From b26ed18c71389e2975ce8ab322bcc18f237f14c4 Mon Sep 17 00:00:00 2001
From: Nareshp1 <44296460+Nareshp1@users.noreply.github.com>
Date: Sun, 20 Jul 2025 10:23:37 -0400
Subject: [PATCH 01/43] fix(secrets): Move changes from old api repo to
 monorepo branch

---
 api/requirements.txt                       |   5 +-
 api/src/app/api/v1/users.py                |  84 +++++++++-
 api/src/app/cloud/aws_creds.py             | 172 +++++++++++++++++++++
 api/src/app/cloud/base_creds.py            |  31 ++++
 api/src/app/cloud/creds_factory.py         |  48 ++++++
 api/src/app/crud/crud_secrets.py           |  64 ++++++++
 api/src/app/schemas/creds_verify_schema.py |  19 +++
 api/src/app/schemas/secret_schema.py       |  50 +++++-
 8 files changed, 470 insertions(+), 3 deletions(-)
 create mode 100644 api/src/app/cloud/aws_creds.py
 create mode 100644 api/src/app/cloud/base_creds.py
 create mode 100644 api/src/app/cloud/creds_factory.py
 create mode 100644 api/src/app/crud/crud_secrets.py
 create mode 100644 api/src/app/schemas/creds_verify_schema.py

diff --git a/api/requirements.txt b/api/requirements.txt
index 3d8b83b0..f62fe2e7 100644
--- a/api/requirements.txt
+++ b/api/requirements.txt
@@ -21,4 +21,7 @@ argon2-cffi>=23.1.0
 # Async Jobs
 arq>=0.26.3
 aiofiles>=24.1.0
-tenacity>=9.1.2
\ No newline at end of file
+tenacity>=9.1.2
+
+# Provider SDKs
+boto3>=1.38.0
\ No newline at end of file
diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index f86d5c34..6bd45ce8 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -3,18 +3,24 @@
 
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.responses import JSONResponse
+from pydantic import ValidationError
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio.session import AsyncSession
 
+from src.app.cloud.creds_factory import CredsFactory
+from src.app.schemas.creds_verify_schema import CredsVerifySchema
+
 from ...core.auth.auth import get_current_user
 from ...core.config import settings
 from ...core.db.database import async_get_db
+from ...crud.crud_secrets import get_user_secrets, upsert_user_secrets
 from ...crud.crud_users import get_user_by_id, update_user_password
 from ...models.secret_model import SecretModel
 from ...models.user_model import UserModel
 from ...schemas.message_schema import (
     AWSUpdateSecretMessageSchema,
     AzureUpdateSecretMessageSchema,
+    MessageSchema,
     UpdatePasswordMessageSchema,
 )
 from ...schemas.secret_schema import (
@@ -116,7 +122,7 @@ async def update_password(
 
 
 @router.get("/me/secrets")
-async def get_user_secrets(
+async def fetch_user_secrets(
     current_user: UserModel = Depends(get_current_user),  # noqa: B008
     db: AsyncSession = Depends(async_get_db),  # noqa: B008
 ) -> UserSecretResponseSchema:
@@ -170,6 +176,82 @@ async def get_user_secrets(
     )
 
 
+@router.post("/me/secrets")
+async def update_user_secrets(
+    creds: CredsVerifySchema,
+    current_user: UserModel = Depends(get_current_user),  # noqa: B008
+    db: AsyncSession = Depends(async_get_db),  # noqa: B008
+) -> MessageSchema:
+    """Update the current user's secrets.
+
+    Args:
+    ----
+        creds (CredsVerifySchema): The provider credentials to store.
+        current_user (UserModel): The authenticated user.
+        db (Session): Database connection.
+
+    Returns:
+    -------
+        MessageSchema: Status message of updating user secrets.
+
+    """
+    # Fetch secrets from the database
+    secrets = await get_user_secrets(db, current_user.id)
+    if not secrets:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="User secrets record not found",
+        )
+
+    # Verify credentials are valid before storing
+    try:
+        creds_obj = CredsFactory.create_creds_verification(
+            provider=creds.provider, credentials=creds.credentials
+        )
+    except ValueError as e:
+        # Handles missing credential fields in request
+        raise HTTPException(status_code=422, detail=str(e)) from None
+    except ValidationError as e:
+        # Handles Pydantic schema validation errors (e.g., bad format/length of credentials)
+        error_msg = e.errors()[0]["msg"].split(", ", 1)[-1]
+        raise HTTPException(status_code=422, detail=error_msg) from None
+
+    verified, msg = creds_obj.verify_creds()
+
+    if not verified:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=msg.message,
+        )
+
+    # Encrypt the AWS credentials using the user's public key
+    if not current_user.public_key:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="User encryption keys not set up. Please register a new account.",
+        )
+
+    # Convert provided credentials to dictionary for encryption
+    user_creds = creds_obj.get_user_creds()
+
+    # Encrypt with the user's public key
+    encrypted_data = encrypt_with_public_key(
+        data=user_creds, public_key_b64=current_user.public_key
+    )
+
+    # Update the secrets with encrypted values
+    secrets = creds_obj.update_secret_schema(
+        secrets=secrets, encrypted_data=encrypted_data
+    )
+
+    # Add new secrets to database
+    await upsert_user_secrets(db, secrets, current_user.id)
+
+    return MessageSchema(
+        message=f"{str(creds.provider.value).upper()} credentials successfully verified and updated"
+    )
+
+
 @router.post("/me/secrets/aws")
 async def update_aws_secrets(
     aws_secrets: AWSSecrets,
diff --git a/api/src/app/cloud/aws_creds.py b/api/src/app/cloud/aws_creds.py
new file mode 100644
index 00000000..2382d7a5
--- /dev/null
+++ b/api/src/app/cloud/aws_creds.py
@@ -0,0 +1,172 @@
+import logging
+from datetime import UTC, datetime
+from typing import Any, List, Tuple
+
+import boto3
+from botocore.exceptions import ClientError
+
+from src.app.schemas.message_schema import MessageSchema
+from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
+
+from .base_creds import AbstractBaseCreds
+
+# Configure logging
+logger = logging.getLogger(__name__)
+
+
+class AWSCreds(AbstractBaseCreds):
+    """Credential verification for AWS."""
+
+    credentials: AWSSecrets
+
+    def __init__(self, credentials: dict[str, Any]) -> None:
+        """Initialize AWS credentials verification object."""
+        # Check for missing fields
+        required_fields = ["aws_access_key", "aws_secret_key"]
+        if not all(field in credentials for field in required_fields):
+            msg = "Partial credentials or no credentials provided. Please ensure you are providing proper AWS credentials."
+            raise ValueError(msg)
+
+        self.credentials = AWSSecrets.model_validate(credentials)
+
+    def get_user_creds(self) -> dict[str, str]:
+        """Convert user AWS secrets to dictionary for encryption."""
+        return {
+            "aws_access_key": self.credentials.aws_access_key,
+            "aws_secret_key": self.credentials.aws_secret_key,
+        }
+
+    def update_secret_schema(
+        self, secrets: SecretSchema, encrypted_data: dict[str, str]
+    ) -> SecretSchema:
+        """Update user secrets schema with newly encrypted secrets."""
+        secrets.aws_access_key = encrypted_data["aws_access_key"]
+        secrets.aws_secret_key = encrypted_data["aws_secret_key"]
+        secrets.aws_created_at = datetime.now(UTC)
+        return secrets
+
+    def verify_creds(self) -> Tuple[bool, MessageSchema]:
+        """Verify credentials authenticate to an AWS account."""
+        try:
+            # --- Step 1: Basic Authentication with STS ---
+            # Created shared session for authenticaion and IAM permission check
+            session = boto3.Session(
+                aws_access_key_id=self.credentials.aws_access_key,
+                aws_secret_access_key=self.credentials.aws_secret_key,
+            )
+            client = session.client("sts")
+            caller_identity = (
+                client.get_caller_identity()
+            )  # will raise an error if not valid
+            caller_arn = caller_identity["Arn"]
+            logger.info(
+                "AWS credentials successfully authenticated for ARN: %s", caller_arn
+            )
+
+            if caller_arn.endswith(
+                ":root"
+            ):  # If root access key credentials are used, skip permissions check as root user has all permissions
+                return (
+                    True,
+                    MessageSchema(
+                        message="AWS credentials authenticated and all required permissions are present."
+                    ),
+                )
+
+            # --- Step 2: Simulate permissions for a sample of minimum critical actions ---
+            iam_client = session.client("iam")
+
+            actions_to_test = [
+                # For Instance
+                "ec2:RunInstances",
+                "ec2:TerminateInstances",
+                "ec2:DescribeInstances",
+                # For Vpc
+                "ec2:CreateVpc",
+                "ec2:DeleteVpc",
+                "ec2:DescribeVpcs",
+                # For Subnet
+                "ec2:CreateSubnet",
+                "ec2:DeleteSubnet",
+                "ec2:DescribeSubnets",
+                # For InternetGateway
+                "ec2:CreateInternetGateway",
+                "ec2:DeleteInternetGateway",
+                "ec2:AttachInternetGateway",
+                "ec2:DetachInternetGateway",
+                # For Eip and NatGateway
+                "ec2:AllocateAddress",  # Create EIP
+                "ec2:ReleaseAddress",  # Delete EIP
+                "ec2:AssociateAddress",
+                "ec2:CreateNatGateway",
+                "ec2:DeleteNatGateway",
+                # For KeyPair
+                "ec2:CreateKeyPair",
+                "ec2:DeleteKeyPair",
+                # For SecurityGroup and SecurityGroupRule
+                "ec2:CreateSecurityGroup",
+                "ec2:DeleteSecurityGroup",
+                "ec2:AuthorizeSecurityGroupIngress",
+                "ec2:RevokeSecurityGroupIngress",
+                "ec2:AuthorizeSecurityGroupEgress",
+                "ec2:RevokeSecurityGroupEgress",
+                # For RouteTable, Route, and RouteTableAssociation
+                "ec2:CreateRouteTable",
+                "ec2:DeleteRouteTable",
+                "ec2:CreateRoute",
+                "ec2:DeleteRoute",
+                "ec2:AssociateRouteTable",
+                "ec2:DisassociateRouteTable",
+                # For Transit Gateway ---
+                "ec2:CreateTransitGateway",
+                "ec2:DeleteTransitGateway",
+                "ec2:CreateTransitGatewayVpcAttachment",
+                "ec2:DeleteTransitGatewayVpcAttachment",
+                "ec2:CreateTransitGatewayRoute",
+                "ec2:DeleteTransitGatewayRoute",
+                "ec2:DescribeTransitGateways",
+                "ec2:DescribeTransitGatewayVpcAttachments",
+            ]
+
+            simulation_results = iam_client.simulate_principal_policy(
+                PolicySourceArn=caller_arn, ActionNames=actions_to_test
+            )
+
+            # --- Step 3: Evaluate the simulation results ---
+            denied_actions: List[str] = []
+            for result in simulation_results["EvaluationResults"]:
+                if result["EvalDecision"] != "allowed":
+                    denied_actions.append(result["EvalActionName"])
+
+            if not denied_actions:
+                logger.info(
+                    "All simulated actions were allowed for ARN: %s", caller_arn
+                )
+                return (
+                    True,
+                    MessageSchema(
+                        message="AWS credentials authenticated and all required permissions are present."
+                    ),
+                )
+
+            error_message = f"Authentication succeeded, but the user/group is missing required permissions. The following actions were denied: {', '.join(denied_actions)}"
+            logger.error(error_message)
+            return (
+                False,
+                MessageSchema(
+                    message=f"Insufficient permissions for your AWS account user/group. Please ensure the following permissions are added: {', '.join(denied_actions)}"
+                ),
+            )
+        except ClientError as e:
+            error_code = e.response["Error"]["Code"]
+            if error_code in ("InvalidClientTokenId", "SignatureDoesNotMatch"):
+                message = "AWS credentials could not be authenticated. Please ensure you are providing credentials that are linked to a valid AWS account."
+            elif error_code == "AccessDenied":
+                message = "AWS credentials are valid, but lack permissions to perform the permissions verification. Please ensure you give your AWS account user/group has the iam:SimulatePrincipalPolicy permission attached to a policy."
+            else:
+                message = e.response["Error"]["Message"]
+            logger.error("AWS verification failed: %s", message)
+            return (
+                False,
+                MessageSchema(message=message),
+            )
diff --git a/api/src/app/cloud/base_creds.py b/api/src/app/cloud/base_creds.py
new file mode 100644
index 00000000..d5430b2f
--- /dev/null
+++ b/api/src/app/cloud/base_creds.py
@@ -0,0 +1,31 @@
+from abc import ABC, abstractmethod
+from typing import Any, Tuple
+
+from src.app.schemas.message_schema import MessageSchema
+from src.app.schemas.secret_schema import SecretSchema
+
+
+class AbstractBaseCreds(ABC):
+    """Abstract class to enforce common credential verification functionality across range cloud providers."""
+
+    @abstractmethod
+    def __init__(self, credentials: dict[str, Any]) -> None:
+        """Expected constructor for all credential subclasses."""  # noqa: D401
+        pass
+
+    @abstractmethod
+    def get_user_creds(self) -> dict[str, str]:
+        """Convert user secrets to dictionary for encryption."""
+        pass
+
+    @abstractmethod
+    def update_secret_schema(
+        self, secrets: SecretSchema, encrypted_data: dict[str, str]
+    ) -> SecretSchema:
+        """Update user secrets schema with newly encrypted secrets."""
+        pass
+
+    @abstractmethod
+    def verify_creds(self) -> Tuple[bool, MessageSchema]:
+        """Verify that user provided credentials properly authenticate to a provider account."""
+        pass
diff --git a/api/src/app/cloud/creds_factory.py b/api/src/app/cloud/creds_factory.py
new file mode 100644
index 00000000..5ff7ec89
--- /dev/null
+++ b/api/src/app/cloud/creds_factory.py
@@ -0,0 +1,48 @@
+import logging
+from typing import Any, ClassVar, Type
+
+from src.app.cloud.aws_creds import AWSCreds
+from src.app.cloud.base_creds import AbstractBaseCreds
+from src.app.enums.providers import OpenLabsProvider
+
+# Configure logging
+logger = logging.getLogger(__name__)
+
+
+class CredsFactory:
+    """Create creds objects."""
+
+    _registry: ClassVar[dict[OpenLabsProvider, Type[AbstractBaseCreds]]] = {
+        OpenLabsProvider.AWS: AWSCreds,
+    }
+
+    @classmethod
+    def create_creds_verification(
+        cls, provider: OpenLabsProvider, credentials: dict[str, Any]
+    ) -> AbstractBaseCreds:
+        """Create creds object.
+
+        **Note:** This function accepts a creation schema as the OpenLabs resource ID is not required
+        for terraform.
+
+        Args:
+        ----
+            cls (CredsFactory): The CredsFactory class.
+            provider (OpenLabsProvider): Cloud provider the credentials to verify are for
+            credentials (dict[str, Any]): User cloud credentials to verify
+
+        Returns:
+        -------
+            AbstractBaseCreds: Creds object that will be used to verify the user cloud credentials provided
+
+        """
+        creds_class = cls._registry.get(provider)
+
+        if creds_class is None:
+            msg = (
+                f"Failed to build creds object. Non-existent provider given: {provider}"
+            )
+            logger.error(msg)
+            raise ValueError(msg)
+
+        return creds_class(credentials=credentials)
diff --git a/api/src/app/crud/crud_secrets.py b/api/src/app/crud/crud_secrets.py
new file mode 100644
index 00000000..de71f636
--- /dev/null
+++ b/api/src/app/crud/crud_secrets.py
@@ -0,0 +1,64 @@
+import logging
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.app.models.secret_model import SecretModel
+
+from ..schemas.secret_schema import SecretSchema
+
+logger = logging.getLogger(__name__)
+
+
+async def get_user_secrets(db: AsyncSession, user_id: int) -> SecretSchema | None:
+    """Get user provider secrets.
+
+    Args:
+    ----
+        db (Session): Database connection.
+        user_id (int): ID of the user requesting data.
+
+    Returns:
+    -------
+        Optional[SecretSchema]: User provider secrets if it exists in the database.
+
+    """
+    stmt = select(SecretModel).where(SecretModel.user_id == user_id)
+    result = await db.execute(stmt)
+
+    if not result:
+        logger.info(
+            "Failed to fetch secrets for user: %s. Not found in database!", user_id
+        )
+        return None
+
+    secrets = result.scalars().first()
+
+    return SecretSchema.model_validate(secrets)
+
+
+async def upsert_user_secrets(
+    db: AsyncSession, secrets: SecretSchema, user_id: int
+) -> None:
+    """Update user provider secrets.
+
+    Args:
+    ----
+        db (Session): Database connection.
+        user_id (int): ID of the user requesting data.
+        secrets (SecretSchema): User secrets record containing new secrets to add to database
+
+    Returns:
+    -------
+        None
+
+    """
+    db_object_to_merge = SecretModel(user_id=user_id, **secrets.model_dump())
+    # 2. Merge the instance into the session.
+    #    SQLAlchemy checks if a record with this primary key exists.
+    #    - If yes, it copies the new data onto the existing record.
+    #    - If no, it stages a new record for insertion.
+    await db.merge(db_object_to_merge)
+    # 3. Commit the transaction to save the changes.
+    #    This will execute either an UPDATE or INSERT statement.
+    await db.commit()
diff --git a/api/src/app/schemas/creds_verify_schema.py b/api/src/app/schemas/creds_verify_schema.py
new file mode 100644
index 00000000..ed25132b
--- /dev/null
+++ b/api/src/app/schemas/creds_verify_schema.py
@@ -0,0 +1,19 @@
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+from src.app.enums.providers import OpenLabsProvider
+
+
+class CredsVerifySchema(BaseModel):
+    """Base creds object for OpenLabs credential verification."""
+
+    provider: OpenLabsProvider = Field(
+        ...,
+        description="Cloud provider",
+        examples=[OpenLabsProvider.AWS, OpenLabsProvider.AZURE],
+    )
+
+    credentials: dict[str, Any] = Field(
+        ..., description="Cloud provider credentials to verify"
+    )
diff --git a/api/src/app/schemas/secret_schema.py b/api/src/app/schemas/secret_schema.py
index b6fbdccd..7ec25033 100644
--- a/api/src/app/schemas/secret_schema.py
+++ b/api/src/app/schemas/secret_schema.py
@@ -1,6 +1,6 @@
 from datetime import datetime, timezone
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 
 class SecretBaseSchema(BaseModel):
@@ -66,6 +66,54 @@ class AWSSecrets(BaseModel):
         description="Secret key for AWS account",
     )
 
+    @field_validator("aws_access_key")
+    @classmethod
+    def validate_access_key(cls, aws_access_key: str) -> str:
+        """Check AWS access key is correct length.
+
+        Args:
+        ----
+            cls: AWSSecrets object.
+            aws_access_key (str): AWS access key.
+
+        Returns:
+        -------
+            str: AWS access key.
+
+        """
+        access_key_length = 20
+        if len(aws_access_key.strip()) == 0:
+            msg = "Partial credentials or no credentials provided.. Please ensure you are providing proper AWS credentials."
+            raise ValueError(msg)
+        if len(aws_access_key.strip()) != access_key_length:
+            msg = "Invalid credential format. Please ensure your AWS credentials are of proper length."
+            raise ValueError(msg)
+        return aws_access_key
+
+    @field_validator("aws_secret_key")
+    @classmethod
+    def validate_secret_key(cls, aws_secret_key: str) -> str:
+        """Check AWS secret key is correct length.
+
+        Args:
+        ----
+            cls: AWSSecrets object.
+            aws_secret_key (str): AWS secret key.
+
+        Returns:
+        -------
+            str: AWS access key.
+
+        """
+        secret_key_length = 40
+        if len(aws_secret_key.strip()) == 0:
+            msg = "Partial credentials or no credentials provided. Please ensure you are providing proper AWS credentials."
+            raise ValueError(msg)
+        if len(aws_secret_key.strip()) != secret_key_length:
+            msg = "Invalid credential format. Please ensure your AWS credentials are of proper length."
+            raise ValueError(msg)
+        return aws_secret_key
+
 
 class AzureSecrets(BaseModel):
     """Azure secret object for setting secrets on OpenLabs."""

