Skip to content

fix: suppress plan drift for enable_binding_cookie, options_preflight_bypass, cors_headers on mcp type #7121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
t0rrant wants to merge 2 commits into
base: next
Choose a base branch
from
+28 −7
Open

fix: suppress plan drift for enable_binding_cookie, options_preflight_bypass, cors_headers on mcp type #7121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4fdab28
fix: suppress plan drift for enable_binding_cookie, options_preflight…
t0rrant May 18, 2026
5ca0ce7
fix: mark enable_binding_cookie, options_preflight_bypass, cors_heade…
t0rrant Jun 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions internal/services/zero_trust_access_application/model.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,22 +28,22 @@ type ZeroTrustAccessApplicationModel struct {
HeaderBgColor types.String `tfsdk:"header_bg_color" json:"header_bg_color,optional"`
LogoURL types.String `tfsdk:"logo_url" json:"logo_url,optional"`
Name types.String `tfsdk:"name" json:"name,computed_optional"`
OptionsPreflightBypass types.Bool `tfsdk:"options_preflight_bypass" json:"options_preflight_bypass,optional"`
OptionsPreflightBypass types.Bool `tfsdk:"options_preflight_bypass" json:"options_preflight_bypass,computed_optional"`
ReadServiceTokensFromHeader types.String `tfsdk:"read_service_tokens_from_header" json:"read_service_tokens_from_header,optional"`
SameSiteCookieAttribute types.String `tfsdk:"same_site_cookie_attribute" json:"same_site_cookie_attribute,optional"`
ServiceAuth401Redirect types.Bool `tfsdk:"service_auth_401_redirect" json:"service_auth_401_redirect,optional"`
SkipInterstitial types.Bool `tfsdk:"skip_interstitial" json:"skip_interstitial,optional"`
Type types.String `tfsdk:"type" json:"type,computed_optional"`
AllowedIdPs *[]types.String `tfsdk:"allowed_idps" json:"allowed_idps,optional"`
CustomPages *[]types.String `tfsdk:"custom_pages" json:"custom_pages,optional"`
CORSHeaders *ZeroTrustAccessApplicationCORSHeadersModel `tfsdk:"cors_headers" json:"cors_headers,optional"`
CORSHeaders *ZeroTrustAccessApplicationCORSHeadersModel `tfsdk:"cors_headers" json:"cors_headers,computed_optional"`
FooterLinks *[]*ZeroTrustAccessApplicationFooterLinksModel `tfsdk:"footer_links" json:"footer_links,optional"`
OAuthConfiguration *ZeroTrustAccessApplicationOAuthConfigurationModel `tfsdk:"oauth_configuration" json:"oauth_configuration,optional"`
SCIMConfig *ZeroTrustAccessApplicationSCIMConfigModel `tfsdk:"scim_config" json:"scim_config,optional"`
TargetCriteria *[]*ZeroTrustAccessApplicationTargetCriteriaModel `tfsdk:"target_criteria" json:"target_criteria,optional"`
AppLauncherVisible types.Bool `tfsdk:"app_launcher_visible" json:"app_launcher_visible,computed_optional"`
AutoRedirectToIdentity types.Bool `tfsdk:"auto_redirect_to_identity" json:"auto_redirect_to_identity,optional"`
EnableBindingCookie types.Bool `tfsdk:"enable_binding_cookie" json:"enable_binding_cookie,optional"`
EnableBindingCookie types.Bool `tfsdk:"enable_binding_cookie" json:"enable_binding_cookie,computed_optional"`
HTTPOnlyCookieAttribute types.Bool `tfsdk:"http_only_cookie_attribute" json:"http_only_cookie_attribute,computed_optional"`
PathCookieAttribute types.Bool `tfsdk:"path_cookie_attribute" json:"path_cookie_attribute,optional"`
SessionDuration types.String `tfsdk:"session_duration" json:"session_duration,computed_optional"`
Expand Down
15 changes: 15 additions & 0 deletions internal/services/zero_trust_access_application/plan_modifiers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,21 @@ func modifyPlan(ctx context.Context, req resource.ModifyPlanRequest, res *resour

