use standard timetypes

example/main.tf

@@ -36,6 +36,7 @@ resource "pomerium_settings" "settings" {
     api_key = "key"
     url     = "http://localhost"
   }
+  timeout_idle = "5m"
 }
 
 resource "pomerium_policy" "test_policy" {
@@ -74,18 +75,18 @@ data "pomerium_namespace" "existing_namespace" {
   id = pomerium_namespace.test_namespace.id
 }
 
-data "pomerium_route" "existing_route" {
-  id = pomerium_route.test_route.id
-}
+# data "pomerium_route" "existing_route" {
+#   id = pomerium_route.test_route.id
+# }
 
 # Output examples
 output "namespace_name" {
   value = data.pomerium_namespace.existing_namespace.name
 }
 
-output "route_from" {
-  value = data.pomerium_route.existing_route.from
-}
+# output "route_from" {
+#   value = data.pomerium_route.existing_route.from
+# }
 
 output "all_namespaces" {
   value = data.pomerium_namespaces.all_namespaces.namespaces

go.mod

@@ -38,6 +38,7 @@ require (
 	github.com/hashicorp/go-set/v3 v3.0.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hashicorp/terraform-plugin-framework-timetypes v0.5.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect

go.sum

@@ -134,6 +134,8 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/terraform-plugin-framework v1.13.0 h1:8OTG4+oZUfKgnfTdPTJwZ532Bh2BobF4H+yBiYJ/scw=
 github.com/hashicorp/terraform-plugin-framework v1.13.0/go.mod h1:j64rwMGpgM3NYXTKuxrCnyubQb/4VKldEKlcG8cvmjU=
+github.com/hashicorp/terraform-plugin-framework-timetypes v0.5.0 h1:v3DapR8gsp3EM8fKMh6up9cJUFQ2iRaFsYLP8UJnCco=
+github.com/hashicorp/terraform-plugin-framework-timetypes v0.5.0/go.mod h1:c3PnGE9pHBDfdEVG9t1S1C9ia5LW+gkFR0CygXlM8ak=
 github.com/hashicorp/terraform-plugin-framework-validators v0.16.0 h1:O9QqGoYDzQT7lwTXUsZEtgabeWW96zUBh47Smn2lkFA=
 github.com/hashicorp/terraform-plugin-framework-validators v0.16.0/go.mod h1:Bh89/hNmqsEWug4/XWKYBwtnw3tbz5BAy1L1OgvbIaY=
 github.com/hashicorp/terraform-plugin-go v0.25.0 h1:oi13cx7xXA6QciMcpcFi/rwA974rdTxjqEhXJjbAyks=

internal/provider/convert.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"fmt"
 	"reflect"
-	"time"
 
+	"github.com/hashicorp/terraform-plugin-framework-timetypes/timetypes"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
@@ -50,7 +50,6 @@ func FromStringMap(m map[string]string) types.Map {
 
 // ToStringList converts a types.List to Settings_StringList and handles diagnostics internally
 func ToStringList(ctx context.Context, dst **pb.Settings_StringList, list types.List, diagnostics *diag.Diagnostics) {
-	// Handle null list case first
 	if list.IsNull() {
 		*dst = nil
 		return
@@ -89,26 +88,27 @@ func ToStringSlice(ctx context.Context, dst *[]string, list types.List, diagnost
 	}
 }
 
-// ToDuration converts a types.String containing a duration to a durationpb.Duration and handles diagnostics internally
-func ToDuration(dst **durationpb.Duration, src types.String, field string, diagnostics *diag.Diagnostics) {
-	if src.IsNull() {
+// ToDuration converts a timetypes.Duration to durationpb.Duration
+func ToDuration(dst **durationpb.Duration, src timetypes.GoDuration, diagnostics *diag.Diagnostics) {
+	if src.IsNull() || src.IsUnknown() {
 		*dst = nil
 		return
 	}
 
-	if d, err := time.ParseDuration(src.ValueString()); err == nil {
-		*dst = durationpb.New(d)
-	} else {
-		diagnostics.AddError("invalid "+field, err.Error())
+	d, diags := src.ValueGoDuration()
+	diagnostics.Append(diags...)
+	if diagnostics.HasError() {
+		return
 	}
+	*dst = durationpb.New(d)
 }
 
-// FromDuration converts a durationpb.Duration to a types.String
-func FromDuration(d *durationpb.Duration) types.String {
+// FromDuration converts a durationpb.Duration to a timetypes.GoDuration
+func FromDuration(d *durationpb.Duration) timetypes.GoDuration {
 	if d == nil {
-		return types.StringNull()
+		return timetypes.NewGoDurationNull()
 	}
-	return types.StringValue(d.AsDuration().String())
+	return timetypes.NewGoDurationValue(d.AsDuration())
 }
 
 // GoStructToPB converts a Go struct to a protobuf Struct.

internal/provider/convert_test.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework-timetypes/timetypes"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/types"
@@ -58,22 +59,22 @@ func TestFromDurationP(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    *durationpb.Duration
-		expected types.String
+		expected timetypes.GoDuration
 	}{
 		{
 			name:     "nil duration",
 			input:    nil,
-			expected: types.StringNull(),
+			expected: timetypes.NewGoDurationNull(),
 		},
 		{
 			name:     "zero duration",
 			input:    durationpb.New(0),
-			expected: types.StringValue("0s"),
+			expected: timetypes.NewGoDurationValueFromStringMust("0s"),
 		},
 		{
 			name:     "normal duration",
 			input:    durationpb.New(time.Hour + time.Minute),
-			expected: types.StringValue("1h1m0s"),
+			expected: timetypes.NewGoDurationValueFromStringMust("1h1m0s"),
 		},
 	}
 
@@ -85,6 +86,56 @@ func TestFromDurationP(t *testing.T) {
 	}
 }
 
+func TestToDuration(t *testing.T) {
+	tests := []struct {
+		name        string
+		input       timetypes.GoDuration
+		expected    *durationpb.Duration
+		expectError bool
+	}{
+		{
+			name:     "null duration",
+			input:    timetypes.NewGoDurationNull(),
+			expected: nil,
+		},
+		{
+			name:     "unknown duration",
+			input:    timetypes.NewGoDurationUnknown(),
+			expected: nil,
+		},
+		{
+			name:     "zero duration",
+			input:    timetypes.NewGoDurationValueFromStringMust("0s"),
+			expected: durationpb.New(0),
+		},
+		{
+			name:     "normal duration",
+			input:    timetypes.NewGoDurationValueFromStringMust("1h1m0s"),
+			expected: durationpb.New(time.Hour + time.Minute),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var result *durationpb.Duration
+			diagnostics := diag.Diagnostics{}
+			provider.ToDuration(&result, tt.input, &diagnostics)
+
+			if tt.expectError {
+				assert.True(t, diagnostics.HasError())
+				return
+			}
+
+			assert.False(t, diagnostics.HasError())
+			if tt.expected == nil {
+				assert.Nil(t, result)
+			} else {
+				assert.Equal(t, tt.expected.AsDuration(), result.AsDuration())
+			}
+		})
+	}
+}
+
 func TestToStringList(t *testing.T) {
 	ctx := context.Background()
 	tests := []struct {

internal/provider/route.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/hashicorp/terraform-plugin-framework-timetypes/timetypes"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -121,10 +122,12 @@ func (r *RouteResource) Schema(_ context.Context, _ resource.SchemaRequest, resp
 			"timeout": schema.StringAttribute{
 				Description: "Timeout.",
 				Optional:    true,
+				CustomType:  timetypes.GoDurationType{},
 			},
 			"idle_timeout": schema.StringAttribute{
 				Description: "Idle timeout.",
 				Optional:    true,
+				CustomType:  timetypes.GoDurationType{},
 			},
 			"allow_websockets": schema.BoolAttribute{
 				Description: "Allow websockets.",

internal/provider/route_model.go

@@ -3,6 +3,7 @@ package provider
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-plugin-framework-timetypes/timetypes"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/types"
@@ -11,41 +12,41 @@ import (
 
