fix(terraform): restore d.Partial(true) on a rejected /key/update

[devin-ai-integration]

TLDR

Problem this solves:

• Terraform provider CI is red on the default branch since fix(terraform): keep prior state when a virtual key update is rejected #40512 and fix(terraform): preserve undeclared server-side key metadata on update #40514 landed together
• The d.Partial(true) from fix(terraform): keep prior state when a virtual key update is rejected #40512 ended up on the wrong error path after the two PRs were combined
• A rejected /key/update once again writes the planned values into Terraform state

How it solves it:

• Call d.Partial(true) before returning the /key/update error, the same one-line fix fix(terraform): keep prior state when a virtual key update is rejected #40512 shipped

User Flow

Before: an operator whose litellm_key update is rejected by the proxy sees the rejected values land in state anyway

1. They change budget_duration = "bad" on a litellm_key and run terraform apply
2. POST http://localhost:4000/key/update returns 400 Invalid budget_duration 'bad' and apply fails
3. terraform plan reports no changes because the state already holds budget_duration = "bad"

After: the same rejected apply leaves the prior state alone

1. They change budget_duration = "bad" on a litellm_key and run terraform apply
2. POST http://localhost:4000/key/update returns 400 Invalid budget_duration 'bad' and apply fails
3. terraform plan still shows the pending budget_duration change, so the mistake stays visible

Relevant issues

Follow-up to #40512 and #40514

Linear ticket

Resolves LIT-6398

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/test_litellm/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

The regression test from #40512, TestResourceKeyUpdateFailureKeepsPriorState, drives the real provider Apply against an httptest proxy that answers 400 on /key/update. It is the check that is currently red on litellm_internal_staging. The live Terraform CLI run against a real proxy for this behavior is in #40512 and was not repeated for this one-line repair

Before (87e2026)

1. cd terraform/provider && go test -timeout 120s -run TestResourceKeyUpdateFailureKeepsPriorState ./litellm/
2. Output:

   --- FAIL: TestResourceKeyUpdateFailureKeepsPriorState (0.00s)
       resource_key_test.go:356: failed update persisted budget_duration="bad" into state, want it absent
   FAIL
   FAIL	github.com/BerriAI/terraform-provider-litellm/litellm	0.008s
   

After (ecbea89)

1. cd terraform/provider && go test -timeout 120s -run TestResourceKeyUpdateFailureKeepsPriorState ./litellm/
2. Output:

   ok  	github.com/BerriAI/terraform-provider-litellm/litellm	0.008s
   

3. gofmt -l . prints nothing, go vet ./... and go build ./... pass, go test -timeout 120s ./... is green for both packages

Type

🐛 Bug Fix

Caveats (if any)

Low

• No new test: the existing fix(terraform): keep prior state when a virtual key update is rejected #40512 regression test already catches this and is what turned red
• Live Terraform proof lives in fix(terraform): keep prior state when a virtual key update is rejected #40512, not re-run here

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

Link to Devin session: https://app.devin.ai/sessions/9dee2130c54c4433a7dd04ee48fb777c
Open in Devin Desktop: https://app.devin.ai/desktop/session/9dee2130c54c4433a7dd04ee48fb777c?variant=devin
Requested by: @yassin-berriai

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

Restores Terraform partial-state handling when the LiteLLM key update API rejects an update.

• Enables partial mode before returning update diagnostics.
• Prevents rejected planned values from replacing the prior Terraform state.
• Keeps successful update behavior unchanged.

Confidence Score: 5/5

The PR appears safe to merge and correctly restores prior-state preservation for rejected key updates.

The change is narrowly placed on the API error path, and the relevant regression test confirms that failed updates retain the previous state without persisting rejected planned values.

Important Files Changed

Filename	Overview
terraform/provider/litellm/resource_key.go	Adds d.Partial(true) to the rejected key-update path so Terraform preserves the prior resource state.

_{Reviews (1): Last reviewed commit: "fix(terraform): restore d.Partial(true) ..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!