
@@ -60,6 +81,7 @@ export class Plugin {
             import: {
                 requiredParameters: requiredPropertyNames,
             },
+            sensitiveParameters,
             allowMultiple
         };
     }

package/dist/pty/vitest.config.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("vite").UserConfig;
+export default _default;

package/dist/pty/vitest.config.js

@@ -0,0 +1,11 @@
+import { defaultExclude, defineConfig } from 'vitest/config';
+export default defineConfig({
+    test: {
+        pool: 'forks',
+        fileParallelism: false,
+        exclude: [
+            ...defaultExclude,
+            './src/utils/test-utils.test.ts',
+        ]
+    },
+});

package/dist/resource/resource-settings.d.ts

@@ -18,6 +18,11 @@ export interface ResourceSettings<T extends StringIndexedObject> {
      * Schema to validate user configs with. Must be in the format JSON Schema draft07
      */
     schema?: Partial<JSONSchemaType<T | any>>;
+    /**
+     * Mark the resource as sensitive. Defaults to false. This prevents the resource from automatically being imported by init and import.
+     * This differs from the parameter level sensitivity which also prevents the parameter value from being displayed in the plan.
+     */
+    isSensitive?: boolean;
     /**
      * Allow multiple of the same resource to unique. Set truthy if
      * multiples are allowed, for example for applications, there can be multiple copy of the same application installed
@@ -167,6 +172,12 @@ export interface DefaultParameterSetting {
      * is mainly used to determine the equality method when performing diffing.
      */
     type?: ParameterSettingType;
+    /**
+     * Mark the field as sensitive. Defaults to false. This has two side effects:
+     * 1. When displaying this field in the plan, it will be replaced with asterisks
+     * 2. When importing, resources with sensitive fields will be skipped unless the user explicitly allows it.
+     */
+    isSensitive?: boolean;
     /**
      * Default value for the parameter. If a value is not provided in the config, then this value will be used.
      */