fix token exact handling

add tls skip to provider
fix provider data
2026-01-14 15:53:59 +01:00 · 2025-11-12 12:01:17 +01:00 · 2025-11-12 09:47:08 +01:00 · 2025-11-11 13:55:16 +01:00 · 2025-11-11 13:53:36 +01:00 · 2025-11-11 13:53:29 +01:00
5 changed files with 371 additions and 229 deletions
--- a/go.mod
+++ b/go.mod
@@ -1,30 +1,30 @@
 module terraform-provider-bitbucket-token

-go 1.22
+go 1.24.0

-require github.com/hashicorp/terraform-plugin-framework v1.9.0
+require github.com/hashicorp/terraform-plugin-framework v1.16.1

 require (
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/hashicorp/go-hclog v1.5.0 // indirect
-	github.com/hashicorp/go-plugin v1.6.0 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
+	github.com/hashicorp/go-plugin v1.7.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.23.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.29.0 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
+	github.com/hashicorp/terraform-registry-address v0.4.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
-	github.com/oklog/run v1.0.0 // indirect
+	github.com/oklog/run v1.2.0 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	golang.org/x/net v0.23.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de // indirect
-	google.golang.org/grpc v1.63.2 // indirect
-	google.golang.org/protobuf v1.34.0 // indirect
+	golang.org/x/net v0.46.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 // indirect
+	google.golang.org/grpc v1.76.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -1,70 +1,97 @@
-github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
-github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
-github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDmTk8A=
-github.com/hashicorp/go-plugin v1.6.0/go.mod h1:lBS5MtSSBZk0SHc66KACcjjlU6WzEVP/8pwz68aMkCI=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
+github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/terraform-plugin-framework v1.9.0 h1:caLcDoxiRucNi2hk8+j3kJwkKfvHznubyFsJMWfZqKU=
-github.com/hashicorp/terraform-plugin-framework v1.9.0/go.mod h1:qBXLDn69kM97NNVi/MQ9qgd1uWWsVftGSnygYG1tImM=
-github.com/hashicorp/terraform-plugin-go v0.23.0 h1:AALVuU1gD1kPb48aPQUjug9Ir/125t+AAurhqphJ2Co=
-github.com/hashicorp/terraform-plugin-go v0.23.0/go.mod h1:1E3Cr9h2vMlahWMbsSEcNrOCxovCZhOOIXjFHbjc/lQ=
+github.com/hashicorp/terraform-plugin-framework v1.16.1 h1:1+zwFm3MEqd/0K3YBB2v9u9DtyYHyEuhVOfeIXbteWA=
+github.com/hashicorp/terraform-plugin-framework v1.16.1/go.mod h1:0xFOxLy5lRzDTayc4dzK/FakIgBhNf/lC4499R9cV4Y=
+github.com/hashicorp/terraform-plugin-go v0.29.0 h1:1nXKl/nSpaYIUBU1IG/EsDOX0vv+9JxAltQyDMpq5mU=
+github.com/hashicorp/terraform-plugin-go v0.29.0/go.mod h1:vYZbIyvxyy0FWSmDHChCqKvI40cFTDGSb3D8D70i9GM=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
 github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-registry-address v0.2.3 h1:2TAiKJ1A3MAkZlH1YI/aTVcLZRu7JseiXNRHbOAyoTI=
-github.com/hashicorp/terraform-registry-address v0.2.3/go.mod h1:lFHA76T8jfQteVfT7caREqguFrW3c4MFSPhZB7HHgUM=
+github.com/hashicorp/terraform-registry-address v0.4.0 h1:S1yCGomj30Sao4l5BMPjTGZmCNzuv7/GDTDX99E9gTk=
+github.com/hashicorp/terraform-registry-address v0.4.0/go.mod h1:LRS1Ay0+mAiRkUyltGT+UHWkIqTFvigGn/LbMshfflE=
 github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
 github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
-github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
-github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
+github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
+github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
 github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
-github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
-github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/oklog/run v1.2.0 h1:O8x3yXwah4A73hJdlrwo/2X6J62gE5qTMusH0dvz60E=
+github.com/oklog/run v1.2.0/go.mod h1:mgDbKRSwPhJfesJ4PntqFUbKQRZ50NgmZTSPlFA0YFk=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de h1:cZGRis4/ot9uVm639a+rHCUaG0JJHEsdyzSQTMX+suY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:H4O17MA/PE9BsGx3w+a+W2VOLLD1Qf7oJneAoU6WktY=
-google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
-google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
-google.golang.org/protobuf v1.34.0 h1:Qo/qEd2RZPCf2nKuorzksSknv0d3ERwp1vFG38gSmH4=
-google.golang.org/protobuf v1.34.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 h1:tRPGkdGHuewF4UisLzzHHr1spKw92qLM98nIzxbC0wY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
+google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/main.go
+++ b/main.go
@@ -8,6 +8,6 @@ import (

