Fixed mappings for a number of broken adapters (#3782)

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Touches adapter query/mapping behavior that affects resource
resolution and caching for BigQuery/KMS/IAM keys; changes are localized
but could alter how Terraform IDs resolve (SEARCH vs GET) if mappings or
interception assumptions are wrong.
>
> **Overview**
> Improves Terraform interoperability for multiple GCP manual adapters
by switching their `TerraformMappings` from `GET`/name-based fields to
`SEARCH` using the resource `.id` field, relying on the framework’s
full-path (`projects/...`) interception to perform `GET` where
appropriate.
>
> Adds missing `SearchStream` implementation for `BigQueryRoutine`
(including caching of streamed items), and introduces Terraform-style
and legacy-format search tests across BigQuery Routine and Cloud KMS
adapters (`CryptoKey`, `CryptoKeyVersion`, `KeyRing`) to validate both
ID parsing and cache key behavior. Also enables Terraform mappings for
`CloudKMSCryptoKey` (previously `nil`) and updates mappings for
`BigQueryTable` and `IAMServiceAccountKey`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9a43c6bf2230c9140ae400ac610abc3ec1899ad7. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

GitOrigin-RevId: b5163225ab07244d89ba567d10d5b0834959944b

Author: dylanratcliffe

sources/gcp/manual/big-query-routine.go

@@ -57,10 +57,12 @@ func (b BigQueryRoutineWrapper) PotentialLinks() map[shared.ItemType]bool {
 func (b BigQueryRoutineWrapper) TerraformMappings() []*sdp.TerraformMapping {
 	return []*sdp.TerraformMapping{
 		{
-			TerraformMethod: sdp.QueryMethod_GET,
+			TerraformMethod: sdp.QueryMethod_SEARCH,
 			// https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/bigquery_routine
-			// projects/{{project}}/datasets/{{dataset_id}}/routines/{{routine_id}}
-			TerraformQueryMap: "google_bigquery_routine.routine_id",
+			// ID format: projects/{{project}}/datasets/{{dataset_id}}/routines/{{routine_id}}
+			// The framework automatically intercepts queries starting with "projects/" and converts
+			// them to GET operations by extracting the last N path parameters (based on GetLookups count).
+			TerraformQueryMap: "google_bigquery_routine.id",
 		},
 	}
 }
@@ -121,7 +123,32 @@ func (b BigQueryRoutineWrapper) Search(ctx context.Context, scope string, queryP
 }
 
 func (b BigQueryRoutineWrapper) SearchStream(ctx context.Context, stream discovery.QueryResultStream, cache sdpcache.Cache, cacheKey sdpcache.CacheKey, scope string, queryParts ...string) {
-	// SearchStream not implemented for BigQueryRoutine
+	location, err := b.LocationFromScope(scope)
+	if err != nil {
+		stream.SendError(&sdp.QueryError{
+			ErrorType:   sdp.QueryError_NOSCOPE,
+			ErrorString: err.Error(),
+		})
+		return
+	}
+
+	toItem := func(metadata *bigquery.RoutineMetadata, datasetID, routineID string) (*sdp.Item, *sdp.QueryError) {
+		item, qerr := b.gcpBigQueryRoutineToItem(metadata, datasetID, routineID, location)
+		if qerr == nil && item != nil {
+			cache.StoreItem(ctx, item, shared.DefaultCacheDuration, cacheKey)
+		}
+		return item, qerr
+	}
+
+	items, listErr := b.client.List(ctx, location.ProjectID, queryParts[0], toItem)
+	if listErr != nil {
+		stream.SendError(gcpshared.QueryError(listErr, scope, b.Type()))
+		return
+	}
+
+	for _, item := range items {
+		stream.SendItem(item)
+	}
 }
 
 func (b BigQueryRoutineWrapper) gcpBigQueryRoutineToItem(metadata *bigquery.RoutineMetadata, datasetID, routineID string, location gcpshared.LocationInfo) (*sdp.Item, *sdp.QueryError) {