From 7a17d57544991adc5a13367f2906b6c3bed72ddd Mon Sep 17 00:00:00 2001
From: Nareshp1 <44296460+Nareshp1@users.noreply.github.com>
Date: Sun, 20 Jul 2025 10:52:48 -0400
Subject: [PATCH 02/43] fix(secrets): Simplified error handling for invalid
 credential payloads

---
 api/src/app/api/v1/users.py    | 9 +++------
 api/src/app/cloud/aws_creds.py | 6 ------
 2 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index 6bd45ce8..7a613a5c 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -208,13 +208,10 @@ async def update_user_secrets(
         creds_obj = CredsFactory.create_creds_verification(
             provider=creds.provider, credentials=creds.credentials
         )
-    except ValueError as e:
-        # Handles missing credential fields in request
-        raise HTTPException(status_code=422, detail=str(e)) from None
     except ValidationError as e:
         # Handles Pydantic schema validation errors (e.g., bad format/length of credentials)
-        error_msg = e.errors()[0]["msg"].split(", ", 1)[-1]
-        raise HTTPException(status_code=422, detail=error_msg) from None
+        error_msg = f"Invalid {creds.provider.value.upper()} credentials payload."
+        raise HTTPException(status_code=422, detail=error_msg) from e
 
     verified, msg = creds_obj.verify_creds()
 
@@ -248,7 +245,7 @@ async def update_user_secrets(
     await upsert_user_secrets(db, secrets, current_user.id)
 
     return MessageSchema(
-        message=f"{str(creds.provider.value).upper()} credentials successfully verified and updated"
+        message=f"{creds.provider.value.upper()} credentials successfully verified and updated"
     )
 
 
diff --git a/api/src/app/cloud/aws_creds.py b/api/src/app/cloud/aws_creds.py
index 2382d7a5..6d14a7c9 100644
--- a/api/src/app/cloud/aws_creds.py
+++ b/api/src/app/cloud/aws_creds.py
@@ -21,12 +21,6 @@ class AWSCreds(AbstractBaseCreds):
 
     def __init__(self, credentials: dict[str, Any]) -> None:
         """Initialize AWS credentials verification object."""
-        # Check for missing fields
-        required_fields = ["aws_access_key", "aws_secret_key"]
-        if not all(field in credentials for field in required_fields):
-            msg = "Partial credentials or no credentials provided. Please ensure you are providing proper AWS credentials."
-            raise ValueError(msg)
-
         self.credentials = AWSSecrets.model_validate(credentials)
 
     def get_user_creds(self) -> dict[str, str]:

From 5663551de3eeea1d8d71fb329936d497c286ee7c Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 13:17:24 -0400
Subject: [PATCH 03/43] fix(tests): Ignore test coverage files

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 1bfea5db..e522da89 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,5 @@ testing-out/
 # Misc
 .vscode/
 
+# Tests
+.coverage
\ No newline at end of file

From 2467078effd6ec56f81bad2831834756d26f02fb Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 13:17:55 -0400
Subject: [PATCH 04/43] feat(tests): Adding initial tests for creds
 verification

---
 api/src/app/api/v1/users.py           | 116 +-------------------------
 api/tests/common/api/v1/config.py     |   9 +-
 api/tests/common/api/v1/test_users.py |  89 +++++---------------
 api/tests/unit/api/v1/test_users.py   |  42 ++++++++++
 4 files changed, 69 insertions(+), 187 deletions(-)
 create mode 100644 api/tests/unit/api/v1/test_users.py

diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index 7a613a5c..cf1e2517 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -211,7 +211,7 @@ async def update_user_secrets(
     except ValidationError as e:
         # Handles Pydantic schema validation errors (e.g., bad format/length of credentials)
         error_msg = f"Invalid {creds.provider.value.upper()} credentials payload."
-        raise HTTPException(status_code=422, detail=error_msg) from e
+        raise HTTPException(status_code=400, detail=error_msg) from e
 
     verified, msg = creds_obj.verify_creds()
 
@@ -247,117 +247,3 @@ async def update_user_secrets(
     return MessageSchema(
         message=f"{creds.provider.value.upper()} credentials successfully verified and updated"
     )
-
-
-@router.post("/me/secrets/aws")
-async def update_aws_secrets(
-    aws_secrets: AWSSecrets,
-    current_user: UserModel = Depends(get_current_user),  # noqa: B008
-    db: AsyncSession = Depends(async_get_db),  # noqa: B008
-) -> AWSUpdateSecretMessageSchema:
-    """Update the current user's AWS secrets.
-
-    Args:
-    ----
-        aws_secrets (AWSSecrets): The AWS credentials to store.
-        current_user (UserModel): The authenticated user.
-        db (Session): Database connection.
-
-    Returns:
-    -------
-        AWSUpdateSecretMessageSchema: Status message.
-
-    """
-    # Fetch secrets explicitly from the database
-    stmt = select(SecretModel).where(SecretModel.user_id == current_user.id)
-    result = await db.execute(stmt)
-    secrets = result.scalars().first()
-    if not secrets:
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail="User secrets record not found",
-        )
-
-    # Encrypt the AWS credentials using the user's public key
-    if not current_user.public_key:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="User encryption keys not set up. Please register a new account.",
-        )
-
-    # Convert to dictionary for encryption
-    aws_data = {
-        "aws_access_key": aws_secrets.aws_access_key,
-        "aws_secret_key": aws_secrets.aws_secret_key,
-    }
-
-    # Encrypt with the user's public key
-    encrypted_data = encrypt_with_public_key(aws_data, current_user.public_key)
-
-    # Update the secrets with encrypted values
-    secrets.aws_access_key = encrypted_data["aws_access_key"]
-    secrets.aws_secret_key = encrypted_data["aws_secret_key"]
-    secrets.aws_created_at = datetime.now(UTC)
-    await db.commit()
-
-    return AWSUpdateSecretMessageSchema(message="AWS credentials updated successfully")
-
-
-@router.post("/me/secrets/azure")
-async def update_azure_secrets(
-    azure_secrets: AzureSecrets,
-    current_user: UserModel = Depends(get_current_user),  # noqa: B008
-    db: AsyncSession = Depends(async_get_db),  # noqa: B008
-) -> AzureUpdateSecretMessageSchema:
-    """Update the current user's Azure secrets.
-
-    Args:
-    ----
-        azure_secrets (AzureSecrets): The Azure credentials to store.
-        current_user (UserModel): The authenticated user.
-        db (Session): Database connection.
-
-    Returns:
-    -------
-        AzureUpdateSecretMessageSchema: Success message.
-
-    """
-    # Fetch secrets explicitly from the database
-    stmt = select(SecretModel).where(SecretModel.user_id == current_user.id)
-    result = await db.execute(stmt)
-    secrets = result.scalars().first()
-    if not secrets:
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail="User secrets record not found",
-        )
-
-    # Encrypt the Azure credentials using the user's public key
-    if not current_user.public_key:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="User encryption keys not set up. Please register a new account.",
-        )
-
-    # Convert to dictionary for encryption
-    azure_data = {
-        "azure_client_id": azure_secrets.azure_client_id,
-        "azure_client_secret": azure_secrets.azure_client_secret,
-        "azure_tenant_id": azure_secrets.azure_tenant_id,
-        "azure_subscription_id": azure_secrets.azure_subscription_id,
-    }
-
-    # Encrypt with the user's public key
-    encrypted_data = encrypt_with_public_key(azure_data, current_user.public_key)
-
-    # Update the secrets with encrypted values
-    secrets.azure_client_id = encrypted_data["azure_client_id"]
-    secrets.azure_client_secret = encrypted_data["azure_client_secret"]
-    secrets.azure_tenant_id = encrypted_data["azure_tenant_id"]
-    secrets.azure_subscription_id = encrypted_data["azure_subscription_id"]
-    secrets.azure_created_at = datetime.now(UTC)
-    await db.commit()
-
-    return AzureUpdateSecretMessageSchema(
-        message="Azure credentials updated successfully"
-    )
diff --git a/api/tests/common/api/v1/config.py b/api/tests/common/api/v1/config.py
index ca5af7d9..66c2c8c5 100644
--- a/api/tests/common/api/v1/config.py
+++ b/api/tests/common/api/v1/config.py
@@ -336,9 +336,12 @@
 }
 
 # Test data for AWS secrets
-aws_secrets_payload = {
-    "aws_access_key": "AKIAIOSFODNN7EXAMPLE",
-    "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+aws_secrets_payload: dict[str, Any] = {
+    "provider": "aws",
+    "credentials": {
+        "aws_access_key": "AKIAIOSFODNN7EXAMPLE",
+        "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    },
 }
 
 # Test data for Azure secrets
diff --git a/api/tests/common/api/v1/test_users.py b/api/tests/common/api/v1/test_users.py
index 577dc43a..2787f049 100644
--- a/api/tests/common/api/v1/test_users.py
+++ b/api/tests/common/api/v1/test_users.py
@@ -47,74 +47,31 @@ async def test_update_password_with_incorrect_current(
         assert update_response.status_code == status.HTTP_400_BAD_REQUEST
         assert update_response.json()["detail"] == "Current password is incorrect"
 
-    async def test_update_aws_credentials(self, auth_api_client: AsyncClient) -> None:
-        """Test updating AWS credentials."""
-        # Add AWS credentials
-        aws_response = await auth_api_client.post(
-            f"{BASE_ROUTE}/users/me/secrets/aws", json=aws_secrets_payload
+    async def test_update_secrets_with_invalid_payload(self, auth_api_client: AsyncClient) -> None:
+        """Test updating user secrets with invalid credentials format"""
+        # Try update with invalid secrets format - Use AWS secrets specifically for this test
+        invalid_payload = copy.deepcopy(aws_secrets_payload)
+        # Using incorrect credentials to test validation - not a security risk
+        invalid_payload["credentials"]["aws_access_key"] = (
+            "string"  # noqa: S105
         )
-        assert aws_response.status_code == status.HTTP_200_OK
-        assert aws_response.json()["message"] == "AWS credentials updated successfully"
 
-        # Check updated status
-        updated_status_response = await auth_api_client.get(
-            f"{BASE_ROUTE}/users/me/secrets"
-        )
-        assert updated_status_response.status_code == status.HTTP_200_OK
-
-        aws_status = updated_status_response.json()
-        assert aws_status["aws"]["has_credentials"] is True
-        assert "created_at" in aws_status["aws"]
-
-    async def test_update_azure_credentials(self, auth_api_client: AsyncClient) -> None:
-        """Test updating Azure credentials."""
-        # Add Azure credentials
-        azure_response = await auth_api_client.post(
-            f"{BASE_ROUTE}/users/me/secrets/azure", json=azure_secrets_payload
-        )
-        assert azure_response.status_code == status.HTTP_200_OK
-        assert (
-            azure_response.json()["message"] == "Azure credentials updated successfully"
+        update_response = await auth_api_client.post(
+            f"{BASE_ROUTE}/users/me/secrets", json=invalid_payload
         )
+        assert update_response.status_code == status.HTTP_400_BAD_REQUEST
+        assert update_response.json()["detail"] == "Invalid AWS credentials payload."
 
-        # Check updated status
-        status_response = await auth_api_client.get(f"{BASE_ROUTE}/users/me/secrets")
-        assert status_response.status_code == status.HTTP_200_OK
-
-        azure_status = status_response.json()
-        assert azure_status["azure"]["has_credentials"] is True
-        assert "created_at" in azure_status["azure"]
-
-    async def test_both_provider_credentials_status(
-        self, auth_api_client: AsyncClient
-    ) -> None:
-        """Test that status shows both provider credentials when set."""
-        # Add AWS credentials
-        aws_response = await auth_api_client.post(
-            f"{BASE_ROUTE}/users/me/secrets/aws", json=aws_secrets_payload
-        )
-        assert aws_response.status_code == status.HTTP_200_OK
-        assert aws_response.json()["message"] == "AWS credentials updated successfully"
+    async def test_update_secrets_with_invalid_credentials(self, auth_api_client: AsyncClient) -> None:
+        """Test updating user secrets with invalid credentials that do not authenticate"""
+        # Try update with invalid secrets - Use AWS secrets specifically for this test
+        invalid_payload = copy.deepcopy(aws_secrets_payload) # Example secrets correct format but do not authenticate
 
-        # Add Azure credentials
-        azure_response = await auth_api_client.post(
-            f"{BASE_ROUTE}/users/me/secrets/azure", json=azure_secrets_payload
-        )
-        assert azure_response.status_code == status.HTTP_200_OK
-        assert (
-            azure_response.json()["message"] == "Azure credentials updated successfully"
+        update_response = await auth_api_client.post(
+            f"{BASE_ROUTE}/users/me/secrets", json=invalid_payload
         )
-
-        # Check final status with both credentials
-        status_response = await auth_api_client.get(f"{BASE_ROUTE}/users/me/secrets")
-        assert status_response.status_code == status.HTTP_200_OK
-
-        provider_status = status_response.json()
-        assert provider_status["aws"]["has_credentials"] is True
-        assert provider_status["azure"]["has_credentials"] is True
-        assert "created_at" in provider_status["aws"]
-        assert "created_at" in provider_status["azure"]
-
+        assert update_response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
+        assert update_response.json()["detail"] == "AWS credentials could not be authenticated. Please ensure you are providing credentials that are linked to a valid AWS account." 
 
 @pytest.mark.asyncio(loop_scope="session")
 @pytest.mark.parametrize(
@@ -195,13 +152,7 @@ async def test_unauthenticated_access(self, api_client: AsyncClient) -> None:
 
         # Try to update AWS secrets without authentication
         response = await api_client.post(
-            f"{BASE_ROUTE}/users/me/secrets/aws", json=aws_secrets_payload
-        )
-        assert response.status_code == status.HTTP_401_UNAUTHORIZED
-
-        # Try to update Azure secrets without authentication
-        response = await api_client.post(
-            f"{BASE_ROUTE}/users/me/secrets/azure", json=azure_secrets_payload
+            f"{BASE_ROUTE}/users/me/secrets", json=aws_secrets_payload
         )
         assert response.status_code == status.HTTP_401_UNAUTHORIZED
 
diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
new file mode 100644
index 00000000..a556315c
--- /dev/null
+++ b/api/tests/unit/api/v1/test_users.py
@@ -0,0 +1,42 @@
+from typing import Any
+from httpx import AsyncClient
+import pytest
+from pytest_mock import MockerFixture
+
+from src.app.schemas.message_schema import MessageSchema
+from tests.unit.api.v1.config import BASE_ROUTE
+from fastapi import status
+from tests.unit.api.v1.config import aws_secrets_payload
+from unittest.mock import MagicMock
+
+
+@pytest.fixture
+def users_api_v1_endpoints_path() -> str:
+    """Get the dot path to the v1 API endpoints for users."""
+    return "src.app.api.v1.users"
+
+
+@pytest.fixture
+def mock_update_secrets_success(
+    mocker: MockerFixture, users_api_v1_endpoints_path: str
+) -> None:
+    """Bypass provider credentials verification to succeed."""
+
+    mock_creds_class = MagicMock()
+    mock_creds_class.verify_creds.return_value = [True, MessageSchema(message="true")]
+    # Patch the function
+    mocker.patch(
+        f"{users_api_v1_endpoints_path}.CredsFactory.create_creds_verification",
+        return_value=mock_creds_class,
+    )
+
+
+async def test_update_secrets_database_fetch_failure(
+    auth_client: AsyncClient, mock_update_secrets_success: None
+) -> None:
+    """Test that attempting to update user provider credentials fails when user record is not found in the database"""
+    response = await auth_client.post(
+        f"{BASE_ROUTE}/me/secrets",
+        json=aws_secrets_payload,
+    )
+    assert response.status_code == status.HTTP_200_OK

From 10d6117e353b9999c230020e1b3fdb9e078d607a Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 14:52:03 -0400
Subject: [PATCH 05/43] fix(secrets): Added additional handling for invalid
 provider in secrets payload.