 func main() {
 	providerserver.Serve(context.Background(), NewProvider, providerserver.ServeOpts{
-		Address: "local/bitbucket/token",
+		Address: "registry.terraform.io/ysoftdevs/bitbucket",
 	})
 }
--- a/provider.go
+++ b/provider.go
@@ -17,8 +17,9 @@ func NewProvider() provider.Provider {
 type bitbucketTokenProvider struct{}

 type bitbucketTokenProviderModel struct {
-	AuthHeader types.String `tfsdk:"auth_header"`
-	ServerURL  types.String `tfsdk:"server_url"`
+	AuthHeader    types.String `tfsdk:"auth_header"`
+	ServerURL     types.String `tfsdk:"server_url"`
+	TLSSkipVerify types.Bool   `tfsdk:"tls_skip_verify"`
 }

 func (p *bitbucketTokenProvider) Metadata(_ context.Context, _ provider.MetadataRequest, resp *provider.MetadataResponse) {
@@ -38,6 +39,10 @@ func (p *bitbucketTokenProvider) Schema(_ context.Context, _ provider.SchemaRequ
 				Description: "Base URL of the Bitbucket server (e.g. https://stash.example.com). Must not end with a slash.",
 				Required:    true,
 			},
+			"tls_skip_verify": schema.BoolAttribute{
+				Description: "If true, disables TLS certificate verification. Use only for testing or internal servers.",
+				Optional:    true,
+			},
 		},
 	}
 }
@@ -65,12 +70,10 @@ func (p *bitbucketTokenProvider) Configure(ctx context.Context, req provider.Con
 		return
 	}

-	serverURL := config.ServerURL.ValueString()
-	authHeader := config.AuthHeader.ValueString()
-
-	providerData := ProviderData{
-		AuthHeader: authHeader,
-		ServerURL:  serverURL,
+	providerData := &ProviderData{
+		AuthHeader:    config.AuthHeader.ValueString(),
+		ServerURL:     config.ServerURL.ValueString(),
+		TLSSkipVerify: config.TLSSkipVerify.ValueBool(), // <-- passes TLS flag through
 	}

 	resp.DataSourceData = providerData
--- a/resource_token.go
+++ b/resource_token.go
@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -14,165 +15,316 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 )

+// ProviderData contains configuration passed from the provider to the resource.
 type ProviderData struct {
-	AuthHeader string
-	ServerURL  string
+	AuthHeader    string
+	ServerURL     string
+	TLSSkipVerify bool
 }

+// BitbucketTokenResource manages Bitbucket repository access tokens.
 type BitbucketTokenResource struct {
-	authHeader string
-	serverURL  string
+	authHeader    string
+	serverURL     string
+	tlsSkipVerify bool
 }

 func NewBitbucketTokenResource() resource.Resource {
 	return &BitbucketTokenResource{}
 }

+// BitbucketTokenResourceModel maps Terraform schema attributes to Go fields.
 type BitbucketTokenResourceModel struct {
-	ID             types.String `tfsdk:"id"`
-	TokenName      types.String `tfsdk:"token_name"`
-	ProjectName    types.String `tfsdk:"project_name"`
-	RepositoryName types.String `tfsdk:"repository_name"`
-	Token          types.String `tfsdk:"token"`
+	ID                 types.String `tfsdk:"id"`
+	TokenName          types.String `tfsdk:"token_name"` // prefix provided by user
+	ProjectName        types.String `tfsdk:"project_name"`
+	RepositoryName     types.String `tfsdk:"repository_name"`
+	Token              types.String `tfsdk:"token"`                // secret; returned only on creation; preserved from state
+	CurrentTokenName   types.String `tfsdk:"current_token_name"`   // actual token identifier (prefix-epoch)
+	CurrentTokenExpiry types.Int64  `tfsdk:"current_token_expiry"` // ms since epoch
 }