sources/gcp/manual/big-query-routine_test.go

@@ -183,6 +183,71 @@ func TestBigQueryRoutine(t *testing.T) {
 			t.Fatalf("Expected error, got nil")
 		}
 	})
+
+	t.Run("Search with terraform format", func(t *testing.T) {
+		wrapper := manual.NewBigQueryRoutine(mockClient, []gcpshared.LocationInfo{gcpshared.NewProjectLocation(projectID)})
+		adapter := sources.WrapperToAdapter(wrapper, sdpcache.NewNoOpCache())
+
+		// Use terraform-style path format
+		terraformStyleQuery := "projects/test-project/datasets/test_dataset/routines/test_routine"
+
+		// Mock Get (called internally when terraform format is detected)
+		mockClient.EXPECT().Get(ctx, projectID, datasetID, routineID).Return(createRoutineMetadata("terraform format test"), nil)
+
+		searchable, ok := adapter.(discovery.SearchableAdapter)
+		if !ok {
+			t.Fatalf("Adapter does not support Search operation")
+		}
+
+		items, qErr := searchable.Search(ctx, wrapper.Scopes()[0], terraformStyleQuery, true)
+		if qErr != nil {
+			t.Fatalf("Expected no error with terraform format, got: %v", qErr)
+		}
+		if len(items) != 1 {
+			t.Fatalf("Expected 1 item, got: %d", len(items))
+		}
+		if items[0].GetType() != gcpshared.BigQueryRoutine.String() {
+			t.Fatalf("Expected type %s, got: %s", gcpshared.BigQueryRoutine.String(), items[0].GetType())
+		}
+	})
+
+	t.Run("Search with legacy pipe format", func(t *testing.T) {
+		wrapper := manual.NewBigQueryRoutine(mockClient, []gcpshared.LocationInfo{gcpshared.NewProjectLocation(projectID)})
+		adapter := sources.WrapperToAdapter(wrapper, sdpcache.NewNoOpCache())
+
+		// Use legacy dataset ID format
+		legacyQuery := datasetID
+
+		// Mock the List function
+		mockClient.EXPECT().List(
+			gomock.Any(),
+			projectID,
+			datasetID,
+			gomock.Any(),
+		).DoAndReturn(func(ctx context.Context, projectID string, datasetID string, converter func(routine *bigquery.RoutineMetadata, datasetID, routineID string) (*sdp.Item, *sdp.QueryError)) ([]*sdp.Item, *sdp.QueryError) {
+			items := make([]*sdp.Item, 0, 1)
+			routine := createRoutineMetadata("legacy format test")
+			item, qErr := converter(routine, datasetID, routineID)
+			if qErr != nil {
+				return nil, qErr
+			}
+			items = append(items, item)
+			return items, nil
+		})
+
+		searchable, ok := adapter.(discovery.SearchableAdapter)
+		if !ok {
+			t.Fatalf("Adapter does not support Search operation")
+		}
+
+		items, qErr := searchable.Search(ctx, wrapper.Scopes()[0], legacyQuery, true)
+		if qErr != nil {
+			t.Fatalf("Expected no error with legacy format, got: %v", qErr)
+		}
+		if len(items) != 1 {
+			t.Fatalf("Expected 1 item, got: %d", len(items))
+		}
+	})
 }
 
 func createRoutineMetadata(description string) *bigquery.RoutineMetadata {

sources/gcp/manual/big-query-table.go

@@ -61,9 +61,11 @@ func (b BigQueryTableWrapper) PotentialLinks() map[shared.ItemType]bool {
 func (b BigQueryTableWrapper) TerraformMappings() []*sdp.TerraformMapping {
 	return []*sdp.TerraformMapping{
 		{
-			TerraformMethod: sdp.QueryMethod_GET,
+			TerraformMethod: sdp.QueryMethod_SEARCH,
 			// https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/bigquery_table
-			// projects/{{project}}/datasets/{{dataset}}/tables/{{name}}
+			// ID format: projects/{{project}}/datasets/{{dataset}}/tables/{{name}}
+			// The framework automatically intercepts queries starting with "projects/" and converts
+			// them to GET operations by extracting the last N path parameters (based on GetLookups count).
 			TerraformQueryMap: "google_bigquery_table.id",
 		},
 	}

