Call resource mutate hook before validate hook (NET-4907) (#18178)

agent/grpc-external/services/resource/write.go

@@ -72,14 +72,14 @@ func (s *Server) Write(ctx context.Context, req *pbresource.WriteRequest) (*pbre
 		)
 	}
 
-	if err = reg.Validate(req.Resource); err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
-	}
-
 	if err = reg.Mutate(req.Resource); err != nil {
 		return nil, status.Errorf(codes.Internal, "failed mutate hook: %v", err.Error())
 	}
 
+	if err = reg.Validate(req.Resource); err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
 	// At the storage backend layer, all writes are CAS operations.
 	//
 	// This makes it possible to *safely* do things like keeping the Uid stable

internal/resource/registry.go

@@ -42,11 +42,9 @@ type Registration struct {
 	// check for required fields).
 	Validate func(*pbresource.Resource) error
 
-	// Mutate is called to fill out any autogenerated fields (e.g. UUIDs).
+	// Mutate is called to fill out any autogenerated fields (e.g. UUIDs) or
+	// apply defaults before validation.
 	Mutate func(*pbresource.Resource) error
-
-	// In the future, we'll add hooks, the controller etc. here.
-	// TODO: https://github.com/hashicorp/consul/pull/16622#discussion_r1134515909
 }
 
 type ACLHooks struct {