---
 api/src/app/api/v1/users.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index cf1e2517..fc07298a 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -208,8 +208,8 @@ async def update_user_secrets(
         creds_obj = CredsFactory.create_creds_verification(
             provider=creds.provider, credentials=creds.credentials
         )
-    except ValidationError as e:
-        # Handles Pydantic schema validation errors (e.g., bad format/length of credentials)
+    except (ValidationError, ValueError) as e:
+        # Handles Pydantic schema validation errors (e.g., bad format/length of credentials) or invalid providers in payload
         error_msg = f"Invalid {creds.provider.value.upper()} credentials payload."
         raise HTTPException(status_code=400, detail=error_msg) from e
 

From 9218f894060d5b92d32a53c6c1ec93168ea274e0 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 14:52:35 -0400
Subject: [PATCH 06/43] fix(tests): Updated AWS Secrets payload in config to
 reflect current payload design.

---
 api/tests/unit/api/v1/config.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/api/tests/unit/api/v1/config.py b/api/tests/unit/api/v1/config.py
index d8126aed..257aafd0 100644
--- a/api/tests/unit/api/v1/config.py
+++ b/api/tests/unit/api/v1/config.py
@@ -309,9 +309,12 @@
 }
 
 # Test data for AWS secrets
-aws_secrets_payload = {
-    "aws_access_key": "AKIAIOSFODNN7EXAMPLE",
-    "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+aws_secrets_payload: dict[str, Any] = {
+    "provider": "aws",
+    "credentials": {
+        "aws_access_key": "AKIAIOSFODNN7EXAMPLE",
+        "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    },
 }
 
 # Test data for Azure secrets

From 8517b8c8003185d1097531adea71f5cc67916663 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 14:52:54 -0400
Subject: [PATCH 07/43] feat(tests): Added tests for CredsFactory class

---
 api/tests/unit/cloud/test_creds_factory.py | 38 ++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 api/tests/unit/cloud/test_creds_factory.py

diff --git a/api/tests/unit/cloud/test_creds_factory.py b/api/tests/unit/cloud/test_creds_factory.py
new file mode 100644
index 00000000..fc5677b9
--- /dev/null
+++ b/api/tests/unit/cloud/test_creds_factory.py
@@ -0,0 +1,38 @@
+import copy
+
+import pytest
+
+from src.app.cloud.aws_creds import AWSCreds
+from src.app.cloud.creds_factory import CredsFactory
+from src.app.schemas.creds_verify_schema import CredsVerifySchema
+from tests.unit.api.v1.config import aws_secrets_payload
+
+
+def test_creds_factory_non_existent_provider_type() -> None:
+    """Test that CredsFactory.create_creds_verification() raises a ValueError when invalid provider is provided."""
+    # Set provider to non-existent provider
+    bad_provider_creds_payload = copy.deepcopy(aws_secrets_payload)
+
+    invalid_creds_verify_schema = CredsVerifySchema.model_validate(
+        bad_provider_creds_payload
+    )
+    # Ignore invalid string assignment since we are triggering a ValueError
+    invalid_creds_verify_schema.provider = "FakeProvider"  # type: ignore
+
+    with pytest.raises(ValueError):
+        _ = CredsFactory.create_creds_verification(
+            provider=invalid_creds_verify_schema.provider,
+            credentials=invalid_creds_verify_schema.credentials,
+        )
+
+
+def test_creds_factory_build_aws_creds() -> None:
+    """Test that CredsFactory can build an AWSCreds."""
+    # Use AWS secrets payload with provider already set to AWS
+    aws_creds = CredsVerifySchema.model_validate(aws_secrets_payload)
+
+    creds_object = CredsFactory.create_creds_verification(
+        provider=aws_creds.provider, credentials=aws_creds.credentials
+    )
+
+    assert type(creds_object) is AWSCreds

From 4b2ff5e2cc3317946695471af842c5c94779b8b4 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 15:40:40 -0400
Subject: [PATCH 08/43] fix(schemas): Extra period in error message

---
 api/src/app/schemas/secret_schema.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/src/app/schemas/secret_schema.py b/api/src/app/schemas/secret_schema.py
index 7ec25033..1cde759b 100644
--- a/api/src/app/schemas/secret_schema.py
+++ b/api/src/app/schemas/secret_schema.py
@@ -83,7 +83,7 @@ def validate_access_key(cls, aws_access_key: str) -> str:
         """
         access_key_length = 20
         if len(aws_access_key.strip()) == 0:
-            msg = "Partial credentials or no credentials provided.. Please ensure you are providing proper AWS credentials."
+            msg = "Partial credentials or no credentials provided. Please ensure you are providing proper AWS credentials."
             raise ValueError(msg)
         if len(aws_access_key.strip()) != access_key_length:
             msg = "Invalid credential format. Please ensure your AWS credentials are of proper length."

From f5311d91a2157b411170b2e44128bbf709c1b6e1 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 15:42:06 -0400
Subject: [PATCH 09/43] fix(tests): Update credential payload to use empty
 dictionary when testing for invalid payload

---
 api/tests/common/api/v1/test_users.py | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/api/tests/common/api/v1/test_users.py b/api/tests/common/api/v1/test_users.py
index 2787f049..ddd67845 100644
--- a/api/tests/common/api/v1/test_users.py
+++ b/api/tests/common/api/v1/test_users.py
@@ -47,14 +47,14 @@ async def test_update_password_with_incorrect_current(
         assert update_response.status_code == status.HTTP_400_BAD_REQUEST
         assert update_response.json()["detail"] == "Current password is incorrect"
 
-    async def test_update_secrets_with_invalid_payload(self, auth_api_client: AsyncClient) -> None:
-        """Test updating user secrets with invalid credentials format"""
+    async def test_update_secrets_with_invalid_payload(
+        self, auth_api_client: AsyncClient
+    ) -> None:
+        """Test updating user secrets with invalid credentials payload"""
         # Try update with invalid secrets format - Use AWS secrets specifically for this test
         invalid_payload = copy.deepcopy(aws_secrets_payload)
-        # Using incorrect credentials to test validation - not a security risk
-        invalid_payload["credentials"]["aws_access_key"] = (
-            "string"  # noqa: S105
-        )
+        # Using incorrect credentials to test validation - submit payload without required fields
+        invalid_payload["credentials"] = {}  # noqa: S105
 
         update_response = await auth_api_client.post(
             f"{BASE_ROUTE}/users/me/secrets", json=invalid_payload
@@ -62,16 +62,24 @@ async def test_update_secrets_with_invalid_payload(self, auth_api_client: AsyncC
         assert update_response.status_code == status.HTTP_400_BAD_REQUEST
         assert update_response.json()["detail"] == "Invalid AWS credentials payload."
 
-    async def test_update_secrets_with_invalid_credentials(self, auth_api_client: AsyncClient) -> None:
+    async def test_update_secrets_with_invalid_credentials(
+        self, auth_api_client: AsyncClient
+    ) -> None:
         """Test updating user secrets with invalid credentials that do not authenticate"""
         # Try update with invalid secrets - Use AWS secrets specifically for this test
-        invalid_payload = copy.deepcopy(aws_secrets_payload) # Example secrets correct format but do not authenticate
+        invalid_payload = copy.deepcopy(
+            aws_secrets_payload
+        )  # Example secrets correct format but do not authenticate
 
         update_response = await auth_api_client.post(
             f"{BASE_ROUTE}/users/me/secrets", json=invalid_payload
         )
         assert update_response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
-        assert update_response.json()["detail"] == "AWS credentials could not be authenticated. Please ensure you are providing credentials that are linked to a valid AWS account." 
+        assert (
+            update_response.json()["detail"]
+            == "AWS credentials could not be authenticated. Please ensure you are providing credentials that are linked to a valid AWS account."
+        )
+
 
 @pytest.mark.asyncio(loop_scope="session")
 @pytest.mark.parametrize(

From e6bf1fc1871cc5c605892ffa8fe62fda6cadc81d Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 15:42:48 -0400
Subject: [PATCH 10/43] fix(tests): fix api route for fixture test
 (in-progress)

---
 api/tests/unit/api/v1/test_users.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index a556315c..7a819fd8 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -36,7 +36,7 @@ async def test_update_secrets_database_fetch_failure(
 ) -> None:
     """Test that attempting to update user provider credentials fails when user record is not found in the database"""
     response = await auth_client.post(
-        f"{BASE_ROUTE}/me/secrets",
+        f"{BASE_ROUTE}/users/me/secrets",
         json=aws_secrets_payload,
     )
     assert response.status_code == status.HTTP_200_OK

From b8c39110fe844856727ce33a18249194c75ed2ef Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 20 Jul 2025 15:43:16 -0400
Subject: [PATCH 11/43] feat(tests): add test coverage for AWS secrets schema

---
 api/tests/unit/schemas/test_secret_schema.py | 52 ++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 api/tests/unit/schemas/test_secret_schema.py

diff --git a/api/tests/unit/schemas/test_secret_schema.py b/api/tests/unit/schemas/test_secret_schema.py
new file mode 100644
index 00000000..77dc4cdf
--- /dev/null
+++ b/api/tests/unit/schemas/test_secret_schema.py
@@ -0,0 +1,52 @@
+import copy
+import re
+
+import pytest
+from pydantic import ValidationError
+
+from src.app.schemas.secret_schema import AWSSecrets
+from tests.unit.api.v1.config import aws_secrets_payload
+
+
+def test_aws_secrets_schema_invalid_access_key_length() -> None:
+    """Test that the AWS Secrets schema fails when aws_access_key is invalid length."""
+    invalid_creds = copy.deepcopy(aws_secrets_payload)
+    invalid_creds["credentials"]["aws_access_key"] = "string"
+
+    expected_msg = re.compile(r"Invalid credential format", re.IGNORECASE)
+    with pytest.raises(ValidationError, match=expected_msg):
+        AWSSecrets.model_validate(invalid_creds["credentials"])
+
+
+def test_aws_secrets_schema_missing_access_key_length() -> None:
+    """Test that the AWS Secrets schema fails when aws_access_key is missing."""
+    invalid_creds = copy.deepcopy(aws_secrets_payload)
+    invalid_creds["credentials"][
+        "aws_access_key"
+    ] = ""  # Empty string = missing access key
+
+    expected_msg = re.compile(r"Partial credentials", re.IGNORECASE)
+    with pytest.raises(ValidationError, match=expected_msg):
+        AWSSecrets.model_validate(invalid_creds["credentials"])
+
+
+def test_aws_secrets_schema_invalid_secret_key_length() -> None:
+    """Test that the AWS Secrets schema fails when aws_secret_key is invalid length."""
+    invalid_creds = copy.deepcopy(aws_secrets_payload)
+    invalid_creds["credentials"]["aws_secret_key"] = "string"
+
+    expected_msg = re.compile(r"Invalid credential format", re.IGNORECASE)
+    with pytest.raises(ValidationError, match=expected_msg):
+        AWSSecrets.model_validate(invalid_creds["credentials"])
+
+
+def test_aws_secrets_schema_missing_secret_key_length() -> None:
+    """Test that the AWS Secrets schema fails when aws_secret_key is missing."""
+    invalid_creds = copy.deepcopy(aws_secrets_payload)
+    invalid_creds["credentials"][
+        "aws_secret_key"
+    ] = ""  # Empty string = missing secret key
+
+    expected_msg = re.compile(r"Partial credentials", re.IGNORECASE)
+    with pytest.raises(ValidationError, match=expected_msg):
+        AWSSecrets.model_validate(invalid_creds["credentials"])

From fcd20a25f586b6a44d999fd3c0eee23bcbb5874b Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Fri, 25 Jul 2025 19:52:54 -0400
Subject: [PATCH 12/43] fix(tests): Update pyproject.toml to ignore botocore
 deprecated warnings.

---
 api/pyproject.toml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/api/pyproject.toml b/api/pyproject.toml
index 6d6c73e9..5b329793 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -76,7 +76,8 @@ addopts = [
 asyncio_mode = "auto"
 asyncio_default_fixture_loop_scope = "session"
 filterwarnings = [
-    "ignore:cannot collect test class 'Testing':pytest.PytestCollectionWarning"
+    "ignore:cannot collect test class 'Testing':pytest.PytestCollectionWarning",
+    "ignore::DeprecationWarning:botocore.auth",
 ]
 
 # Register markers to easily select unit or integration tests.

From 0ae48eb06ec84d9a499670f1a08143aa9ade340f Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Fri, 25 Jul 2025 19:53:50 -0400
Subject: [PATCH 13/43] fix(api): Update user error message for updating
 secrets endpoint.

---
 api/src/app/api/v1/users.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index fc07298a..44ab03ee 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -200,7 +200,7 @@ async def update_user_secrets(
     if not secrets:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail="User secrets record not found",
+            detail="User secrets record not found!",
         )
 
     # Verify credentials are valid before storing
@@ -245,5 +245,5 @@ async def update_user_secrets(
     await upsert_user_secrets(db, secrets, current_user.id)
 
     return MessageSchema(
-        message=f"{creds.provider.value.upper()} credentials successfully verified and updated"
+        message=f"{creds.provider.value.upper()} credentials successfully verified and updated."
     )

From 0b226520c824875fe9c270d25826479ee9573c66 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Fri, 25 Jul 2025 19:54:49 -0400
Subject: [PATCH 14/43] fix(crud): Remove unnecessary commit line from crud
 function.

---
 api/src/app/crud/crud_secrets.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/api/src/app/crud/crud_secrets.py b/api/src/app/crud/crud_secrets.py
index de71f636..4f3ef855 100644
--- a/api/src/app/crud/crud_secrets.py
+++ b/api/src/app/crud/crud_secrets.py
@@ -59,6 +59,3 @@ async def upsert_user_secrets(
     #    - If yes, it copies the new data onto the existing record.
     #    - If no, it stages a new record for insertion.
     await db.merge(db_object_to_merge)
-    # 3. Commit the transaction to save the changes.
-    #    This will execute either an UPDATE or INSERT statement.
-    await db.commit()

From 83e76f84c7d6231cbc9dca8ad7e28e6f762590bb Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Fri, 25 Jul 2025 19:55:38 -0400
Subject: [PATCH 15/43] fix(tests): Working full coverage unit api tests for
 users secrets endpoint.

---
 api/tests/unit/api/v1/test_users.py | 83 +++++++++++++++++++++++++++--
 1 file changed, 78 insertions(+), 5 deletions(-)

diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index 7a819fd8..716b6267 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -1,8 +1,13 @@
+from datetime import UTC, datetime
 from typing import Any
 from httpx import AsyncClient
 import pytest
-from pytest_mock import MockerFixture
+from pytest_mock import MockerFixture, mocker
 
+from src.app.core.auth.auth import get_current_user
+from src.app.main import app
+from src.app.models.user_model import UserModel
+from src.app.schemas.secret_schema import SecretSchema
 from src.app.schemas.message_schema import MessageSchema
 from tests.unit.api.v1.config import BASE_ROUTE
 from fastapi import status
@@ -20,23 +25,91 @@ def users_api_v1_endpoints_path() -> str:
 def mock_update_secrets_success(
     mocker: MockerFixture, users_api_v1_endpoints_path: str
 ) -> None:
-    """Bypass provider credentials verification to succeed."""
+    """Bypass provider credentials verification and updating user secrets record to succeed."""
 
     mock_creds_class = MagicMock()
     mock_creds_class.verify_creds.return_value = [True, MessageSchema(message="true")]
-    # Patch the function
+    mock_creds_class.update_secret_schema.return_value = SecretSchema()
+    # Patch the functions
     mocker.patch(
         f"{users_api_v1_endpoints_path}.CredsFactory.create_creds_verification",
         return_value=mock_creds_class,
     )
 
 
-async def test_update_secrets_database_fetch_failure(
+@pytest.fixture
+def mock_get_secrets_failure(
+    mocker: MockerFixture, users_api_v1_endpoints_path: str
+) -> None:
+    """Bypass fetching users secrets to fail."""
+    # Patch the function
+    mocker.patch(f"{users_api_v1_endpoints_path}.get_user_secrets", return_value=None)
+
+
+@pytest.fixture
+def mock_get_secrets(mocker: MockerFixture, users_api_v1_endpoints_path: str) -> None:
+    """Bypass fetching users secrets to pass for a fake user."""
+
+    def override_get_current_user_no_key():
+        """Fake dependency that returns a user without a public key."""
+        return UserModel(
+            name="FakeUser",
+            email="fakeuser@gmail.com",
+            hashed_password="faskpasswordhash",
+            created_at=datetime.now(UTC),
+            last_active=datetime.now(UTC),
+            is_admin=False,
+            public_key=None,
+        )
+
+    # Temporarily override the dependency
+    app.dependency_overrides[get_current_user] = override_get_current_user_no_key
+    # Patch the function
+    mocker.patch(
+        f"{users_api_v1_endpoints_path}.get_user_secrets",
+        return_value=SecretSchema(),
+    )
+
+
+async def test_update_aws_secrets_success(
     auth_client: AsyncClient, mock_update_secrets_success: None
 ) -> None:
-    """Test that attempting to update user provider credentials fails when user record is not found in the database"""
+    """Test that attempting to update user AWS provider credentials succeeds."""
     response = await auth_client.post(
         f"{BASE_ROUTE}/users/me/secrets",
         json=aws_secrets_payload,
     )
     assert response.status_code == status.HTTP_200_OK
+    assert (
+        response.json()["message"]
+        == "AWS credentials successfully verified and updated."
+    )
+
+
+async def test_update_user_secrets_database_fetch_failure(
+    auth_client: AsyncClient, mock_get_secrets_failure: None
+) -> None:
+    """Test that attempting to update user provider credentials fails when user record is not found in database."""
+    response = await auth_client.post(
+        f"{BASE_ROUTE}/users/me/secrets",
+        json=aws_secrets_payload,
+    )
+    assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
+    assert response.json()["detail"] == "User secrets record not found!"
+
+
+async def test_update_user_secrets_encryption_failure(
+    auth_client: AsyncClient,
+    mock_get_secrets: None,
+    mock_update_secrets_success: None,
+) -> None:
+    """Test that attempting to update user provider credentials fails when user public key does not exist."""
+    response = await auth_client.post(
+        f"{BASE_ROUTE}/users/me/secrets",
+        json=aws_secrets_payload,
+    )
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert (
+        response.json()["detail"]
+        == "User encryption keys not set up. Please register a new account."
+    )

From b672026ce7273d6ac6d7b578f96a31b016366629 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Fri, 25 Jul 2025 19:56:11 -0400
Subject: [PATCH 16/43] feat(tests): working full unit test coverage for crud
 secrets.