sources/gcp/manual/cloud-kms-crypto-key-version.go

@@ -55,7 +55,11 @@ func (c cloudKMSCryptoKeyVersionWrapper) PotentialLinks() map[shared.ItemType]bo
 func (c cloudKMSCryptoKeyVersionWrapper) TerraformMappings() []*sdp.TerraformMapping {
 	return []*sdp.TerraformMapping{
 		{
-			TerraformMethod:   sdp.QueryMethod_GET,
+			TerraformMethod: sdp.QueryMethod_SEARCH,
+			// https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_crypto_key_version
+			// ID format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{version}
+			// The framework automatically intercepts queries starting with "projects/" and converts
+			// them to GET operations by extracting the last N path parameters (based on GetLookups count).
 			TerraformQueryMap: "google_kms_crypto_key_version.id",
 		},
 	}

sources/gcp/manual/cloud-kms-crypto-key-version_test.go

@@ -206,6 +206,126 @@ func TestCloudKMSCryptoKeyVersion(t *testing.T) {
 		}
 	})
 
+	t.Run("Search_TerraformFormat", func(t *testing.T) {
+		cache := sdpcache.NewCache(ctx)
+		defer cache.Clear()
+
+		// Pre-populate cache with CryptoKeyVersion items under SEARCH cache key (by cryptoKey)
+		attrs1, _ := sdp.ToAttributesViaJson(map[string]interface{}{
+			"name":       "projects/test-project-id/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key/cryptoKeyVersions/1",
+			"uniqueAttr": "us-central1|my-keyring|my-key|1",
+		})
+		_ = attrs1.Set("uniqueAttr", "us-central1|my-keyring|my-key|1")
+
+		attrs2, _ := sdp.ToAttributesViaJson(map[string]interface{}{
+			"name":       "projects/test-project-id/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key/cryptoKeyVersions/2",
+			"uniqueAttr": "us-central1|my-keyring|my-key|2",
+		})
+		_ = attrs2.Set("uniqueAttr", "us-central1|my-keyring|my-key|2")
+
+		item1 := &sdp.Item{
+			Type:            gcpshared.CloudKMSCryptoKeyVersion.String(),
+			UniqueAttribute: "uniqueAttr",
+			Attributes:      attrs1,
+			Scope:           projectID,
+			Health:          sdp.Health_HEALTH_OK.Enum(),
+		}
+		item2 := &sdp.Item{
+			Type:            gcpshared.CloudKMSCryptoKeyVersion.String(),
+			UniqueAttribute: "uniqueAttr",
+			Attributes:      attrs2,
+			Scope:           projectID,
+			Health:          sdp.Health_HEALTH_OK.Enum(),
+		}
+
+		// Search by location|keyRing|cryptoKey (what the terraform format will be converted to)
+		searchCacheKey := sdpcache.CacheKeyFromParts("gcp-source", sdp.QueryMethod_SEARCH, projectID, gcpshared.CloudKMSCryptoKeyVersion.String(), "us-central1|my-keyring|my-key")
+		cache.StoreItem(ctx, item1, shared.DefaultCacheDuration, searchCacheKey)
+		cache.StoreItem(ctx, item2, shared.DefaultCacheDuration, searchCacheKey)
+
+		loader := gcpshared.NewCloudKMSAssetLoader(nil, projectID, cache, "gcp-source", []gcpshared.LocationInfo{gcpshared.NewProjectLocation(projectID)})
+
+		wrapper := manual.NewCloudKMSCryptoKeyVersion(loader, []gcpshared.LocationInfo{gcpshared.NewProjectLocation(projectID)})
+		adapter := sources.WrapperToAdapter(wrapper, cache)
+
+		searchable, ok := adapter.(discovery.SearchableAdapter)
+		if !ok {
+			t.Fatalf("Adapter does not support Search operation")
+		}
+
+		// Use terraform-style path format
+		terraformStyleQuery := "projects/test-project-id/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key/cryptoKeyVersions/1"
+
+		items, qErr := searchable.Search(ctx, wrapper.Scopes()[0], terraformStyleQuery, false)
+		if qErr != nil {
+			t.Fatalf("Expected no error with terraform format, got: %v", qErr)
+		}
+
+		// Verify we got at least one item back
+		if len(items) == 0 {
