fix(secret): add support of secret path

Author: estellesoulard

plugins/module_utils/model.py

@@ -74,6 +74,7 @@ class Secret(Model):
     id: str = ""
     description: str = ""
     tags: list[str] = field(default_factory=list)
+    path: str = "/"
 
 
 @dataclass

plugins/module_utils/scaleway_secret.py

@@ -23,15 +23,22 @@ def build_secret_version(parameters: dict) -> SecretVersion:
 
 def get_secret(api: "SecretV1Beta1API", **kwargs) -> Secret:
     """
-    Get a secret by secret_id or name
+    Get a secret by secret_id or name with optional path.
     """
     if "secret_id" in kwargs:
         secret = api.get_secret(secret_id=kwargs["secret_id"])
 
     elif "name" in kwargs:
-        secrets = api.list_secrets(name=kwargs["name"], scheduled_for_deletion=False)
+        list_kwargs = dict(name=kwargs["name"], scheduled_for_deletion=False)
+        if "path" in kwargs:
+            list_kwargs["path"] = kwargs["path"]
+        secrets = api.list_secrets(**list_kwargs)
 
         if len(secrets.secrets) == 0:
+            if "path" in kwargs:
+                raise SecretNotFound(
+                    f"Secret {kwargs['name']} not found at path {kwargs['path']}"
+                )
             raise SecretNotFound(f"Secret {kwargs['name']} not found")
 
         secret = secrets.secrets[0]
@@ -72,7 +79,10 @@ def update_secret(
 
     return changed, local_model, remote_model
     """
-    remote_model = get_secret(api, name=parameters.get("name"))
+    lookup = {"name": parameters.get("name")}
+    if "path" in parameters:
+        lookup["path"] = parameters["path"]
+    remote_model = get_secret(api, **lookup)
 
     # build and diff source model with the api one
     local_model = build_secret(parameters)

plugins/modules/scaleway_secret.py

@@ -31,6 +31,11 @@
         description: name
         type: str
         required: true
+    path:
+        description: path
+        type: str
+        required: false
+        default: /
     project_id:
         description: project_id
         type: str
@@ -203,6 +208,7 @@ def main() -> None:
         dict(
             state=dict(type="str", default="present", choices=["absent", "present"]),
             name=dict(type="str", required=True),
+            path=dict(type="str", required=False, default="/"),
             project_id=dict(type="str", required=False),
             tags=dict(type="list", required=False, elements="str"),
             description=dict(type="str", required=False),

tests/unit/plugins/test_scaleway_secret.py

@@ -91,6 +91,44 @@ def test_create_with_default_project_id(
             },
         )
 
+    @pytest.mark.parametrize(
+        "set_module_args",
+        [
+            {
+                "name": "test_secret",
+                "path": "/custom/path",
+                "tags": ["test", "secret"],
+                "description": "test_description",
+                "protected": False,
+            }
+        ],
+        indirect=True,
+    )
+    @patch.object(secret_api, "unmarshal_Secret")
+    @patch.object(secret_api.SecretV1Beta1API, "_request")
+    def test_create_with_custom_path(
+        self,
+        mock_request,
+        mock_unmarshal_secret,
+        scaleway_config_profile,
+        set_module_args,
+    ):
+        mock_unmarshal_secret.return_value = MagicMock()
+        mock_request.return_value = MagicMock(status_code=201)
+        scaleway_secret.main()
+        mock_request.assert_called_once_with(
+            "POST",
+            f"/secret-manager/v1beta1/regions/{scaleway_config_profile.default_region}/secrets",
+            body={
+                "name": "test_secret",
+                "path": "/custom/path",
+                "tags": ["test", "secret"],
+                "description": "test_description",
+                "protected": False,
+                "project_id": scaleway_config_profile.default_project_id,
+            },
+        )
+
     @pytest.mark.parametrize(
         "set_module_args",
         [
@@ -130,6 +168,173 @@ def __dict__(self):
             f"/secret-manager/v1beta1/regions/{scaleway_config_profile.default_region}/secrets/{self.test_uuid}",
         )
 