-func (r *BitbucketTokenResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+// Metadata defines the Terraform resource type name.
+func (r *BitbucketTokenResource) Metadata(_ context.Context, _ resource.MetadataRequest, resp *resource.MetadataResponse) {
 	resp.TypeName = "bitbucket_token"
 }

-func (r *BitbucketTokenResource) Schema(_ context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+// Schema defines the Terraform resource schema.
+func (r *BitbucketTokenResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
 	resp.Schema = schema.Schema{
-		Description: "Manages Bitbucket access tokens for a repository.",
+		Description: "Manages Bitbucket access tokens for a repository. The token secret is only returned when created and is preserved in state for reuse while valid.",
 		Attributes: map[string]schema.Attribute{
 			"id": schema.StringAttribute{
 				Computed: true,
 			},
 			"token_name": schema.StringAttribute{
-				Description: "Name prefix for the Bitbucket access token.",
+				Description: "Name prefix for the Bitbucket access token. Actual token will be created as '<prefix>-<epoch_ms>'.",
 				Required:    true,
 			},
 			"project_name": schema.StringAttribute{
-				Description: "Name of the Bitbucket project.",
+				Description: "Name/key of the Bitbucket project.",
 				Required:    true,
 			},
 			"repository_name": schema.StringAttribute{
-				Description: "Name of the Bitbucket repository.",
+				Description: "Slug/name of the Bitbucket repository.",
 				Required:    true,
 			},
 			"token": schema.StringAttribute{
-				Description: "Generated Bitbucket access token (sensitive).",
+				Description: "Bitbucket access token secret (only returned on creation; preserved from state if still valid).",
 				Computed:    true,
 				Sensitive:   true,
 			},
+			"current_token_name": schema.StringAttribute{
+				Description: "Identifier of the currently managed token (e.g., '<prefix>-<epoch_ms>').",
+				Computed:    true,
+			},
+			"current_token_expiry": schema.Int64Attribute{
+				Description: "Expiry of the current token in milliseconds since epoch.",
+				Computed:    true,
+			},
 		},
 	}
 }

-func (r *BitbucketTokenResource) Configure(ctx context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+// Configure sets up provider-level data for the resource.
+func (r *BitbucketTokenResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
 	if req.ProviderData == nil {
-		resp.Diagnostics.AddError(
-			"Missing provider configuration",
-			"The Bitbucket provider was not configured before using this resource.",
-		)
 		return
 	}

-	providerData, ok := req.ProviderData.(ProviderData)
+	providerData, ok := req.ProviderData.(*ProviderData)
 	if !ok {
 		resp.Diagnostics.AddError(
 			"Unexpected Provider Data Type",
-			fmt.Sprintf("Expected ProviderData, got: %T", req.ProviderData),
+			fmt.Sprintf("Expected *ProviderData, got: %T", req.ProviderData),
 		)
 		return
 	}

 	if providerData.ServerURL == "" {
 		resp.Diagnostics.AddError(
-			"Invalid provider configuration",
-			"The 'server_url' in provider configuration cannot be empty.",
+			"Invalid Provider Configuration",
+			"The 'server_url' cannot be empty.",
 		)
 		return
 	}

 	r.authHeader = providerData.AuthHeader
 	r.serverURL = providerData.ServerURL
+	r.tlsSkipVerify = providerData.TLSSkipVerify
 }

-func (r *BitbucketTokenResource) getExistingToken(auth, baseURL, project, repo, name string) (string, error) {
-	apiURL := fmt.Sprintf("%s/rest/access-tokens/latest/projects/%s/repos/%s?limit=10000", baseURL, project, repo)
-	client := &http.Client{Timeout: 15 * time.Second}
-
-	reqGet, _ := http.NewRequest("GET", apiURL, nil)
-	reqGet.Header.Add("Authorization", "Basic "+auth)
-	respGet, err := client.Do(reqGet)
-	if err != nil {
-		return "", err
+// httpClient creates a custom HTTP client with optional TLS skip verification.
+func (r *BitbucketTokenResource) httpClient() *http.Client {
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: r.tlsSkipVerify}, // #nosec G402 - intentional per user config
 	}
-	defer respGet.Body.Close()
+	return &http.Client{
+		Timeout:   20 * time.Second,
+		Transport: tr,
+	}
+}

