fix: validate schema module inputs

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.0.1 - 2026-09-16
+
+- Validate module inputs and access rules before provider API requests.
+- Reject invalid permissions and conflicting settings without changing resource addresses.
+- Preserve provider defaults for optional values.
+
 ## 1.0.0 - 2026-09-09
 
 - Declare the module contract stable. The inputs, outputs, resource addresses, and provider

README.md

@@ -16,7 +16,7 @@ The resource addresses above are part of the DataTF import contract. Do not rena
 ```hcl
 module "schema" {
   source  = "536tech/schema/databricks"
-  version = "1.0.0"
+  version = "1.0.1"
 
   catalog_name = "sales"
   name         = "bronze"
@@ -61,6 +61,19 @@ The workspace pattern module checks the complete DataTF contract and its integra
 
 [Apache-2.0](LICENSE).
 
+## Input safeguards
+
+The module rejects blank required names and invalid access inputs during the plan.
+Cross-input preconditions preserve the Terraform 1.5 minimum and existing resource addresses.
+Provider and API checks still apply. These checks do not prove complete permission visibility.
+
+Each grant needs one unique principal and at least one nonblank privilege.
+The module does not freeze the Unity Catalog privilege list; the provider and API check supported privileges.
+`databricks_grants` manages the complete direct grant set on the object.
+Preserve the caller's required grants and review the plan before apply.
+Empty grants omit the grant resource; they do not declare an empty authoritative grant set.
+See [provider grant semantics](https://github.com/databricks/terraform-provider-databricks/blob/v1.130.0/docs/resources/grants.md).
+
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
 

tests/module.tftest.hcl

@@ -38,3 +38,35 @@ run "without_access" {
     error_message = "Empty access must omit the access resources."
   }
 }
+
+run "reject_blank_name" {
+  command = plan
+  variables {
+    name = "  "
+  }
+  expect_failures = [var.name]
+}
+
+run "reject_blank_principal" {
+  command = plan
+  variables {
+    grants = [{ principal = " ", privileges = ["SELECT"] }]
+  }
+  expect_failures = [var.grants]
+}
+
+run "reject_empty_privileges" {
+  command = plan
+  variables {
+    grants = [{ principal = "readers", privileges = [] }]
+  }
+  expect_failures = [var.grants]
+}
+
+run "reject_duplicate_principal" {
+  command = plan
+  variables {
+    grants = [{ principal = "readers", privileges = ["SELECT"] }, { principal = "readers", privileges = ["MODIFY"] }]
+  }
+  expect_failures = [var.grants]
+}

variables.tf

@@ -1,11 +1,23 @@
 variable "catalog_name" {
   description = "Name of the catalog that holds the schema."
   type        = string
+  nullable    = false
+
+  validation {
+    condition     = try(length(trimspace(var.catalog_name)) > 0, false)
+    error_message = "catalog_name must not be empty or blank."
+  }
 }
 
 variable "name" {
   description = "Schema name."
   type        = string
+  nullable    = false
+
+  validation {
+    condition     = try(length(trimspace(var.name)) > 0, false)
+    error_message = "name must not be empty or blank."
+  }
 }
 
 variable "storage_root" {
@@ -26,7 +38,16 @@ variable "grants" {
     principal  = string
     privileges = list(string)
   }))
-  default = []
+  default  = []
+  nullable = false
+
+  validation {
+    condition = try(alltrue([for grant in var.grants :
+      length(trimspace(grant.principal)) > 0 && length(grant.privileges) > 0 &&
+      alltrue([for privilege in grant.privileges : length(trimspace(privilege)) > 0])
+    ]) && length(distinct([for grant in var.grants : grant.principal])) == length(var.grants), false)
+    error_message = "Each grant needs a unique nonblank principal and at least one nonblank privilege."
+  }
 }
 
 variable "force_destroy" {