Read extension metadata safely

[IlyaasK]

Summary

• add a narrow durable metadata reader interface consumed by the extension resource package
• validate canonical extension ID and recorded project scope before any API call
• read by canonical ID using only project scope already stored in Terraform state
• remove the resource only for the API's coded extension not_found
• preserve state and diagnose project loss, uncoded 404s, access errors, empty responses, and malformed metadata
• include canonical extension ID and resolved scope in non-not-found recovery diagnostics
• delegate durable state construction to the previously reviewed Read flattener
• cover success, scope, not-found classification, malformed state, missing client, and nil response with a fake client

Why this is v1 work

Resource Read must not re-resolve a changed provider default or treat every 404 as proof the extension was deleted. This pure core establishes safe state-scoped metadata behavior before the Terraform Read adapter and complete resource shell are registered.

Intentionally unsupported

• no Terraform Read request/response adapter
• no resource registration
• no Delete or Import behavior
• no archive download or Chrome Web Store operation
• no browser/session/runtime operation
• no runtime fields in Terraform state

Verification

• gofmt -l cmd internal
• go test -count=20 ./internal/resources/extension
• go test -race -count=1 ./internal/resources/extension
• go test -count=1 -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check

All commands passed locally. Tests are fake-client based, deterministic, and require no network or container.

Acceptance status

No registered Terraform resource or complete lifecycle is introduced, so live acceptance testing is not applicable to this Read-core slice.

Remaining risk

The API does not return project identity with extension metadata. Existing resources must remain pinned to the scope recorded in Terraform state, and unqualified imports under API-key-bound scope cannot later prove an explicit project without replacement.

---

Note

Medium Risk
Read governs whether Terraform drops extension resources from state; misclassified 404s would be disruptive, though the change explicitly narrows removal to coded not_found and pins scope to stored project_id.

Overview
Adds readExtension, a provider-core read path for the extension resource that fetches durable metadata via a narrow extensionReader interface and maps API results through the existing flattenExtensionRead helper.

Read uses only id and project_id already in Terraform state (including empty project for API-key-bound scope) and refuses to call the API when id is missing/unknown or project_id is unknown. On success it returns updated state; it signals removal from state only when projectscope.IsNotFound matches the API’s coded extension not_found, while project_not_found, uncoded 404s, access errors, nil responses, and missing client produce diagnostics that keep state (with extension id and resolved scope in error text where relevant).

read_test.go exercises success/flattening, not-found classification, pre-flight state validation, and client/empty-response failures with a fake client (and asserts kernelclient.Clients satisfies extensionReader).

^{Reviewed by Cursor Bugbot for commit 70396df. Bugbot is set up for automated code reviews on this repo. Configure here.}