feat(team_vault_folder): add archestra_team_vault_folder resource (EE) - #102
Open
priyanshu0x wants to merge 1 commit into
Open
priyanshu0x wants to merge 1 commit into
priyanshu0x wants to merge 1 commit into
Conversation
Adds `archestra_team_vault_folder` mapping to the EE per-team Vault folder endpoints (`POST/GET/DELETE /api/teams/:teamId/vault-folder`). Each team can mount exactly one Vault folder; secrets stored under that path become readable by team members in BYOS mode. Design notes: - The backend's `SetTeamVaultFolder` is an idempotent upsert on (teamId, vaultPath), so Create and Update share one `setFolder` helper. `team_id` is `RequiresReplace` since the one-to-one relationship is keyed on team. - `vault_path` ships a plan-time format validator that mirrors the backend's checks (rejects `..`, leading `/`, trailing `/`) — the backend returns 400 with "Invalid Vault path" otherwise. The validator surfaces the failure before any apply round-trip. - Test setup gates on both `testAccRequireEnterprise` and `testAccRequireByosEnabled` — the backend's `assertByosEnabled()` returns 403 "Readonly Vault is not enabled" when BYOS isn't active, so an EE-only stack would 403-fail mysteriously without the second gate. - ImportState uses the bare `team_id` (the resource is 1:1-keyed on team), and Read populates the rest. Acceptance coverage: - Happy-path Create + Read + Update + Import with idempotent re-apply. - Plan-time validator sub-tests for each of the three rejected path shapes. - Read-404 recovery test (out-of-band delete → next refresh drops → plan recreates). Un-excludes the `Vault` OpenAPI tag in `oapi-config.yaml` and regenerates the client.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #101.
Summary
archestra_team_vault_folder(CRUD + Import) mapping to the EE per-team Vault folder endpoints (POST/GET/DELETE /api/teams/:teamId/vault-folder). Each team can mount exactly one Vault KV folder; team members gain read access to secrets under that path in BYOS mode.VaultOpenAPI tag inoapi-config.yamland regeneratesinternal/client/archestra_client.go.completeexample module.Design notes
SetTeamVaultFolderis an idempotent upsert on(teamId, vaultPath), so Create and Update share onesetFolderhelper.team_idisRequiresReplacebecause the one-to-one relationship is keyed on team.vault_pathships a plan-time format validator (vaultPathFormatValidator) that mirrors the backend's rejections (.., leading/, trailing/). The backend returns 400Invalid Vault pathotherwise; the validator surfaces the failure before any apply round-trip.testAccRequireEnterpriseandtestAccRequireByosEnabled. The backend'sassertByosEnabled()returns 403Readonly Vault is not enabledwhen BYOS isn't active, so an EE-only stack would 403-fail mysteriously without the second gate.team_id; Read populates the rest.