fix(secret): add support of secret path

Author: estellesoulard

plugins/module_utils/model.py

@@ -74,6 +74,7 @@ class Secret(Model):
     id: str = ""
     description: str = ""
     tags: list[str] = field(default_factory=list)
+    path: str = ""
 
 
 @dataclass

plugins/module_utils/scaleway_secret.py

@@ -23,15 +23,22 @@ def build_secret_version(parameters: dict) -> SecretVersion:
 
 def get_secret(api: "SecretV1Beta1API", **kwargs) -> Secret:
     """
-    Get a secret by secret_id or name
+    Get a secret by secret_id or name with optional path.
     """
     if "secret_id" in kwargs:
         secret = api.get_secret(secret_id=kwargs["secret_id"])
 
     elif "name" in kwargs:
-        secrets = api.list_secrets(name=kwargs["name"], scheduled_for_deletion=False)
+        list_kwargs = dict(name=kwargs["name"], scheduled_for_deletion=False)
+        if "path" in kwargs:
+            list_kwargs["path"] = kwargs["path"]
+        secrets = api.list_secrets(**list_kwargs)
 
         if len(secrets.secrets) == 0:
+            if "path" in kwargs:
+                raise SecretNotFound(
+                    f"Secret {kwargs['name']} not found at path {kwargs['path']}"
+                )
             raise SecretNotFound(f"Secret {kwargs['name']} not found")
 
         secret = secrets.secrets[0]
@@ -72,7 +79,10 @@ def update_secret(
 
     return changed, local_model, remote_model
     """
-    remote_model = get_secret(api, name=parameters.get("name"))
+    lookup = {"name": parameters.get("name")}
+    if "path" in parameters:
+        lookup["path"] = parameters["path"]
+    remote_model = get_secret(api, **lookup)
 
     # build and diff source model with the api one
     local_model = build_secret(parameters)

plugins/modules/scaleway_secret.py

@@ -31,6 +31,10 @@
         description: name
         type: str
         required: true
+    path:
+        description: path
+        type: str
+        required: false
     project_id:
         description: project_id
         type: str
@@ -203,6 +207,7 @@ def main() -> None:
         dict(
             state=dict(type="str", default="present", choices=["absent", "present"]),
             name=dict(type="str", required=True),
+            path=dict(type="str", required=False),
             project_id=dict(type="str", required=False),
             tags=dict(type="list", required=False, elements="str"),
             description=dict(type="str", required=False),

tests/unit/plugins/test_scaleway_secret.py

@@ -91,6 +91,44 @@ def test_create_with_default_project_id(
             },
         )
 
+    @pytest.mark.parametrize(
+        "set_module_args",
+        [
+            {
+                "name": "test_secret",
+                "path": "/custom/path",
+                "tags": ["test", "secret"],
+                "description": "test_description",
+                "protected": False,
+            }
+        ],
+        indirect=True,
+    )
+    @patch.object(secret_api, "unmarshal_Secret")
+    @patch.object(secret_api.SecretV1Beta1API, "_request")
+    def test_create_with_custom_path(
+        self,
+        mock_request,
+        mock_unmarshal_secret,
+        scaleway_config_profile,
+        set_module_args,
+    ):
+        mock_unmarshal_secret.return_value = MagicMock()
+        mock_request.return_value = MagicMock(status_code=201)
+        scaleway_secret.main()
+        mock_request.assert_called_once_with(
+            "POST",
+            f"/secret-manager/v1beta1/regions/{scaleway_config_profile.default_region}/secrets",
+            body={
+                "name": "test_secret",
+                "path": "/custom/path",
+                "tags": ["test", "secret"],
+                "description": "test_description",
+                "protected": False,
+                "project_id": scaleway_config_profile.default_project_id,
+            },
+        )
+
     @pytest.mark.parametrize(
         "set_module_args",
         [
@@ -130,6 +168,154 @@ def __dict__(self):
             f"/secret-manager/v1beta1/regions/{scaleway_config_profile.default_region}/secrets/{self.test_uuid}",
         )
 
