fix #48

go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/ory/dockertest/v3 v3.6.0
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/sirupsen/logrus v1.5.0 // indirect
+	github.com/stretchr/testify v1.6.1
 	github.com/tidwall/gjson v1.6.7
 	github.com/tidwall/sjson v1.1.4
 	gopkg.in/yaml.v2 v2.2.8 // indirect

pingaccess/resource_pingaccess_application.go

@@ -224,14 +224,33 @@ func resourcePingAccessApplicationReadResult(d *schema.ResourceData, rv *models.
 			diags = append(diags, diag.FromErr(err)...)
 		}
 	}
-	if rv.Policy != nil && (len(*rv.Policy["API"]) > 0 || len(*rv.Policy["Web"]) > 0) {
-		if err := d.Set("policy", flattenPolicy(rv.Policy)); err != nil {
-			diags = append(diags, diag.FromErr(err)...)
+	if rv.Policy != nil {
+		if len(*rv.Policy["API"]) > 0 || len(*rv.Policy["Web"]) > 0 || policyStateHasData(d) {
+			if err := d.Set("policy", flattenPolicy(rv.Policy)); err != nil {
+				diags = append(diags, diag.FromErr(err)...)
+			}
 		}
 	}
 	return diags
 }
 
+//https://github.com/hashicorp/terraform-plugin-sdk/issues/142
+//because we cannot set the default for the policies, there was an original check to not write policy state
+//if the default response was returned from the api (web and api with empty arrays), however this left an edge case
+//where config and state could have rules but a manual removal of all rules would not be saved. This helper method checks
+//to see if the current config/state has values that should be zero'd out.
+func policyStateHasData(d *schema.ResourceData) bool {
+	if v, ok := d.GetOk("policy"); ok {
+		pol := expandPolicy(v.([]interface{}))
+		for _, items := range pol {
+			if items != nil && len(*items) > 0 {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func resourcePingAccessApplicationReadData(d *schema.ResourceData) *models.ApplicationView {
 	siteID, _ := strconv.Atoi(d.Get("site_id").(string))
 	virtualHostIds := expandStringList(d.Get("virtual_host_ids").(*schema.Set).List())

pingaccess/resource_pingaccess_application_test.go

@@ -2,6 +2,7 @@ package pingaccess
 
 import (
 	"fmt"
+	"github.com/stretchr/testify/assert"
 	"os"
 	"reflect"
 	"testing"
@@ -272,3 +273,46 @@ func Test_resourcePingAccessApplicationReadData(t *testing.T) {
 		})
 	}
 }
+
+func Test_issue48(t *testing.T) {
+	app := &models.ApplicationView{
+		Name:              String("engine1"),
+		ApplicationType:   String("API"),
+		AccessValidatorId: Int(0),
+		AgentId:           Int(0),
+		CaseSensitivePath: Bool(true),
+		ContextRoot:       String("/"),
+		DefaultAuthType:   String("API"),
+		SiteId:            Int(0),
+		SpaSupportEnabled: Bool(true),
+		VirtualHostIds:    &[]*int{Int(1)},
+		Policy: map[string]*[]*models.PolicyItem{
+			"API": {
+				{
+					Id:   "1",
+					Type: String("Rule"),
+				},
+				{
+					Id:   "2",
+					Type: String("Rule"),
+				},
+			},
+			"Web": {},
+		},
+		WebSessionId: Int(0),
+	}
+
+	resourceSchema := resourcePingAccessApplicationSchema()
+	resourceLocalData := schema.TestResourceDataRaw(t, resourceSchema, map[string]interface{}{})
+	resourcePingAccessApplicationReadResult(resourceLocalData, app)
+
+	exp := resourcePingAccessApplicationReadData(resourceLocalData)
+	assert.Equal(t, exp, app)
+
+	app.Policy["API"] = &[]*models.PolicyItem{}
+	assert.NotEqual(t, exp, app) //make sure they are now different
+	//when we read it should now become equal
+	resourcePingAccessApplicationReadResult(resourceLocalData, app)
+	exp = resourcePingAccessApplicationReadData(resourceLocalData)
+	assert.Equal(t, exp, app)
+}