-	body, _ := io.ReadAll(respGet.Body)
-	var respJSON map[string]interface{}
-	_ = json.Unmarshal(body, &respJSON)
+// tokenInfo describes an access token returned by listing API.
+type tokenInfo struct {
+	Name        string
+	ExpiryMs    int64
+	Permissions []string
+}

-	values, _ := respJSON["values"].([]interface{})
-	now := time.Now().UnixMilli()
-	var latestExpiry int64
-	var latestToken string
+// listTokens lists all tokens for a repo and filters by prefix; returns all matches.
+func (r *BitbucketTokenResource) listTokens(auth, baseURL, project, repo, prefix string) ([]tokenInfo, error) {
+	apiURL := fmt.Sprintf("%s/rest/access-tokens/latest/projects/%s/repos/%s?limit=10000", baseURL, project, repo)
+	client := r.httpClient()

+	req, _ := http.NewRequest("GET", apiURL, nil)
+	req.Header.Add("Authorization", "Basic "+auth)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("Bitbucket API returned %d: %s", resp.StatusCode, string(body))
+	}
+
+	body, _ := io.ReadAll(resp.Body)
+	var jsonResp map[string]interface{}
+	_ = json.Unmarshal(body, &jsonResp)
+
+	values, _ := jsonResp["values"].([]interface{})
+	var out []tokenInfo
 	for _, v := range values {
 		obj, ok := v.(map[string]interface{})
 		if !ok {
 			continue
 		}
-		n, _ := obj["name"].(string)
-		eFloat, _ := obj["expiryDate"].(float64)
-		e := int64(eFloat) * 1000
-		if len(n) >= len(name) && n[:len(name)] == name && e > now && e > latestExpiry {
-			latestExpiry = e
-			latestToken = n
+		name, _ := obj["name"].(string)
+		if len(name) < len(prefix) || name[:len(prefix)] != prefix {
+			continue
 		}
-	}
+		exp, _ := obj["expiryDate"].(float64) // ms since epoch
+		expMs := int64(exp)

-	if latestToken == "" {
-		return "", nil
+		var perms []string
+		if ps, ok := obj["permissions"].([]interface{}); ok {
+			for _, p := range ps {
+				if s, ok := p.(string); ok {
+					perms = append(perms, s)
+				}
+			}
+		}
+		out = append(out, tokenInfo{
+			Name:        name,
+			ExpiryMs:    expMs,
+			Permissions: perms,
+		})
 	}
-	return latestToken, nil
+	return out, nil
 }

-func (r *BitbucketTokenResource) createToken(auth, baseURL, project, repo, name string) (string, error) {
-	now := time.Now().UnixMilli()
+// getTokenByName searches list results for an exact name.
+func getTokenByName(tokens []tokenInfo, name string) *tokenInfo {
+	for i := range tokens {
+		if tokens[i].Name == name {
+			return &tokens[i]
+		}
+	}
+	return nil
+}
+
+// getLatestByExpiry picks the token with the highest expiry.
+func getLatestByExpiry(tokens []tokenInfo) *tokenInfo {
+	var latest *tokenInfo
+	for i := range tokens {
+		if latest == nil || tokens[i].ExpiryMs > latest.ExpiryMs {
+			copy := tokens[i]
+			latest = &copy
+		}
+	}
+	return latest
+}
+
+// createToken creates a new access token and returns (secret, name, expiryMs).
+func (r *BitbucketTokenResource) createToken(auth, baseURL, project, repo, prefix string) (string, string, int64, error) {
 	putURL := fmt.Sprintf("%s/rest/access-tokens/latest/projects/%s/repos/%s", baseURL, project, repo)
 	payload := map[string]interface{}{
 		"expiryDays":  90,
-		"name":        fmt.Sprintf("%s-%d", name, now),
+		"name":        fmt.Sprintf("%s-%d", prefix, time.Now().UnixMilli()),
 		"permissions": []string{"REPO_READ"},
 	}
+	bodyBytes, _ := json.Marshal(payload)

-	payloadBytes, _ := json.Marshal(payload)
-	client := &http.Client{Timeout: 15 * time.Second}
-	reqPut, _ := http.NewRequest("PUT", putURL, bytes.NewReader(payloadBytes))
-	reqPut.Header.Add("Authorization", "Basic "+auth)
-	reqPut.Header.Add("Content-Type", "application/json")
+	client := r.httpClient()
+	req, _ := http.NewRequest("PUT", putURL, bytes.NewReader(bodyBytes))
+	req.Header.Add("Authorization", "Basic "+auth)
+	req.Header.Add("Content-Type", "application/json")

