From 16fb151cbb5084b7844d25d96de9704c1eb385bc Mon Sep 17 00:00:00 2001 From: mvdbeek Date: Tue, 21 Apr 2026 15:18:50 +0200 Subject: [PATCH] Address review: clarify version comment and swap test order --- lib/galaxy/security/vault.py | 2 +- test/unit/data/security/test_vault.py | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/galaxy/security/vault.py b/lib/galaxy/security/vault.py index 2fe24df4e2a..af481ef4743 100644 --- a/lib/galaxy/security/vault.py +++ b/lib/galaxy/security/vault.py @@ -157,7 +157,7 @@ class HashicorpVault(Vault): return None def _read_legacy_and_migrate(self, key: str) -> Optional[str]: - # Galaxy < 26.x emitted a leading slash in Vault paths, which hvac's + # Galaxy <= 26.0 emitted a leading slash in Vault paths, which hvac's # format_url turned into a double-slash KV v2 key. Vault 1.x accepted # it silently; Vault 2.0 rejects it. Fall back to reading the legacy # form and rewrite under the canonical key so the secret survives the diff --git a/test/unit/data/security/test_vault.py b/test/unit/data/security/test_vault.py index 87aa86fc437..26023fe01f6 100644 --- a/test/unit/data/security/test_vault.py +++ b/test/unit/data/security/test_vault.py @@ -145,14 +145,14 @@ def test_vault_key_prefix_wrapper_emits_canonical_path(prefix): inner.client.secrets.kv.read_secret_version.return_value = {"data": {"data": {"value": "v"}}} vault = VaultKeyValidationWrapper(VaultKeyPrefixWrapper(inner, prefix=prefix)) + assert vault.read_secret("user/1/preferences/editor") == "v" + inner.client.secrets.kv.read_secret_version.assert_called_once_with(path="galaxy/user/1/preferences/editor") + vault.write_secret("user/1/preferences/editor", "vscode") inner.client.secrets.kv.v2.create_or_update_secret.assert_called_once_with( path="galaxy/user/1/preferences/editor", secret={"value": "vscode"} ) - assert vault.read_secret("user/1/preferences/editor") == "v" - inner.client.secrets.kv.read_secret_version.assert_called_once_with(path="galaxy/user/1/preferences/editor") - @pytest.mark.parametrize("prefix", ["", "/", "gal//axy", "gal /axy", "gal/ axy"]) def test_vault_key_prefix_wrapper_rejects_invalid_prefix(prefix):