Repository navigation
Adds TFC_CLOUD_ORGANIZATION and TF_WORKSPACE Terraform env defaults for search tools - #564
Closed
sowju-hashicorp wants to merge 16 commits into
Closed
sowju-hashicorp wants to merge 16 commits into
sowju-hashicorp wants to merge 16 commits into
Conversation
## Description This PR hardens provider schema discovery and aligns it with the other HCP Terraform Search tools. Provider catalog and schema requests now use the session-scoped `go-tfe` client instead of manually extracting tokens and constructing authenticated HTTP requests. Each request validates access to the supplied workspace before calling the provider endpoint. ## Changes - Validate the organization and workspace before fetching provider data. - Stop before the provider endpoint when workspace lookup fails. - Use the shared session TFE client for provider catalog and schema requests. - Safely encode provider path segments and organization query parameters. - Mark `provider_list_schema_list` as an open-world tool. - Consolidate duplicated search tool error handling. - Remove the now-unused context token helper and manual HTTP request code. - Add handler-level tests for successful and failed workspace validation. ## Testing - `go test ./pkg/tools/search ./pkg/client` - `git diff --check sowju/finding_resources...HEAD` ## Rollback Revert this PR. No migrations, persistent data changes, or configuration changes are required. ## Security impact No security controls are added or removed. Provider requests continue to use the authenticated session client, and workspace access is now verified before accessing the provider catalog. The change also removes duplicate bearer-token handling. ## PCI review checklist <!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 --> - [x] I have documented a clear reason for, and description of, the change I am making. - [x] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request. - [x] If applicable, I've documented the impact of any changes to security controls.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Partial environment configuration can combine mismatched organization and workspace scopes and exposes an inconsistent schema contract.
3 open findings
What changed in this PR
Adds environment-based organization and workspace defaults to HCP Terraform search tools.
Changes:
- Shares environment-first scope resolution between search tools.
- Exposes environment values through MCP schemas.
- Adds scope-resolution and schema tests.
| File | Description |
|---|---|
pkg/tools/search/provider_list_schema_list.go |
Adds environment-backed scope resolution and defaults. |
pkg/tools/search/provider_list_schema_list_test.go |
Tests scope precedence and missing scope handling. |
pkg/tools/search/execute_query.go |
Applies shared scope resolution to query execution. |
pkg/tools/search/execute_query_test.go |
Updates tool-definition expectations. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+57
to
+58
| if organizationName != "" { | ||
| organizationOptions = append(organizationOptions, mcp.DefaultString(organizationName)) |
Author
There was a problem hiding this comment.
This is intended if one variable is not set. Please prompt the user
Comment on lines
+48
to
+49
| if organizationName != "" { | ||
| organizationOptions = append(organizationOptions, mcp.DefaultString(organizationName)) |
Author
There was a problem hiding this comment.
This is intended if one variable is not set. Please prompt the user
Comment on lines
+123
to
+133
| func resolveSearchScope(request mcp.CallToolRequest) (string, string) { | ||
| orgName := strings.TrimSpace(os.Getenv("TF_CLOUD_ORGANIZATION")) | ||
| if orgName == "" { | ||
| orgName = strings.TrimSpace(request.GetString("organization_name", "")) | ||
| } | ||
| workspaceName := strings.TrimSpace(os.Getenv("TF_WORKSPACE")) | ||
| if workspaceName == "" { | ||
| workspaceName = strings.TrimSpace(request.GetString("workspace_name", "")) | ||
| } | ||
| return orgName, workspaceName | ||
| } |
sowju-hashicorp
force-pushed
the
sowju/adds_env_defaults
branch
from
October 9, 2026 00:04
e024dd1 to
2634e1d
Compare
mjyocca
force-pushed
the
sowju/finding_resources
branch
from
October 12, 2026 17:24
f287512 to
5e9c89e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Uses
TF_CLOUD_ORGANIZATIONandTF_WORKSPACEas the default query scope for the HCP Terraform Search workflow.This prevents
provider_list_schema_listandexecute_queryfrom unnecessarily stopping to request organization and workspace values when they are already configured in the environment.Changes
TF_CLOUD_ORGANIZATIONandTF_WORKSPACE.provider_list_schema_listandexecute_query.Testing
go test ./pkg/tools/searchRollback
Revert this PR. No migrations, persistent data changes, or additional cleanup are required.
Security impact
No security controls are added or removed. Organization and workspace scope remain mandatory before provider schemas are fetched or queries are executed. Existing authenticated session and workspace-access validation remain unchanged.
PCI review checklist
I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.