-	respPut, err := client.Do(reqPut)
+	resp, err := client.Do(req)
 	if err != nil {
-		return "", err
+		return "", "", 0, err
 	}
-	defer respPut.Body.Close()
+	defer resp.Body.Close()

-	bodyPut, _ := io.ReadAll(respPut.Body)
-	var putJSON map[string]interface{}
-	_ = json.Unmarshal(bodyPut, &putJSON)
-
-	tok, _ := putJSON["token"].(string)
-	if tok == "" {
-		return "", fmt.Errorf("failed to obtain token from API response: %s", string(bodyPut))
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(resp.Body)
+		return "", "", 0, fmt.Errorf("Bitbucket API returned %d: %s", resp.StatusCode, string(body))
 	}

-	return tok, nil
+	body, _ := io.ReadAll(resp.Body)
+	var jsonResp map[string]interface{}
+	_ = json.Unmarshal(body, &jsonResp)
+
+	secret, _ := jsonResp["token"].(string)
+	name, _ := jsonResp["name"].(string)
+	exp, _ := jsonResp["expiryDate"].(float64)
+	expMs := int64(exp)
+
+	if secret == "" || name == "" || expMs == 0 {
+		return "", "", 0, fmt.Errorf("API response missing fields (token/name/expiryDate): %s", string(body))
+	}
+
+	return secret, name, expMs, nil
 }

-// Create resource
+// deleteToken removes a token by name.
+func (r *BitbucketTokenResource) deleteToken(auth, baseURL, project, repo, name string) error {
+	client := r.httpClient()
+	delURL := fmt.Sprintf("%s/rest/access-tokens/latest/projects/%s/repos/%s/%s", baseURL, project, repo, name)
+
+	req, _ := http.NewRequest("DELETE", delURL, nil)
+	req.Header.Add("Authorization", "Basic "+auth)
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("Bitbucket returned %d: %s", resp.StatusCode, string(body))
+	}
+	return nil
+}
+
+// ensureToken ensures we end with a valid token secret in state.
+// If state has a valid token → keep its secret.
+// If missing/expired → delete expired (if any) and create a fresh one.
+func (r *BitbucketTokenResource) ensureToken(data *BitbucketTokenResourceModel) (*BitbucketTokenResourceModel, error) {
+	project := data.ProjectName.ValueString()
+	repo := data.RepositoryName.ValueString()
+	prefix := data.TokenName.ValueString()
+
+	tokens, err := r.listTokens(r.authHeader, r.serverURL, project, repo, prefix)
+	if err != nil {
+		return nil, err
+	}
+
+	nowMs := time.Now().UnixMilli()
+
+	// If we already have a specific token tracked in state, check it first.
+	stateName := data.CurrentTokenName.ValueString()
+	stateSecret := data.Token.ValueString()
+
+	if stateName != "" && stateSecret != "" {
+		if t := getTokenByName(tokens, stateName); t != nil && t.ExpiryMs > nowMs {
+			// Still valid → reuse secret from state.
+			data.Token = types.StringValue(stateSecret)
+			data.CurrentTokenName = types.StringValue(t.Name)
+			data.CurrentTokenExpiry = types.Int64Value(t.ExpiryMs)
+			return data, nil
+		}
+		// If expired or missing → try to delete it (best effort).
+		if t := getTokenByName(tokens, stateName); t != nil && t.ExpiryMs <= nowMs {
+			_ = r.deleteToken(r.authHeader, r.serverURL, project, repo, stateName)
+		}
+	}
+
+	// Clean up all expired tokens with this prefix before creating a new one.
+	for _, t := range tokens {
+		if t.ExpiryMs <= nowMs {
+			_ = r.deleteToken(r.authHeader, r.serverURL, project, repo, t.Name)
+		}
+	}
+
+	// Create a new token and record its secret + metadata.
+	secret, newName, expiry, err := r.createToken(r.authHeader, r.serverURL, project, repo, prefix)
+	if err != nil {
+		return nil, err
+	}
+
+	data.Token = types.StringValue(secret)
+	data.CurrentTokenName = types.StringValue(newName)
+	data.CurrentTokenExpiry = types.Int64Value(expiry)
+
+	return data, nil
+}
+
+// Create — always produces a token value. Since no prior state exists,
+// we create a fresh token (after cleaning up any expired ones for the prefix).
 func (r *BitbucketTokenResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
 	var data BitbucketTokenResourceModel
 	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
@@ -180,44 +332,18 @@ func (r *BitbucketTokenResource) Create(ctx context.Context, req resource.Create
 		return
 	}