---
 api/tests/unit/crud/test_crud_secrets.py | 72 ++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 api/tests/unit/crud/test_crud_secrets.py

diff --git a/api/tests/unit/crud/test_crud_secrets.py b/api/tests/unit/crud/test_crud_secrets.py
new file mode 100644
index 00000000..d09f70db
--- /dev/null
+++ b/api/tests/unit/crud/test_crud_secrets.py
@@ -0,0 +1,72 @@
+import re
+from unittest.mock import MagicMock
+import pytest
+from pytest_mock import MockerFixture
+
+from src.app.models.secret_model import SecretModel
+from .crud_mocks import DummyDB
+from src.app.crud.crud_secrets import get_user_secrets, upsert_user_secrets
+from src.app.schemas.secret_schema import SecretSchema
+
+
+@pytest.fixture
+def crud_secrets_path() -> str:
+    """Return the dot path of the tested crud secrets file."""
+    return "src.app.crud.crud_secrets"
+
+
+async def test_upsert_user_secrets() -> None:
+    """Test that updating user secrets works correctly."""
+    mock_db = DummyDB()
+    fake_secrets = SecretSchema()
+    mock_user_id = 1
+
+    await upsert_user_secrets(db=mock_db, secrets=fake_secrets, user_id=mock_user_id)
+
+    # Check we upsert correctly
+    mock_db.merge.assert_awaited_once()
+
+    # Check we are upserting the creds for the correct user
+    called_with_object = mock_db.merge.call_args[0][0]
+
+    # 5. Assert that the object has the correct attributes
+    assert isinstance(called_with_object, SecretModel)
+    assert called_with_object.user_id == mock_user_id
+
+
+async def test_get_user_secrets_success(mocker: MockerFixture) -> None:
+    """Tests successfully retrieving user secrets when they exist."""
+    dummy_db = DummyDB()
+    user_id = 123
+    mock_secret_model = MagicMock()
+
+    # Mock the full database call to return mock model
+    mock_result = dummy_db.execute.return_value
+    mock_result.scalars = MagicMock()
+    mock_result.scalars.return_value.first.return_value = mock_secret_model
+
+    # Patch validation of secrets
+    mock_validate = mocker.patch.object(
+        SecretSchema, "model_validate", return_value="validated_secrets"
+    )
+
+    result = await get_user_secrets(db=dummy_db, user_id=user_id)
+    assert result == "validated_secrets"
+    mock_validate.assert_called_once_with(mock_secret_model)
+
+    # Verify the fetching secrets for correct user
+    stmt = dummy_db.execute.call_args[0][0]
+    assert str(SecretModel.user_id == user_id) in str(stmt.whereclause)
+
+
+async def test_get_user_secrets_not_found(caplog: pytest.LogCaptureFixture) -> None:
+    """Tests that None is returned and a message is logged when secrets are not found."""
+    dummy_db = DummyDB()
+    user_id = 404
+
+    # Mock the database to return no results
+    dummy_db.execute.return_value = None
+
+    result = await get_user_secrets(db=dummy_db, user_id=user_id)
+    assert result is None
+    assert re.search(f"failed to fetch secrets.*{user_id}", caplog.text, re.IGNORECASE)

From 67c999fd75af28c5fd283bbf9f34bc5c2dccd99e Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Mon, 28 Jul 2025 20:54:58 -0400
Subject: [PATCH 17/43] feat(tests): full test coverage for creds verification
 on AWS.

---
 api/tests/unit/cloud/test_aws_creds.py | 176 +++++++++++++++++++++++++
 1 file changed, 176 insertions(+)
 create mode 100644 api/tests/unit/cloud/test_aws_creds.py

diff --git a/api/tests/unit/cloud/test_aws_creds.py b/api/tests/unit/cloud/test_aws_creds.py
new file mode 100644
index 00000000..46679083
--- /dev/null
+++ b/api/tests/unit/cloud/test_aws_creds.py
@@ -0,0 +1,176 @@
+import pytest
+from unittest.mock import MagicMock
+from botocore.exceptions import ClientError
+
+from src.app.utils.crypto import encrypt_with_public_key, generate_rsa_key_pair
+from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
+from src.app.cloud.aws_creds import AWSCreds
+from tests.unit.api.v1.config import aws_secrets_payload
+
+
+@pytest.fixture(scope="module")
+def aws_creds_class() -> AWSCreds:
+    """Create a AWS creds class object."""
+    return AWSCreds(aws_secrets_payload["credentials"])
+
+
+def test_init(aws_creds_class: AWSCreds) -> None:
+    """Test that initializing the aws creds object creates and stores and AWS Secrets Schema object."""
+    assert isinstance(aws_creds_class.credentials, AWSSecrets)
+
+
+def test_get_user_creds(aws_creds_class: AWSCreds) -> None:
+    """Test that getting user credentials is returned as a proper dictionary."""
+    user_creds = aws_creds_class.get_user_creds()
+
+    # Keys
+    access_key = "aws_access_key"
+    secret_key = "aws_secret_key"
+
+    assert user_creds[access_key] == aws_secrets_payload["credentials"][access_key]
+    assert user_creds[secret_key] == aws_secrets_payload["credentials"][secret_key]
+
+
+def test_update_secret_schema(aws_creds_class: AWSCreds) -> None:
+    """Test that Secret Schema is updated with encrypted user credentials"""
+    user_creds = aws_creds_class.get_user_creds()
+
+    # Encrypt with the user's public key
+    _, public_key = generate_rsa_key_pair()
+    encrypted_data = encrypt_with_public_key(data=user_creds, public_key_b64=public_key)
+
+    # Update the secrets with encrypted values
+    secrets = SecretSchema()
+    secrets = aws_creds_class.update_secret_schema(
+        secrets=secrets, encrypted_data=encrypted_data
+    )
+
+    assert secrets.aws_access_key == encrypted_data["aws_access_key"]
+    assert secrets.aws_secret_key == encrypted_data["aws_secret_key"]
+
+
+def test_verify_creds_success(aws_creds_class: AWSCreds, mocker: MagicMock) -> None:
+    """Test successful credential verification with sufficient permissions."""
+    # Mock the boto3 session and its clients
+    mock_session = mocker.patch("boto3.Session").return_value
+    mock_sts = mock_session.client.return_value
+    mock_iam = mock_session.client.return_value
+
+    # Configure mock responses
+    mock_sts.get_caller_identity.return_value = {
+        "Arn": "arn:aws:iam::123456789012:user/test-user"
+    }
+    mock_iam.simulate_principal_policy.return_value = {
+        "EvaluationResults": [
+            {"EvalDecision": "allowed", "EvalActionName": "ec2:RunInstances"}
+        ]
+    }
+
+    # Execute the function
+    verified, msg = aws_creds_class.verify_creds()
+
+    # Assert the results
+    assert verified is True
+    assert "authenticated and all required permissions are present" in msg.message
+    mock_sts.get_caller_identity.assert_called_once()
+    mock_iam.simulate_principal_policy.assert_called_once()
+
+
+def test_verify_creds_root_user(aws_creds_class: AWSCreds, mocker: MagicMock) -> None:
+    """Test that the permissions check is skipped for the root user."""
+    mock_session = mocker.patch("boto3.Session").return_value
+    mock_sts = mock_session.client.return_value
+    mock_iam = mock_session.client.return_value
+
+    mock_sts.get_caller_identity.return_value = {
+        "Arn": "arn:aws:iam::123456789012:root"
+    }
+
+    verified, msg = aws_creds_class.verify_creds()
+
+    assert verified is True
+    assert "authenticated and all required permissions are present" in msg.message
+    mock_iam.simulate_principal_policy.assert_not_called()  # Ensure IAM check was skipped
+
+
+def test_verify_creds_insufficient_permissions(
+    aws_creds_class: AWSCreds, mocker: MagicMock
+) -> None:
+    """Test verification failure due to denied actions in the simulation."""
+    mock_session = mocker.patch("boto3.Session").return_value
+    mock_sts = mock_session.client.return_value
+    mock_iam = mock_session.client.return_value
+
+    mock_sts.get_caller_identity.return_value = {
+        "Arn": "arn:aws:iam::123456789012:user/limited-user"
+    }
+    mock_iam.simulate_principal_policy.return_value = {
+        "EvaluationResults": [
+            {"EvalDecision": "allowed", "EvalActionName": "ec2:DescribeInstances"},
+            {"EvalDecision": "implicitDeny", "EvalActionName": "ec2:RunInstances"},
+            {"EvalDecision": "implicitDeny", "EvalActionName": "ec2:CreateVpc"},
+        ]
+    }
+
+    verified, msg = aws_creds_class.verify_creds()
+
+    assert verified is False
+    assert "Insufficient permissions" in msg.message
+    assert "ec2:RunInstances" in msg.message
+    assert "ec2:CreateVpc" in msg.message
+    assert (
+        "ec2:DescribeInstances" not in msg.message
+    )  # Ensure only denied actions are listed
+
+
+def test_verify_creds_invalid_token(
+    aws_creds_class: AWSCreds, mocker: MagicMock
+) -> None:
+    """Test verification failure due to invalid credentials."""
+    mock_session = mocker.patch("boto3.Session").return_value
+    mock_sts = mock_session.client.return_value
+
+    # Simulate a ClientError for an invalid token
+    error_response = {
+        "Error": {
+            "Code": "InvalidTokenId",
+            "Message": "The security token included in the request is invalid.",
+        }
+    }
+    mock_sts.get_caller_identity.side_effect = ClientError(
+        error_response, "GetCallerIdentity"
+    )
+
+    verified, msg = aws_creds_class.verify_creds()
+
+    assert verified is False
+    assert msg.message == "The security token included in the request is invalid."
+
+
+def test_verify_creds_iam_access_denied(
+    aws_creds_class: AWSCreds, mocker: MagicMock
+) -> None:
+    """Test failure when credentials are valid but cannot perform the IAM simulation."""
+    mock_session = mocker.patch("boto3.Session").return_value
+    mock_sts = mock_session.client.return_value
+    mock_iam = mock_session.client.return_value
+
+    mock_sts.get_caller_identity.return_value = {
+        "Arn": "arn:aws:iam::123456789012:user/test-user"
+    }
+
+    # Simulate a ClientError for lack of iam:SimulatePrincipalPolicy permission
+    error_response = {
+        "Error": {
+            "Code": "AccessDenied",
+            "Message": "User is not authorized to perform iam:SimulatePrincipalPolicy",
+        }
+    }
+    mock_iam.simulate_principal_policy.side_effect = ClientError(
+        error_response, "SimulatePrincipalPolicy"
+    )
+
+    verified, msg = aws_creds_class.verify_creds()
+
+    assert verified is False
+    assert "iam:SimulatePrincipalPolicy permission" in msg.message

From 9603e5ac57532b80fe0cdf4719c2c5d5acbf92da Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Mon, 28 Jul 2025 23:01:37 -0400
Subject: [PATCH 18/43] feat(frontend): Combined secrets pages into a single
 section with tabs to separate providers

---
 frontend/src/lib/api.ts                   |  13 +
 frontend/src/lib/types/api.ts             |   6 +
 frontend/src/routes/settings/+page.svelte | 700 ++++++++--------------
 3 files changed, 253 insertions(+), 466 deletions(-)

diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index c4c29f4d..03b95462 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -16,6 +16,8 @@ import type {
   PasswordUpdateResponse,
   AWSSecretsRequest,
   AWSSecretsResponse,
+  SecretsRequest,
+  SecretsResponse,
   AzureSecretsRequest,
   AzureSecretsResponse,
   DeployRangeRequest
@@ -175,6 +177,17 @@ export const userApi = {
     )
   },
 
+  updateSecrets: async (payload: any): Promise<ApiResponse<SecretsResponse>> => {
+    const request: SecretsRequest = {
+      secrets: payload
+    }
+    return await apiRequest<SecretsResponse>(
+      '/api/v1/users/me/secrets',
+      'POST',
+      request
+    )
+  },
+
   // Set Azure secrets
   setAzureSecrets: async (
     clientId: string,
diff --git a/frontend/src/lib/types/api.ts b/frontend/src/lib/types/api.ts
index b8530f98..1f544d2e 100644
--- a/frontend/src/lib/types/api.ts
+++ b/frontend/src/lib/types/api.ts
@@ -200,6 +200,12 @@ export interface AWSSecretsRequest {
 export interface AWSSecretsResponse {
   message: string;
 }
+export interface SecretsRequest {
+  secrets: any;
+}
+export interface SecretsResponse {
+  message: string;
+}
 
 // Azure secrets types
 export interface AzureSecretsRequest {
diff --git a/frontend/src/routes/settings/+page.svelte b/frontend/src/routes/settings/+page.svelte
index 9880f002..6a19273c 100644
--- a/frontend/src/routes/settings/+page.svelte
+++ b/frontend/src/routes/settings/+page.svelte
@@ -7,6 +7,9 @@
   import { fade } from 'svelte/transition'
   import logger from '$lib/utils/logger'
 
+  // Active tab state
+  let activeTab: 'aws' | 'azure' = 'aws'
+
   // Password form
   let currentPassword = ''
   let newPassword = ''
@@ -41,18 +44,18 @@
   let secretsStatus = {
     aws: {
       configured: false,
-      createdAt: null,
+      createdAt: null as string | null,
     },
     azure: {
       configured: false,
-      createdAt: null,
+      createdAt: null as string | null,
     },
   }
   let loadingSecrets = true
   let loadingUserData = true
 
   // Format date for tooltip display
-  function formatDateForTooltip(dateString) {
+  function formatDateForTooltip(dateString: string | null) {
     if (!dateString) return 'Date unavailable'
     try {
       return `Configured on ${new Date(dateString).toLocaleString()}`
@@ -62,54 +65,49 @@
     }
   }
 
-  // Custom tooltip management
-  let showAwsTooltip = false
-  let showAzureTooltip = false
-
-  // Position tracking for tooltips
-  let awsTooltipPosition = { x: 0, y: 0 }
-  let azureTooltipPosition = { x: 0, y: 0 }
-
-  function handleMouseEnter(event, tooltipType) {
-    // Calculate position for tooltip
-    const rect = event.target.getBoundingClientRect()
-    const position = {
-      x: rect.left + window.scrollX + rect.width / 2, // Center horizontally
-      y: rect.top + window.scrollY - 40, // Position higher above the element
+  // Helper for tab styling
+  function getTabClass(tabName: 'aws' | 'azure') {
+    const baseClasses = 'whitespace-nowrap border-b-2 px-1 py-4 text-sm font-medium'
+    const inactiveClasses = 'border-transparent text-gray-400 hover:border-gray-500 hover:text-gray-300'
+    
+    if (activeTab === tabName) {
+      const activeClasses = tabName === 'aws' 
+        ? 'border-yellow-500 text-yellow-500' 
+        : 'border-blue-500 text-blue-500'
+      return `${baseClasses} ${activeClasses}`
     }
+    
+    return `${baseClasses} ${inactiveClasses}`
+  }
 
-    // Set position and show appropriate tooltip
-    if (tooltipType === 'aws') {
-      awsTooltipPosition = position
-      showAwsTooltip = true
-    } else if (tooltipType === 'azure') {
-      azureTooltipPosition = position
-      showAzureTooltip = true
+  // Custom tooltip management
+  let showTooltip = false
+  let tooltipPosition = { x: 0, y: 0 }
+
+  function handleMouseEnter(event: MouseEvent) {
+    const rect = (event.target as HTMLElement).getBoundingClientRect()
+    tooltipPosition = {
+      x: rect.left + window.scrollX + rect.width / 2,
+      y: rect.top + window.scrollY - 10,
     }
+    showTooltip = true
   }
 
-  function handleMouseLeave(tooltipType) {
-    if (tooltipType === 'aws') {
-      showAwsTooltip = false
-    } else if (tooltipType === 'azure') {
-      showAzureTooltip = false
-    }
+  function handleMouseLeave() {
+    showTooltip = false
   }
 
   // Load user data and secrets status
   onMount(async () => {
+    loadingUserData = true
     try {
-      // Load user data first
       const { authApi } = await import('$lib/api')
       const userResponse = await authApi.getCurrentUser()
-
       if (userResponse.data?.user) {
         userData = {
           name: userResponse.data.user.name || '',
           email: userResponse.data.user.email || '',
         }
-
-        // Update auth store
         auth.updateUser(userResponse.data.user)
       }
     } catch (error) {
@@ -118,22 +116,18 @@
       loadingUserData = false
     }
 
+    loadingSecrets = true
     try {
-      // Then load secrets status
       const result = await userApi.getUserSecrets()
-
       if (result.data) {
-        const awsDate = result.data.aws?.created_at
-        const azureDate = result.data.azure?.created_at
-
         secretsStatus = {
           aws: {
             configured: result.data.aws?.has_credentials || false,
-            createdAt: awsDate,
+            createdAt: result.data.aws?.created_at || null,
           },
           azure: {
             configured: result.data.azure?.has_credentials || false,
-            createdAt: azureDate,
+            createdAt: result.data.azure?.created_at || null,
           },
         }
       }
@@ -146,42 +140,27 @@
 
