Repository navigation
feat(coderd_ai_provider): delete the stored API key with an empty api_key_wo - #451
Conversation
…_key_wo The resource had no way to delete a stored provider key: an empty api_key_wo was rejected, a version bump without a key errored, and removing the attribute kept the key. Accept api_key_wo = "" with a version bump and send an empty api_keys list, which the Coder API treats as deleting every stored key. Mirrors how empty Bedrock credentials clear stored credentials.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Warn when an apply deletes the stored API key, and report a missing api_key_wo on a version bump at plan time instead of apply time. Drop tests that duplicate stronger coverage.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cf621f18ba
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review re: Skip null destroy plans before reading attributes Not an issue. ModifyPlan reads single attributes with GetAttribute, not the whole model with req.Plan.Get. In terraform-plugin-framework v1.19.0, ValueAtPath ignores tftypes.ErrInvalidStep and returns a null value without a diagnostic (internal/fwschemadata/data_value.go:66-67), and tftypes returns that error for any null value. On destroy the planned api_key_wo_version is therefore null, and the |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Problem
coderd_ai_providercannot delete a stored provider API key:api_key_wo = ""fails validation (string length must be at least 1).api_key_wo_versionwithoutapi_key_wofails withMissing API Key.api_key_wofrom config keeps the stored key, by design.The only way out was replacing the resource, which deletes and recreates the provider under a new ID. That blocks switching an existing
anthropicprovider from api.anthropic.com tosettings.claude_platform_awsin place: Coder authenticates with a stored key before falling back to SigV4, so the old api.anthropic.com key keeps being sent to Claude Platform. Replacing the provider instead also churns everything that references it, such ascoderd_agents_model.ai_provider_id.Fix
Setting
api_key_wo = ""together with a newapi_key_wo_versionnow sendsapi_keys: []. The Coder API deletes every stored key that is not listed in the request, so the stored key goes away. On create, an empty key sends no keys. Without a version bump nothing changes, as before.This mirrors the existing Bedrock behavior, where empty
access_key_woandaccess_key_secret_wowith acredentials_wo_versionbump clear stored credentials. The acceptance test gains a step that clears the OpenAI key and checks thatapi_key_maskedis gone.