-	existing, err := r.getExistingToken(
-		r.authHeader,
-		r.serverURL,
-		data.ProjectName.ValueString(),
-		data.RepositoryName.ValueString(),
-		data.TokenName.ValueString(),
-	)
+	out, err := r.ensureToken(&data)
 	if err != nil {
-		resp.Diagnostics.AddError("Error checking existing token", err.Error())
+		resp.Diagnostics.AddError("Error ensuring token", err.Error())
 		return
 	}

-	if existing != "" {
-		data.Token = types.StringValue(existing)
-	} else {
-		token, err := r.createToken(
-			r.authHeader,
-			r.serverURL,
-			data.ProjectName.ValueString(),
-			data.RepositoryName.ValueString(),
-			data.TokenName.ValueString(),
-		)
-		if err != nil {
-			resp.Diagnostics.AddError("Error creating new token", err.Error())
-			return
-		}
-		data.Token = types.StringValue(token)
-	}
-
-	data.ID = types.StringValue(fmt.Sprintf("%s/%s/%s",
-		data.ProjectName.ValueString(),
-		data.RepositoryName.ValueString(),
-		data.TokenName.ValueString(),
-	))
-
-	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+	out.ID = types.StringValue(fmt.Sprintf("%s/%s/%s", out.ProjectName.ValueString(), out.RepositoryName.ValueString(), out.TokenName.ValueString()))
+	resp.Diagnostics.Append(resp.State.Set(ctx, out)...)
 }

+// Read — does not create new tokens (to keep Read side-effect free).
+// If the tracked token is missing or expired, remove from state so the next Apply will recreate it.
 func (r *BitbucketTokenResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
 	var data BitbucketTokenResourceModel
 	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
@@ -225,19 +351,30 @@ func (r *BitbucketTokenResource) Read(ctx context.Context, req resource.ReadRequ
 		return
 	}

-	existing, err := r.getExistingToken(
-		r.authHeader,
-		r.serverURL,
-		data.ProjectName.ValueString(),
-		data.RepositoryName.ValueString(),
-		data.TokenName.ValueString(),
-	)
+	project := data.ProjectName.ValueString()
+	repo := data.RepositoryName.ValueString()
+	prefix := data.TokenName.ValueString()
+
+	tokens, err := r.listTokens(r.authHeader, r.serverURL, project, repo, prefix)
 	if err != nil {
-		resp.Diagnostics.AddError("Error reading token", err.Error())
+		resp.Diagnostics.AddError("Error listing tokens", err.Error())
 		return
 	}

-	if existing == "" {
+	nowMs := time.Now().UnixMilli()
+	stateName := data.CurrentTokenName.ValueString()
+	var valid bool
+
+	if stateName != "" {
+		if t := getTokenByName(tokens, stateName); t != nil && t.ExpiryMs > nowMs {
+			// keep state as-is
+			data.CurrentTokenExpiry = types.Int64Value(t.ExpiryMs)
+			valid = true
+		}
+	}
+
+	if !valid {
+		// Not present or expired -> remove from state; next Apply will create a new one in Create/Update paths.
 		resp.State.RemoveResource(ctx)
 		return
 	}
@@ -245,45 +382,41 @@ func (r *BitbucketTokenResource) Read(ctx context.Context, req resource.ReadRequ
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 }

+// Update — same semantics as Create: ensure we output a valid token value.
+// If state has a valid token, reuse its secret; otherwise delete expired and create new.
 func (r *BitbucketTokenResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
-	var data BitbucketTokenResourceModel
-	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+	var plan BitbucketTokenResourceModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
 	if resp.Diagnostics.HasError() {
 		return
 	}