+			t.Fatalf("Expected at least 1 item with terraform format, got: %d", len(items))
+		}
+
+		// Verify the items have the expected unique attributes
+		foundVersion1 := false
+		for _, item := range items {
+			uniqueAttr, err := item.GetAttributes().Get("uniqueAttr")
+			if err == nil && (uniqueAttr == "us-central1|my-keyring|my-key|1" || uniqueAttr == "us-central1|my-keyring|my-key|2") {
+				if uniqueAttr == "us-central1|my-keyring|my-key|1" {
+					foundVersion1 = true
+				}
+			}
+		}
+
+		if !foundVersion1 {
+			t.Fatalf("Expected to find version 1 in results")
+		}
+	})
+
+	t.Run("Search_LegacyPipeFormat", func(t *testing.T) {
+		cache := sdpcache.NewCache(ctx)
+		defer cache.Clear()
+
+		// Pre-populate cache with CryptoKeyVersion items
+		attrs1, _ := sdp.ToAttributesViaJson(map[string]interface{}{
+			"name":       "projects/test-project-id/locations/europe-west1/keyRings/prod-keyring/cryptoKeys/prod-key/cryptoKeyVersions/1",
+			"uniqueAttr": "europe-west1|prod-keyring|prod-key|1",
+		})
+		_ = attrs1.Set("uniqueAttr", "europe-west1|prod-keyring|prod-key|1")
+
+		item1 := &sdp.Item{
+			Type:            gcpshared.CloudKMSCryptoKeyVersion.String(),
+			UniqueAttribute: "uniqueAttr",
+			Attributes:      attrs1,
+			Scope:           projectID,
+			Health:          sdp.Health_HEALTH_OK.Enum(),
+		}
+
+		// Search by location|keyRing|cryptoKey (legacy format)
+		searchCacheKey := sdpcache.CacheKeyFromParts("gcp-source", sdp.QueryMethod_SEARCH, projectID, gcpshared.CloudKMSCryptoKeyVersion.String(), "europe-west1|prod-keyring|prod-key")
+		cache.StoreItem(ctx, item1, shared.DefaultCacheDuration, searchCacheKey)
+
+		loader := gcpshared.NewCloudKMSAssetLoader(nil, projectID, cache, "gcp-source", []gcpshared.LocationInfo{gcpshared.NewProjectLocation(projectID)})
+
+		wrapper := manual.NewCloudKMSCryptoKeyVersion(loader, []gcpshared.LocationInfo{gcpshared.NewProjectLocation(projectID)})
+		adapter := sources.WrapperToAdapter(wrapper, cache)
+
+		searchable, ok := adapter.(discovery.SearchableAdapter)
+		if !ok {
+			t.Fatalf("Adapter does not support Search operation")
+		}
+
+		// Use legacy pipe-separated format with multiple query parts
+		items, qErr := searchable.Search(ctx, wrapper.Scopes()[0], "europe-west1|prod-keyring|prod-key", false)
+		if qErr != nil {
+			t.Fatalf("Expected no error with legacy format, got: %v", qErr)
+		}
+
+		if len(items) != 1 {
+			t.Fatalf("Expected 1 item with legacy format, got: %d", len(items))
+		}
+	})
+
 	t.Run("StaticTests", func(t *testing.T) {
 		cache := sdpcache.NewMemoryCache()
 		defer cache.Clear()

sources/gcp/manual/cloud-kms-crypto-key.go

@@ -55,9 +55,16 @@ func (c cloudKMSCryptoKeyWrapper) PotentialLinks() map[shared.ItemType]bool {
 
 // TerraformMappings returns the Terraform mappings for the CryptoKey wrapper.
 func (c cloudKMSCryptoKeyWrapper) TerraformMappings() []*sdp.TerraformMapping {
-	// TODO: Revisit this when working on this ticket:
-	// https://linear.app/overmind/issue/ENG-706/fix-terraform-mappings-for-crypto-key
-	return nil
+	return []*sdp.TerraformMapping{
+		{
+			TerraformMethod: sdp.QueryMethod_SEARCH,
+			// https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_crypto_key
+			// ID format: projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{name}}
+			// The framework automatically intercepts queries starting with "projects/" and converts
+			// them to GET operations by extracting the last N path parameters (based on GetLookups count).
+			TerraformQueryMap: "google_kms_crypto_key.id",
+		},
+	}
 }
 
 // GetLookups returns the lookups for the CryptoKey wrapper.