not_null: disallow unknown values and check if the underlying value i…

…s null.

internal/provider/not_null_function.go

@@ -47,5 +47,19 @@ func (r NotNullFunction) Run(ctx context.Context, req function.RunRequest, resp
 		return
 	}
 
-	resp.Error = function.ConcatFuncErrors(resp.Result.Set(ctx, !argument.IsNull()))
+	if argument.IsNull() {
+		if err := resp.Result.Set(ctx, false); err == nil {
+			return
+		}
+		return
+	}
+
+	if !argument.IsUnderlyingValueNull() {
+		if err := resp.Result.Set(ctx, true); err == nil {
+			return
+		}
+		return
+	}
+
+	resp.Error = function.ConcatFuncErrors(resp.Result.Set(ctx, false))
 }

internal/provider/not_null_function_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/hashicorp/go-version"
+	"github.com/hashicorp/terraform-plugin-testing/config"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/tfversion"
 )
@@ -220,13 +221,63 @@ output "test" {
 	})
 }
 
+func TestNotNullFunction_compoundValidation(t *testing.T) {
+	t.Parallel()
+	resource.UnitTest(t, resource.TestCase{
+		TerraformVersionChecks: []tfversion.TerraformVersionCheck{
+			tfversion.SkipBelow(version.Must(version.NewVersion(MinimalRequiredTerraformVersion))),
+		},
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: `
+variable "ipv4_ipam_pool_id" {
+  default     = null
+  description = "ID of the IPv4 IPAM pool to use for the VPC."
+  type        = string
+}
+
+variable "cidr_block" {
+  default     = null
+  description = "CIDR block for the VPC."
+  type        = string
+
+  validation {
+    condition = provider::assert::cidr(var.cidr_block)
+    error_message = "CIDR block must be a valid CIDR range."
+  }
+
+  validation {
+    condition = anytrue([
+	  provider::assert::not_null(var.cidr_block), 
+	  provider::assert::not_null(var.ipv4_ipam_pool_id)
+	])
+    error_message = "Exactly one of cidr_block or ipv4_ipam_pool_id must be provided."
+  }
+}
+				`,
+				ConfigVariables: config.Variables{
+					"cidr_block": config.StringVariable("10.0.42.0/24"),
+				},
+				Check: resource.ComposeAggregateTestCheckFunc(),
+			},
+		},
+	})
+}
+
 func TestNotNullFunction_falseCases(t *testing.T) {
 	t.Parallel()
 	resource.UnitTest(t, resource.TestCase{
 		TerraformVersionChecks: []tfversion.TerraformVersionCheck{
 			tfversion.SkipBelow(version.Must(version.NewVersion(MinimalRequiredTerraformVersion))),
 		},
 		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"wireguard": {
+				Source:            "OJFord/wireguard",
+				VersionConstraint: "0.3.1",
+			},
+		},
 		Steps: []resource.TestStep{
 			{
 				Config: `
@@ -235,6 +286,23 @@ locals {
 }
 output "test" {
   value = provider::assert::not_null(local.object)
+}
+				`,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckOutput("test", "false"),
+				),
+			},
+			{
+				Config: `
+resource "wireguard_asymmetric_key" "main" {}
+
+data "wireguard_config_document" "main" {
+  private_key = wireguard_asymmetric_key.main.private_key
+}
+
+output "test" {
+  // .addresses is always null in this configuration
+  value = provider::assert::not_null(data.wireguard_config_document.main.addresses)
 }
 				`,
 				Check: resource.ComposeAggregateTestCheckFunc(