   // Handle password update
   async function handlePasswordUpdate() {
-    // Reset messages
     passwordError = ''
     passwordSuccess = ''
-
-    // Validate input
-    if (!currentPassword) {
-      passwordError = 'Current password is required'
-      return
-    }
-
-    if (!newPassword) {
-      passwordError = 'New password is required'
+    if (!currentPassword || !newPassword) {
+      passwordError = 'All password fields are required'
       return
     }
-
     if (newPassword !== confirmPassword) {
       passwordError = 'New passwords do not match'
       return
     }
-
     if (newPassword.length < 8) {
       passwordError = 'Password must be at least 8 characters long'
       return
     }
-
     isPasswordLoading = true
-
     try {
       const result = await userApi.updatePassword(currentPassword, newPassword)
-
       if (result.error) {
         passwordError = result.error
         return
       }
-
-      // Success
       passwordSuccess = 'Password updated successfully'
       currentPassword = ''
       newPassword = ''
@@ -194,124 +173,110 @@
     }
   }
 
-  // Handle AWS secrets update
-  async function handleAwsSecretsUpdate() {
-    // Reset messages
-    awsError = ''
-    awsSuccess = ''
-
-    // Validate input
-    if (!awsAccessKey) {
-      awsError = 'AWS Access Key is required'
-      return
-    }
-
-    if (!awsSecretKey) {
-      awsError = 'AWS Secret Key is required'
-      return
+  // Shared function to call the single endpoint
+  async function updateSecrets(provider: 'aws' | 'azure', payload: any) {
+    // Set loading state based on provider
+    if (provider === 'aws') {
+      isAwsLoading = true
+    } else {
+      isAzureLoading = true
     }
 
-    isAwsLoading = true
-
     try {
-      const result = await userApi.setAwsSecrets(awsAccessKey, awsSecretKey)
+      // **IMPORTANT**: This now calls a single, unified API endpoint.
+      // Make sure `userApi.updateSecrets` exists and handles the payload format.
+      const result = await userApi.updateSecrets(payload)
 
       if (result.error) {
-        awsError = result.error
+        if (provider === 'aws') awsError = result.error
+        else azureError = result.error
         return
       }
 
-      // Success
-      awsSuccess = 'AWS credentials updated successfully'
-      secretsStatus.aws.configured = true // Update local status
-      secretsStatus.aws.createdAt = new Date().toISOString()
-      awsAccessKey = ''
-      awsSecretKey = ''
+      // Handle success based on provider
+      if (provider === 'aws') {
+        awsSuccess = 'AWS credentials updated successfully'
+        secretsStatus.aws = { configured: true, createdAt: new Date().toISOString() }
+        awsAccessKey = ''
+        awsSecretKey = ''
+      } else {
+        azureSuccess = 'Azure credentials updated successfully'
+        secretsStatus.azure = { configured: true, createdAt: new Date().toISOString() }
+        azureClientId = ''
+        azureClientSecret = ''
+        azureTenantId = ''
+        azureSubscriptionId = ''
+      }
     } catch (error) {
-      awsError =
-        error instanceof Error
-          ? error.message
-          : 'Failed to update AWS credentials'
+      const errorMessage = error instanceof Error ? error.message : 'Failed to update credentials'
+      if (provider === 'aws') awsError = errorMessage
+      else azureError = errorMessage
     } finally {
-      isAwsLoading = false
+      // Reset loading state based on provider
+      if (provider === 'aws') isAwsLoading = false
+      else isAzureLoading = false
     }
   }
 
-  // Handle Azure secrets update
-  async function handleAzureSecretsUpdate() {
-    // Reset messages
-    azureError = ''
-    azureSuccess = ''
-
-    // Validate input
-    if (!azureClientId) {
-      azureError = 'Azure Client ID is required'
+  // Handle AWS secrets update
+  async function handleAwsSecretsUpdate() {
+    awsError = ''
+    awsSuccess = ''
+    if (!awsAccessKey || !awsSecretKey) {
+      awsError = 'Both AWS Access Key and Secret Key are required'
       return
     }
-
-    if (!azureClientSecret) {
-      azureError = 'Azure Client Secret is required'
-      return
+    
+    // Construct the AWS-specific payload
+    const payload = {
+      provider: 'aws',
+      credentials: {
+        aws_access_key: awsAccessKey,
+        aws_secret_key: awsSecretKey,
+      },
     }
 
-    if (!azureTenantId) {
-      azureError = 'Azure Tenant ID is required'
-      return
-    }
+    // Call the shared update function
+    await updateSecrets('aws', payload)
+  }
 
-    if (!azureSubscriptionId) {
-      azureError = 'Azure Subscription ID is required'
+  // Handle Azure secrets update
+  async function handleAzureSecretsUpdate() {
+    azureError = ''
+    azureSuccess = ''
+    if (
+      !azureClientId ||
+      !azureClientSecret ||
+      !azureTenantId ||
+      !azureSubscriptionId
+    ) {
+      azureError = 'All Azure fields are required'
       return
     }
-
-    isAzureLoading = true
-
-    try {
-      const result = await userApi.setAzureSecrets(
-        azureClientId,
-        azureClientSecret,
-        azureTenantId,
-        azureSubscriptionId
-      )
-
-      if (result.error) {
-        azureError = result.error
-        return
-      }
-
-      // Success
-      azureSuccess = 'Azure credentials updated successfully'
-      secretsStatus.azure.configured = true // Update local status
-      secretsStatus.azure.createdAt = new Date().toISOString()
-      azureClientId = ''
-      azureClientSecret = ''
-      azureTenantId = ''
-      azureSubscriptionId = ''
-    } catch (error) {
-      azureError =
-        error instanceof Error
-          ? error.message
-          : 'Failed to update Azure credentials'
-    } finally {
-      isAzureLoading = false
+    
+    // Construct the Azure-specific payload
+    const payload = {
+      provider: 'azure',
+      credentials: {
+        azure_client_id: azureClientId,
+        azure_client_secret: azureClientSecret,
+        azure_tenant_id: azureTenantId,
+        azure_subscription_id: azureSubscriptionId,
+      },
     }
+    
+    // Call the shared update function
+    await updateSecrets('azure', payload)
   }
 </script>
 
 <AuthGuard requireAuth={true} redirectTo="/login">
-  <div class="relative min-h-screen bg-gray-900 p-8 text-white">
+  <div class="relative min-h-screen bg-gray-900 p-4 sm:p-8 text-white">
     <div class="mx-auto max-w-4xl">
       <div class="mb-8">
         <div class="mb-4">
           <button
-            on:click={() => {
-              // Track if we've recently submitted a form, go back twice
-              if (awsSuccess || azureSuccess || passwordSuccess) {
-                window.history.go(-2);
-              } else {
-                window.history.back();
-              }
-            }}
+            on:click={() => window.history.back()}
             class="flex w-fit cursor-pointer items-center border-none bg-transparent text-blue-500 hover:text-blue-700"
           >
             <svg
@@ -342,11 +307,11 @@
             <LoadingSpinner size="md" />
           </div>
         {:else}
-          <div class="mb-4 flex items-center space-x-4">
+          <div class="flex items-center space-x-4">
             <div
-              class="flex h-16 w-16 items-center justify-center rounded-full bg-gray-700"
+              class="flex h-16 w-16 items-center justify-center rounded-full bg-gray-700 text-2xl"
             >
-              <span class="text-2xl">{userData.name?.[0] || 'U'}</span>
+              {userData.name?.[0]?.toUpperCase() || 'U'}
             </div>
             <div>
               <p class="text-xl font-medium">{userData.name || 'User'}</p>
@@ -361,7 +326,6 @@
       <!-- Password change -->
       <div class="mb-8 rounded-lg bg-gray-800 p-6">
         <h2 class="mb-4 text-2xl font-semibold">Change Password</h2>
-
         <form on:submit|preventDefault={handlePasswordUpdate} class="space-y-4">
           <div>
             <label
@@ -374,11 +338,10 @@
               id="current-password"
               type="password"
               bind:value={currentPassword}
-              class="w-full rounded-md border border-gray-700 bg-gray-900 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
+              class="w-full rounded-md border border-gray-700 bg-gray-900 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500"
               placeholder="Enter current password"
             />
           </div>
-
           <div>
             <label
               for="new-password"
@@ -390,11 +353,10 @@
               id="new-password"
               type="password"
               bind:value={newPassword}
-              class="w-full rounded-md border border-gray-700 bg-gray-900 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
+              class="w-full rounded-md border border-gray-700 bg-gray-900 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500"
               placeholder="Enter new password"
             />
           </div>
-
           <div>
             <label
               for="confirm-password"
@@ -406,27 +368,20 @@
               id="confirm-password"
               type="password"
               bind:value={confirmPassword}
-              class="w-full rounded-md border border-gray-700 bg-gray-900 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
+              class="w-full rounded-md border border-gray-700 bg-gray-900 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500"
               placeholder="Confirm new password"
             />
           </div>
-
           {#if passwordError}
-            <div class="text-sm text-red-500">
-              {passwordError}
-            </div>
+            <div class="text-sm text-red-500">{passwordError}</div>
           {/if}
-
           {#if passwordSuccess}
-            <div class="text-sm text-green-500">
-              {passwordSuccess}
-            </div>
+            <div class="text-sm text-green-500">{passwordSuccess}</div>
           {/if}
-
           <button
             type="submit"
             disabled={isPasswordLoading}
-            class="rounded-md bg-blue-600 px-4 py-2 font-medium text-white hover:bg-blue-700 focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-gray-900 focus:outline-none disabled:cursor-not-allowed disabled:opacity-50"
+            class="rounded-md bg-blue-600 px-4 py-2 font-medium text-white hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-gray-900 disabled:cursor-not-allowed disabled:opacity-50"
           >
             {#if isPasswordLoading}
               <span class="mr-2 inline-block">
@@ -440,77 +395,23 @@
         </form>
       </div>
 
-      <!-- Cloud Provider Credentials -->
-      <div class="mb-8 rounded-lg bg-gray-800 p-6">
+      <!-- Cloud Provider Credentials with Tabs -->
+      <div class="rounded-lg bg-gray-800 p-6">
         <div class="mb-4 flex items-center justify-between">
-          <div class="flex items-center">
             <h2 class="text-2xl font-semibold">Cloud Provider Credentials</h2>
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              class="ml-2 h-5 w-5 text-green-400"
-              fill="none"
-              viewBox="0 0 24 24"
-              stroke="currentColor"
-            >
-              <path
-                stroke-linecap="round"
-                stroke-linejoin="round"
-                stroke-width="2"
-                d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"
-              />
-            </svg>
-          </div>
-          <div class="group relative">
-            <button
-              class="flex h-6 w-6 items-center justify-center rounded-full bg-gray-700 text-gray-300 hover:bg-gray-600 focus:outline-none"
-              aria-label="Encryption information"
-            >
-              <svg
-                xmlns="http://www.w3.org/2000/svg"
-                class="h-4 w-4"
-                fill="none"
-                viewBox="0 0 24 24"
-                stroke="currentColor"
-              >
-                <path
-                  stroke-linecap="round"
-                  stroke-linejoin="round"
-                  stroke-width="2"
-                  d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                />
-              </svg>
-            </button>
-            <div
-              class="pointer-events-none absolute right-0 z-50 mt-2 w-72 rounded-md bg-gray-900 px-4 py-3 text-sm text-white opacity-0 shadow-lg transition-opacity duration-200 group-hover:opacity-100"
-            >
-              <div class="mb-2 flex items-center text-green-400">
-                <svg
-                  xmlns="http://www.w3.org/2000/svg"
-                  class="mr-2 h-5 w-5"
-                  fill="none"
-                  viewBox="0 0 24 24"
-                  stroke="currentColor"
-                >
-                  <path
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"
-                  />
-                </svg>
-                <span class="font-semibold">End-to-End Encrypted</span>
+            <div class="group relative">
+              <button class="flex h-6 w-6 items-center justify-center rounded-full bg-gray-700 text-gray-300 hover:bg-gray-600 focus:outline-none" aria-label="Encryption information">
+                <svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" /></svg>
+              </button>
+              <div class="pointer-events-none absolute right-0 z-50 mt-2 w-72 rounded-md bg-gray-900 px-4 py-3 text-sm text-white opacity-0 shadow-lg transition-opacity duration-200 group-hover:opacity-100">
+                <div class="mb-2 flex items-center text-green-400">
+                  <svg xmlns="http://www.w3.org/2000/svg" class="mr-2 h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z" /></svg>
+                  <span class="font-semibold">End-to-End Encrypted</span>
+                </div>
+                <p>Your credentials are encrypted before being stored and are only decrypted when needed for a range. We cannot access your cloud provider credentials.</p>
+                <div class="tooltip-arrow absolute h-2 w-2 rotate-45 transform bg-gray-900" style="top: -4px; right: 10px;"></div>
               </div>
-              <p>
-                Your credentials are encrypted before entering the database and
-                are only decrypted when needed for a range. Even the person
-                hosting OpenLabs cannot access your cloud provider credentials.
-              </p>
-              <div
-                class="tooltip-arrow absolute h-2 w-2 rotate-45 transform bg-gray-900"
-                style="top: -4px; right: 10px;"
-              ></div>
             </div>
-          </div>
         </div>
 
         {#if loadingSecrets}
@@ -518,255 +419,122 @@
             <LoadingSpinner size="md" />
           </div>
         {:else}
-          <div class="grid grid-cols-1 gap-8 md:grid-cols-2">
-            <!-- AWS Credentials -->
-            <div
-              class="flex h-full flex-col rounded-lg bg-gray-700 p-5"
-              style="min-height: 350px;"
-            >
-              <div class="mb-4 flex items-center justify-between">
-                <h3 class="text-xl font-medium">AWS Credentials</h3>
-                <span
-                  role="status"
-                  aria-label={secretsStatus.aws.configured
-                    ? formatDateForTooltip(secretsStatus.aws.createdAt)
-                    : 'AWS credentials not configured'}
-                  class={`${secretsStatus.aws.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
-                  on:mouseenter={(e) => handleMouseEnter(e, 'aws')}
-                  on:mouseleave={() => handleMouseLeave('aws')}
+          <div>
+            <!-- Tab Navigation -->
+            <div class="mb-4 border-b border-gray-700">
+              <nav class="-mb-px flex space-x-4" aria-label="Tabs">
+                <button
+                  on:click={() => (activeTab = 'aws')}
+                  class={getTabClass('aws')}
                 >
-                  {secretsStatus.aws.configured
-                    ? 'Configured'
-                    : 'Not Configured'}
-                </span>
-
-                {#if showAwsTooltip && secretsStatus.aws.configured}
-                  <div
-                    transition:fade={{ duration: 150 }}
-                    class="absolute z-50 -translate-x-1/2 transform rounded-md bg-gray-900 px-3 py-2 pb-3 text-sm text-white shadow-lg"
-                    style="left: {awsTooltipPosition.x}px; top: {awsTooltipPosition.y}px; pointer-events: none;"
-                  >
-                    {formatDateForTooltip(secretsStatus.aws.createdAt)}
-                    <div
-                      class="tooltip-arrow absolute h-2 w-2 rotate-45 transform bg-gray-900"
-                      style="left: 50%; bottom: -4px; margin-left: -4px;"
-                    ></div>
-                  </div>
-                {/if}
-              </div>
-
-              <form
-                on:submit|preventDefault={handleAwsSecretsUpdate}
-                class="flex flex-grow flex-col"
-              >
-                <div class="flex-grow space-y-4">
-                  <div>
-                    <label
-                      for="aws-access-key"
-                      class="mb-1 block text-sm font-medium text-gray-300"
-                    >
-                      Access Key
-                    </label>
-                    <input
-                      id="aws-access-key"
-                      type="text"
-                      bind:value={awsAccessKey}
-                      class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
-                      placeholder="Enter AWS Access Key"
-                    />
-                  </div>
+                  AWS
+                </button>
+                <button
+                  on:click={() => (activeTab = 'azure')}
+                  class={getTabClass('azure')}
+                >
+                  Azure
+                </button>
+              </nav>
+            </div>
 
