[PiquelChips]

#429 guarded the access endpoint, but a secret upload could still lose a concurrent access change. app secret set --previews, and the dashboard's Save when its form changed the access, merge their change into the access they read and send the whole list with the value. The upload was only checked against the generation, and an access change doesn't bump it, so the other change was overwritten.

• API: the value upload (PUT …/secrets/{name}) takes expected_environments and expected_previews, the access the caller read, in the same form as environments and previews. Replacing an existing secret then fails with 409 secret_access_conflict if its access changed meanwhile, checked in the same transaction, as fix(secrets): refuse access edits made from an outdated access list #429 does. Without them, uploads behave as before.
• CLI and dashboard: app secret set and the dashboard's Save send the access they read whenever they replace it. A value-only upload sends none, since it keeps the current access and has nothing to overwrite.
• Store: Store::put_stored_secret_guarded takes a SecretPrecondition (expected generation, and access when read), and shares check_expected_access with the access endpoint. put_stored_secret delegates to it unguarded, so its many test callers are unchanged. The 400 for an undecodable query also names expected_environments and expected_previews.

The OpenAPI document, the generated client, api.md and cli.md are updated.

This is based on #429's branch. Once #429 merges, I'll rebase it onto main and retarget it.

Proof: a contract test checks the 409 over HTTP for both the access endpoint and the upload. A store test shows an upload made from an outdated access read fails with SecretAccessConflict, and one made from the current access applies. A CLI test checks that secret set --previews sends expected_environments=all&expected_previews=false. cargo nextest run -p piquelctl -p piqueld-client (148), the daemon's secret and promotion tests (67), the Playwright secrets spec (3), just lint, just openapi-check and fmt pass.

Note

Written by Claude Opus 5.5 in Claude Code and reviewed by Claude Opus 5.5 (via T3 Code)

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Pre-merge checks: 2

Failed checks: 2 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.
Description check		This assessment has not completed. The check will be retried on the next pre-merge check run.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn