Demonstrate how the operator can cause a cycle error with okta_brand and

okta_email_domain resources.

Closes #1824

okta/resource_okta_brand_test.go

@@ -2,6 +2,7 @@ package okta
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -55,3 +56,86 @@ resource okta_brand test{
 		},
 	})
 }
+
+// TestAccResourceOktaBrand_Issue_1824_with_email_domain addresses issue
+// https://github.com/okta/terraform-provider-okta/issues/1824 . This test was
+// broken, then the brand resource was fixed to make the test pass.
+func TestAccResourceOktaBrand_Issue_1824_with_email_domain(t *testing.T) {
+	mgr := newFixtureManager("resources", brand, t.Name())
+	resourceName := fmt.Sprintf("%s.test", brand)
+	step1 := `
+resource okta_brand test{
+	name = "testAcc-replace_with_uuid"
+	locale = "en"
+}`
+	step2 := `
+resource okta_brand test{
+	name = "testAcc-replace_with_uuid"
+	locale = "en"
+}
+# HERE when email domain is created, the next time the brand resource is
+# refreshed it will now have an email_domain_id and will trigger change
+# detection.
+resource "okta_email_domain" "test" {
+	brand_id     = okta_brand.test.id
+	domain       = "testAcc-replace_with_uuid.example.com"
+	display_name = "test"
+	user_name    = "fff"
+}`
+	step3 := `
+resource okta_brand test{
+	name = "testAcc-replace_with_uuid"
+	locale = "en"
+	email_domain_id = okta_email_domain.test.id
+}
+resource "okta_email_domain" "test" {
+	brand_id     = okta_brand.test.id
+	domain       = "testAcc-replace_with_uuid.example.com"
+	display_name = "test"
+	user_name    = "fff"
+}`
+
+	oktaResourceTest(t, resource.TestCase{
+		PreCheck:                 testAccPreCheck(t),
+		ErrorCheck:               testAccErrorChecks(t),
+		ProtoV5ProviderFactories: testAccMergeProvidersFactories,
+		Steps: []resource.TestStep{
+			{
+				// Step 1
+				// Create okta_brand.test
+				Config: mgr.ConfigReplace(step1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckNoResourceAttr(resourceName, "email_domain_id"),
+				),
+			},
+			{
+				// Step 2
+				// Create okta_email_domain.test with a brand_id from okta_brand.test.id
+				// Upon refresh, okta_brand.test will have change detection as the Okta API will
+				// reflect the brand having an email_domain_id value.
+				Config: mgr.ConfigReplace(step2),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckNoResourceAttr(resourceName, "email_domain_id"),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			{
+				// Step 3
+				// Here, when we destroy okta_email_domain.test Terraform runtime will have a cyclic error
+				Config: mgr.ConfigReplace(step3),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrSet(resourceName, "email_domain_id"),
+				),
+				ExpectError: regexp.MustCompile(`.*Cycle: okta_email_domain.test, okta_brand.test.*`),
+			},
+			{
+				// Step 4
+				// Rolling back to just having a brand resource after the operator unwound the cyclic error.
+				Config: mgr.ConfigReplace(step1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckNoResourceAttr(resourceName, "email_domain_id"),
+				),
+			},
+		},
+	})
+}