// Add default values for some app type specific attributes
setDefaultAccordingToAppTypes(append(selfHostedAppTypes, "mcp"), appType, &planApp.HTTPOnlyCookieAttribute, types.BoolValue(true), types.BoolNull())
// For non-selfHosted types (e.g. mcp), enable_binding_cookie, options_preflight_bypass, and cors_headers
// are returned by the API but cannot be set in config. Copy state into plan to suppress false -> null diffs.
if !slices.Contains(selfHostedAppTypes, appType) && stateApp != nil {
if planApp.EnableBindingCookie.IsNull() {
planApp.EnableBindingCookie = stateApp.EnableBindingCookie
}
if planApp.OptionsPreflightBypass.IsNull() {
planApp.OptionsPreflightBypass = stateApp.OptionsPreflightBypass
}
if planApp.CORSHeaders == nil {
planApp.CORSHeaders = stateApp.CORSHeaders
}
}
setDefaultAccordingToAppTypes(selfHostedAppTypes, appType, &planApp.EnableBindingCookie, types.BoolValue(false), types.BoolNull())
setDefaultAccordingToAppTypes(selfHostedAppTypes, appType, &planApp.OptionsPreflightBypass, types.BoolValue(false), types.BoolNull())
setDefaultAccordingToAppTypes(appLauncherVisibleAppTypes, appType, &planApp.AppLauncherVisible, types.BoolValue(true), types.BoolNull())
setDefaultAccordingToAppType("app_launcher", appType, &planApp.SkipAppLauncherLoginPage, types.BoolValue(false), types.BoolNull())
setDefaultAccordingToAppTypes(sessionDurationCompatibleAppTypes, appType, &planApp.SessionDuration, types.StringValue("24h"), types.StringNull())
Expand Down
11 changes: 7 additions & 4 deletions internal/services/zero_trust_access_application/resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2096,18 +2096,21 @@ func TestAccCloudflareAccessApplication_MCPSetup(t *testing.T) {
ImportState: true,
ImportStateVerify: true,
ImportStateIdPrefix: fmt.Sprintf("accounts/%s/", accountID),
ImportStateVerifyIgnore: []string{"enable_binding_cookie", "options_preflight_bypass", "auto_redirect_to_identity"},
ImportStateVerifyIgnore: []string{"auto_redirect_to_identity"},
},
{
ResourceName: mcpAppName,
ImportState: true,
ImportStateVerify: true,
ImportStateIdPrefix: fmt.Sprintf("accounts/%s/", accountID),
ImportStateVerifyIgnore: []string{"service_auth_401_redirect", "destinations", "enable_binding_cookie", "options_preflight_bypass", "self_hosted_domains", "tags", "auto_redirect_to_identity"},
ImportStateVerifyIgnore: []string{"service_auth_401_redirect", "destinations", "self_hosted_domains", "tags", "auto_redirect_to_identity"},
},
// Verify no plan drift after import — enable_binding_cookie, options_preflight_bypass,
// and cors_headers must not show false -> null changes for mcp/mcp_portal types.
{
Config: testAccCloudflareAccessApplicationMCPConfig(rnd, domain, accountID),
PlanOnly: true,
Config: testAccCloudflareAccessApplicationMCPConfig(rnd, domain, accountID),
PlanOnly: true,
ExpectNonEmptyPlan: false,
},
},
})
Expand Down
3 changes: 3 additions & 0 deletions internal/services/zero_trust_access_application/schema.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ func ResourceSchema(ctx context.Context) schema.Schema {
},
"options_preflight_bypass": schema.BoolAttribute{
Description: "Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.",
Computed: true,
Optional: true,
Validators: []validator.Bool{
customvalidator.RequiresOtherStringAttributeToBeOneOf(path.MatchRoot("type"), selfHostedAppTypes...),
Expand Down Expand Up @@ -174,6 +175,7 @@ func ResourceSchema(ctx context.Context) schema.Schema {
ElementType: types.StringType,
},
"cors_headers": schema.SingleNestedAttribute{
Computed: true,
Optional: true,
Validators: []validator.Object{
customvalidator.RequiresOtherStringAttributeToBeOneOf(path.MatchRoot("type"), selfHostedAppTypes...),
Expand Down Expand Up @@ -479,6 +481,7 @@ func ResourceSchema(ctx context.Context) schema.Schema {
},
"enable_binding_cookie": schema.BoolAttribute{
Description: "Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.",
Computed: true,
Optional: true,
Validators: []validator.Bool{
customvalidator.RequiresOtherStringAttributeToBeOneOf(path.MatchRoot("type"), selfHostedAppTypes...),
Expand Down