From bfbeee9592a782894f543c5d791289c03d3e82eb Mon Sep 17 00:00:00 2001
From: James Bardin <j.bardin@gmail.com>
Date: Wed, 19 Feb 2025 12:57:15 -0500
Subject: [PATCH] wo attrs can be null, but cannot traverse null

There were two existing tests for incorrect return values, which the
code still satisfied. While we can return paths _to_ null values which
are write-only, you cannot traverse a null value to a write-only path.
---
 internal/configs/configschema/write_only.go      | 11 +++++------
 internal/configs/configschema/write_only_test.go |  8 ++------
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/internal/configs/configschema/write_only.go b/internal/configs/configschema/write_only.go
index 0069cf6954..4a667f4e27 100644
--- a/internal/configs/configschema/write_only.go
+++ b/internal/configs/configschema/write_only.go
@@ -19,7 +19,11 @@ import (
 func (b *Block) WriteOnlyPaths(val cty.Value, basePath cty.Path) []cty.Path {
 	var ret []cty.Path
 
-	// We can mark attributes as write-only even if the value is null
+	// the value as a whole cannot be write-only, so nothing to return
+	if val.IsNull() || !val.IsKnown() {
+		return ret
+	}
+
 	for name, attrS := range b.Attributes {
 		if attrS.WriteOnly {
 			attrPath := slices.Concat(basePath, cty.GetAttrPath(name))
@@ -27,11 +31,6 @@ func (b *Block) WriteOnlyPaths(val cty.Value, basePath cty.Path) []cty.Path {
 		}
 	}
 
-	// If the value is null, no other marks are possible
-	if val.IsNull() {
-		return ret
-	}
-
 	// Extract paths for marks from nested attribute type values
 	for name, attrS := range b.Attributes {
 		// If the attribute has no nested type, or the nested type doesn't
diff --git a/internal/configs/configschema/write_only_test.go b/internal/configs/configschema/write_only_test.go
index b122103615..538614f84b 100644
--- a/internal/configs/configschema/write_only_test.go
+++ b/internal/configs/configschema/write_only_test.go
@@ -115,15 +115,11 @@ func TestBlock_WriteOnlyPaths(t *testing.T) {
 	}{
 		"unknown value": {
 			cty.UnknownVal(schema.ImpliedType()),
-			[]cty.Path{
-				{cty.GetAttrStep{Name: "wo"}},
-			},
+			[]cty.Path{},
 		},
 		"null object": {
 			cty.NullVal(schema.ImpliedType()),
-			[]cty.Path{
-				{cty.GetAttrStep{Name: "wo"}},
-			},
+			[]cty.Path{},
 		},
 		"object with unknown attributes and blocks": {
 			cty.ObjectVal(map[string]cty.Value{