[Bug] Temporal Cloud User with no namespace access

[DmytroRomantsovM]

What are you really trying to do?

Create a Temporal Cloud User with no namespace access and read account access.

Describe the bug

Terrafrom returned the following error:

temporalcloud_user.user: Creating... ╷ │ Error: Provider produced inconsistent result after apply │ │ When applying changes to temporalcloud_user.user, provider │ "provider[\"registry.terraform.io/temporalio/temporalcloud\"]" produced an │ unexpected new value: .namespace_accesses: was │ cty.ListValEmpty(cty.Object(map[string]cty.Type{"namespace_id":cty.String, │ "permission":cty.String})), but now null. │ │ This is a bug in the provider, which should be reported in the provider's │ own issue tracker.

Minimal Reproduction

1. Create terraform deployment with one Temporal Cloud User For example: resource "temporalcloud_user" "user" { account_access = "read" email = "test3@email.com" namespace_accesses = [] }
2. Apply the changes.
3. The error also appears during the destruction of the resource.

Environment/Versions

• OS and processor: M2 Pro Mac
• Temporal Version: Terraform provider: registry.terraform.io/temporalio/temporalcloud: 0.0.11

[DmytroRomantsovM]

Another approach is to specify all namespaces, which also gives an error:

Terraform plan:

 # temporalcloud_user.user["user@emal.com"] will be created
  + resource "temporalcloud_user" "user" {
      + account_access     = "admin"
      + email              = "user@emal.com"
      + id                 = (known after apply)
      + namespace_accesses = [
          + {
              + namespace_id = "qa-svc-eu01-temporal-hello-world.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "miro-poc.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "prod-eu01-teleport-access-automation.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "qa-svc-eu01-temporal-hello-world.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "staging-eu01-temporal-hello-world.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "staging-eu01-temporal-nexus-1.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "staging-eu01-temporal-nexus-2.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-org-id-bf-production-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-org-id-bf-production-us.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-org-id-bf-staging-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-production-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-production-us.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-qa-svc-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-staging-au01.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-staging-eu.muvq0"
              + permission   = "admin"
            },
        ]
      + state              = (known after apply)
    }

Terraform apply:

temporalcloud_user.user["user@emal.com"]: Creating...
╷
│ Error: Failed to create user
│ 
│   with temporalcloud_user.user["user@emal.com"],
│   on main.tf line 19, in resource "temporalcloud_user" "user":
│   19: resource "temporalcloud_user" "user" {
│ 
│ rpc error: code = InvalidArgument desc = may not be assigned an account
│ admin role along with namespace permissions (type: bad-request, retryable:
│ false)
╵