[Bug] Temporal Cloud User with no namespace access

[DmytroRomantsovM]

What are you really trying to do?

Create a Temporal Cloud User with no namespace access and read account access.

Describe the bug

Terrafrom returned the following error:

temporalcloud_user.user: Creating...
╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to temporalcloud_user.user, provider
│ "provider["registry.terraform.io/temporalio/temporalcloud"]" produced an
│ unexpected new value: .namespace_accesses: was
│ cty.ListValEmpty(cty.Object(map[string]cty.Type{"namespace_id":cty.String,
│ "permission":cty.String})), but now null.
│
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.

Minimal Reproduction

1. Create terraform deployment with one Temporal Cloud User
   For example:
   resource "temporalcloud_user" "user" {
   account_access = "read"
   email = "[email protected]"
   namespace_accesses = []
   }
2. Apply the changes.
3. The error also appears during the destruction of the resource.

Environment/Versions

• OS and processor: M2 Pro Mac
• Temporal Version: Terraform provider: registry.terraform.io/temporalio/temporalcloud: 0.0.11

[DmytroRomantsovM]

Another approach is to specify all namespaces, which also gives an error:

Terraform plan:

 # temporalcloud_user.user["[email protected]"] will be created
  + resource "temporalcloud_user" "user" {
      + account_access     = "admin"
      + email              = "[email protected]"
      + id                 = (known after apply)
      + namespace_accesses = [
          + {
              + namespace_id = "qa-svc-eu01-temporal-hello-world.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "miro-poc.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "prod-eu01-teleport-access-automation.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "qa-svc-eu01-temporal-hello-world.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "staging-eu01-temporal-hello-world.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "staging-eu01-temporal-nexus-1.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "staging-eu01-temporal-nexus-2.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-org-id-bf-production-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-org-id-bf-production-us.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-org-id-bf-staging-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-production-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-production-us.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-qa-svc-eu.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-staging-au01.muvq0"
              + permission   = "admin"
            },
          + {
              + namespace_id = "temporal-pg-repack-staging-eu.muvq0"
              + permission   = "admin"
            },
        ]
      + state              = (known after apply)
    }

Terraform apply:

temporalcloud_user.user["[email protected]"]: Creating...
╷
│ Error: Failed to create user
│ 
│   with temporalcloud_user.user["[email protected]"],
│   on main.tf line 19, in resource "temporalcloud_user" "user":
│   19: resource "temporalcloud_user" "user" {
│ 
│ rpc error: code = InvalidArgument desc = may not be assigned an account
│ admin role along with namespace permissions (type: bad-request, retryable:
│ false)
╵