fix(api_token): migrate permission_groups data source references instead of extracting map keys

integration/v4_to_v5/testdata/api_token/expected/api_token.tf

@@ -187,6 +187,8 @@ resource "cloudflare_api_token" "full_example" {
 }
 
 # Test Case 8: Token with data reference and timestamps
+data "cloudflare_api_token_permission_groups_list" "all" {}
+
 resource "cloudflare_api_token" "api_token_create" {
   name = "${local.name_prefix} api_token_create"
 

internal/datasources/api_token_permission_groups/v4_to_v5.go

@@ -0,0 +1,54 @@
+package api_token_permission_groups
+
+import (
+	"github.com/hashicorp/hcl/v2/hclwrite"
+
+	"github.com/cloudflare/tf-migrate/internal"
+	"github.com/cloudflare/tf-migrate/internal/transform"
+	tfhcl "github.com/cloudflare/tf-migrate/internal/transform/hcl"
+)
+
+// V4ToV5Migrator handles the cloudflare_api_token_permission_groups data source.
+//
+// In v4, this data source returns a map of permission names to IDs (e.g.
+// data.cloudflare_api_token_permission_groups.all.permissions["DNS Read"]).
+//
+// In v5, this data source was replaced by cloudflare_api_token_permission_groups_list,
+// which returns a list of objects with id/name/scopes fields. The migrator renames
+// the block so that the data source is still available for reference resolution.
+//
+// Any expression references in cloudflare_api_token.permission_groups that use the
+// old map-style lookups are rewritten by the api_token resource migrator to use
+// for-expressions against the new list-style data source.
+type V4ToV5Migrator struct{}
+
+// NewV4ToV5Migrator creates a new migrator for the
+// cloudflare_api_token_permission_groups datasource (v4 → v5).
+func NewV4ToV5Migrator() transform.ResourceTransformer {
+	migrator := &V4ToV5Migrator{}
+	internal.RegisterMigrator("data.cloudflare_api_token_permission_groups", "v4", "v5", migrator)
+	return migrator
+}
+
+func (m *V4ToV5Migrator) GetResourceType() string {
+	return "cloudflare_api_token_permission_groups"
+}
+
+func (m *V4ToV5Migrator) CanHandle(resourceType string) bool {
+	return resourceType == "data.cloudflare_api_token_permission_groups"
+}
+
+func (m *V4ToV5Migrator) Preprocess(content string) string {
+	return content
+}
+
+// TransformConfig renames the data source block from
+// cloudflare_api_token_permission_groups to cloudflare_api_token_permission_groups_list.
+func (m *V4ToV5Migrator) TransformConfig(ctx *transform.Context, block *hclwrite.Block) (*transform.TransformResult, error) {
+	tfhcl.RenameResourceType(block, "cloudflare_api_token_permission_groups", "cloudflare_api_token_permission_groups_list")
+
+	return &transform.TransformResult{
+		Blocks:         []*hclwrite.Block{block},
+		RemoveOriginal: false,
+	}, nil
+}

internal/registry/registry.go

@@ -3,6 +3,7 @@ package registry
 import (
 	accountrolesdata "github.com/cloudflare/tf-migrate/internal/datasources/account_roles"
 	accountsdata "github.com/cloudflare/tf-migrate/internal/datasources/accounts"
+	apitokenpermgroupsdata "github.com/cloudflare/tf-migrate/internal/datasources/api_token_permission_groups"
 	lbpoolsdata "github.com/cloudflare/tf-migrate/internal/datasources/load_balancer_pools"
 	rulesetsdata "github.com/cloudflare/tf-migrate/internal/datasources/rulesets"
 	zonedata "github.com/cloudflare/tf-migrate/internal/datasources/zone"
@@ -97,6 +98,7 @@ func RegisterAllMigrations() {
 	// Datasources
 	accountrolesdata.NewV4ToV5Migrator()
 	accountsdata.NewV4ToV5Migrator()
+	apitokenpermgroupsdata.NewV4ToV5Migrator()
 	lbpoolsdata.NewV4ToV5Migrator()
 	rulesetsdata.NewV4ToV5Migrator()
 	zonedata.NewV4ToV5Migrator()