-	existing, err := r.getExistingToken(
-		r.authHeader,
-		r.serverURL,
-		data.ProjectName.ValueString(),
-		data.RepositoryName.ValueString(),
-		data.TokenName.ValueString(),
-	)
+	// Carry over prior state (for secret) if present.
+	var state BitbucketTokenResourceModel
+	_ = req.State.Get(ctx, &state)
+
+	// Start from plan but keep any state-held secret/name/expiry for reuse.
+	if !state.Token.IsNull() && !state.Token.IsUnknown() {
+		plan.Token = state.Token
+	}
+	if !state.CurrentTokenName.IsNull() && !state.CurrentTokenName.IsUnknown() {
+		plan.CurrentTokenName = state.CurrentTokenName
+	}
+	if !state.CurrentTokenExpiry.IsNull() && !state.CurrentTokenExpiry.IsUnknown() {
+		plan.CurrentTokenExpiry = state.CurrentTokenExpiry
+	}
+
+	out, err := r.ensureToken(&plan)
 	if err != nil {
-		resp.Diagnostics.AddError("Error checking existing token", err.Error())
+		resp.Diagnostics.AddError("Error ensuring token on update", err.Error())
 		return
 	}

-	if existing != "" {
-		data.Token = types.StringValue(existing)
-	} else {
-		token, err := r.createToken(
-			r.authHeader,
-			r.serverURL,
-			data.ProjectName.ValueString(),
-			data.RepositoryName.ValueString(),
-			data.TokenName.ValueString(),
-		)
-		if err != nil {
-			resp.Diagnostics.AddError("Error creating new token", err.Error())
-			return
-		}
-		data.Token = types.StringValue(token)
-	}
-
-	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+	out.ID = types.StringValue(fmt.Sprintf("%s/%s/%s", out.ProjectName.ValueString(), out.RepositoryName.ValueString(), out.TokenName.ValueString()))
+	resp.Diagnostics.Append(resp.State.Set(ctx, out)...)
 }

+// Delete removes the tracked token if it still exists.
 func (r *BitbucketTokenResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
 	var data BitbucketTokenResourceModel
 	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
@@ -291,34 +424,13 @@ func (r *BitbucketTokenResource) Delete(ctx context.Context, req resource.Delete
 		return
 	}

-	auth := r.authHeader
 	project := data.ProjectName.ValueString()
 	repo := data.RepositoryName.ValueString()
-	name := data.TokenName.ValueString()
-	baseURL := r.serverURL
+	name := data.CurrentTokenName.ValueString()

-	client := &http.Client{Timeout: 15 * time.Second}
-
-	tokenID, err := r.getExistingToken(auth, baseURL, project, repo, name)
-	if err != nil {
-		resp.Diagnostics.AddWarning("Failed to verify token before deletion", err.Error())
-	} else if tokenID != "" {
-		apiURL := fmt.Sprintf("%s/rest/access-tokens/latest/projects/%s/repos/%s/%s", baseURL, project, repo, tokenID)
-		reqDel, _ := http.NewRequest("DELETE", apiURL, nil)
-		reqDel.Header.Add("Authorization", "Basic "+auth)
-
-		respDel, err := client.Do(reqDel)
-		if err != nil {
+	if name != "" {
+		if err := r.deleteToken(r.authHeader, r.serverURL, project, repo, name); err != nil {
 			resp.Diagnostics.AddWarning("Error deleting token", err.Error())
-		} else {
-			defer respDel.Body.Close()
-			if respDel.StatusCode >= 400 {
-				body, _ := io.ReadAll(respDel.Body)
-				resp.Diagnostics.AddWarning(
-					"Bitbucket returned error during delete",
-					fmt.Sprintf("Status: %s\nBody: %s", respDel.Status, string(body)),
-				)
-			}
 		}
 	}
Author	SHA1	Message	Date
Jan Husak	84725d51cf	fix token exact handling	2025-11-12 12:01:17 +01:00
Jan Husak	cffc2656b0	add tls skip to provider	2025-11-12 09:47:08 +01:00
Jan Husak	5e00156fc9	fix provider data	2025-11-11 13:55:16 +01:00
Jan Husak	f186ebf370	Merge branch 'main' of github.com:ysoftdevs/terraform-provider-bitbucket	2025-11-11 13:53:36 +01:00
Jan Husak	be79b657d2	fix provider context	2025-11-11 13:53:29 +01:00
kardinal	12dd1f50a1	Fix provider	2025-11-10 17:44:37 +01:00
Jan Husak	0f2a12d84f	upgrade go and plugin api	2025-11-09 23:56:25 +01:00
Jan Husak	5bab68bf67	fix provider namespace	2025-11-07 14:18:27 +01:00