feat: resolve auth profiles through secret ids

2026-04-07 00:43:35 +03:00
parent a6388e4353
commit 191e749b14
10 changed files with 237 additions and 40 deletions
@@ -25,11 +25,11 @@ use crank_registry::{
    CreateVersionRequest, CreateWorkspaceRequest, InvitationRecord, InvocationLogRecord,
    ListInvocationLogsQuery, MembershipRecord, OperationAgentRef, OperationSampleMetadata,
    OperationSummary, OperationUsageSummary, OperationVersionRecord, Page, PlatformApiKeyRecord,
-    PostgresRegistry, PublishAgentRequest, PublishRequest, RegistryOperation, RotateSecretRequest,
-    SampleKind, SaveAgentBindingsRequest, SaveAuthProfileRequest, SaveDescriptorMetadataRequest,
-    SaveSampleMetadataRequest, StreamSessionFilter, UpdateWorkspaceRequest, UsageAgentBreakdown,
-    UsageBucket, UsageOperationBreakdown, UsageQuery, UsageSummary, UsageTimelinePoint,
-    WorkspaceMembershipRecord, WorkspaceRecord,
+    PostgresRegistry, PublishAgentRequest, PublishRequest, RegistryError, RegistryOperation,
+    RotateSecretRequest, SampleKind, SaveAgentBindingsRequest, SaveAuthProfileRequest,
+    SaveDescriptorMetadataRequest, SaveSampleMetadataRequest, StreamSessionFilter,
+    UpdateWorkspaceRequest, UsageAgentBreakdown, UsageBucket, UsageOperationBreakdown, UsageQuery,
+    UsageSummary, UsageTimelinePoint, WorkspaceMembershipRecord, WorkspaceRecord,
 };
 use crank_runtime::{PreparedRequest, RuntimeError, RuntimeExecutor, RuntimeOperation};
 use crank_schema::Schema;
@@ -2085,6 +2085,19 @@ impl AdminService {
        secret_id: &SecretId,
    ) -> Result<(), ApiError> {
        self.ensure_workspace_exists(workspace_id).await?;
+        if let Some(profile) = self
+            .registry
+            .list_auth_profiles_referencing_secret(workspace_id, secret_id)
+            .await?
+            .into_iter()
+            .next()
+        {
+            return Err(RegistryError::SecretReferencedByAuthProfile {
+                secret_id: secret_id.as_str().to_owned(),
+                auth_profile_id: profile.id.as_str().to_owned(),
+            }
+            .into());
+        }
        self.registry.delete_secret(workspace_id, secret_id).await?;
        info!(secret_id = %secret_id.as_str(), "secret deleted");
        Ok(())
@@ -2774,6 +2787,8 @@ impl AdminService {
    ) -> Result<AuthProfile, ApiError> {
        validate_auth_profile_kind(payload.kind, &payload.config)?;
        self.ensure_workspace_exists(workspace_id).await?;
+        self.validate_auth_profile_secret_ids(workspace_id, &payload.config)
+            .await?;

        let now = now_string()?;
        let profile = AuthProfile {
@@ -2797,6 +2812,18 @@ impl AdminService {
        Ok(profile)
    }

+    async fn validate_auth_profile_secret_ids(
+        &self,
+        workspace_id: &WorkspaceId,
+        config: &AuthConfig,
+    ) -> Result<(), ApiError> {
+        for secret_id in config.secret_ids() {
+            self.get_secret(workspace_id, secret_id).await?;
+        }
+
+        Ok(())
+    }
+
    #[instrument(skip(self), fields(operation_id = %operation_id.as_str(), version = query.version.unwrap_or_default(), mode = ?query.mode))]
    pub async fn export_operation(
        &self,