 // RouteModel represents the shared model for route resources and data sources
 type RouteModel struct {
-	ID                               types.String `tfsdk:"id"`
-	Name                             types.String `tfsdk:"name"`
-	From                             types.String `tfsdk:"from"`
-	To                               types.List   `tfsdk:"to"`
-	NamespaceID                      types.String `tfsdk:"namespace_id"`
-	Policies                         types.List   `tfsdk:"policies"`
-	StatName                         types.String `tfsdk:"stat_name"`
-	Prefix                           types.String `tfsdk:"prefix"`
-	Path                             types.String `tfsdk:"path"`
-	Regex                            types.String `tfsdk:"regex"`
-	PrefixRewrite                    types.String `tfsdk:"prefix_rewrite"`
-	RegexRewritePattern              types.String `tfsdk:"regex_rewrite_pattern"`
-	RegexRewriteSubstitution         types.String `tfsdk:"regex_rewrite_substitution"`
-	HostRewrite                      types.String `tfsdk:"host_rewrite"`
-	HostRewriteHeader                types.String `tfsdk:"host_rewrite_header"`
-	HostPathRegexRewritePattern      types.String `tfsdk:"host_path_regex_rewrite_pattern"`
-	HostPathRegexRewriteSubstitution types.String `tfsdk:"host_path_regex_rewrite_substitution"`
-	RegexPriorityOrder               types.Int64  `tfsdk:"regex_priority_order"`
-	Timeout                          types.String `tfsdk:"timeout"`
-	IdleTimeout                      types.String `tfsdk:"idle_timeout"`
-	AllowWebsockets                  types.Bool   `tfsdk:"allow_websockets"`
-	AllowSPDY                        types.Bool   `tfsdk:"allow_spdy"`
-	TLSSkipVerify                    types.Bool   `tfsdk:"tls_skip_verify"`
-	TLSUpstreamServerName            types.String `tfsdk:"tls_upstream_server_name"`
-	TLSDownstreamServerName          types.String `tfsdk:"tls_downstream_server_name"`
-	TLSUpstreamAllowRenegotiation    types.Bool   `tfsdk:"tls_upstream_allow_renegotiation"`
-	SetRequestHeaders                types.Map    `tfsdk:"set_request_headers"`
-	RemoveRequestHeaders             types.List   `tfsdk:"remove_request_headers"`
-	SetResponseHeaders               types.Map    `tfsdk:"set_response_headers"`
-	PreserveHostHeader               types.Bool   `tfsdk:"preserve_host_header"`
-	PassIdentityHeaders              types.Bool   `tfsdk:"pass_identity_headers"`
-	KubernetesServiceAccountToken    types.String `tfsdk:"kubernetes_service_account_token"`
-	IDPClientID                      types.String `tfsdk:"idp_client_id"`
-	IDPClientSecret                  types.String `tfsdk:"idp_client_secret"`
-	ShowErrorDetails                 types.Bool   `tfsdk:"show_error_details"`
+	ID                               types.String         `tfsdk:"id"`
+	Name                             types.String         `tfsdk:"name"`
+	From                             types.String         `tfsdk:"from"`
+	To                               types.List           `tfsdk:"to"`
+	NamespaceID                      types.String         `tfsdk:"namespace_id"`
+	Policies                         types.List           `tfsdk:"policies"`
+	StatName                         types.String         `tfsdk:"stat_name"`
+	Prefix                           types.String         `tfsdk:"prefix"`
+	Path                             types.String         `tfsdk:"path"`
+	Regex                            types.String         `tfsdk:"regex"`
+	PrefixRewrite                    types.String         `tfsdk:"prefix_rewrite"`
+	RegexRewritePattern              types.String         `tfsdk:"regex_rewrite_pattern"`
+	RegexRewriteSubstitution         types.String         `tfsdk:"regex_rewrite_substitution"`
+	HostRewrite                      types.String         `tfsdk:"host_rewrite"`
+	HostRewriteHeader                types.String         `tfsdk:"host_rewrite_header"`
+	HostPathRegexRewritePattern      types.String         `tfsdk:"host_path_regex_rewrite_pattern"`
+	HostPathRegexRewriteSubstitution types.String         `tfsdk:"host_path_regex_rewrite_substitution"`
+	RegexPriorityOrder               types.Int64          `tfsdk:"regex_priority_order"`
+	Timeout                          timetypes.GoDuration `tfsdk:"timeout"`
+	IdleTimeout                      timetypes.GoDuration `tfsdk:"idle_timeout"`
+	AllowWebsockets                  types.Bool           `tfsdk:"allow_websockets"`
+	AllowSPDY                        types.Bool           `tfsdk:"allow_spdy"`
+	TLSSkipVerify                    types.Bool           `tfsdk:"tls_skip_verify"`
+	TLSUpstreamServerName            types.String         `tfsdk:"tls_upstream_server_name"`
+	TLSDownstreamServerName          types.String         `tfsdk:"tls_downstream_server_name"`
+	TLSUpstreamAllowRenegotiation    types.Bool           `tfsdk:"tls_upstream_allow_renegotiation"`
+	SetRequestHeaders                types.Map            `tfsdk:"set_request_headers"`
+	RemoveRequestHeaders             types.List           `tfsdk:"remove_request_headers"`
+	SetResponseHeaders               types.Map            `tfsdk:"set_response_headers"`
+	PreserveHostHeader               types.Bool           `tfsdk:"preserve_host_header"`
+	PassIdentityHeaders              types.Bool           `tfsdk:"pass_identity_headers"`
+	KubernetesServiceAccountToken    types.String         `tfsdk:"kubernetes_service_account_token"`
+	IDPClientID                      types.String         `tfsdk:"idp_client_id"`
+	IDPClientSecret                  types.String         `tfsdk:"idp_client_secret"`
+	ShowErrorDetails                 types.Bool           `tfsdk:"show_error_details"`
 }
 