+    @pytest.mark.parametrize(
+        "set_module_args",
+        [
+            {
+                "name": "test_secret",
+                "path": "/custom/path",
+                "state": "absent",
+            }
+        ],
+        indirect=True,
+    )
+    @patch.object(secret_api, "unmarshal_ListSecretsResponse")
+    @patch.object(secret_api.SecretV1Beta1API, "_request")
+    def test_delete_secret_with_path(
+        self,
+        mock_request,
+        mock_unmarshal_list_secrets_response,
+        scaleway_config_profile,
+        set_module_args,
+    ):
+        class MockedSecret(MagicMock):
+            id = self.test_uuid
+            name = "test_secret"
+            path = "/custom/path"
+
+            def __dict__(self):
+                return {
+                    "id": self.id,
+                    "name": self.name,
+                    "path": self.path,
+                }
+
+        mock_unmarshal_list_secrets_response.return_value = MagicMock(
+            secrets=[MockedSecret]
+        )
+        mock_request.side_effect = [
+            MagicMock(status_code=200),  # list secret response
+            MagicMock(status_code=204),  # delete secret response
+        ]
+        scaleway_secret.main()
+        mock_request.assert_any_call(
+            "DELETE",
+            f"/secret-manager/v1beta1/regions/{scaleway_config_profile.default_region}/secrets/{self.test_uuid}",
+        )
+
+    def test_update_secret_with_path_check_mode(self):
+        """Test updating a secret with path in check mode"""
+        from ....plugins.module_utils.scaleway_secret import update_secret
+        from ....plugins.module_utils.model import Secret
+
+        mock_api = MagicMock()
+
+        existing_secret = MagicMock()
+        existing_secret.name = "test_secret"
+        existing_secret.path = "/custom/path"
+        existing_secret.id = self.test_uuid
+        existing_secret.description = "old_description"
+        existing_secret.tags = ["old-tag"]
+
+        mock_list_response = MagicMock()
+        mock_list_response.secrets = [existing_secret]
+
+        mock_api.list_secrets.return_value = mock_list_response
+
+        parameters = {
+            "name": "test_secret",
+            "path": "/custom/path",
+            "description": "test_description",
+            "tags": ["test", "secret"],
+            "protected": False,
+        }
+
+        changed, local_model, remote_model = update_secret(
+            mock_api, parameters, check_mode=True
+        )
+
+        mock_api.list_secrets.assert_called_once_with(
+            name="test_secret", scheduled_for_deletion=False, path="/custom/path"
+        )
+
+        mock_api.update_secret.assert_not_called()
+
+        assert changed is False
+        assert local_model.name == "test_secret"
+        assert local_model.path == "/custom/path"
+        assert local_model.description == "test_description"
+        assert isinstance(local_model, Secret)
+
+    def test_update_secret_with_path(self):
+        """Test updating a secret with path parameter"""
+        from ....plugins.module_utils.scaleway_secret import update_secret
+        from ....plugins.module_utils.model import Secret
+
+        mock_api = MagicMock()
+
+        existing_secret = MagicMock()
+        existing_secret.name = "test_secret"
+        existing_secret.path = "/custom/path"
+        existing_secret.id = self.test_uuid
+        existing_secret.description = "old_description"
+        existing_secret.tags = ["old-tag"]
+
+        mock_list_response = MagicMock()
+        mock_list_response.secrets = [existing_secret]
+
+        updated_secret = MagicMock()
+        updated_secret.name = "test_secret"
+        updated_secret.path = "/custom/path"
+        updated_secret.id = self.test_uuid
+        updated_secret.description = "test_description"
+        updated_secret.tags = ["test", "secret"]
+
+        mock_api.list_secrets.return_value = mock_list_response
+        mock_api.update_secret.return_value = updated_secret
+
+        parameters = {
+            "name": "test_secret",
+            "path": "/custom/path",
+            "description": "test_description",
+            "tags": ["test", "secret"],
+            "protected": False,
+        }
+
+        changed, local_model, remote_model = update_secret(mock_api, parameters)
+
+        mock_api.list_secrets.assert_called_once_with(
+            name="test_secret", scheduled_for_deletion=False, path="/custom/path"
+        )
+
+        mock_api.update_secret.assert_called_once_with(
+            secret_id=self.test_uuid,
+            description="test_description",
+            tags=["test", "secret"],
+        )
+
+        assert changed is True
+        assert local_model.name == "test_secret"
+        assert local_model.path == "/custom/path"
+        assert local_model.description == "test_description"
+        assert local_model.tags == ["test", "secret"]
+        assert isinstance(local_model, Secret)
+
+        assert remote_model.name == "test_secret"
+        assert remote_model.path == "/custom/path"
+        assert remote_model.description == "old_description"
+        assert remote_model.tags == ["old-tag"]
+        assert isinstance(remote_model, Secret)
+
 
 @patch.object(basic.AnsibleModule, "exit_json", MagicMock())
 class TestScalewaySecretVersion: