resource/cloudflare_ruleset: ensure custom keys via query strings are known

.changelog/2388.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/cloudflare_ruleset: ensure custom cache keys using query parameters are defined as known values for state handling
+```

internal/framework/service/rulesets/resource.go

@@ -527,12 +527,20 @@ func toRulesetResourceModel(zoneID, accountID basetypes.StringValue, in cloudfla
 						include, _ := basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include)
 						exclude, _ := basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude)
 
-						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include != nil && ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include.All {
-							include, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include != nil {
+							if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include.All {
+								include, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+							} else {
+								include, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include.List)
+							}
 						}
 
-						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude != nil && ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude.All {
-							exclude, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude != nil {
+							if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude.All {
+								exclude, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+							} else {
+								exclude, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude.List)
+							}
 						}
 
 						key.QueryString = []*ActionParameterCacheKeyCustomKeyQueryStringModel{{

internal/framework/service/rulesets/resource_test.go

@@ -2011,6 +2011,36 @@ func TestAccCloudflareRuleset_ConfigConflictingCacheByDevice(t *testing.T) {
 	})
 }
 
+func TestAccCloudflareRuleset_CacheSettingsDefinedQueryStringExcludeKeys(t *testing.T) {
+	rnd := utils.GenerateRandomResourceName()
+	zoneID := os.Getenv("CLOUDFLARE_ZONE_ID")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.TestAccPreCheck(t) },
+		ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsExclude(rnd, zoneID),
+			},
+		},
+	})
+}
+
+func TestAccCloudflareRuleset_CacheSettingsDefinedQueryStringIncludeKeys(t *testing.T) {
+	rnd := utils.GenerateRandomResourceName()
+	zoneID := os.Getenv("CLOUDFLARE_ZONE_ID")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.TestAccPreCheck(t) },
+		ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsInclude(rnd, zoneID),
+			},
+		},
+	})
+}
+
 func testAccCheckCloudflareRulesetMagicTransitSingle(rnd, name, accountID string) string {
 	return fmt.Sprintf(`
   resource "cloudflare_ruleset" "%[1]s" {
@@ -3725,6 +3755,72 @@ func testAccCloudflareRulesetConfigConflictingCacheByDeviceConfigs(rnd, zoneID s
   }`, rnd, zoneID)
 }
 
+func testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsExclude(rnd, zoneID string) string {
+	return fmt.Sprintf(`
+	resource "cloudflare_ruleset" "cache_settings_example" {
+		zone_id     = "%[2]s"
+    name        = "%[1]s"
+		description = "set cache settings for the request"
+		kind        = "zone"
+		phase       = "http_request_cache_settings"
+		rules {
+		  action      = "set_cache_settings"
+		  description = "example"
+		  enabled     = true
+		  expression  = "(http.host eq \"example.com\" and starts_with(http.request.uri.path, \"/example\"))"
+		  action_parameters {
+			cache = true
+			edge_ttl {
+			  mode    = "override_origin"
+			  default = 7200
+			}
+			cache_key {
+			  ignore_query_strings_order = true
+			  custom_key {
+				query_string {
+				  exclude = ["example"]
+				}
+			  }
+			}
+		  }
+		}
+	  }
+	`, rnd, zoneID)
+}
+
+func testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsInclude(rnd, zoneID string) string {
+	return fmt.Sprintf(`
+	resource "cloudflare_ruleset" "cache_settings_example" {
+		zone_id     = "%[2]s"
+    name        = "%[1]s"
+		description = "set cache settings for the request"
+		kind        = "zone"
+		phase       = "http_request_cache_settings"
+		rules {
+		  action      = "set_cache_settings"
+		  description = "example"
+		  enabled     = true
+		  expression  = "(http.host eq \"example.com\" and starts_with(http.request.uri.path, \"/example\"))"
+		  action_parameters {
+			cache = true
+			edge_ttl {
+			  mode    = "override_origin"
+			  default = 7200
+			}
+			cache_key {
+			  ignore_query_strings_order = true
+			  custom_key {
+				query_string {
+				  include = ["another_example"]
+				}
+			  }
+			}
+		  }
+		}
+	  }
+	`, rnd, zoneID)
+}
+
 func testAccCheckCloudflareRulesetDestroy(s *terraform.State) error {
 	return nil
 }