Fix secret scope permission level

.nextchanges/bundles/secret-scope-invalid-permission-level.md

@@ -0,0 +1 @@
+Warn on invalid `secret_scopes` permission levels (`READ`, `WRITE`, `MANAGE`); fail under `bundle validate --strict`.

acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml

@@ -0,0 +1,18 @@
+bundle:
+ name: test-bundle
+
+resources:
+ secret_scopes:
+ bad_levels:
+ name: test-scope-bad-levels
+ permissions:
+ # YAML int is coerced to string; must still fail enum validation.
+ - level: 12
+ group_name: users
+ - level: fuzz_badlevel
+ service_principal_name: 12345678-1234-1234-1234-123456789abc
+ valid:
+ name: test-scope-valid
+ permissions:
+ - level: READ
+ group_name: users

acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt

@@ -0,0 +1,31 @@
+
+>>> [CLI] bundle validate
+Warning: invalid value "12" for enum field. Valid values are [READ WRITE MANAGE]
+ at resources.secret_scopes.bad_levels.permissions[0].level
+
+Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE]
+ at resources.secret_scopes.bad_levels.permissions[1].level
+
+Name: test-bundle
+Target: default
+Workspace:
+ User: [USERNAME]
+ Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 2 warnings
+
+>>> [CLI] bundle validate --strict
+Warning: invalid value "12" for enum field. Valid values are [READ WRITE MANAGE]
+ at resources.secret_scopes.bad_levels.permissions[0].level
+
+Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE]
+ at resources.secret_scopes.bad_levels.permissions[1].level
+
+Name: test-bundle
+Target: default
+Workspace:
+ User: [USERNAME]
+ Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 2 warnings
+Error: 2 warnings were found. Warnings are not allowed in strict mode

acceptance/bundle/validate/secret_scope_invalid_permission_level/script

@@ -0,0 +1,3 @@
+# Invalid levels warn (same as other enum fields); --strict must fail.
+trace $CLI bundle validate
+musterr trace $CLI bundle validate --strict

bundle/config/resources/secret_scope.go

@@ -13,10 +13,19 @@ type SecretScopePermissionLevel string
 
 const (
 	SecretScopePermissionLevelRead SecretScopePermissionLevel = "READ"
-	SecretScopePermissionLevelManage SecretScopePermissionLevel = "MANAGE"
 	SecretScopePermissionLevelWrite SecretScopePermissionLevel = "WRITE"
+	SecretScopePermissionLevelManage SecretScopePermissionLevel = "MANAGE"
 )
 
+// Values enables generated enum validation. Order matches privilege rank (READ < WRITE < MANAGE).
+func (SecretScopePermissionLevel) Values() []SecretScopePermissionLevel {
+	return []SecretScopePermissionLevel{
+ SecretScopePermissionLevelRead,
+ SecretScopePermissionLevelWrite,
+ SecretScopePermissionLevelManage,
+	}
+}
+
 // SecretScopePermission holds the permission level setting for a single principal.
 // Multiple of these can be defined on any secret scope.
 // Secret scopes permissions are mapped to Secret ACLs