+    @pytest.mark.parametrize(
+        "set_module_args",
+        [
+            {
+                "name": "test_secret",
+                "path": "/custom/path",
+                "state": "absent",
+            }
+        ],
+        indirect=True,
+    )
+    @patch.object(secret_api, "unmarshal_ListSecretsResponse")
+    @patch.object(secret_api.SecretV1Beta1API, "_request")
+    def test_delete_secret_with_path(
+        self,
+        mock_request,
+        mock_unmarshal_list_secrets_response,
+        scaleway_config_profile,
+        set_module_args,
+    ):
+        class MockedSecret(MagicMock):
+            id = self.test_uuid
+            name = "test_secret"
+            path = "/custom/path"
+
+            def __dict__(self):
+                return {
+                    "id": self.id,
+                    "name": self.name,
+                    "path": self.path,
+                }
+
+        mock_unmarshal_list_secrets_response.return_value = MagicMock(
+            secrets=[MockedSecret]
+        )
+        mock_request.side_effect = [
+            MagicMock(status_code=200),  # list secret response
+            MagicMock(status_code=204),  # delete secret response
+        ]
+        scaleway_secret.main()
+        mock_request.assert_any_call(
+            "DELETE",
+            f"/secret-manager/v1beta1/regions/{scaleway_config_profile.default_region}/secrets/{self.test_uuid}",
+        )
+
+    @pytest.mark.parametrize(
+        "set_module_args",
+        [
+            {
+                "name": "test_secret",
+                "path": "/custom/path",
+                "tags": ["test", "secret"],
+                "description": "test_description",
+                "protected": False,
+                "state": "present",
+                "__check_mode__": True,
+            }
+        ],
+        indirect=True,
+    )
+    @patch.object(secret_api, "unmarshal_ListSecretsResponse")
+    @patch.object(secret_api, "unmarshal_Secret")
+    @patch.object(secret_api.SecretV1Beta1API, "_request")
+    def test_update_secret_with_path_check_mode(
+        self,
+        mock_request,
+        mock_unmarshal_secret,
+        mock_unmarshal_list_secrets_response,
+        scaleway_config_profile,
+        set_module_args,
+    ):
+        class MockedSecret(MagicMock):
+            id = self.test_uuid
+            name = "test_secret"
+            path = "/custom/path"
+            description = "old_description"
+            tags = ["old-tag"]
+
+            def __dict__(self):
+                return {
+                    "id": self.id,
+                    "name": self.name,
+                    "path": self.path,
+                    "description": self.description,
+                    "tags": self.tags,
+                }
+
+        mock_unmarshal_list_secrets_response.return_value = MagicMock(
+            secrets=[MockedSecret]
+        )
+        mock_unmarshal_secret.return_value = MagicMock()
+        mock_request.side_effect = [
+            MagicMock(status_code=200),  # list secrets response
+        ]
+        scaleway_secret.main()
+
+        mock_request.assert_called_once()
+        call = mock_request.call_args_list[0]
+        assert call[0][0] == "GET", "Only GET request should be made in check mode"
+
+    @pytest.mark.parametrize(
+        "set_module_args",
+        [
+            {
+                "name": "test_secret",
+                "path": "/custom/path",
+                "tags": ["test", "secret"],
+                "description": "test_description",
+                "protected": False,
+            }
+        ],
+        indirect=True,
+    )
+    @patch.object(secret_api, "unmarshal_ListSecretsResponse")
+    @patch.object(secret_api, "unmarshal_Secret")
+    @patch.object(secret_api.SecretV1Beta1API, "_request")
+    def test_update_secret_with_path(
+        self,
+        mock_request,
+        mock_unmarshal_secret,
+        mock_unmarshal_list_secrets_response,
+        scaleway_config_profile,
+        set_module_args,
+    ):
+        class MockedSecret(MagicMock):
+            id = self.test_uuid
+            name = "test_secret"
+            path = "/custom/path"
+            description = "old_description"
+
+            def __dict__(self):
+                return {
+                    "id": self.id,
+                    "name": self.name,
+                    "path": self.path,
+                    "description": self.description,
+                }
+
+        mock_unmarshal_list_secrets_response.return_value = MagicMock(
+            secrets=[MockedSecret]
+        )
+        mock_unmarshal_secret.return_value = MagicMock()
+        mock_request.side_effect = [
+            MagicMock(status_code=200),  # list secrets response
+            MagicMock(status_code=200),  # update secret response
+        ]
+        scaleway_secret.main()
+
+        list_call = None
+        update_call = None
+        for call in mock_request.call_args_list:
+            if call[0][0] == "GET":
+                list_call = call
+            elif call[0][0] == "PATCH":
+                update_call = call
+
+        assert list_call is not None, "List secrets call should be made"
+        assert update_call is not None, "Update secret call should be made"
+
+        update_body = update_call[1]["body"]
+        assert "path" in update_body, "Update should include path parameter"
+        assert update_body["path"] == "/custom/path", "Path should be /custom/path"
+        assert update_body["description"] == "test_description", (
+            "Description should be updated"
+        )
+        assert update_body["tags"] == ["test", "secret"], "Tags should be updated"
+
 
 @patch.object(basic.AnsibleModule, "exit_json", MagicMock())
 class TestScalewaySecretVersion: