ephemeral: add WriteOnlyAttributesAllowed client capability

we allow it for all requests

docs/plugin-protocol/tfplugin5.8.proto

@@ -166,6 +166,10 @@ message ClientCapabilities {
     // The deferral_allowed capability signals that the client is able to
     // handle deferred responses from the provider.
     bool deferral_allowed = 1;
+
+    // The write_only_attributes_allowed capability signals that the client
+    // is able to handle write_only attributes for managed resources.
+    bool write_only_attributes_allowed = 2;
 }
 
 message Function {

docs/plugin-protocol/tfplugin6.8.proto

@@ -241,6 +241,10 @@ message ClientCapabilities {
     // The deferral_allowed capability signals that the client is able to
     // handle deferred responses from the provider.
     bool deferral_allowed = 1;
+    
+    // The write_only_attributes_allowed capability signals that the client
+    // is able to handle write_only attributes for managed resources.
+    bool write_only_attributes_allowed = 2;
 }
 
 // Deferred is a message that indicates that change is deferred for a reason.

internal/plugin6/grpc_provider.go

@@ -345,7 +345,8 @@ func (p *GRPCProvider) ConfigureProvider(r providers.ConfigureProviderRequest) (
 			Msgpack: mp,
 		},
 		ClientCapabilities: &proto6.ClientCapabilities{
-			DeferralAllowed: r.ClientCapabilities.DeferralAllowed,
+			DeferralAllowed:            r.ClientCapabilities.DeferralAllowed,
+			WriteOnlyAttributesAllowed: r.ClientCapabilities.WriteOnlyAttributesAllowed,
 		},
 	}
 

internal/providers/provider.go

@@ -166,6 +166,10 @@ type ClientCapabilities struct {
 	// The deferral_allowed capability signals that the client is able to
 	// handle deferred responses from the provider.
 	DeferralAllowed bool
+
+	// The write_only_attributes_allowed capability signals that the client
+	// is able to handle write_only attributes for managed resources.
+	WriteOnlyAttributesAllowed bool
 }
 
 type ValidateProviderConfigRequest struct {

internal/stacks/stackruntime/internal/stackeval/provider_instance.go

@@ -259,7 +259,8 @@ func (p *ProviderInstance) CheckClient(ctx context.Context, phase EvalPhase) (pr
 				TerraformVersion: version.SemVer.String(),
 				Config:           unmarkedArgs,
 				ClientCapabilities: providers.ClientCapabilities{
-					DeferralAllowed: true,
+					DeferralAllowed:            true,
+					WriteOnlyAttributesAllowed: true,
 				},
 			})
 			diags = diags.Append(resp.Diagnostics)

internal/stacks/stackruntime/internal/stackeval/provider_instance_test.go

@@ -384,7 +384,8 @@ func TestProviderInstanceCheckClient(t *testing.T) {
 					"test": cty.StringVal("yep"),
 				}),
 				ClientCapabilities: providers.ClientCapabilities{
-					DeferralAllowed: true,
+					DeferralAllowed:            true,
+					WriteOnlyAttributesAllowed: true,
 				},
 			}
 			if diff := cmp.Diff(want, got, ctydebug.CmpOptions); diff != "" {
@@ -426,7 +427,8 @@ func TestProviderInstanceCheckClient(t *testing.T) {
 					"test": cty.StringVal("yep"),
 				}),
 				ClientCapabilities: providers.ClientCapabilities{
-					DeferralAllowed: true,
+					DeferralAllowed:            true,
+					WriteOnlyAttributesAllowed: true,
 				},
 			}
 			if diff := cmp.Diff(want, got, ctydebug.CmpOptions); diff != "" {

internal/terraform/context_plan_test.go

@@ -1762,6 +1762,10 @@ func TestContext2Plan_blockNestingGroup(t *testing.T) {
 				"baz": cty.NullVal(cty.String),
 			}),
 		}),
+		ClientCapabilities: providers.ClientCapabilities{
+			DeferralAllowed:            false,
+			WriteOnlyAttributesAllowed: true,
+		},
 	}
 	if !cmp.Equal(got, want, valueTrans) {
 		t.Errorf("wrong PlanResourceChange request\n%s", cmp.Diff(got, want, valueTrans))

internal/terraform/eval_context_builtin.go

@@ -228,7 +228,8 @@ func (ctx *BuiltinEvalContext) ConfigureProvider(addr addrs.AbsProviderConfig, c
 		TerraformVersion: version.String(),
 		Config:           cfg,
 		ClientCapabilities: providers.ClientCapabilities{
-			DeferralAllowed: ctx.Deferrals().DeferralAllowed(),
+			DeferralAllowed:            ctx.Deferrals().DeferralAllowed(),
+			WriteOnlyAttributesAllowed: true,
 		},
 	}
 

internal/terraform/node_resource_abstract_instance.go

@@ -439,7 +439,8 @@ func (n *NodeAbstractResourceInstance) planDestroy(ctx EvalContext, currentState
 			PriorPrivate:     currentState.Private,
 			ProviderMeta:     metaConfigVal,
 			ClientCapabilities: providers.ClientCapabilities{
-				DeferralAllowed: deferralAllowed,
+				DeferralAllowed:            deferralAllowed,
+				WriteOnlyAttributesAllowed: true,
 			},
 		})
 		deferred = resp.Deferred
@@ -639,7 +640,8 @@ func (n *NodeAbstractResourceInstance) refresh(ctx EvalContext, deposedKey state
 			Private:      state.Private,
 			ProviderMeta: metaConfigVal,
 			ClientCapabilities: providers.ClientCapabilities{
-				DeferralAllowed: deferralAllowed,
+				DeferralAllowed:            deferralAllowed,
+				WriteOnlyAttributesAllowed: true,
 			},
 		})
 
@@ -928,7 +930,8 @@ func (n *NodeAbstractResourceInstance) plan(
 			PriorPrivate:     priorPrivate,
 			ProviderMeta:     metaConfigVal,
 			ClientCapabilities: providers.ClientCapabilities{
-				DeferralAllowed: deferralAllowed,
+				DeferralAllowed:            deferralAllowed,
+				WriteOnlyAttributesAllowed: true,
 			},
 		})
 		// If we don't support deferrals, but the provider reports a deferral and does not
@@ -1101,7 +1104,8 @@ func (n *NodeAbstractResourceInstance) plan(
 				PriorPrivate:     plannedPrivate,
 				ProviderMeta:     metaConfigVal,
 				ClientCapabilities: providers.ClientCapabilities{
-					DeferralAllowed: deferralAllowed,
+					DeferralAllowed:            deferralAllowed,
+					WriteOnlyAttributesAllowed: true,
 				},
 			})
 
@@ -1548,7 +1552,8 @@ func (n *NodeAbstractResourceInstance) readDataSource(ctx EvalContext, configVal
 			Config:       configVal,
 			ProviderMeta: metaConfigVal,
 			ClientCapabilities: providers.ClientCapabilities{
-				DeferralAllowed: deferralAllowed,
+				DeferralAllowed:            deferralAllowed,
+				WriteOnlyAttributesAllowed: true,
 			},
 		})
 

internal/terraform/node_resource_import.go

@@ -106,7 +106,8 @@ func (n *graphNodeImportState) Execute(ctx EvalContext, op walkOperation) (diags
 		TypeName: n.Addr.Resource.Resource.Type,
 		ID:       n.ID,
 		ClientCapabilities: providers.ClientCapabilities{
-			DeferralAllowed: false,
+			DeferralAllowed:            false,
+			WriteOnlyAttributesAllowed: true,
 		},
 	})
 	diags = diags.Append(resp.Diagnostics)

internal/terraform/node_resource_plan_instance.go

@@ -652,7 +652,8 @@ func (n *NodePlannableResourceInstance) importState(ctx EvalContext, addr addrs.
 			TypeName: addr.Resource.Resource.Type,
 			ID:       importId,
 			ClientCapabilities: providers.ClientCapabilities{
-				DeferralAllowed: deferralAllowed,
+				DeferralAllowed:            deferralAllowed,
+				WriteOnlyAttributesAllowed: true,
 			},
 		})
 	}