fix(recipes): restore Terraform inputs for recipe deletion

docs/architecture/extensibility.md

@@ -375,7 +375,9 @@ with `x-radius-sensitive`, and encrypts those property values before the
 accepted resource is stored. During backend processing,
 `CreateOrUpdateResource` decrypts a recipe-only copy of those values, persists
 a redacted resource, and passes the decrypted copy to the recipe engine. This
-keeps recipe input usable without storing sensitive plaintext.
+keeps recipe input usable without storing sensitive plaintext in the Radius resource record.
+
+Terraform recipes also retain module inputs in the reserved, sensitive `_radius_recipe_inputs` state output. Before destroy, the executor reads this output and restores the prior inputs. Terraform can then validate required arguments even when the Radius resource properties have been redacted. This applies to wrapped recipes and direct modules on all state backends. Create and update do not restore prior inputs, so missing required values still fail validation. The executor removes this internal output from the deployment response; it is not a recipe output or a managed secret. Terraform's `sensitive` flag hides the output in normal CLI logs but does not encrypt state. Protect access to the state backend. Older state files have no saved inputs and keep the previous deletion behavior; redeploy with the required values to save inputs before deletion.
 
 ### How The Recipe Runs
 

pkg/recipes/terraform/config/inputs.go

@@ -0,0 +1,95 @@
+/*
+Copyright 2026 The Radius Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+)
+
+// RecipeInputsOutputName is reserved for inputs retained in Terraform state for deletion.
+const RecipeInputsOutputName = "_radius_recipe_inputs"
+
+// AddRecipeInputs retains module inputs in a sensitive state output for destroy.
+func (cfg *TerraformConfig) AddRecipeInputs(moduleName string) error {
+	module, ok := cfg.Module[moduleName]
+	if !ok {
+		return fmt.Errorf("module %q not found in the initialized terraform config", moduleName)
+	}
+	if _, exists := cfg.Output[RecipeInputsOutputName]; exists {
+		return fmt.Errorf("output %q is reserved for Radius recipe inputs", RecipeInputsOutputName)
+	}
+
+	inputs := RecipeParams{}
+	for name, value := range module {
+		if !isModuleMetadata(name) {
+			inputs[name] = value
+		}
+	}
+	data, err := json.Marshal(inputs)
+	if err != nil {
+		return fmt.Errorf("encoding terraform recipe inputs: %w", err)
+	}
+	if cfg.Output == nil {
+		cfg.Output = map[string]any{}
+	}
+	// Base64 prevents Terraform from evaluating interpolation syntax inside the saved JSON.
+	// It is not encryption; the state backend must protect this sensitive output.
+	cfg.Output[RecipeInputsOutputName] = map[string]any{
+		"value":     base64.StdEncoding.EncodeToString(data),
+		"sensitive": true,
+	}
+	return nil
+}
+
+// RestoreRecipeInputs replaces module inputs with those saved during deployment.
+// It must only be used for destroy, never for create or update.
+func (cfg *TerraformConfig) RestoreRecipeInputs(moduleName, encoded string) error {
+	module, ok := cfg.Module[moduleName]
+	if !ok {
+		return fmt.Errorf("module %q not found in the initialized terraform config", moduleName)
+	}
+	data, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		return errors.New("invalid saved terraform recipe inputs: expected base64")
+	}
+	var inputs RecipeParams
+	if err := json.Unmarshal(data, &inputs); err != nil || inputs == nil {
+		// Do not include the decoder error: it can contain secret input data.
+		return errors.New("invalid saved terraform recipe inputs: expected a JSON object")
+	}
+	for name := range inputs {
+		if isModuleMetadata(name) {
+			return errors.New("invalid saved terraform recipe inputs: module metadata is not allowed")
+		}
+	}
+	for name := range module {
+		if !isModuleMetadata(name) {
+			delete(module, name)
+		}
+	}
+	for name, value := range inputs {
+		module[name] = value
+	}
+	return nil
+}
+
+func isModuleMetadata(name string) bool {
+	return name == moduleSourceKey || name == moduleVersionKey || name == moduleProvidersKey
+}

