laniakea-api-server 0.2.0__tar.gz → 0.2.1__tar.gz

{laniakea_api_server-0.2.0 → laniakea_api_server-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: laniakea-api-server
-Version: 0.2.0
+Version: 0.2.1
 Summary: Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration
 Project-URL: Homepage, https://github.com/laniakea/laniakea-api
 Project-URL: Issues, https://github.com/laniakea/laniakea-api/issues

{laniakea_api_server-0.2.0 → laniakea_api_server-0.2.1}/laniakea_api/models.py

@@ -35,6 +35,7 @@ class UserCredentials(BaseModel):
     """
     # NOTE: now no credentials is essential. Consider changing this logic
     # OpenStack
+    ssh_private_key: Optional[str] = None
     openstack_ssh_key:               Optional[str] = None
     openstack_app_credential_id:     Optional[str] = None
     openstack_app_credential_secret: Optional[str] = None

{laniakea_api_server-0.2.0 → laniakea_api_server-0.2.1}/laniakea_api/queue.py

@@ -65,16 +65,35 @@ vault_client = hvac.Client(
     verify=VAULT_TLS_VERIFY,
 )
 
+
 def vault_write_credentials(user_sub: str, creds: dict) -> str:
     """
     Write user credentials to Vault under secret/data/<sub>/credentials.
+
+    MERGE semantics: the existing secret is read first and only the fields
+    provided in `creds` are overwritten. Fields already in Vault but not in
+    this request are preserved (e.g. ssh_private_key must survive a
+    GARR-only app-credentials update).
+
     Returns the vault path on success; raises HTTP 502 on failure.
     """
     vault_path = f"{user_sub}/credentials"
     try:
+        # Read existing secret (if any) to merge with incoming fields
+        try:
+            existing = vault_client.secrets.kv.v2.read_secret_version(
+                path=vault_path,
+                mount_point=VAULT_MOUNT,
+                raise_on_deleted_version=True,
+            )["data"]["data"]
+        except Exception:
+            existing = {}
+
+        merged = {**existing, **creds}
+
         vault_client.secrets.kv.v2.create_or_update_secret(
             path=vault_path,
-            secret=creds,
+            secret=merged,
             mount_point=VAULT_MOUNT,
         )
     except Exception as exc:
@@ -84,7 +103,6 @@ def vault_write_credentials(user_sub: str, creds: dict) -> str:
         )
     return vault_path
 
-
 def check_vault() -> str:
     """
     Returns 'authenticated' or an error string.

{laniakea_api_server-0.2.0 → laniakea_api_server-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "laniakea-api-server"
-version = "0.2.0"
+version = "0.2.1"
 description = "Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration"
 readme = "README.md"
 license = { text = "MIT" }