Unit test CanCreate

provider/pkg/resources/customresources/custom_pim.go

@@ -72,8 +72,6 @@ func pimRoleManagementPolicy(lookupResource resources.ResourceLookupFunc, crudCl
 				return nil, err
 			}
 
-			// TODO sort rules?
-
 			outputs := client.ResponseBodyToSdkOutputs(resp)
 			outputs[OriginalStateKey] = originalState
 			return outputs, nil
@@ -108,7 +106,6 @@ func pimRoleManagementPolicy(lookupResource resources.ResourceLookupFunc, crudCl
 
 		// PIM Role Management Policies cannot be deleted. Instead, we reset the policy to its default.
 		Delete: func(ctx context.Context, id string, previousInputs, state resource.PropertyMap) error {
-			queryParams := map[string]any{"api-version": client.ApiVersion()}
 			if !state.HasValue(OriginalStateKey) {
 				logging.V(3).Infof("Warning: no original state found for %s, cannot reset", id)
 				return nil
@@ -125,6 +122,7 @@ func pimRoleManagementPolicy(lookupResource resources.ResourceLookupFunc, crudCl
 				return err
 			}
 
+			queryParams := map[string]any{"api-version": client.ApiVersion()}
 			_, _, err = client.CreateOrUpdate(ctx, id, origRequest, queryParams)
 			return err
 		},

provider/pkg/resources/customresources/custom_pim_test.go

@@ -1,6 +1,7 @@
 package customresources
 
 import (
+	"context"
 	"testing"
 
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
@@ -9,6 +10,17 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestCanCreate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns nil", func(t *testing.T) {
+		t.Parallel()
+		r, err := pimRoleManagementPolicy(nil, nil)
+		require.NoError(t, err)
+		assert.Nil(t, r.CanCreate(context.Background(), ""))
+	})
+}
+
 func TestRestoreDefaultsForDeletedRules(t *testing.T) {
 	t.Run("nothing to restore", func(t *testing.T) {
 		// There's one rule, it's in the original state with a different value for isExpirationRequired.