feat(teo): add message field to teo bind security template resource

Author: iac-agent

.changelog/4352.txt

@@ -1,3 +1,3 @@
 ```release-note:enhancement
-resource/tencentcloud_teo_bind_security_template: add message computed parameter and replace read API with DescribeSecurityTemplateBindings
-```
+resource/tencentcloud_teo_bind_security_template: add `message` computed parameter
+```

openspec/changes/archive/2026-07-28-add-teo-bind-security-template-message/design.md

@@ -0,0 +1,32 @@
+## Context
+
+The `tencentcloud_teo_bind_security_template` resource manages template-to-domain bindings for TEO security policies. The Read path uses `DescribeTeoBindSecurityTemplateById` which returns an `EntityStatus` struct. The vendor SDK's `EntityStatus` struct already includes a `Message` field (instance configuration delivery message), but the resource schema currently does not expose it.
+
+The service layer `DescribeTeoBindSecurityTemplateById` handles special-case logic for locating bindings and is intentionally kept as-is. This change only adds the `message` computed field to the resource schema and sets it in the Read function when the returned `EntityStatus.Message` is non-nil.
+
+## Goals / Non-Goals
+
+**Goals:**
+- Add a `message` computed attribute to `tencentcloud_teo_bind_security_template` resource
+- Preserve all existing behavior (status field, id construction, nil handling, retry logic)
+
+**Non-Goals:**
+- Do not modify the service layer `DescribeTeoBindSecurityTemplateById` function or any other service code
+- Do not change the Create or Delete paths (they use `BindSecurityTemplateToEntity` which is unaffected)
+- Do not add `message` as an input parameter (it is read-only/computed)
+- Do not change the `EntityStatus` struct in the vendor SDK
+
+## Decisions
+
+### Decision 1: Add `message` as a `Computed` field in the schema
+
+**Rationale**: `Message` is read-only configuration delivery information. It should be `Computed` only (not `Required` or `Optional`), matching the pattern of the existing `status` field.
+
+### Decision 2: Set `message` from `respData.Message` only when non-nil
+
+**Rationale**: Following the existing pattern for the `status` field, the Read function only calls `d.Set("message", ...)` when `respData.Message` is not nil. This avoids overwriting the field unnecessarily and keeps the behavior consistent with the rest of the Read function.
+
+## Risks / Trade-offs
+
+- **Risk**: The service layer may not currently populate the `Message` field, so the `message` attribute may remain empty until the service layer is updated separately.
+  → **Mitigation**: This is acceptable and intentional — the service layer handles special cases and must not be modified in this change. The schema field is additive and backward compatible. When the service layer returns `Message`, it will automatically flow through to the resource state without further schema changes.

openspec/changes/archive/2026-07-28-add-teo-bind-security-template-message/proposal.md

@@ -0,0 +1,20 @@
+## Why
+
+The `tencentcloud_teo_bind_security_template` resource currently exposes only `status` from the template binding query result. The cloud API `EntityStatus` struct returned by the read path includes an additional `Message` field that provides human-readable delivery status information (e.g., failure reasons). Exposing this `Message` field as a computed attribute gives users visibility into configuration delivery details without having to check the cloud console.
+
+## What Changes
+
+- Add a new `message` computed attribute to the `tencentcloud_teo_bind_security_template` resource schema, sourced from the `Message` field of the `EntityStatus` returned by the read path.
+
+## Capabilities
+
+### New Capabilities
+- `teo-bind-security-template-message`: Expose the `Message` field of `EntityStatus` as a computed attribute on `tencentcloud_teo_bind_security_template`.
+
+## Impact
+
+- **Affected files**:
+  - `tencentcloud/services/teo/resource_tc_teo_bind_security_template.go` — add `message` schema field and set it in Read
+  - `tencentcloud/services/teo/resource_tc_teo_bind_security_template.md` — add `message` to example usage
+  - `tencentcloud/services/teo/resource_tc_teo_bind_security_template_test.go` — add test coverage for `message`
+- **Backward compatibility**: Fully backward compatible — the new `message` field is computed-only, and the existing `status` field behavior is preserved

openspec/changes/archive/2026-07-28-add-teo-bind-security-template-message/specs/teo-bind-security-template-read-api/spec.md

@@ -1,16 +1,16 @@
 ## ADDED Requirements
 
-### Requirement: Resource exposes Message from DescribeSecurityTemplateBindings
-The `tencentcloud_teo_bind_security_template` resource SHALL expose a `message` computed attribute of type `TypeString` in its schema. The value SHALL be sourced from the `Message` field of `EntityStatus` returned by the `DescribeSecurityTemplateBindings` API.
+### Requirement: Resource exposes Message field
+The `tencentcloud_teo_bind_security_template` resource SHALL expose a `message` computed attribute of type `TypeString` in its schema. The value SHALL be sourced from the `Message` field of the `EntityStatus` returned by the read path's service function.
 
 #### Scenario: Message is set during Read
-- **WHEN** the `DescribeSecurityTemplateBindings` API returns an `EntityStatus` with a non-nil `Message` field
+- **WHEN** the service function returns an `EntityStatus` with a non-nil `Message` field
 - **THEN** the resource Read function SHALL set `message` on the resource data to the value of `EntityStatus.Message`
 
-#### Scenario: Message is nil in API response
-- **WHEN** the `DescribeSecurityTemplateBindings` API returns an `EntityStatus` with a nil `Message` field
+#### Scenario: Message is nil in service response
+- **WHEN** the service function returns an `EntityStatus` with a nil `Message` field
 - **THEN** the resource Read function SHALL NOT call `d.Set("message", ...)` (the field retains its prior value or zero value)
 
 #### Scenario: Message is not set by user during Create
 - **WHEN** a user creates a `tencentcloud_teo_bind_security_template` resource without specifying `message`
-- **THEN** the resource SHALL still be created successfully because `message` is `Computed` only
+- **THEN** the resource SHALL still be created successfully because `message` is `Computed` only

openspec/changes/archive/2026-07-28-add-teo-bind-security-template-message/tasks.md

@@ -0,0 +1,18 @@
+## 1. Resource Schema Changes
+
+- [x] 1.1 Add `message` computed field (`TypeString`, `Computed: true`) to the resource schema in `resource_tc_teo_bind_security_template.go`.
+- [x] 1.2 In the `resourceTencentCloudTeoBindSecurityTemplateRead` function, set `message` from `respData.Message` when `respData.Message` is not nil.
+
+## 2. Documentation
+
+- [x] 2.1 Update `resource_tc_teo_bind_security_template.md` example usage to include the `message` attribute in the output.
+
+## 3. Testing
+
+- [x] 3.1 Add test cases in `resource_tc_teo_bind_security_template_test.go` to verify the `message` schema field exists and is `Computed`.
+- [x] 3.2 Add test case to verify the `message` attribute remains empty when the service layer does not populate `Message`.
+
+## 4. Validation
+
+- [x] 4.1 Verify the code compiles successfully with `go build ./...`. (Handled by tfpacer-finalize skill per workspace rules)
+- [x] 4.2 Run `make doc` to regenerate website documentation. (Handled by tfpacer-finalize skill per workspace rules)