feat(endpoint): add wss_url output to endpoint resource

[jscaltreto]

Summary

The quicknode_endpoint resource exposed only a single url attribute holding the RPC endpoint, so there was no way to reach the WebSocket endpoint QuickNode returns alongside it — users had to hand-construct the wss:// URL or step outside Terraform entirely. This surfaces the API's wss_url as its own computed attribute.

Detail

New attribute:

• internal/provider/endpoint_resource.go: Adds a computed wss_url attribute, populated from the wss_url field that single_endpoint already returns on both CreateEndpoint and ShowEndpoint. No additional API calls are made. It is null when the API returns null or empty, which is how chains and networks without WebSocket support report it.
• Normalized to scheme + host, matching the existing url treatment, so neither attribute carries the authentication token path. Callers compose the full URL from the attribute plus security.tokens[0].token, exactly as they already do for url.
• Uses UseStateForUnknown like the other computed attributes, so pre-existing state populates wss_url on the next refresh instead of forcing a diff.

Refactor:

• Extracts a baseUrl helper and a setUrls method, replacing the url.Parse / Sprintf pair that was duplicated verbatim in Create and Read. baseUrl now returns null rather than a malformed "://" string when the URL fails to parse — the previous code discarded the parse error and used the zero-value URL regardless.
• Clarifies the url description, which read only "Endpoint URL that was created" and did not mention that the token path is stripped.

Dependency bump (unrelated to the feature, included to keep the Trivy gate green):

• github.com/getkin/kin-openapi v0.135.0 -> v0.144.0, resolving GHSA-r277-6w6q-xmqw (critical: ValidationHandler.Load() fail-open auth bypass via the default NoopAuthenticationFunc) and GHSA-jpcw-4wr7-c3vq (medium: unauthenticated nil-pointer panic validating a request against a content schema).
• Neither advisory is reachable here: both live in openapi3filter, and go list -deps ./... shows only openapi3 in the build graph, pulled in by the generated client's embedded spec and GetSwagger(). This provider is an API client and does no server-side request validation. Bumped rather than .trivyignore'd because a fixed version exists.
• Pulls transitive bumps to go-openapi/jsonpointer, go-openapi/swag/jsonname, oasdiff/yaml, and oasdiff/yaml3. Re-running go generate ./api/... against v0.144.0 produces no diff in the generated clients.

Testing

• Adds TestSetUrls, a table test over the URL mapping: both URLs present, nil wss_url, empty-string wss_url, and an unparseable http_url.
• Extends TestAccMinimalQuicknodeEndpointResource to assert that url and wss_url match ^https://[^/]+$ and ^wss://[^/]+$ respectively. The test provisions eth/mainnet, which offers WebSocket support, so wss_url must be populated — this is the check that confirms the field is really present on live API responses and not just in the spec. The existing ImportStateVerify step covers the Read path, since it compares wss_url between created state and a fresh import.
• go build ./..., go vet ./..., and go test ./internal/... pass locally. Acceptance tests need CI to run, hence the branch on this repo rather than a fork.
• trivy fs --scanners vuln --exit-code 1 . reports 0 vulnerabilities locally after the bump (2 before).

Documentation

docs/resources/endpoint.md regenerated via go generate ./... (tfplugindocs) to add wss_url and pick up the revised url description.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 5 package(s) with unknown licenses.

See the Details below.

License Issues

go.mod

Package	Version	License	Issue Type
github.com/getkin/kin-openapi	0.144.0	Null	Unknown License
github.com/go-openapi/jsonpointer	0.22.5	Null	Unknown License
github.com/go-test/deep	1.0.8	Null	Unknown License
github.com/oasdiff/yaml	0.1.1	Null	Unknown License
github.com/oasdiff/yaml3	0.0.14	Null	Unknown License

