fixing key isolation

sdk/appconfiguration/azure-appconfiguration-provider/assets.json

@@ -2,5 +2,5 @@
   "AssetsRepo": "Azure/azure-sdk-assets",
   "AssetsRepoPrefixPath": "python",
   "TagPrefix": "python/appconfiguration/azure-appconfiguration-provider",
-  "Tag": "python/appconfiguration/azure-appconfiguration-provider_05f22217b9"
+  "Tag": "python/appconfiguration/azure-appconfiguration-provider_e80b715d7c"
 }

sdk/appconfiguration/azure-appconfiguration-provider/tests/aio/key_vault/test_async_secret_refresh.py

@@ -10,6 +10,7 @@
 from devtools_testutils import EnvironmentVariableLoader
 from devtools_testutils.aio import recorded_by_proxy_async
 from asynctestcase import AppConfigTestCase
+from testcase import create_secret_config_setting
 from test_constants import (
     APPCONFIGURATION_ENDPOINT_STRING,
     APPCONFIGURATION_KEYVAULT_SECRET_URL,
@@ -82,35 +83,30 @@ async def test_secret_refresh_with_updated_values(
     ):
         """Test that secrets are refreshed with updated values."""
         mock_callback = Mock()
-
-        # Create client with the mock secret resolver
-        client = await self.create_client(
-            endpoint=appconfiguration_endpoint_string,
-            selects={SettingSelector(key_filter="*", label_filter="prod")},
-            keyvault_secret_url=appconfiguration_keyvault_secret_url,
-            keyvault_secret_url2=appconfiguration_keyvault_secret_url2,
-            on_refresh_success=mock_callback,
-            refresh_on=[WatchKey("secret", "prod")],
-            refresh_interval=1,
-            secret_refresh_interval=1,  # Using a short interval for testing
-        )
-
-        # Add a key vault reference to the client (this will use mock resolver)
+        secret_key = f"{self.get_resource_name('test')}-secret"
         appconfig_client = self.create_appconfig_client(appconfiguration_endpoint_string)
-
-        # Get and modify a key vault reference setting
-        kv_setting = await appconfig_client.get_configuration_setting(key="secret", label="prod")
-        assert kv_setting is not None
-
-        # Verify initial value from mock resolver
-        assert client["secret"] == "Very secret value"
-        assert kv_setting is not None
-        assert isinstance(kv_setting, SecretReferenceConfigurationSetting)
-        # Update the secret_id (which is the value for SecretReferenceConfigurationSetting)
-        kv_setting.secret_id = appconfiguration_keyvault_secret_url2
-        await appconfig_client.set_configuration_setting(kv_setting)
-
+        kv_setting = create_secret_config_setting(secret_key, "prod", appconfiguration_keyvault_secret_url)
+        secret_created = False
         try:
+            await appconfig_client.set_configuration_setting(kv_setting)
+            secret_created = True
+
+            client = await self.create_client(
+                endpoint=appconfiguration_endpoint_string,
+                selects={SettingSelector(key_filter=secret_key, label_filter="prod")},
+                keyvault_secret_url=appconfiguration_keyvault_secret_url,
+                keyvault_secret_url2=appconfiguration_keyvault_secret_url2,
+                on_refresh_success=mock_callback,
+                refresh_on=[WatchKey(secret_key, "prod")],
+                refresh_interval=1,
+                secret_refresh_interval=1,
+            )
+
+            assert client[secret_key] == "Very secret value"
+            assert isinstance(kv_setting, SecretReferenceConfigurationSetting)
+            kv_setting.secret_id = appconfiguration_keyvault_secret_url2
+            await appconfig_client.set_configuration_setting(kv_setting)
+
             # Expire the refresh timers to simulate time passing
             client._refresh_timer._next_refresh_time = 0
             client._secret_provider.secret_refresh_timer._next_refresh_time = 0
@@ -119,11 +115,11 @@ async def test_secret_refresh_with_updated_values(
             await client.refresh()
 
             # Verify the value was updated
-            assert client["secret"] == "Very secret value 2"
+            assert client[secret_key] == "Very secret value 2"
             assert mock_callback.call_count >= 1
         finally:
-            kv_setting.secret_id = appconfiguration_keyvault_secret_url
-            await appconfig_client.set_configuration_setting(kv_setting)
+            if secret_created:
+                await appconfig_client.delete_configuration_setting(key=secret_key, label="prod")
 
     @AppConfigProviderPreparer()
     @recorded_by_proxy_async

sdk/appconfiguration/azure-appconfiguration-provider/tests/conftest.py

@@ -104,16 +104,16 @@ def add_sanitizers(test_proxy):
         (
             os.environ.get(
                 "APPCONFIGURATION_KEYVAULT_SECRET_URL2",
-                "https://sanitized.vault.azure.net/secrets/fake-secret2/",
+                "https://sanitized.vault.azure.net/secrets/SecondSecret/",
             ),
-            "https://sanitized.vault.azure.net/secrets/fake-secret2/",
+            "https://sanitized.vault.azure.net/secrets/SecondSecret/",
         ),
         (
             os.environ.get(
                 "APPCONFIGURATION_KEYVAULT_SECRET_URL",
-                "https://sanitized.vault.azure.net/secrets/fake-secret/",
+                "https://sanitized.vault.azure.net/secrets/TestSecret/",
             ),
-            "https://sanitized.vault.azure.net/secrets/fake-secret/",
+            "https://sanitized.vault.azure.net/secrets/TestSecret/",
         ),
     )
 

sdk/appconfiguration/azure-appconfiguration-provider/tests/key_vault/test_secret_refresh.py

