mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-26 06:52:57 +08:00
natedemossandCopilot Autofix powered by AI
0f0c94bda3
* fix(cli): preserve provider type on credential updates provider_update built every UpdateProviderRequest with an empty type and profile workspace. Policy interceptors evaluate the request before the gateway merges it with stored state, so they cannot tell the target is a profile-managed provider and deny credential-only updates. Creating a provider from an interceptor-vended profile works; rotating its credentials does not. Look up the stored provider and forward its type and profile workspace verbatim. The gateway treats profile_workspace as immutable, so the stored value is passed through rather than recomputed from the request workspace. The read is best-effort: a caller holding provider:write without provider:read must still be able to rotate credentials, so a denied read falls back to the previous empty metadata rather than failing the update. --from-existing and --from-oidc-token need the stored type, so they surface the error instead. This also removes a duplicate GetProvider call, since the oidc-token and from-existing paths each fetched the same provider separately. Signed-off-by: Nathan DeMoss <ndemoss28@gmail.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Nathan DeMoss <ndemoss28@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>