Allowed Licenses: BSD-1-Clause, BSD-2-Clause, BSD-3-Clause, MIT, MIT-0, Apache-1.1, Apache-2.0, Artistic-1.0, Artistic-2.0, PHP-3.0, PHP-3.01, PSF-2.0, Zlib, zlib-acknowledgement, BSL-1.0, OpenSSL, WTFPL, CC0-1.0, CC-PDDC, CC-BY-1.0, CC-BY-2.0, CC-BY-2.5, CC-BY-3.0, CC-BY-4.0, Unlicense, ISC, BlueOak-1.0.0, BSD-2-Clause-Patent, ADSL, Apache-2.0, APAFML, BSD-1-Clause, BSD-2-Clause, BSD-2-Clause-FreeBSD, BSD-2-Clause-NetBSD, BSD-2-Clause-Views, BSL-1.0, DSDP, ECL-1.0, ECL-2.0, ImageMagick, ISC, Linux-OpenIB, MIT, MIT-Modern-Variant, MS-PL, MulanPSL-1.0, Mup, PostgreSQL, Spencer-99, UPL-1.0, Xerox, 0BSD, AFL-1.1, AFL-1.2, AFL-2.0, AFL-2.1, AFL-3.0, AMDPLPA, AML, AMPAS, ANTLR-PD, ANTLR-PD-fallback, Apache-1.0, Apache-1.1, Artistic-2.0, Bahyph, Barr, BSD-3-Clause, BSD-3-Clause-Attribution, BSD-3-Clause-Clear, BSD-3-Clause-LBNL, BSD-3-Clause-Modification, BSD-3-Clause-No-Nuclear-License-2014, BSD-3-Clause-No-Nuclear-Warranty, BSD-3-Clause-Open-MPI, BSD-4-Clause, BSD-4-Clause-Shortened, BSD-4-Clause-UC, BSD-Source-Code, bzip2-1.0.5, bzip2-1.0.6, CC0-1.0, CNRI-Jython, CNRI-Python, CNRI-Python-GPL-Compatible, Cube, curl, eGenix, Entessa, FTL, HTMLTIDY, IBM-pibs, ICU, Info-ZIP, Intel, JasPer-2.0, Libpng, libpng-2.0, libtiff, LPPL-1.3c, MIT-0, MIT-advertising, MIT-open-group, MIT-CMU, MIT-enna, MIT-feh, MITNFA, MTLL, MulanPSL-2.0, Multics, Naumen, NCSA, Net-SNMP, NetCDF, NTP, OLDAP-2.0, OLDAP-2.0.1, OLDAP-2.1, OLDAP-2.2, OLDAP-2.2.1, OLDAP-2.2.2, OLDAP-2.3, OLDAP-2.4, OLDAP-2.5, OLDAP-2.6, OLDAP-2.7, OLDAP-2.8, OML, OpenSSL, PHP-3.0, PHP-3.01, Plexus, PSF-2.0, Python-2.0, Ruby, Saxpath, SGI-B-2.0, SMLNJ, SWL, TCL, TCP-wrappers, Unicode-DFS-2015, Unicode-DFS-2016, Unlicense, VSL-1.0, W3C, X11, XFree86-1.1, Xnet, xpp, Zlib, zlib-acknowledgement, ZPL-2.0, ZPL-2.1, AAL, Adobe-2006, Afmparse, Artistic-1.0, Artistic-1.0-cl8, Artistic-1.0-Perl, Beerware, blessing, Borceux, CECILL-B, ClArtistic, Condor-1.1, Crossword, CrystalStacker, diffmark, DOC, EFL-1.0, EFL-2.0, Fair, FSFUL, FSFULLR, Giftware, HPND, IJG, Leptonica, LPL-1.0, LPL-1.02, MirOS, mpich2, NASA-1.3, NBPL-1.0, Newsletr, NLPL, NRL, OGTSL, OLDAP-1.1, OLDAP-1.2, OLDAP-1.3, OLDAP-1.4, psutils, Qhull, Rdisc, RSA-MD, Spencer-86, Spencer-94, TU-Berlin-1.0, TU-Berlin-2.0, Vim, W3C-19980720, W3C-20150513, Wsuipa, WTFPL, xinetd, Zed, Zend-2.0, ZPL-1.1

Excluded from license check: pkg:golang/github.com/hashicorp/terraform-plugin-framework@v1.15.0, pkg:golang/github.com/hashicorp/terraform-plugin-go@v0.27.0, pkg:golang/github.com/hashicorp/terraform-registry-address@v0.2.5, pkg:golang/google.golang.org/protobuf, pkg:golang/golang.org/x/crypto, pkg:golang/golang.org/x/mod, pkg:golang/golang.org/x/net, pkg:golang/golang.org/x/sync, pkg:golang/golang.org/x/sys, pkg:golang/golang.org/x/text, pkg:golang/golang.org/x/time, pkg:golang/golang.org/x/tools, pkg:golang/honnef.co/go/tools, pkg:golang/go.yaml.in/yaml/v3

OpenSSF Scorecard

Package	Version	Score	Details
gomod/github.com/getkin/kin-openapi	0.144.0	Unknown	Unknown
gomod/github.com/go-openapi/jsonpointer	0.22.5	Unknown	Unknown
gomod/github.com/go-openapi/swag/jsonname	0.25.5	🟢 8.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 0/11 approved changesets -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
gomod/github.com/go-test/deep	1.0.8	Unknown	Unknown
gomod/github.com/oasdiff/yaml	0.1.1	Unknown	Unknown
gomod/github.com/oasdiff/yaml3	0.0.14	Unknown	Unknown
gomod/github.com/santhosh-tekuri/jsonschema/v6	6.0.2	🟢 3.2	Details Check Score Reason Maintained 🟢 5 5 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 2 Found 6/30 approved changesets -- score normalized to 2 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• go.mod

[nexx88]

@jscaltreto

Complexity only (correctness/security out of scope). Feature and the dependency-bump rationale both look sound; these are cut-only notes.

internal/provider/endpoint_resource.go

• setUrls: the wssUrl != nil && *wssUrl != "" guard duplicates what baseUrl already rejects — an empty string parses to no Scheme/Host and returns types.StringNull(). Collapses to two lines, using the types.StringPointerValue idiom already in this file (L465):

  func (data *EndpointResourceModel) setUrls(httpUrl string, wssUrl *string) {
      data.Url = baseUrl(httpUrl)
      data.WssUrl = baseUrl(types.StringPointerValue(wssUrl).ValueString())
  }

• baseUrl: fmt.Sprintf("%s://%s", u.Scheme, u.Host) → u.Scheme + "://" + u.Host. Same line count, one less format-string parse. Only worth it if it also drops the fmt import.

internal/provider/endpoint_resource_test.go

• strPtr is a helper for a single call site. It disappears entirely with the setUrls change above.
• "nil wss" and "empty wss" exercise the same path once the branch is gone — one case covers it.

net: -8 lines possible. Nothing blocking.