feat: migrate zero_trust_access_group migrations

[tamas-jozsa]

Summary

Implements comprehensive v4→v5 migration support for zero trust access group resources,
handling both configuration syntax transformations and state schema upgrades for the breaking
changes in rule structure.

• ✅ Config Migration: HCL AST transformations from v4 array-based to v5 object-based rules
• ✅ State Upgrades: Schema version 0→1 upgrade with complete rule restructuring
• ✅ Provider Rules: Complex identity provider transformations (Azure AD, GitHub, GSuite,
  Okta)
• ✅ Migration Tests: Comprehensive test coverage for all transformation scenarios
• ✅ Plan Validation: Custom ordering-aware plan checks for post-migration validation

Migration Scenarios Covered

v4 Rule Format	v5 Result	Migration Type
email = ["[email protected]", "[email protected]"]	Multiple `email = { email =
"[email protected]" }` objects	Array expansion
everyone = true, certificate = true	Separate everyone = {}, certificate = {} objects
Boolean to empty objects
azure = [{ id = ["group1", "group2"] }]	Multiple azure_ad = { id = "group1" } objects
Provider rename + expansion
github = [{ teams = ["team1", "team2"] }]	Multiple `github_organization = { team =
"team1" }` objects	Provider rename + expansion
common_names = ["cert1", "cert2"]	Multiple common_name = { common_name = "cert1" }
objects	Attribute rename + expansion

Key Changes

Config Transformation (cmd/migrate/zero_trust_access_group.go)

• Comprehensive HCL AST transformation handling all v4→v5 rule format changes
• Processes include, exclude, and require rule blocks consistently
• Expands array-based attributes into individual rule objects with nested structures
• Handles complex identity provider block transformations with array expansion
• Maintains deterministic ordering matching state migration for consistency

State Upgrade Functions (internal/services/zero_trust_access_group/migrations.go)

• Implements ResourceWithUpgradeState interface for v0→v1 schema migration
• Handles JSON state parsing and transformation to new v5 structure
• Creates clean rule objects with only relevant fields initialized
• Processes migration in fixed order to ensure deterministic results
• Supports both account-scoped and zone-scoped access groups

Migration Tests (internal/services/zero_trust_access_group/migrations_test.go)

• 8 comprehensive test scenarios covering all transformation types
• Uses modern Terraform testing patterns with statecheck and knownvalue assertions
• Tests basic rules, complex expansions, identity providers, and mixed scenarios
• Validates both config transformation and state migration in 3-step process
• Includes zone-scoped testing for complete coverage

Custom Test Helpers (internal/acctest/zero_trust_access_group.go)

• ExpectEmptyPlanExceptZeroTrustAccessGroupOrdering - Custom plan checker
• Handles expected ordering differences between v4 and v5 rule representations
• Allows provider migration artifacts while catching actual configuration drift
• ZeroTrustAccessGroupMigrationTestStep - Specialized migration test helper

Schema Definition (internal/services/zero_trust_access_group/schema.go)

• Schema version bumped to 1 with v0 schema preserved for migration
• Object size validators ensuring each rule object contains exactly one rule type
• Comprehensive attribute coverage for all supported identity providers and rule types

Test Results

All migration tests passing with proper validation of:

• Array expansion (emails, IPs, domains) → individual nested objects
• Boolean transformation (everyone, certificate) → empty objects
• Identity provider expansion (Azure AD, GitHub, GSuite, Okta) with team/group arrays
• Resource name transformation (azure→azure_ad, github→github_organization)
• Mixed complex scenarios with include/exclude/require combinations

The migration maintains full backward compatibility while enabling the new v5 object-based rule
structure that provides better type safety and validation.

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

Additional context & links