fix: allow unsetting storage secrets (#415)

Author: Panaetius

components/renku_data_services/storage/api.spec.yaml

@@ -515,7 +515,7 @@ components:
           minLength: 1
           maxLength: 99
         value:
-          $ref: "#/components/schemas/SecretValue"
+          $ref: "#/components/schemas/SecretValueNullable"
       required:
         - name
         - value
@@ -543,11 +543,12 @@ components:
       required:
         - name
         - secret_id
-    SecretValue:
-      description: Secret value that can be any text
-      type: string
-      minLength: 1
-      maxLength: 5000
+    SecretValueNullable: 
+      description: Secret value that can be any text 
+      type: string 
+      minLength: 1 
+      maxLength: 5000 
+      nullable: true 
     RCloneSchema:
       description: List of RClone schemas for different storage types
       type: array

components/renku_data_services/storage/apispec.py

@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  api.spec.yaml
-#   timestamp: 2024-08-13T13:29:46+00:00
+#   timestamp: 2024-10-07T08:21:24+00:00
 
 from __future__ import annotations
 
@@ -242,7 +242,7 @@ class CloudStorageSecretPost(BaseAPISpec):
         max_length=99,
         min_length=1,
     )
-    value: str = Field(
+    value: Optional[str] = Field(
         ...,
         description="Secret value that can be any text",
         max_length=5000,

components/renku_data_services/storage/db.py

@@ -188,6 +188,16 @@ async def upsert_storage_secrets(
             stored_secrets = []
 
             for name, value in secret_names_values.items():
+                if value is None:
+                    # delete the secret
+                    storage_secret_orm = existing_secrets.get(name)
+                    if storage_secret_orm is None:
+                        continue
+                    await session.delete(storage_secret_orm)
+                    await session.delete(storage_secret_orm.secret)
+                    del existing_secrets[name]
+                    continue
+
                 encrypted_value, encrypted_key = await encrypt_user_secret(
                     user_repo=self.user_repo,
                     requested_by=user,

components/renku_data_services/storage/models.py

@@ -252,4 +252,4 @@ class CloudStorageSecretUpsert(BaseModel):
     """Insert/update storage secret data."""
 
     name: str = Field()
-    value: str = Field()
+    value: str | None = Field()