Merge 7b3a003712 into d56ff281de

terraform/provider/litellm/client.go

@@ -359,6 +359,10 @@ func (c *Client) parseKeyResponse(resp map[string]interface{}) (*Key, error) {
 			if m, ok := v.(map[string]interface{}); ok {
 				createdKey.ModelTPMLimit = m
 			}
+		case "status":
+			if s, ok := v.(string); ok {
+				createdKey.Status = s
+			}
 		case "guardrails":
 			if guardrails, ok := v.([]interface{}); ok {
 				createdKey.Guardrails = make([]string, len(guardrails))

terraform/provider/litellm/resource_key.go

@@ -358,6 +358,14 @@ func resourceKeyRead(ctx context.Context, d *schema.ResourceData, m interface{})
 		return nil
 	}
 
+	// The gateway archives deleted keys and still serves them from /key/info
+	// with status "deleted", so only that flag separates them from live keys.
+	if key.Status == "deleted" {
+		log.Printf("[WARN] Key %s is deleted on the gateway, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
 	d.Set("server_metadata", serverKeyMetadata(key.Metadata))
 	key.Metadata = declaredKeyMetadata(key.Metadata, d.Get("metadata").(map[string]interface{}))
 	mapKeyToResourceData(d, key)
@@ -531,6 +539,11 @@ func resourceKeyDelete(ctx context.Context, d *schema.ResourceData, m interface{
 	c := m.(*Client)
 
 	err := c.DeleteKey(d.Id())
+	if isNotFound(err) {
+		log.Printf("[WARN] Key %s already deleted on the gateway", d.Id())
+		d.SetId("")
+		return nil
+	}
 	if err != nil {
 		return diag.FromErr(fmt.Errorf("error deleting key: %s", err))
 	}

terraform/provider/litellm/resource_key_test.go

@@ -897,6 +897,45 @@ func TestResourceKeyReadDropsMissingKeyFromState(t *testing.T) {
 	}
 }
 
+func TestResourceKeyReadDropsArchivedDeletedKeyFromState(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"key":"sk-archived","info":{"key":"sk-archived","token_id":"tok-1","status":"deleted"}}`))
+	}))
+	defer srv.Close()
+
+	d := newKeyResourceData(t, map[string]interface{}{"key_alias": "archived"})
+	d.SetId("deleted-outside-terraform")
+
+	diags := resourceKeyRead(context.Background(), d, NewClient(srv.URL, "test-key", true))
+	if diags.HasError() {
+		t.Fatalf("read of an archived deleted key must not error, got: %v", diags)
+	}
+	if d.Id() != "" {
+		t.Errorf("Id = %q, want empty so Terraform plans a recreate instead of trusting a 200 for a deleted key", d.Id())
+	}
+}
+
+func TestResourceKeyDeleteTreatsNotFoundAsGone(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusNotFound)
+		w.Write([]byte(`{"error":{"message":"{'error': 'No keys found'}","type":"internal_server_error","param":null,"code":"404"}}`))
+	}))
+	defer srv.Close()
+
+	d := newKeyResourceData(t, map[string]interface{}{"key_alias": "already-gone"})
+	d.SetId("deleted-outside-terraform")
+
+	diags := resourceKeyDelete(context.Background(), d, NewClient(srv.URL, "test-key", true))
+	if diags.HasError() {
+		t.Fatalf("destroy of an already-deleted key must succeed, got: %v", diags)
+	}
+	if d.Id() != "" {
+		t.Errorf("Id = %q, want empty so destroy completes without state rm", d.Id())
+	}
+}
+
 func TestResourceKeyReadStillFailsOnNon404Errors(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)

terraform/provider/litellm/types.go

@@ -171,6 +171,7 @@ type Key struct {
 	Prompts                  []string               `json:"prompts,omitempty"`
 	OrganizationID           string                 `json:"organization_id,omitempty"`
 	ProjectID                string                 `json:"project_id,omitempty"`
+	Status                   string                 `json:"status,omitempty"`
 }
 
 // KeyResponse represents a response from the API containing key information.