I don't recall if you can write to a config block (blocks can't be computed) like this. I suspect you can't.

If you can, I assume it would just be to error if the post-apply plan isn't empty.
For that you'd need to usetypes.ObjectValueFrom and provide it the type of the object using amap[string]attr.Type. I've got an example on the template resource & data source.

I think I figured something out that works 😄

I just realised we're missing enterprise/premium entitlement checks on this and the provisioner key resource. We have them on the workspace proxy and the enterprise features of template resources, but they run duringapply, when they should really run duringplan. Let's not worry about it for now, and at some point I'll see if I can get them working at plan-time using a plan modifier (validators don't have the provider config we need).

If that doesn't work we can just copy the ones at apply-time to these two new resources.

This defaults tofalse on coder right? Should just have adefault set in the schema, and then you can remove the null checks on it.

would that preventgroup_sync from beingnull tho?

Nope, the default only gets computed if the parent is known, so:

    group_sync {}

would default any values within it, but omitting the block altogether would not.

If you wanted to default the block to known, and the bool to false, then you'd also add aDefault to the block itself.