Merge pull request #975 from hashicorp/TF-20366-unlocking-a-workspace…

…-that-is-locked-by-a-team-or-user-returns-the-wrong-error

[TF-20366] Return correct error message when workspace is locked by a Team or User

errors.go

@@ -63,6 +63,12 @@ var (
 	// ErrWorkspaceLockedByRun is returned when trying to unlock a workspace locked by a run.
 	ErrWorkspaceLockedByRun = errors.New("unable to unlock workspace locked by run")
 
+	// ErrWorkspaceLockedByTeam is returned when trying to unlock a workspace locked by a team.
+	ErrWorkspaceLockedByTeam = errors.New("unable to unlock workspace locked by team")
+
+	// ErrWorkspaceLockedByUser is returned when trying to unlock a workspace locked by a user.
+	ErrWorkspaceLockedByUser = errors.New("unable to unlock workspace locked by user")
+
 	// ErrWorkspaceStillProcessing is returned when a workspace is still processing state
 	// to determine if it is safe to delete. "conflict" followed by newline is used to
 	// preserve go-tfe version compatibility with the error constructed at runtime before it was

tfe.go

@@ -973,6 +973,14 @@ func checkResponseCode(r *http.Response) error {
 				return ErrWorkspaceLockedByRun
 			}
 
+			if errorPayloadContains(errs, "is locked by Team") {
+				return ErrWorkspaceLockedByTeam
+			}
+
+			if errorPayloadContains(errs, "is locked by User") {
+				return ErrWorkspaceLockedByUser
+			}
+
 			return ErrWorkspaceNotLocked
 		case strings.HasSuffix(r.Request.URL.Path, "actions/force-unlock"):
 			return ErrWorkspaceNotLocked

workspace_integration_test.go

@@ -2029,6 +2029,41 @@ func TestWorkspacesUnlock(t *testing.T) {
 		assert.Equal(t, ErrWorkspaceLockedByRun, err)
 	})
 
+	t.Run("when a workspace is locked by a team", func(t *testing.T) {
+		wTest2, wTest2Cleanup := createWorkspace(t, client, orgTest)
+		t.Cleanup(wTest2Cleanup)
+
+		// Create a new team to lock the workspace
+		tmTest, tmTestCleanup := createTeam(t, client, orgTest)
+		defer tmTestCleanup()
+		ta, err := client.TeamAccess.Add(ctx, TeamAccessAddOptions{
+			Access:    Access(AccessAdmin),
+			Team:      tmTest,
+			Workspace: wTest2,
+		})
+		assert.Nil(t, err)
+		defer func() {
+			err := client.TeamAccess.Remove(ctx, ta.ID)
+			if err != nil {
+				t.Logf("error removing team access (%s): %s", ta.ID, err)
+			}
+		}()
+		tt, ttTestCleanup := createTeamToken(t, client, tmTest)
+		defer ttTestCleanup()
+
+		// Create a new client with the team token
+		teamClient := testClient(t)
+		teamClient.token = tt.Token
+
+		// Lock the workspace with the team client
+		_, err = teamClient.Workspaces.Lock(ctx, wTest2.ID, WorkspaceLockOptions{})
+		assert.Nil(t, err)
+
+		// Attempt to unlock the workspace with the original client
+		_, err = client.Workspaces.Unlock(ctx, wTest2.ID)
+		assert.Equal(t, ErrWorkspaceLockedByTeam, err)
+	})
+
 	t.Run("without a valid workspace ID", func(t *testing.T) {
 		w, err := client.Workspaces.Unlock(ctx, badIdentifier)
 		assert.Nil(t, w)