-                  <div>
-                    <label
-                      for="aws-secret-key"
-                      class="mb-1 block text-sm font-medium text-gray-300"
+            <!-- Tab Content -->
+            <div class="pt-4" style="min-height: 380px;">
+              {#if activeTab === 'aws'}
+                <div transition:fade={{ duration: 150, delay: 100 }}>
+                  <div class="mb-4 flex items-center justify-between">
+                    <h3 class="text-xl font-medium">AWS Credentials</h3>
+                    <span
+                      role="status"
+                      aria-label={secretsStatus.aws.configured ? formatDateForTooltip(secretsStatus.aws.createdAt) : 'AWS credentials not configured'}
+                      class={`${secretsStatus.aws.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
+                      on:mouseenter={handleMouseEnter}
+                      on:mouseleave={handleMouseLeave}
                     >
-                      Secret Key
-                    </label>
-                    <input
-                      id="aws-secret-key"
-                      type="password"
-                      bind:value={awsSecretKey}
-                      class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
-                      placeholder="Enter AWS Secret Key"
-                    />
+                      {secretsStatus.aws.configured ? 'Configured' : 'Not Configured'}
+                    </span>
                   </div>
-
-                  {#if awsError}
-                    <div class="text-sm text-red-500">
-                      {awsError}
+                  <form on:submit|preventDefault={handleAwsSecretsUpdate} class="space-y-4">
+                    <div>
+                      <label for="aws-access-key" class="mb-1 block text-sm font-medium text-gray-300">Access Key</label>
+                      <input id="aws-access-key" type="text" bind:value={awsAccessKey} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-yellow-500" placeholder="Enter AWS Access Key" />
                     </div>
-                  {/if}
-
-                  {#if awsSuccess}
-                    <div class="text-sm text-green-500">
-                      {awsSuccess}
+                    <div>
+                      <label for="aws-secret-key" class="mb-1 block text-sm font-medium text-gray-300">Secret Key</label>
+                      <input id="aws-secret-key" type="password" bind:value={awsSecretKey} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-yellow-500" placeholder="Enter AWS Secret Key" />
                     </div>
-                  {/if}
-                </div>
-
-                <div class="mt-auto pt-4">
-                  <button
-                    type="submit"
-                    disabled={isAwsLoading}
-                    class="w-full rounded-md bg-yellow-600 px-4 py-2 font-medium text-white hover:bg-yellow-700 focus:ring-2 focus:ring-yellow-500 focus:ring-offset-2 focus:ring-offset-gray-900 focus:outline-none disabled:cursor-not-allowed disabled:opacity-50"
-                  >
-                    {#if isAwsLoading}
-                      <span class="mr-2 inline-block">
-                        <LoadingSpinner size="sm" color="white" />
-                      </span>
-                      Updating...
-                    {:else}
-                      {secretsStatus.aws.configured
-                        ? 'Update AWS Credentials'
-                        : 'Set AWS Credentials'}
-                    {/if}
-                  </button>
+                    {#if awsError}<div class="text-sm text-red-500">{awsError}</div>{/if}
+                    {#if awsSuccess}<div class="text-sm text-green-500">{awsSuccess}</div>{/if}
+                    <div class="pt-4">
+                      <button type="submit" disabled={isAwsLoading} class="w-full rounded-md bg-yellow-600 px-4 py-2 font-medium text-white hover:bg-yellow-700 focus:outline-none focus:ring-2 focus:ring-yellow-500 focus:ring-offset-2 focus:ring-offset-gray-900 disabled:cursor-not-allowed disabled:opacity-50">
+                        {#if isAwsLoading}<span class="mr-2 inline-block"><LoadingSpinner size="sm" color="white" /></span>Updating...{:else}{secretsStatus.aws.configured ? 'Update' : 'Set'} AWS Credentials{/if}
+                      </button>
+                    </div>
+                  </form>
                 </div>
-              </form>
-            </div>
-
-            <!-- Azure Credentials -->
-            <div
-              class="flex h-full flex-col rounded-lg bg-gray-700 p-5"
-              style="min-height: 350px;"
-            >
-              <div class="mb-4 flex items-center justify-between">
-                <h3 class="text-xl font-medium">Azure Credentials</h3>
-                <span
-                  role="status"
-                  aria-label={secretsStatus.azure.configured
-                    ? formatDateForTooltip(secretsStatus.azure.createdAt)
-                    : 'Azure credentials not configured'}
-                  class={`${secretsStatus.azure.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
-                  on:mouseenter={(e) => handleMouseEnter(e, 'azure')}
-                  on:mouseleave={() => handleMouseLeave('azure')}
-                >
-                  {secretsStatus.azure.configured
-                    ? 'Configured'
-                    : 'Not Configured'}
-                </span>
-
-                {#if showAzureTooltip && secretsStatus.azure.configured}
-                  <div
-                    transition:fade={{ duration: 150 }}
-                    class="absolute z-50 -translate-x-1/2 transform rounded-md bg-gray-900 px-3 py-2 pb-3 text-sm text-white shadow-lg"
-                    style="left: {azureTooltipPosition.x}px; top: {azureTooltipPosition.y}px; pointer-events: none;"
-                  >
-                    {formatDateForTooltip(secretsStatus.azure.createdAt)}
-                    <div
-                      class="tooltip-arrow absolute h-2 w-2 rotate-45 transform bg-gray-900"
-                      style="left: 50%; bottom: -4px; margin-left: -4px;"
-                    ></div>
-                  </div>
-                {/if}
-              </div>
-
-              <form
-                on:submit|preventDefault={handleAzureSecretsUpdate}
-                class="flex flex-grow flex-col"
-              >
-                <div class="flex-grow space-y-4">
-                  <div>
-                    <label
-                      for="azure-client-id"
-                      class="mb-1 block text-sm font-medium text-gray-300"
+              {:else if activeTab === 'azure'}
+                <div transition:fade={{ duration: 150, delay: 100 }}>
+                   <div class="mb-4 flex items-center justify-between">
+                    <h3 class="text-xl font-medium">Azure Credentials</h3>
+                    <span
+                      role="status"
+                      aria-label={secretsStatus.azure.configured ? formatDateForTooltip(secretsStatus.azure.createdAt) : 'Azure credentials not configured'}
+                      class={`${secretsStatus.azure.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
+                      on:mouseenter={handleMouseEnter}
+                      on:mouseleave={handleMouseLeave}
                     >
-                      Client ID
-                    </label>
-                    <input
-                      id="azure-client-id"
-                      type="text"
-                      bind:value={azureClientId}
-                      class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
-                      placeholder="Enter Azure Client ID"
-                    />
+                      {secretsStatus.azure.configured ? 'Configured' : 'Not Configured'}
+                    </span>
                   </div>
-
-                  <div>
-                    <label
-                      for="azure-client-secret"
-                      class="mb-1 block text-sm font-medium text-gray-300"
-                    >
-                      Client Secret
-                    </label>
-                    <input
-                      id="azure-client-secret"
-                      type="password"
-                      bind:value={azureClientSecret}
-                      class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
-                      placeholder="Enter Azure Client Secret"
-                    />
-                  </div>
-
-                  <div>
-                    <label
-                      for="azure-tenant-id"
-                      class="mb-1 block text-sm font-medium text-gray-300"
-                    >
-                      Tenant ID
-                    </label>
-                    <input
-                      id="azure-tenant-id"
-                      type="text"
-                      bind:value={azureTenantId}
-                      class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
-                      placeholder="Enter Azure Tenant ID"
-                    />
-                  </div>
-
-                  <div>
-                    <label
-                      for="azure-subscription-id"
-                      class="mb-1 block text-sm font-medium text-gray-300"
-                    >
-                      Subscription ID
-                    </label>
-                    <input
-                      id="azure-subscription-id"
-                      type="text"
-                      bind:value={azureSubscriptionId}
-                      class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:ring-2 focus:ring-blue-500 focus:outline-none"
-                      placeholder="Enter Azure Subscription ID"
-                    />
-                  </div>
-
-                  {#if azureError}
-                    <div class="text-sm text-red-500">
-                      {azureError}
+                  <form on:submit|preventDefault={handleAzureSecretsUpdate} class="space-y-4">
+                     <div>
+                      <label for="azure-client-id" class="mb-1 block text-sm font-medium text-gray-300">Client ID</label>
+                      <input id="azure-client-id" type="text" bind:value={azureClientId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Client ID" />
                     </div>
-                  {/if}
-
-                  {#if azureSuccess}
-                    <div class="text-sm text-green-500">
-                      {azureSuccess}
+                    <div>
+                      <label for="azure-client-secret" class="mb-1 block text-sm font-medium text-gray-300">Client Secret</label>
+                      <input id="azure-client-secret" type="password" bind:value={azureClientSecret} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Client Secret" />
                     </div>
-                  {/if}
-                </div>
-
-                <div class="mt-auto pt-4">
-                  <button
-                    type="submit"
-                    disabled={isAzureLoading}
-                    class="w-full rounded-md bg-blue-600 px-4 py-2 font-medium text-white hover:bg-blue-700 focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-gray-900 focus:outline-none disabled:cursor-not-allowed disabled:opacity-50"
-                  >
-                    {#if isAzureLoading}
-                      <span class="mr-2 inline-block">
-                        <LoadingSpinner size="sm" color="white" />
-                      </span>
-                      Updating...
-                    {:else}
-                      {secretsStatus.azure.configured
-                        ? 'Update Azure Credentials'
-                        : 'Set Azure Credentials'}
-                    {/if}
-                  </button>
+                    <div>
+                      <label for="azure-tenant-id" class="mb-1 block text-sm font-medium text-gray-300">Tenant ID</label>
+                      <input id="azure-tenant-id" type="text" bind:value={azureTenantId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Tenant ID" />
+                    </div>
+                    <div>
+                      <label for="azure-subscription-id" class="mb-1 block text-sm font-medium text-gray-300">Subscription ID</label>
+                      <input id="azure-subscription-id" type="text" bind:value={azureSubscriptionId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Subscription ID" />
+                    </div>
+                    {#if azureError}<div class="text-sm text-red-500">{azureError}</div>{/if}
+                    {#if azureSuccess}<div class="text-sm text-green-500">{azureSuccess}</div>{/if}
+                    <div class="pt-4">
+                       <button type="submit" disabled={isAzureLoading} class="w-full rounded-md bg-blue-600 px-4 py-2 font-medium text-white hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-gray-900 disabled:cursor-not-allowed disabled:opacity-50">
+                        {#if isAzureLoading}<span class="mr-2 inline-block"><LoadingSpinner size="sm" color="white" /></span>Updating...{:else}{secretsStatus.azure.configured ? 'Update' : 'Set'} Azure Credentials{/if}
+                      </button>
+                    </div>
+                  </form>
                 </div>
-              </form>
+              {/if}
             </div>
           </div>
         {/if}
       </div>
     </div>
+
+    <!-- Tooltip -->
+    {#if showTooltip}
+      {@const status = activeTab === 'aws' ? secretsStatus.aws : secretsStatus.azure}
+      {#if status.configured}
+        <div
+          transition:fade={{ duration: 150 }}
+          class="absolute z-50 -translate-x-1/2 transform rounded-md bg-gray-900 px-3 py-2 pb-3 text-sm text-white shadow-lg"
+          style="left: {tooltipPosition.x}px; top: {tooltipPosition.y}px; pointer-events: none;"
+        >
+          {formatDateForTooltip(status.createdAt)}
+          <div
+            class="tooltip-arrow absolute h-2 w-2 rotate-45 transform bg-gray-900"
+            style="left: 50%; bottom: -4px; margin-left: -4px;"
+          ></div>
+        </div>
+      {/if}
+    {/if}
   </div>
 </AuthGuard>

From 61330c2e408670dcb458330a27a62873690010bd Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Tue, 29 Jul 2025 20:00:41 -0400
Subject: [PATCH 19/43] feat(frontend): Working creds verification endpoint
 from frontend.

---
 frontend/src/lib/api.ts       | 38 +----------------------------------
 frontend/src/lib/types/api.ts | 25 +----------------------
 2 files changed, 2 insertions(+), 61 deletions(-)

diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 03b95462..4c6ebf07 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -164,47 +164,11 @@ export const userApi = {
     )
   },
 
-  // Set AWS secrets
-  setAwsSecrets: async (accessKey: string, secretKey: string): Promise<ApiResponse<AWSSecretsResponse>> => {
-    const request: AWSSecretsRequest = {
-      aws_access_key: accessKey,
-      aws_secret_key: secretKey,
-    }
-    return await apiRequest<AWSSecretsResponse>(
-      '/api/v1/users/me/secrets/aws',
-      'POST',
-      request
-    )
-  },
-
   updateSecrets: async (payload: any): Promise<ApiResponse<SecretsResponse>> => {
-    const request: SecretsRequest = {
-      secrets: payload
-    }
     return await apiRequest<SecretsResponse>(
       '/api/v1/users/me/secrets',
       'POST',
-      request
-    )
-  },
-
-  // Set Azure secrets
-  setAzureSecrets: async (
-    clientId: string,
-    clientSecret: string,
-    tenantId: string,
-    subscriptionId: string
-  ): Promise<ApiResponse<AzureSecretsResponse>> => {
-    const request: AzureSecretsRequest = {
-      azure_client_id: clientId,
-      azure_client_secret: clientSecret,
-      azure_tenant_id: tenantId,
-      azure_subscription_id: subscriptionId,
-    }
-    return await apiRequest<AzureSecretsResponse>(
-      '/api/v1/users/me/secrets/azure',
-      'POST',
-      request
+      payload
     )
   },
 }
diff --git a/frontend/src/lib/types/api.ts b/frontend/src/lib/types/api.ts
index 1f544d2e..9fe4619e 100644
--- a/frontend/src/lib/types/api.ts
+++ b/frontend/src/lib/types/api.ts
@@ -191,34 +191,11 @@ export interface PasswordUpdateResponse {
   message: string;
 }
 
-// AWS secrets types
-export interface AWSSecretsRequest {
-  aws_access_key: string;
-  aws_secret_key: string;
-}
-
-export interface AWSSecretsResponse {
-  message: string;
-}
-export interface SecretsRequest {
-  secrets: any;
-}
+// Secrets verification response
 export interface SecretsResponse {
   message: string;
 }
 
-// Azure secrets types
-export interface AzureSecretsRequest {
-  azure_client_id: string;
-  azure_client_secret: string;
-  azure_tenant_id: string;
-  azure_subscription_id: string;
-}
-
-export interface AzureSecretsResponse {
-  message: string;
-}
-
 // Deploy range request
 export interface DeployRangeRequest {
   blueprint_id: number;

From 64dd79944bf08073a3e5487fbe3516913375b73c Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Wed, 30 Jul 2025 16:05:13 -0400
Subject: [PATCH 20/43] feat(frontend): Updated function logic for creating the
 payload used for updating provider credentials before sending it to the
 endpoint.

---
 frontend/src/lib/api.ts                   | 12 ++++++------
 frontend/src/lib/types/api.ts             |  4 ++++
 frontend/src/routes/settings/+page.svelte | 11 ++---------
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 4c6ebf07..f8b3fb0a 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -14,12 +14,8 @@ import type {
   BlueprintRange,
   PasswordUpdateRequest,
   PasswordUpdateResponse,
-  AWSSecretsRequest,
-  AWSSecretsResponse,
   SecretsRequest,
   SecretsResponse,
-  AzureSecretsRequest,
-  AzureSecretsResponse,
   DeployRangeRequest
 } from '$lib/types/api'
 
@@ -164,11 +160,15 @@ export const userApi = {
     )
   },
 
-  updateSecrets: async (payload: any): Promise<ApiResponse<SecretsResponse>> => {
+  updateSecrets: async (credentialprovider: string, payload: any): Promise<ApiResponse<SecretsResponse>> => {
+    const request: SecretsRequest = {
+      provider: credentialprovider,
+      credentials: payload,
+    }
     return await apiRequest<SecretsResponse>(
       '/api/v1/users/me/secrets',
       'POST',
-      payload
+      request
     )
   },
 }
diff --git a/frontend/src/lib/types/api.ts b/frontend/src/lib/types/api.ts
index 9fe4619e..faf56e69 100644
--- a/frontend/src/lib/types/api.ts
+++ b/frontend/src/lib/types/api.ts
@@ -192,6 +192,10 @@ export interface PasswordUpdateResponse {
 }
 
 // Secrets verification response
+export interface SecretsRequest {
+  provider: string;
+  credentials: any;
+}
 export interface SecretsResponse {
   message: string;
 }
diff --git a/frontend/src/routes/settings/+page.svelte b/frontend/src/routes/settings/+page.svelte
index 6a19273c..90054d57 100644
--- a/frontend/src/routes/settings/+page.svelte
+++ b/frontend/src/routes/settings/+page.svelte
@@ -183,9 +183,8 @@
     }
 
     try {
-      // **IMPORTANT**: This now calls a single, unified API endpoint.
-      // Make sure `userApi.updateSecrets` exists and handles the payload format.
-      const result = await userApi.updateSecrets(payload)
+      // Call single, common endpoint
+      const result = await userApi.updateSecrets(provider, payload)
 
       if (result.error) {
         if (provider === 'aws') awsError = result.error
@@ -229,11 +228,8 @@
     
     // Construct the AWS-specific payload
     const payload = {
-      provider: 'aws',
-      credentials: {
         aws_access_key: awsAccessKey,
         aws_secret_key: awsSecretKey,
-      },
     }
 
     // Call the shared update function
@@ -256,13 +252,10 @@
     
     // Construct the Azure-specific payload
     const payload = {
-      provider: 'azure',
-      credentials: {
         azure_client_id: azureClientId,
         azure_client_secret: azureClientSecret,
         azure_tenant_id: azureTenantId,
         azure_subscription_id: azureSubscriptionId,
-      },
     }
     
     // Call the shared update function

From 121c388a2d918d051f7987dbcbc9d14a7efc50cc Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Wed, 30 Jul 2025 18:19:53 -0400
Subject: [PATCH 21/43] feat(cli): Updated secrets verification endpoint for
 cli

---
 cli/internal/client/auth.go | 48 +++++++++++++++++++++++++++++--------
 1 file changed, 38 insertions(+), 10 deletions(-)

diff --git a/cli/internal/client/auth.go b/cli/internal/client/auth.go
index aba21553..9ffab49e 100644
--- a/cli/internal/client/auth.go
+++ b/cli/internal/client/auth.go
@@ -114,14 +114,39 @@ func (c *Client) GetUserSecrets() (*UserSecretResponse, error) {
 	return &secrets, nil
 }
 
+type AWSCredentials struct {
+	AccessKey string `json:"aws_access_key"`
+	SecretKey string `json:"aws_secret_key"`
+}
+
+type AWSSecretsPayload struct {
+	Provider    string         `json:"provider"`
+	Credentials AWSCredentials `json:"credentials"`
+}
+
+type AzureCredentials struct {
+	ClientID       string `json:"azure_client_id"`
+	ClientSecret   string `json:"azure_client_secret"`
+	TenantID       string `json:"azure_tenant_id"`
+	SubscriptionID string `json:"azure_subscription_id"`
+}
+
+type AzureSecretsPayload struct {
+	Provider    string           `json:"provider"`
+	Credentials AzureCredentials `json:"credentials"`
+}
+
 func (c *Client) UpdateAWSSecrets(accessKey, secretKey string) error {
-	secrets := AWSSecrets{
-		AccessKey: accessKey,
-		SecretKey: secretKey,
+	payload := AWSSecretsPayload{
+		Provider: "aws",
+		Credentials: AWSCredentials{
+			AccessKey: accessKey,
+			SecretKey: secretKey,
+		},
 	}
 
 	var response Message
-	if err := c.makeRequest("POST", "/api/v1/users/me/secrets/aws", secrets, &response); err != nil {
+	if err := c.makeRequest("POST", "/api/v1/users/me/secrets", payload, &response); err != nil {
 		return fmt.Errorf("failed to update AWS secrets: %w", err)
 	}
 
@@ -129,15 +154,18 @@ func (c *Client) UpdateAWSSecrets(accessKey, secretKey string) error {
 }
 
 func (c *Client) UpdateAzureSecrets(clientID, clientSecret, tenantID, subscriptionID string) error {
-	secrets := AzureSecrets{
-		ClientID:       clientID,
-		ClientSecret:   clientSecret,
-		TenantID:       tenantID,
-		SubscriptionID: subscriptionID,
+	payload := AzureSecretsPayload{
+		Provider: "azure",
+		Credentials: AzureCredentials{
+			ClientID:       clientID,
+			ClientSecret:   clientSecret,
+			TenantID:       tenantID,
+			SubscriptionID: subscriptionID,
+		},
 	}
 
 	var response Message
-	if err := c.makeRequest("POST", "/api/v1/users/me/secrets/azure", secrets, &response); err != nil {
+	if err := c.makeRequest("POST", "/api/v1/users/me/secrets", payload, &response); err != nil {
 		return fmt.Errorf("failed to update Azure secrets: %w", err)
 	}
 

From cf3b14708b747f322b91b1ec6dc2043a0b42e240 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Wed, 30 Jul 2025 18:48:55 -0400
Subject: [PATCH 22/43] fix(workflows): Fix ruff errors.