@@ -8,7 +8,7 @@
 import unittest
 from unittest.mock import Mock, patch
 from devtools_testutils import EnvironmentVariableLoader, recorded_by_proxy
-from testcase import AppConfigTestCase
+from testcase import AppConfigTestCase, create_secret_config_setting
 from test_constants import (
     APPCONFIGURATION_ENDPOINT_STRING,
     APPCONFIGURATION_KEYVAULT_SECRET_URL,
@@ -75,35 +75,30 @@ def test_secret_refresh_with_updated_values(
     ):
         """Test that secrets are refreshed with updated values."""
         mock_callback = Mock()
-
-        # Create client with the mock secret resolver
-        client = self.create_client(
-            endpoint=appconfiguration_endpoint_string,
-            selects={SettingSelector(key_filter="*", label_filter="prod")},
-            keyvault_secret_url=appconfiguration_keyvault_secret_url,
-            keyvault_secret_url2=appconfiguration_keyvault_secret_url2,
-            on_refresh_success=mock_callback,
-            refresh_on=[WatchKey("secret", "prod")],
-            refresh_interval=1,
-            secret_refresh_interval=1,  # Using a short interval for testing
-        )
-
-        # Add a key vault reference to the client (this will use mock resolver)
+        secret_key = f"{self.get_resource_name('test')}-secret"
         appconfig_client = self.create_appconfig_client(appconfiguration_endpoint_string)
-
-        # Get and modify a key vault reference setting
-        kv_setting = appconfig_client.get_configuration_setting(key="secret", label="prod")
-        assert kv_setting is not None
-
-        # Verify initial value from mock resolver
-        assert client["secret"] == "Very secret value"
-        assert kv_setting is not None
-        assert isinstance(kv_setting, SecretReferenceConfigurationSetting)
-        # Update the secret_id (which is the value for SecretReferenceConfigurationSetting)
-        kv_setting.secret_id = appconfiguration_keyvault_secret_url2
-        appconfig_client.set_configuration_setting(kv_setting)
-
+        kv_setting = create_secret_config_setting(secret_key, "prod", appconfiguration_keyvault_secret_url)
+        secret_created = False
         try:
+            appconfig_client.set_configuration_setting(kv_setting)
+            secret_created = True
+
+            client = self.create_client(
+                endpoint=appconfiguration_endpoint_string,
+                selects={SettingSelector(key_filter=secret_key, label_filter="prod")},
+                keyvault_secret_url=appconfiguration_keyvault_secret_url,
+                keyvault_secret_url2=appconfiguration_keyvault_secret_url2,
+                on_refresh_success=mock_callback,
+                refresh_on=[WatchKey(secret_key, "prod")],
+                refresh_interval=1,
+                secret_refresh_interval=1,
+            )
+
+            assert client[secret_key] == "Very secret value"
+            assert isinstance(kv_setting, SecretReferenceConfigurationSetting)
+            kv_setting.secret_id = appconfiguration_keyvault_secret_url2
+            appconfig_client.set_configuration_setting(kv_setting)
+
             # Expire the refresh timers to simulate time passing
             client._refresh_timer._next_refresh_time = 0
             client._secret_provider.secret_refresh_timer._next_refresh_time = 0
@@ -112,11 +107,11 @@ def test_secret_refresh_with_updated_values(
             client.refresh()
 
             # Verify the value was updated
-            assert client["secret"] == "Very secret value 2"
+            assert client[secret_key] == "Very secret value 2"
             assert mock_callback.call_count >= 1
         finally:
-            kv_setting.secret_id = appconfiguration_keyvault_secret_url
-            appconfig_client.set_configuration_setting(kv_setting)
+            if secret_created:
+                appconfig_client.delete_configuration_setting(key=secret_key, label="prod")
 
     @AppConfigProviderPreparer()
     @recorded_by_proxy

sdk/appconfiguration/azure-appconfiguration-provider/tests/test_constants.py

@@ -6,5 +6,5 @@
     "Secret=lamefakesecretlamefakesecretlamefakesecrett="  # cspell: disable-line
 )
 APPCONFIGURATION_ENDPOINT_STRING = "https://sanitized.azconfig.io"
-APPCONFIGURATION_KEYVAULT_SECRET_URL = "https://sanitized.vault.azure.net/secrets/fake-secret/"
-APPCONFIGURATION_KEYVAULT_SECRET_URL2 = "https://sanitized.vault.azure.net/secrets/fake-secret2/"
+APPCONFIGURATION_KEYVAULT_SECRET_URL = "https://sanitized.vault.azure.net/secrets/TestSecret/"
+APPCONFIGURATION_KEYVAULT_SECRET_URL2 = "https://sanitized.vault.azure.net/secrets/SecondSecret/"