pkg/recipes/terraform/config/inputs_test.go

@@ -0,0 +1,109 @@
+/*
+Copyright 2026 The Radius Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"encoding/base64"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRecipeInputsRoundTrip(t *testing.T) {
+	t.Parallel()
+	inputs := RecipeParams{
+		"context": map[string]any{
+			"resource": map[string]any{
+				"properties": map[string]any{
+					"data": map[string]any{
+						"password": map[string]any{"value": "secret-${literal}-%{literal}"},
+					},
+				},
+			},
+		},
+		"enabled": true,
+		"counted": float64(2),
+		"list":    []any{"first", nil},
+		"null":    nil,
+	}
+	cfg := &TerraformConfig{Module: map[string]TFModuleConfig{
+		"recipe": {moduleSourceKey: "original", moduleVersionKey: "1.0", moduleProvidersKey: map[string]string{"aws": "aws"}},
+	}}
+	// Include an explicit null to verify that restoration preserves the saved input exactly.
+	for name, value := range inputs {
+		cfg.Module["recipe"][name] = value
+	}
+	require.NoError(t, cfg.AddRecipeInputs("recipe"))
+	output := cfg.Output[RecipeInputsOutputName].(map[string]any)
+	require.Equal(t, true, output["sensitive"])
+	encoded := output["value"].(string)
+	require.NotContains(t, encoded, "secret")
+	require.NotContains(t, encoded, "${")
+	require.NotContains(t, encoded, "%{")
+
+	cfg.Module["recipe"] = TFModuleConfig{
+		moduleSourceKey: "current", moduleVersionKey: "2.0",
+		moduleProvidersKey: map[string]string{"aws": "aws.current"},
+		"context":          nil,
+		"newInput":         "must not survive",
+	}
+	require.NoError(t, cfg.RestoreRecipeInputs("recipe", encoded))
+	expected := TFModuleConfig{
+		moduleSourceKey: "current", moduleVersionKey: "2.0",
+		moduleProvidersKey: map[string]string{"aws": "aws.current"},
+	}
+	for name, value := range inputs {
+		expected[name] = value
+	}
+	require.Equal(t, expected, cfg.Module["recipe"])
+}
+
+func TestRecipeInputsRejectInvalidState(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		encoded string
+	}{
+		{name: "not base64", encoded: "invalid secret"},
+		{name: "not JSON", encoded: base64.StdEncoding.EncodeToString([]byte("secret"))},
+		{name: "null", encoded: base64.StdEncoding.EncodeToString([]byte("null"))},
+		{name: "array", encoded: base64.StdEncoding.EncodeToString([]byte("[]"))},
+		{name: "source override", encoded: base64.StdEncoding.EncodeToString([]byte(`{"source":"secret"}`))},
+		{name: "version override", encoded: base64.StdEncoding.EncodeToString([]byte(`{"version":"secret"}`))},
+		{name: "provider override", encoded: base64.StdEncoding.EncodeToString([]byte(`{"providers":"secret"}`))},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			cfg := &TerraformConfig{Module: map[string]TFModuleConfig{"recipe": {"input": "unchanged"}}}
+			err := cfg.RestoreRecipeInputs("recipe", tt.encoded)
+			require.ErrorContains(t, err, "invalid saved terraform recipe inputs")
+			require.NotContains(t, err.Error(), "secret")
+			require.Equal(t, TFModuleConfig{"input": "unchanged"}, cfg.Module["recipe"])
+		})
+	}
+}
+
+func TestRecipeInputsRequireModuleAndReservedOutput(t *testing.T) {
+	t.Parallel()
+	cfg := &TerraformConfig{Module: map[string]TFModuleConfig{"recipe": {}}}
+	require.ErrorContains(t, cfg.AddRecipeInputs("missing"), `module "missing" not found`)
+	require.ErrorContains(t, cfg.RestoreRecipeInputs("missing", ""), `module "missing" not found`)
+	cfg.Output = map[string]any{RecipeInputsOutputName: map[string]any{"value": "user output"}}
+	require.ErrorContains(t, cfg.AddRecipeInputs("recipe"), "reserved")
+	require.Equal(t, map[string]any{"value": "user output"}, cfg.Output[RecipeInputsOutputName])
+}

pkg/recipes/terraform/execute.go

@@ -18,6 +18,7 @@ package terraform
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -101,6 +102,8 @@ type executor struct {
 
 // backendResult carries the extra lifecycle operations each backend needs after Terraform runs.
 type backendResult struct {
+	config *config.TerraformConfig
+
 	// kubernetesSecretName is set only for the Kubernetes backend, whose state secret Radius manages.
 	kubernetesSecretName string
 
@@ -191,7 +194,7 @@ func (e *executor) Delete(ctx context.Context, options Options) error {
 	stateLockTimeout := getStateLockTimeout(options.StateLockTimeout)
 	if backend.kubernetesSecretName == "" {
 		// Native cloud backends handle missing state, locking and permissions.
-		if err := initAndDestroy(ctx, tf, stateLockTimeout); err != nil {
+		if err := initAndDestroy(ctx, tf, stateLockTimeout, backend.config, options.EnvRecipe.Name); err != nil {
 			return err
 		}
 