---
 api/src/app/api/v1/users.py                  |  5 -----
 api/tests/common/api/v1/test_users.py        |  7 +++----
 api/tests/unit/api/v1/test_users.py          | 18 ++++++++++--------
 api/tests/unit/cloud/test_aws_creds.py       |  5 +++--
 api/tests/unit/crud/test_crud_secrets.py     |  3 ++-
 api/tests/unit/schemas/test_secret_schema.py |  2 +-
 6 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index 44ab03ee..21969087 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -1,5 +1,4 @@
 import base64
-from datetime import UTC, datetime
 
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.responses import JSONResponse
@@ -18,14 +17,10 @@
 from ...models.secret_model import SecretModel
 from ...models.user_model import UserModel
 from ...schemas.message_schema import (
-    AWSUpdateSecretMessageSchema,
-    AzureUpdateSecretMessageSchema,
     MessageSchema,
     UpdatePasswordMessageSchema,
 )
 from ...schemas.secret_schema import (
-    AWSSecrets,
-    AzureSecrets,
     CloudSecretStatusSchema,
     UserSecretResponseSchema,
 )
diff --git a/api/tests/common/api/v1/test_users.py b/api/tests/common/api/v1/test_users.py
index ddd67845..2fc79488 100644
--- a/api/tests/common/api/v1/test_users.py
+++ b/api/tests/common/api/v1/test_users.py
@@ -15,7 +15,6 @@
     AUTH_API_CLIENT_PARAMS,
     BASE_ROUTE,
     aws_secrets_payload,
-    azure_secrets_payload,
     password_update_payload,
 )
 
@@ -50,11 +49,11 @@ async def test_update_password_with_incorrect_current(
     async def test_update_secrets_with_invalid_payload(
         self, auth_api_client: AsyncClient
     ) -> None:
-        """Test updating user secrets with invalid credentials payload"""
+        """Test updating user secrets with invalid credentials payload."""
         # Try update with invalid secrets format - Use AWS secrets specifically for this test
         invalid_payload = copy.deepcopy(aws_secrets_payload)
         # Using incorrect credentials to test validation - submit payload without required fields
-        invalid_payload["credentials"] = {}  # noqa: S105
+        invalid_payload["credentials"] = {}
 
         update_response = await auth_api_client.post(
             f"{BASE_ROUTE}/users/me/secrets", json=invalid_payload
@@ -65,7 +64,7 @@ async def test_update_secrets_with_invalid_payload(
     async def test_update_secrets_with_invalid_credentials(
         self, auth_api_client: AsyncClient
     ) -> None:
-        """Test updating user secrets with invalid credentials that do not authenticate"""
+        """Test updating user secrets with invalid credentials that do not authenticate."""
         # Try update with invalid secrets - Use AWS secrets specifically for this test
         invalid_payload = copy.deepcopy(
             aws_secrets_payload
diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index 716b6267..2a024b28 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -1,8 +1,8 @@
+import pytest
 from datetime import UTC, datetime
-from typing import Any
+from fastapi import status
 from httpx import AsyncClient
-import pytest
-from pytest_mock import MockerFixture, mocker
+from pytest_mock import MockerFixture
 
 from src.app.core.auth.auth import get_current_user
 from src.app.main import app
@@ -10,7 +10,6 @@
 from src.app.schemas.secret_schema import SecretSchema
 from src.app.schemas.message_schema import MessageSchema
 from tests.unit.api.v1.config import BASE_ROUTE
-from fastapi import status
 from tests.unit.api.v1.config import aws_secrets_payload
 from unittest.mock import MagicMock
 
@@ -26,7 +25,6 @@ def mock_update_secrets_success(
     mocker: MockerFixture, users_api_v1_endpoints_path: str
 ) -> None:
     """Bypass provider credentials verification and updating user secrets record to succeed."""
-
     mock_creds_class = MagicMock()
     mock_creds_class.verify_creds.return_value = [True, MessageSchema(message="true")]
     mock_creds_class.update_secret_schema.return_value = SecretSchema()
@@ -50,12 +48,16 @@ def mock_get_secrets_failure(
 def mock_get_secrets(mocker: MockerFixture, users_api_v1_endpoints_path: str) -> None:
     """Bypass fetching users secrets to pass for a fake user."""
 
-    def override_get_current_user_no_key():
-        """Fake dependency that returns a user without a public key."""
+    def override_get_current_user_no_key() -> UserModel:
+        """Fake dependency that returns a user without a public key.
+
+        Returns:
+        -------
+            MessageSchema: Status message of updating user secrets."""
         return UserModel(
             name="FakeUser",
             email="fakeuser@gmail.com",
-            hashed_password="faskpasswordhash",
+            hashed_password="faskpasswordhash",  # noqa: S105
             created_at=datetime.now(UTC),
             last_active=datetime.now(UTC),
             is_admin=False,
diff --git a/api/tests/unit/cloud/test_aws_creds.py b/api/tests/unit/cloud/test_aws_creds.py
index 46679083..4a4ae9f5 100644
--- a/api/tests/unit/cloud/test_aws_creds.py
+++ b/api/tests/unit/cloud/test_aws_creds.py
@@ -5,6 +5,7 @@
 from src.app.utils.crypto import encrypt_with_public_key, generate_rsa_key_pair
 from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
 from src.app.cloud.aws_creds import AWSCreds
+
 from tests.unit.api.v1.config import aws_secrets_payload
 
 
@@ -25,14 +26,14 @@ def test_get_user_creds(aws_creds_class: AWSCreds) -> None:
 
     # Keys
     access_key = "aws_access_key"
-    secret_key = "aws_secret_key"
+    secret_key = "aws_secret_key"  # noqa: S105
 
     assert user_creds[access_key] == aws_secrets_payload["credentials"][access_key]
     assert user_creds[secret_key] == aws_secrets_payload["credentials"][secret_key]
 
 
 def test_update_secret_schema(aws_creds_class: AWSCreds) -> None:
-    """Test that Secret Schema is updated with encrypted user credentials"""
+    """Test that Secret Schema is updated with encrypted user credentials."""
     user_creds = aws_creds_class.get_user_creds()
 
     # Encrypt with the user's public key
diff --git a/api/tests/unit/crud/test_crud_secrets.py b/api/tests/unit/crud/test_crud_secrets.py
index d09f70db..f93ab326 100644
--- a/api/tests/unit/crud/test_crud_secrets.py
+++ b/api/tests/unit/crud/test_crud_secrets.py
@@ -4,10 +4,11 @@
 from pytest_mock import MockerFixture
 
 from src.app.models.secret_model import SecretModel
-from .crud_mocks import DummyDB
 from src.app.crud.crud_secrets import get_user_secrets, upsert_user_secrets
 from src.app.schemas.secret_schema import SecretSchema
 
+from .crud_mocks import DummyDB
+
 
 @pytest.fixture
 def crud_secrets_path() -> str:
diff --git a/api/tests/unit/schemas/test_secret_schema.py b/api/tests/unit/schemas/test_secret_schema.py
index 77dc4cdf..89fb0cf4 100644
--- a/api/tests/unit/schemas/test_secret_schema.py
+++ b/api/tests/unit/schemas/test_secret_schema.py
@@ -33,7 +33,7 @@ def test_aws_secrets_schema_missing_access_key_length() -> None:
 def test_aws_secrets_schema_invalid_secret_key_length() -> None:
     """Test that the AWS Secrets schema fails when aws_secret_key is invalid length."""
     invalid_creds = copy.deepcopy(aws_secrets_payload)
-    invalid_creds["credentials"]["aws_secret_key"] = "string"
+    invalid_creds["credentials"]["aws_secret_key"] = "string"  # noqa: S105
 
     expected_msg = re.compile(r"Invalid credential format", re.IGNORECASE)
     with pytest.raises(ValidationError, match=expected_msg):

From d8ed96db5ca34311396e8f9e42a5144d9512dd94 Mon Sep 17 00:00:00 2001
From: Alex Christy <a.christy@ufl.edu>
Date: Thu, 31 Jul 2025 19:48:43 +0200
Subject: [PATCH 23/43] fix(api): add init for api cloud module

---
 api/src/app/cloud/__init__.py | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 api/src/app/cloud/__init__.py

diff --git a/api/src/app/cloud/__init__.py b/api/src/app/cloud/__init__.py
new file mode 100644
index 00000000..7036f4db
--- /dev/null
+++ b/api/src/app/cloud/__init__.py
@@ -0,0 +1 @@
+"""Cloud controls for the OpenLabs API."""

From c598a9664ee6069f8a08e0f05deb76e07e1fe7ab Mon Sep 17 00:00:00 2001
From: Alex Christy <a.christy@ufl.edu>
Date: Thu, 31 Jul 2025 19:49:38 +0200
Subject: [PATCH 24/43] feat(tests): add integration tests for aws creds
 verification class

---
 api/tests/aws_test_utils.py                   |  26 ++++
 api/tests/integration/cloud/__init__.py       |   1 +
 api/tests/integration/cloud/aws_config.py     |  55 ++++++++
 api/tests/integration/cloud/test_aws_creds.py | 126 ++++++++++++++++++
 4 files changed, 208 insertions(+)
 create mode 100644 api/tests/aws_test_utils.py
 create mode 100644 api/tests/integration/cloud/__init__.py
 create mode 100644 api/tests/integration/cloud/aws_config.py
 create mode 100644 api/tests/integration/cloud/test_aws_creds.py

diff --git a/api/tests/aws_test_utils.py b/api/tests/aws_test_utils.py
new file mode 100644
index 00000000..c2b8c017
--- /dev/null
+++ b/api/tests/aws_test_utils.py
@@ -0,0 +1,26 @@
+import logging
+import os
+
+from src.app.enums.providers import OpenLabsProvider
+from tests.deploy_test_utils import get_provider_test_creds
+
+# Configure logging
+logger = logging.getLogger(__name__)
+
+
+def set_test_boto_creds() -> bool:
+    """Set credentials for the AWS boto client."""
+    aws_provider = OpenLabsProvider.AWS
+    creds = get_provider_test_creds(aws_provider)
+    if not creds:
+        logger.error(
+            "Failed to set test boto creds. Test credentials for %s not set.",
+            aws_provider.value.upper(),
+        )
+        return False
+
+    # Set environment variables
+    os.environ["AWS_ACCESS_KEY_ID"] = creds["aws_access_key"]
+    os.environ["AWS_SECRET_ACCESS_KEY"] = creds["aws_secret_key"]
+
+    return True
diff --git a/api/tests/integration/cloud/__init__.py b/api/tests/integration/cloud/__init__.py
new file mode 100644
index 00000000..26394a91
--- /dev/null
+++ b/api/tests/integration/cloud/__init__.py
@@ -0,0 +1 @@
+"""Tests for cloud controls of the OpenLabs API."""
diff --git a/api/tests/integration/cloud/aws_config.py b/api/tests/integration/cloud/aws_config.py
new file mode 100644
index 00000000..d7337a11
--- /dev/null
+++ b/api/tests/integration/cloud/aws_config.py
@@ -0,0 +1,55 @@
+import pytest
+
+# --- IAM ---
+SUCCESS_POLICY = {
+    "Version": "2012-10-17",
+    "Statement": [
+        {"Effect": "Allow", "Action": "iam:SimulatePrincipalPolicy", "Resource": "*"},
+        {"Effect": "Allow", "Action": "ec2:*", "Resource": "*"},
+    ],
+}
+
+NO_SIMULATE_POLICY = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "ec2:*", "Resource": "*"}],
+}
+
+INSUFFICIENT_EC2_POLICY = {
+    "Version": "2012-10-17",
+    "Statement": [
+        {"Effect": "Allow", "Action": "iam:SimulatePrincipalPolicy", "Resource": "*"},
+        {
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DescribeInstances",
+                "ec2:DescribeVpcs",
+                "ec2:DescribeSubnets",
+            ],
+            "Resource": "*",
+        },
+    ],
+}
+
+VERIFY_CREDS_TEST_CASES = [
+    pytest.param(
+        SUCCESS_POLICY,
+        True,
+        "permissions are present",
+        id="success-all-permissions",
+        marks=pytest.mark.aws,
+    ),
+    pytest.param(
+        NO_SIMULATE_POLICY,
+        False,
+        "iam:simulateprincipalpolicy",
+        id="failure-no-simulate-permission",
+        marks=pytest.mark.aws,
+    ),
+    pytest.param(
+        INSUFFICIENT_EC2_POLICY,
+        False,
+        "insufficient permissions",
+        id="failure-insufficient-ec2-permissions",
+        marks=pytest.mark.aws,
+    ),
+]
diff --git a/api/tests/integration/cloud/test_aws_creds.py b/api/tests/integration/cloud/test_aws_creds.py
new file mode 100644
index 00000000..cb8d4dfd
--- /dev/null
+++ b/api/tests/integration/cloud/test_aws_creds.py
@@ -0,0 +1,126 @@
+import json
+import logging
+import time
+import uuid
+from typing import Generator
+
+import boto3
+import pytest
+from botocore.exceptions import ClientError
+
+from src.app.cloud.aws_creds import AWSCreds
+from tests.aws_test_utils import set_test_boto_creds
+
+from .aws_config import VERIFY_CREDS_TEST_CASES
+
+logger = logging.getLogger(__name__)
+
+
+@pytest.fixture(scope="session")
+def iam_client(load_test_env_file: bool) -> boto3.client:
+    """Create IAM client, skipping if credentials are not set."""
+    if not load_test_env_file or not set_test_boto_creds():
+        pytest.skip("Credentials for AWS not set.")
+    return boto3.client("iam")
+
+
+@pytest.fixture(scope="session")
+def all_test_credentials(
+    iam_client: boto3.client,
+) -> Generator[dict[str, dict[str, str]], None, None]:
+    """Create all necessary IAM users/policies for the entire test session at once."""
+    session_id = uuid.uuid4().hex[:8]
+    created_resources = {}
+    credentials_by_id = {}
+
+    logger.info("Starting batch creation of IAM test resources...")
+
+    try:
+        # Batch Create all IAM Resources
+        for param in VERIFY_CREDS_TEST_CASES:
+            test_id = str(param.id)
+            policy_document = param.values[0]
+
+            user_name = f"openlabs-test-{test_id}-{session_id}"
+            policy_name = f"OpenLabsTest-{test_id}-{session_id}"
+
+            # Create user, policy, attach, and create key
+            iam_client.create_user(UserName=user_name)
+            policy_response = iam_client.create_policy(
+                PolicyName=policy_name, PolicyDocument=json.dumps(policy_document)
+            )
+            policy_arn = policy_response["Policy"]["Arn"]
+            iam_client.attach_user_policy(UserName=user_name, PolicyArn=policy_arn)
+            key_response = iam_client.create_access_key(UserName=user_name)
+            access_key = key_response["AccessKey"]
+
+            # Store credentials for the test to use
+            credentials_by_id[test_id] = {
+                "aws_access_key": access_key["AccessKeyId"],
+                "aws_secret_key": access_key["SecretAccessKey"],
+            }
+            # Store all identifiers for later cleanup
+            created_resources[test_id] = {
+                "user_name": user_name,
+                "policy_arn": policy_arn,
+                "access_key_id": access_key["AccessKeyId"],
+            }
+            logger.info("Created resources for test ID: %s", test_id)
+
+        prop_wait = 10
+        logger.info("Waiting %d seconds for all IAM changes to propagate...", prop_wait)
+        time.sleep(prop_wait)
+
+        yield credentials_by_id
+
+    finally:
+        # 3. --- Batch Cleanup ---
+        logger.info("Starting cleanup of all IAM test resources.")
+        for test_id, resources in created_resources.items():
+            user_name = resources["user_name"]
+            logger.info(
+                "Cleaning up resources for %s (user: %s)...", test_id, user_name
+            )
+            try:
+                iam_client.detach_user_policy(
+                    UserName=user_name, PolicyArn=resources["policy_arn"]
+                )
+            except ClientError as e:
+                logger.warning("Failed to detach policy for %s: %s", user_name, e)
+            try:
+                iam_client.delete_policy(PolicyArn=resources["policy_arn"])
+            except ClientError as e:
+                logger.warning("Failed to delete policy for %s: %s", user_name, e)
+            try:
+                iam_client.delete_access_key(
+                    UserName=user_name, AccessKeyId=resources["access_key_id"]
+                )
+            except ClientError as e:
+                logger.warning("Failed to delete access key for %s: %s", user_name, e)
+            try:
+                iam_client.delete_user(UserName=user_name)
+            except ClientError as e:
+                logger.warning("Failed to delete user %s: %s", user_name, e)
+        logger.info("IAM resource cleanup complete.")
+
+
+@pytest.mark.parametrize(
+    "test_id, expected_result, expected_message_part",
+    [(p.id, p.values[1], p.values[2]) for p in VERIFY_CREDS_TEST_CASES],
+    ids=[str(p.id) for p in VERIFY_CREDS_TEST_CASES],
+)
+def test_verify_aws_creds(
+    all_test_credentials: dict[str, dict[str, str]],
+    test_id: str,
+    expected_result: bool,
+    expected_message_part: str,
+) -> None:
+    """Test the AWS verify_creds method with various scenarios."""
+    # The test now receives exactly the arguments it needs. No unpacking!
+    credentials = all_test_credentials[test_id]
+
+    aws_verifier = AWSCreds(credentials=credentials)
+    is_valid, message_schema = aws_verifier.verify_creds()
+
+    assert is_valid is expected_result
+    assert expected_message_part in message_schema.message.lower()

From ed0262bb1ba32559a1d1f7938f241af464af3d65 Mon Sep 17 00:00:00 2001
From: Alex Christy <a.christy@ufl.edu>
Date: Thu, 31 Jul 2025 19:50:08 +0200
Subject: [PATCH 25/43] fix(tests): fix adding credentials in deploy tests to
 match new secrets submission endpoint

---
 api/tests/api_test_utils.py | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/api/tests/api_test_utils.py b/api/tests/api_test_utils.py
index 3a620d79..6d9bb2f5 100644
--- a/api/tests/api_test_utils.py
+++ b/api/tests/api_test_utils.py
@@ -12,6 +12,7 @@
 from src.app.enums.job_status import OpenLabsJobStatus
 from src.app.enums.providers import OpenLabsProvider
 from src.app.enums.regions import OpenLabsRegion
+from src.app.schemas.creds_verify_schema import CredsVerifySchema
 from src.app.schemas.job_schemas import JobSchema, JobSubmissionResponseSchema
 from src.app.schemas.range_schemas import (
     BlueprintRangeHeaderSchema,
@@ -225,7 +226,7 @@ async def is_logged_in(client: AsyncClient) -> bool:
 async def add_cloud_credentials(
     auth_client: AsyncClient,
     provider: OpenLabsProvider,
-    credentials_payload: dict[str, Any],
+    credentials: dict[str, Any],
 ) -> bool:
     """Add cloud credentials to the authenticated client's account.
 
