nonsensitive: no longer produces error when applied to nonsensitive values

[joaocc]

#28222 and #31693 and other issues describe a set of situations where users are effectively locked into a situation where they can't use derivations of collections of objects where some fields are marked as sensitive into for_each, and are also unable to use nonsensitive because some of the values are indeed nonsensitive already. It also applies to arrays of elements where some are marked as sensitive while others are not.
In these hybrid situations, there doesn't seem to be an way to mark everything as nonsensitive.

The behaviour in 1.5.x causes an error if nonsensitive is called on a value that is not marked as "sensitive".
The documentation at https://developer.hashicorp.com/terraform/language/functions/nonsensitive offers a rationale

nonsensitive will return an error if you pass a value that isn't marked as sensitive, because such a call would be redundant and potentially confusing or misleading to a future maintainer of your module.

Also, this behaviour is not consistent with that of sensitive, where sensitive can be applied to any value, regardless of whether it is already sensitive or not.

However, from the sheer amount of issues complaining about the implications of this decision, this well-intentioned decision is causing unintended pain.
The current behaviour is not only interfering with developer decision of determining what is and what isn't sensitive, but also doing that when there is not even a security risk (fields are already nonsensitive). The workarounds proposed force developers away from simpler and more straightforward solutions, more difficult to understand and maintain, without any tangible benefit in terms of security.

For this reason, this PR proposes that nonsensitive does what it is meant to do, which is to allow developers to mark fields as nonsensitive, leaving softer aspects of maintainability and maintainer confusion to be decided by each developer.

This PR should not cause breaking behaviours, as it is enabling a behaviour that wasn't allowed before.

Fixes #
#31693

Relates #
#32880
#32828
#31646
#31609
#31609
#29744
#28222 (comment)
#28222

Target Release

1.5.x

Draft CHANGELOG entry

• nonsensitive no longer produces error when applied to values that are not sensitive

BUG FIXES

• nonsensitive can now be used to remove sensitive from any element, regardless of it's original sensitivity flag.

[hashicorp-cla]

All committers have signed the CLA.

[crw]

Thanks for this submission. I've added it to the triage queue. Just a reminder that we will not be able to review / merge unless the CLA is signed. Thanks!

[liamcervante]

Hi @joaocc, the code changes look good to me. Just have a note around the documentation.

Also, can you change your description so it says it is fixing just #31693, and then simply relates to all the others. I agree this change is related to them, but I don't think it actually fixes them.

Thanks!

[liamcervante]

I think we don't need to clarify this with no longer as new readers won't have the context that this used to not work.

Let's change this to:

nonsensitive will make no changes to values that aren't marked as sensitive, even though such a call may be redundant and potentially confusing.

[joaocc]

Changed as per @liamcervante indication. Thx

[liamcervante]

The cutoff for v1.6 is next week, I'll add the backport label in again if we get this approved and merged before then. Otherwise it'll have to wait for v1.7.

[joaocc]

@liamcervante any news on when this is planned for merge and release?

[liamcervante]

Hi @joaocc , apologies for the delay. Could you update the documentation to address my comments? Thanks!

[joaocc]

Updated as per instructions, and rebased on main. Thx

[github-actions]

Reminder for the merging maintainer: if this is a user-visible change, please update the changelog on the appropriate release branch.

[liamcervante]

This is merged and the CHANGELOG updated, will be released in Terraform v1.7.0.

Thanks @joaocc for your contribution!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.