AzureKeyVaultSettingsSource tries to load disabled secrets

[CisterMoke]

The AzureKeyVaultSettingsSource throws an error when the keyvault contains disabled secrets.

KeyVault disabled setting:

Error raised by AzureKeyVaultSettingsSource:

Traceback (most recent call last):
  File "c:\<project_dir>\.venv\lib\site-packages\pydantic_settings\sources.py", line 2214, in __getitem__
    self._loaded_secrets[key] = self._secret_client.get_secret(key).value
  (...)
azure.core.exceptions.HttpResponseError: (Forbidden) Operation get is not allowed on a disabled secret.
Code: Forbidden
Message: Operation get is not allowed on a disabled secret.
Inner error: {
    "code": "SecretDisabled"
}

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\<project_dir>\main.py", line 95, in <module>
    settings = Settings()
  (...)
  File "c:\<project_dir>\.venv\lib\site-packages\pydantic_settings\sources.py", line 2216, in __getitem__
    raise KeyError(key)
KeyError: 'disabled-setting'

[CisterMoke]

From what I understand, this error is linked to the definition of AzureKeyVaultMapping._secret_names inside AzureKeyVaultMapping.__init__ and then the subsequent call of AzureKeyVaultMapping.__getitem__

class AzureKeyVaultMapping(Mapping[str, Optional[str]]):
    _loaded_secrets: dict[str, str | None]
    _secret_client: SecretClient  # type: ignore
    _secret_names: list[str]

    def __init__(
        self,
        secret_client: SecretClient,  # type: ignore
    ) -> None:
        self._loaded_secrets = {}
        self._secret_client = secret_client
        # Stores all secret names retrieved via list_properties_of_secrets() (both enabled and disabled)
        self._secret_names: list[str] = [secret.name for secret in self._secret_client.list_properties_of_secrets()]

    def __getitem__(self, key: str) -> str | None:
        if key not in self._loaded_secrets:
            try:
                # Fails when trying to load a disabled key
                self._loaded_secrets[key] = self._secret_client.get_secret(key).value
            except Exception:
                raise KeyError(key)

        return self._loaded_secrets[key]

I propose to fix this by excluding disabled secret names from AzureKeyVaultMapping._secret_names using the following definition

class AzureKeyVaultMapping(Mapping[str, Optional[str]]):
    _loaded_secrets: dict[str, str | None]
    _secret_client: SecretClient  # type: ignore
    _secret_names: list[str]

    def __init__(
        self,
        secret_client: SecretClient,  # type: ignore
    ) -> None:
        self._loaded_secrets = {}
        self._secret_client = secret_client
        # Stores only secret names retrieved via list_properties_of_secrets() that are enabled
        self._secret_names: list[str] = [
            secret.name for secret in self._secret_client.list_properties_of_secrets()
            if secret.enabled
        ]

[hramezani]

Thanks @CisterMoke for reporting this.

@AndreuCodina could you please take a look?

[AndreuCodina]

The solution proposed by @CisterMoke is correct 🚀. The .NET provider does the same: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/extensions/Azure.Extensions.AspNetCore.Configuration.Secrets/src/AzureKeyVaultConfigurationProvider.cs#L81

I've created a PR: #578

[hramezani]

Fixed in d54d146