From dac42524f5037c796187c77ba49367b964b03e9f Mon Sep 17 00:00:00 2001
From: Serge Smertin <259697+nfx@users.noreply.github.com>
Date: Fri, 22 Apr 2022 12:52:36 +0200
Subject: [PATCH] Delete permissions resource for auto-purged cluster (#1252)

Fix #1227
---
 permissions/resource_permissions.go      | 10 ++++++++++
 permissions/resource_permissions_test.go | 23 +++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/permissions/resource_permissions.go b/permissions/resource_permissions.go
index 9d56ff433a..b043a69caf 100644
--- a/permissions/resource_permissions.go
+++ b/permissions/resource_permissions.go
@@ -203,6 +203,16 @@ func (a PermissionsAPI) Delete(objectID string) error {
 // Read gets all relevant permissions for the object, including inherited ones
 func (a PermissionsAPI) Read(objectID string) (objectACL ObjectACL, err error) {
 	err = a.client.Get(a.context, urlPathForObjectID(objectID), nil, &objectACL)
+	apiErr, ok := err.(common.APIError)
+	// https://github.com/databrickslabs/terraform-provider-databricks/issues/1227
+	// platform propagates INVALID_STATE error for auto-purged clusters in 
+	// the permissions api. this adds "a logical fix" also here, not to introduce
+	// cross-package dependency on "clusters".
+	if ok && strings.Contains(apiErr.Message, "Cannot access cluster") {
+		apiErr.StatusCode = 404
+		err = apiErr
+		return
+	}
 	return
 }
 
diff --git a/permissions/resource_permissions_test.go b/permissions/resource_permissions_test.go
index 77787da68b..af7fd2f7eb 100644
--- a/permissions/resource_permissions_test.go
+++ b/permissions/resource_permissions_test.go
@@ -98,6 +98,29 @@ func TestResourcePermissionsRead(t *testing.T) {
 	assert.Equal(t, "CAN_READ", firstElem["permission_level"])
 }
 
+// https://github.com/databrickslabs/terraform-provider-databricks/issues/1227
+func TestResourcePermissionsRead_RemovedCluster(t *testing.T) {
+	qa.ResourceFixture{
+		Fixtures: []qa.HTTPFixture{
+			me,
+			{
+				Method:   http.MethodGet,
+				Resource: "/api/2.0/permissions/clusters/abc",
+				Status:   400,
+				Response: common.APIError{
+					ErrorCode: "INVALID_STATE",
+					Message:   "Cannot access cluster X that was terminated or unpinned more than Y days ago.",
+				},
+			},
+		},
+		Resource: ResourcePermissions(),
+		Read:     true,
+		New:      true,
+		Removed:  true,
+		ID:       "/clusters/abc",
+	}.ApplyNoError(t)
+}
+
 func TestResourcePermissionsRead_SQLA_Asset(t *testing.T) {
 	d, err := qa.ResourceFixture{
 		Fixtures: []qa.HTTPFixture{