Merge branch 'state-lock-delete-validation' into 'master'

Prevent locked Terraform states from being deleted

See merge request gitlab-org/gitlab!50798

app/models/terraform/state.rb

@@ -27,6 +27,8 @@ module Terraform
     validates :uuid, presence: true, uniqueness: true, length: { is: UUID_LENGTH },
               format: { with: HEX_REGEXP, message: 'only allows hex characters' }
 
+    before_destroy :ensure_state_is_unlocked
+
     default_value_for(:uuid, allows_nil: false) { SecureRandom.hex(UUID_LENGTH / 2) }
 
     def latest_file
@@ -87,6 +89,13 @@ module Terraform
       new_version.save!
     end
 
+    def ensure_state_is_unlocked
+      return unless locked?
+
+      errors.add(:base, s_("Terraform|You cannot remove the State file because it's locked. Unlock the State file first before removing it."))
+      throw :abort # rubocop:disable Cop/BanCatchThrow
+    end
+
     def parse_serial(file)
       Gitlab::Json.parse(file)["serial"]
     rescue JSON::ParserError

changelogs/unreleased/state-lock-delete-validation.yml

+---
+title: Prevent locked Terraform states from being deleted
+merge_request: 50798
+author:
+type: changed

locale/gitlab.pot

@@ -27549,6 +27549,9 @@ msgstr ""
 msgid "Terraform|You are about to remove the State file %{name}. This will permanently delete all the State versions and history. The infrastructure provisioned previously\twill remain intact, only the state file with all its versions are to be removed. This action is non-revertible."
 msgstr ""
 
+msgid "Terraform|You cannot remove the State file because it's locked. Unlock the State file first before removing it."
+msgstr ""
+
 msgid "Test"
 msgstr ""
 

spec/models/terraform/state_spec.rb

@@ -27,6 +27,22 @@ RSpec.describe Terraform::State do
     end
   end
 
+  describe '#destroy' do
+    let(:terraform_state) { create(:terraform_state) }
+    let(:user) { terraform_state.project.creator }
+
+    it 'deletes when the state is unlocked' do
+      expect(terraform_state.destroy).to be_truthy
+    end
+
+    it 'fails to delete when the state is locked', :aggregate_failures do
+      terraform_state.update!(lock_xid: SecureRandom.uuid, locked_by_user: user, locked_at: Time.current)
+
+      expect(terraform_state.destroy).to be_falsey
+      expect(terraform_state.errors.full_messages).to eq(["You cannot remove the State file because it's locked. Unlock the State file first before removing it."])
+    end
+  end
+
   describe '#latest_file' do
     let(:terraform_state) { create(:terraform_state, :with_version) }
     let(:latest_version) { terraform_state.latest_version }