 func ConvertRouteToPB(
@@ -71,8 +72,8 @@ func ConvertRouteToPB(
 	pbRoute.HostPathRegexRewritePattern = src.HostPathRegexRewritePattern.ValueStringPointer()
 	pbRoute.HostPathRegexRewriteSubstitution = src.HostPathRegexRewriteSubstitution.ValueStringPointer()
 	pbRoute.RegexPriorityOrder = src.RegexPriorityOrder.ValueInt64Pointer()
-	ToDuration(&pbRoute.Timeout, src.Timeout, "timeout", &diagnostics)
-	ToDuration(&pbRoute.IdleTimeout, src.IdleTimeout, "idle_timeout", &diagnostics)
+	ToDuration(&pbRoute.Timeout, src.Timeout, &diagnostics)
+	ToDuration(&pbRoute.IdleTimeout, src.IdleTimeout, &diagnostics)
 	pbRoute.AllowWebsockets = src.AllowWebsockets.ValueBoolPointer()
 	pbRoute.AllowSpdy = src.AllowSPDY.ValueBoolPointer()
 	pbRoute.TlsSkipVerify = src.TLSSkipVerify.ValueBoolPointer()
@@ -134,8 +135,8 @@ func ConvertRouteFromPB(
 	dst.HostPathRegexRewritePattern = types.StringPointerValue(src.HostPathRegexRewritePattern)
 	dst.HostPathRegexRewriteSubstitution = types.StringPointerValue(src.HostPathRegexRewriteSubstitution)
 	dst.RegexPriorityOrder = types.Int64PointerValue(src.RegexPriorityOrder)
-	dst.Timeout = types.StringValue(src.Timeout.String())
-	dst.IdleTimeout = types.StringValue(src.IdleTimeout.String())
+	dst.Timeout = FromDuration(src.Timeout)
+	dst.IdleTimeout = FromDuration(src.IdleTimeout)
 	dst.AllowWebsockets = types.BoolPointerValue(src.AllowWebsockets)
 	dst.AllowSPDY = types.BoolPointerValue(src.AllowSpdy)
 	dst.TLSSkipVerify = types.BoolPointerValue(src.TlsSkipVerify)

internal/provider/settings_schema.go

@@ -3,6 +3,7 @@ package provider
 import (
 	_ "embed"
 
+	"github.com/hashicorp/terraform-plugin-framework-timetypes/timetypes"
 	"github.com/hashicorp/terraform-plugin-framework-validators/objectvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -71,14 +72,17 @@ var SettingsResourceSchema = schema.Schema{
 		"timeout_read": schema.StringAttribute{
 			Optional:    true,
 			Description: "Timeout read",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"timeout_write": schema.StringAttribute{
 			Optional:    true,
 			Description: "Timeout write",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"timeout_idle": schema.StringAttribute{
 			Optional:    true,
 			Description: "Timeout idle",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"authenticate_service_url": schema.StringAttribute{
 			Optional:    true,
@@ -116,6 +120,7 @@ var SettingsResourceSchema = schema.Schema{
 		"cookie_expire": schema.StringAttribute{
 			Optional:    true,
 			Description: "Cookie expire",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"idp_client_id": schema.StringAttribute{
 			Optional:    true,
@@ -147,10 +152,12 @@ var SettingsResourceSchema = schema.Schema{
 		"idp_refresh_directory_timeout": schema.StringAttribute{
 			Optional:    true,
 			Description: "IDP refresh directory timeout",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"idp_refresh_directory_interval": schema.StringAttribute{
 			Optional:    true,
 			Description: "IDP refresh directory interval",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"request_params": schema.MapAttribute{
 			ElementType: types.StringType,
@@ -186,6 +193,7 @@ var SettingsResourceSchema = schema.Schema{
 		"default_upstream_timeout": schema.StringAttribute{
 			Optional:    true,
 			Description: "Default upstream timeout",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"metrics_address": schema.StringAttribute{
 			Optional:    true,
@@ -443,10 +451,12 @@ var SettingsResourceSchema = schema.Schema{
 		"identity_provider_refresh_interval": schema.StringAttribute{
 			Optional:    true,
 			Description: "Identity provider refresh interval",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"identity_provider_refresh_timeout": schema.StringAttribute{
 			Optional:    true,
 			Description: "Identity provider refresh timeout",
+			CustomType:  timetypes.GoDurationType{},
 		},
 		"access_log_fields": schema.ListAttribute{
 			Optional:    true,