@@ -223,7 +226,7 @@ func (e *executor) Delete(ctx context.Context, options Options) error {
 	}
 
 	// Run TF Destroy in the working directory to delete the resources deployed by the recipe
-	err = initAndDestroy(ctx, tf, stateLockTimeout)
+	err = initAndDestroy(ctx, tf, stateLockTimeout, backend.config, options.EnvRecipe.Name)
 	if err != nil {
 		return err
 	}
@@ -391,7 +394,7 @@ func (e *executor) generateConfig(ctx context.Context, tf *tfexec.Terraform, opt
 		return nil, err
 	}
 
-	result := &backendResult{}
+	result := &backendResult{config: tfConfig}
 	if backendDetails, ok := backendConfig[backends.BackendKubernetes]; ok {
 		backendMap := backendDetails.(map[string]any)
 		if secret, ok := backendMap["secret_suffix"]; ok {
@@ -478,6 +481,10 @@ func (e *executor) generateConfig(ctx context.Context, tf *tfexec.Terraform, opt
 
 	// Add more configurations here.
 
+	if err := tfConfig.AddRecipeInputs(options.EnvRecipe.Name); err != nil {
+		return nil, err
+	}
+
 	// Ensure that we need to save the configuration after adding providers and recipecontext.
 	if err := tfConfig.Save(ctx, workingDir); err != nil {
 		return nil, err
@@ -582,11 +589,19 @@ func initAndApply(ctx context.Context, tf *tfexec.Terraform, stateLockTimeout st
 	tf.SetStdout(io.Discard)
 	defer tf.SetStdout(&tfLogWrapper{logger: logger})
 
-	return tf.Show(ctx)
+	state, err := tf.Show(ctx)
+	if err != nil {
+		return nil, err
+	}
+	// Internal inputs must not reach recipe outputs or managed secret materialization.
+	if state != nil && state.Values != nil {
+		delete(state.Values.Outputs, config.RecipeInputsOutputName)
+	}
+	return state, nil
 }
 
 // initAndDestroy runs Terraform init and destroy in the provided working directory.
-func initAndDestroy(ctx context.Context, tf *tfexec.Terraform, stateLockTimeout string) error {
+func initAndDestroy(ctx context.Context, tf *tfexec.Terraform, stateLockTimeout string, cfg *config.TerraformConfig, moduleName string) error {
 	logger := ucplog.FromContextOrDiscard(ctx)
 
 	// Initialize Terraform
@@ -600,6 +615,10 @@ func initAndDestroy(ctx context.Context, tf *tfexec.Terraform, stateLockTimeout
 	}
 	metrics.DefaultRecipeEngineMetrics.RecordTerraformInitializationDuration(ctx, terraformInitStartTime, nil)
 
+	if err := restoreRecipeInputs(ctx, tf, cfg, moduleName); err != nil {
+		return err
+	}
+
 	// Destroy Terraform configuration with state lock timeout
 	logger.Info("Running Terraform destroy with state lock timeout: " + stateLockTimeout)
 	if err := tf.Destroy(ctx, tfexec.Lock(true), tfexec.LockTimeout(stateLockTimeout)); err != nil {
@@ -609,6 +628,29 @@ func initAndDestroy(ctx context.Context, tf *tfexec.Terraform, stateLockTimeout
 	return nil
 }
 
+func restoreRecipeInputs(ctx context.Context, tf *tfexec.Terraform, cfg *config.TerraformConfig, moduleName string) error {
+	// Output -json exposes sensitive values. Keep them out of the Radius logs.
+	tf.SetStdout(io.Discard)
+	outputs, err := tf.Output(ctx)
+	tf.SetStdout(&tfLogWrapper{logger: ucplog.FromContextOrDiscard(ctx)})
+	if err != nil {
+		return fmt.Errorf("reading terraform recipe inputs for deletion: %w", err)
+	}
+	output, ok := outputs[config.RecipeInputsOutputName]
+	if !ok {
+		// Older state has no saved inputs. Preserve its existing deletion behavior.
+		return nil
+	}
+	var encoded string
+	if err := json.Unmarshal(output.Value, &encoded); err != nil {
+		return errors.New("invalid saved terraform recipe inputs: expected a string")
+	}
+	if err := cfg.RestoreRecipeInputs(moduleName, encoded); err != nil {
+		return err
+	}
+	return cfg.Save(ctx, tf.WorkingDir())
+}
+
 func initializeTerraform(ctx context.Context, tf *tfexec.Terraform) error {
 	backoff := goretry.WithMaxRetries(2, goretry.NewExponential(time.Second))
 	retryer := retry.NewRetryer(&retry.RetryConfig{BackoffStrategy: backoff})