@@ -233,7 +234,7 @@ async def add_cloud_credentials(
     ----
         auth_client (AsyncClient): Any authenticated httpx client. NOT THE `auth_client` FIXTURE!
         provider (OpenLabsProvider): A valid OpenLabs cloud provider to configure credentials for.
-        credentials_payload (dict[str, Any]): Dictionary representation of corresponding cloud provider's credential schema.
+        credentials (dict[str, Any]): Dictionary representation of corresponding cloud provider's credential schema.
 
     Returns:
     -------
@@ -242,10 +243,14 @@ async def add_cloud_credentials(
     """
     base_route = get_api_base_route(version=1)
 
-    if not credentials_payload:
+    if not credentials:
         logger.error("Failed to add cloud credentials. Payload empty!")
         return False
 
+    credentials_payload = CredsVerifySchema(
+        provider=provider, credentials=credentials
+    ).model_dump(mode="json")
+
     # Verify we are logged in
     logged_in = await is_logged_in(auth_client)
     if not logged_in:
@@ -255,9 +260,8 @@ async def add_cloud_credentials(
         return False
 
     # Submit credentials
-    provider_url = provider.value.lower()
     response = await auth_client.post(
-        f"{base_route}/users/me/secrets/{provider_url}", json=credentials_payload
+        f"{base_route}/users/me/secrets", json=credentials_payload
     )
     if response.status_code != status.HTTP_200_OK:
         logger.error(

From 907614244b45698a60981f17d82eaa3ade3d6a18 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Thu, 31 Jul 2025 20:51:22 -0400
Subject: [PATCH 26/43] fix(tests): Fix failing ruff tests

---
 api/tests/unit/api/v1/test_users.py      | 6 ++++--
 api/tests/unit/cloud/test_aws_creds.py   | 7 ++++---
 api/tests/unit/crud/test_crud_secrets.py | 3 ++-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index 2a024b28..2f917b46 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -52,12 +52,14 @@ def override_get_current_user_no_key() -> UserModel:
         """Fake dependency that returns a user without a public key.
 
         Returns:
+
         -------
-            MessageSchema: Status message of updating user secrets."""
+            UserModel: Fake user that doesn't have a public key set.
+        """
         return UserModel(
             name="FakeUser",
             email="fakeuser@gmail.com",
-            hashed_password="faskpasswordhash",  # noqa: S105
+            hashed_password="faskpasswordhash",  # noqa: S106
             created_at=datetime.now(UTC),
             last_active=datetime.now(UTC),
             is_admin=False,
diff --git a/api/tests/unit/cloud/test_aws_creds.py b/api/tests/unit/cloud/test_aws_creds.py
index 4a4ae9f5..83e75678 100644
--- a/api/tests/unit/cloud/test_aws_creds.py
+++ b/api/tests/unit/cloud/test_aws_creds.py
@@ -1,10 +1,11 @@
-import pytest
 from unittest.mock import MagicMock
+
+import pytest
 from botocore.exceptions import ClientError
 
-from src.app.utils.crypto import encrypt_with_public_key, generate_rsa_key_pair
-from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
 from src.app.cloud.aws_creds import AWSCreds
+from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
+from src.app.utils.crypto import encrypt_with_public_key, generate_rsa_key_pair
 
 from tests.unit.api.v1.config import aws_secrets_payload
 
diff --git a/api/tests/unit/crud/test_crud_secrets.py b/api/tests/unit/crud/test_crud_secrets.py
index f93ab326..5eea2466 100644
--- a/api/tests/unit/crud/test_crud_secrets.py
+++ b/api/tests/unit/crud/test_crud_secrets.py
@@ -1,10 +1,11 @@
 import re
 from unittest.mock import MagicMock
+
 import pytest
 from pytest_mock import MockerFixture
 
-from src.app.models.secret_model import SecretModel
 from src.app.crud.crud_secrets import get_user_secrets, upsert_user_secrets
+from src.app.models.secret_model import SecretModel
 from src.app.schemas.secret_schema import SecretSchema
 
 from .crud_mocks import DummyDB

From 332c8956e4942051222fee1cc980d3d761b916f2 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Thu, 31 Jul 2025 21:23:38 -0400
Subject: [PATCH 27/43] fix(tests): Fix MyPy error with crud_secrets test.

---
 api/tests/unit/crud/test_crud_secrets.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/api/tests/unit/crud/test_crud_secrets.py b/api/tests/unit/crud/test_crud_secrets.py
index 5eea2466..42fb38ed 100644
--- a/api/tests/unit/crud/test_crud_secrets.py
+++ b/api/tests/unit/crud/test_crud_secrets.py
@@ -49,11 +49,12 @@ async def test_get_user_secrets_success(mocker: MockerFixture) -> None:
 
     # Patch validation of secrets
     mock_validate = mocker.patch.object(
-        SecretSchema, "model_validate", return_value="validated_secrets"
+        SecretSchema, "model_validate", return_value=SecretSchema()
     )
 
     result = await get_user_secrets(db=dummy_db, user_id=user_id)
-    assert result == "validated_secrets"
+    fake_secrets = SecretSchema()
+    assert result == fake_secrets
     mock_validate.assert_called_once_with(mock_secret_model)
 
     # Verify the fetching secrets for correct user

From 8982a1999605bef9944278c4f5025da2222d2728 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Thu, 31 Jul 2025 21:42:39 -0400
Subject: [PATCH 28/43] fix(tests): More ruff error fixes :(

---
 api/tests/unit/api/v1/test_users.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index 2f917b46..7d07f2e9 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -52,8 +52,8 @@ def override_get_current_user_no_key() -> UserModel:
         """Fake dependency that returns a user without a public key.
 
         Returns:
-
         -------
+
             UserModel: Fake user that doesn't have a public key set.
         """
         return UserModel(

From 3b150182fbfc7ac6a40a3d982ee5bb5f86b350a2 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Thu, 31 Jul 2025 22:18:49 -0400
Subject: [PATCH 29/43] fix(tests): More ruff fixes :(

---
 api/tests/unit/api/v1/test_users.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index 7d07f2e9..1945722a 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -53,8 +53,8 @@ def override_get_current_user_no_key() -> UserModel:
 
         Returns:
         -------
-
             UserModel: Fake user that doesn't have a public key set.
+
         """
         return UserModel(
             name="FakeUser",

From 4d7b3df90b6d658fa67bf80a6a37bee301dac352 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Fri, 1 Aug 2025 16:00:24 -0400
Subject: [PATCH 30/43] fix(tests): Fix ruff checks

---
 api/tests/unit/api/v1/test_users.py    | 17 +++++------------
 api/tests/unit/cloud/test_aws_creds.py |  1 -
 2 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index 1945722a..30c4cda8 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -1,5 +1,7 @@
-import pytest
 from datetime import UTC, datetime
+from unittest.mock import MagicMock
+
+import pytest
 from fastapi import status
 from httpx import AsyncClient
 from pytest_mock import MockerFixture
@@ -7,11 +9,9 @@
 from src.app.core.auth.auth import get_current_user
 from src.app.main import app
 from src.app.models.user_model import UserModel
-from src.app.schemas.secret_schema import SecretSchema
 from src.app.schemas.message_schema import MessageSchema
-from tests.unit.api.v1.config import BASE_ROUTE
-from tests.unit.api.v1.config import aws_secrets_payload
-from unittest.mock import MagicMock
+from src.app.schemas.secret_schema import SecretSchema
+from tests.unit.api.v1.config import BASE_ROUTE, aws_secrets_payload
 
 
 @pytest.fixture
@@ -49,13 +49,6 @@ def mock_get_secrets(mocker: MockerFixture, users_api_v1_endpoints_path: str) ->
     """Bypass fetching users secrets to pass for a fake user."""
 
     def override_get_current_user_no_key() -> UserModel:
-        """Fake dependency that returns a user without a public key.
-
-        Returns:
-        -------
-            UserModel: Fake user that doesn't have a public key set.
-
-        """
         return UserModel(
             name="FakeUser",
             email="fakeuser@gmail.com",
diff --git a/api/tests/unit/cloud/test_aws_creds.py b/api/tests/unit/cloud/test_aws_creds.py
index 83e75678..a1098aa4 100644
--- a/api/tests/unit/cloud/test_aws_creds.py
+++ b/api/tests/unit/cloud/test_aws_creds.py
@@ -6,7 +6,6 @@
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
 from src.app.utils.crypto import encrypt_with_public_key, generate_rsa_key_pair
-
 from tests.unit.api.v1.config import aws_secrets_payload
 
 

From 6109ada501cc3b710fc03f4e6073ad0b683b478e Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Fri, 1 Aug 2025 16:02:25 -0400
Subject: [PATCH 31/43] Fix(secrets verification): Fix typos.

---
 api/src/app/api/v1/users.py    | 2 +-
 api/src/app/cloud/aws_creds.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index 21969087..9f868de9 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -216,7 +216,7 @@ async def update_user_secrets(
             detail=msg.message,
         )
 
-    # Encrypt the AWS credentials using the user's public key
+    # Encrypt the credentials using the user's public key
     if not current_user.public_key:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
diff --git a/api/src/app/cloud/aws_creds.py b/api/src/app/cloud/aws_creds.py
index 6d14a7c9..1105fd5c 100644
--- a/api/src/app/cloud/aws_creds.py
+++ b/api/src/app/cloud/aws_creds.py
@@ -43,7 +43,7 @@ def verify_creds(self) -> Tuple[bool, MessageSchema]:
         """Verify credentials authenticate to an AWS account."""
         try:
             # --- Step 1: Basic Authentication with STS ---
-            # Created shared session for authenticaion and IAM permission check
+            # Created shared session for authentication and IAM permission check
             session = boto3.Session(
                 aws_access_key_id=self.credentials.aws_access_key,
                 aws_secret_access_key=self.credentials.aws_secret_key,

From be0a58485a3d2a1f558097ee915b3d79db3daf3b Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 16:21:58 -0400
Subject: [PATCH 32/43] fix(tests): Updated test config for aws secrets and
 renamed aws tests to reflect purpose.

---
 api/tests/unit/api/v1/config.py              | 16 ----------------
 api/tests/unit/api/v1/test_users.py          |  2 +-
 api/tests/unit/cloud/test_aws_creds.py       | 17 +++++++++--------
 api/tests/unit/cloud/test_creds_factory.py   |  2 +-
 api/tests/unit/schemas/test_secret_schema.py |  6 +++---
 5 files changed, 14 insertions(+), 29 deletions(-)

diff --git a/api/tests/unit/api/v1/config.py b/api/tests/unit/api/v1/config.py
index 3df49281..39768d40 100644
--- a/api/tests/unit/api/v1/config.py
+++ b/api/tests/unit/api/v1/config.py
@@ -181,22 +181,6 @@
     "new_password": "newpassword123",
 }
 
-# Test data for AWS secrets
-aws_secrets_payload: dict[str, Any] = {
-    "provider": "aws",
-    "credentials": {
-        "aws_access_key": "AKIAIOSFODNN7EXAMPLE",
-        "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-    },
-}
-
-# Test data for Azure secrets
-azure_secrets_payload = {
-    "azure_client_id": "00000000-0000-0000-0000-000000000000",
-    "azure_client_secret": "example-client-secret-value",
-    "azure_tenant_id": "00000000-0000-0000-0000-000000000000",
-    "azure_subscription_id": "00000000-0000-0000-0000-000000000000",
-}
 # ==============================
 #         Job Payloads
 # ==============================
diff --git a/api/tests/unit/api/v1/test_users.py b/api/tests/unit/api/v1/test_users.py
index 30c4cda8..27ab1c77 100644
--- a/api/tests/unit/api/v1/test_users.py
+++ b/api/tests/unit/api/v1/test_users.py
@@ -11,7 +11,7 @@
 from src.app.models.user_model import UserModel
 from src.app.schemas.message_schema import MessageSchema
 from src.app.schemas.secret_schema import SecretSchema
-from tests.unit.api.v1.config import BASE_ROUTE, aws_secrets_payload
+from tests.common.api.v1.config import BASE_ROUTE, aws_secrets_payload
 
 
 @pytest.fixture
diff --git a/api/tests/unit/cloud/test_aws_creds.py b/api/tests/unit/cloud/test_aws_creds.py
index a1098aa4..b492cee0 100644
--- a/api/tests/unit/cloud/test_aws_creds.py
+++ b/api/tests/unit/cloud/test_aws_creds.py
@@ -1,12 +1,11 @@
-from unittest.mock import MagicMock
-
 import pytest
+from pytest_mock import MockerFixture
 from botocore.exceptions import ClientError
 
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
 from src.app.utils.crypto import encrypt_with_public_key, generate_rsa_key_pair
-from tests.unit.api.v1.config import aws_secrets_payload
+from tests.common.api.v1.config import aws_secrets_payload
 
 
 @pytest.fixture(scope="module")
@@ -50,7 +49,7 @@ def test_update_secret_schema(aws_creds_class: AWSCreds) -> None:
     assert secrets.aws_secret_key == encrypted_data["aws_secret_key"]
 
 
-def test_verify_creds_success(aws_creds_class: AWSCreds, mocker: MagicMock) -> None:
+def test_verify_creds_success(aws_creds_class: AWSCreds, mocker: MockerFixture) -> None:
     """Test successful credential verification with sufficient permissions."""
     # Mock the boto3 session and its clients
     mock_session = mocker.patch("boto3.Session").return_value
@@ -77,7 +76,9 @@ def test_verify_creds_success(aws_creds_class: AWSCreds, mocker: MagicMock) -> N
     mock_iam.simulate_principal_policy.assert_called_once()
 
 
-def test_verify_creds_root_user(aws_creds_class: AWSCreds, mocker: MagicMock) -> None:
+def test_verify_creds_root_user(
+    aws_creds_class: AWSCreds, mocker: MockerFixture
+) -> None:
     """Test that the permissions check is skipped for the root user."""
     mock_session = mocker.patch("boto3.Session").return_value
     mock_sts = mock_session.client.return_value
@@ -95,7 +96,7 @@ def test_verify_creds_root_user(aws_creds_class: AWSCreds, mocker: MagicMock) ->
 
 
 def test_verify_creds_insufficient_permissions(
-    aws_creds_class: AWSCreds, mocker: MagicMock
+    aws_creds_class: AWSCreds, mocker: MockerFixture
 ) -> None:
     """Test verification failure due to denied actions in the simulation."""
     mock_session = mocker.patch("boto3.Session").return_value
@@ -125,7 +126,7 @@ def test_verify_creds_insufficient_permissions(
 
 
 def test_verify_creds_invalid_token(
-    aws_creds_class: AWSCreds, mocker: MagicMock
+    aws_creds_class: AWSCreds, mocker: MockerFixture
 ) -> None:
     """Test verification failure due to invalid credentials."""
     mock_session = mocker.patch("boto3.Session").return_value
@@ -149,7 +150,7 @@ def test_verify_creds_invalid_token(
 
 
 def test_verify_creds_iam_access_denied(
-    aws_creds_class: AWSCreds, mocker: MagicMock
+    aws_creds_class: AWSCreds, mocker: MockerFixture
 ) -> None:
     """Test failure when credentials are valid but cannot perform the IAM simulation."""
     mock_session = mocker.patch("boto3.Session").return_value
diff --git a/api/tests/unit/cloud/test_creds_factory.py b/api/tests/unit/cloud/test_creds_factory.py
index fc5677b9..e6ce06db 100644
--- a/api/tests/unit/cloud/test_creds_factory.py
+++ b/api/tests/unit/cloud/test_creds_factory.py
@@ -5,7 +5,7 @@
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.cloud.creds_factory import CredsFactory
 from src.app.schemas.creds_verify_schema import CredsVerifySchema
-from tests.unit.api.v1.config import aws_secrets_payload
+from tests.common.api.v1.config import aws_secrets_payload
 
 
 def test_creds_factory_non_existent_provider_type() -> None:
diff --git a/api/tests/unit/schemas/test_secret_schema.py b/api/tests/unit/schemas/test_secret_schema.py
index 89fb0cf4..2b3a8e21 100644
--- a/api/tests/unit/schemas/test_secret_schema.py
+++ b/api/tests/unit/schemas/test_secret_schema.py
@@ -5,7 +5,7 @@
 from pydantic import ValidationError
 
 from src.app.schemas.secret_schema import AWSSecrets
-from tests.unit.api.v1.config import aws_secrets_payload
+from tests.common.api.v1.config import aws_secrets_payload
 
 
 def test_aws_secrets_schema_invalid_access_key_length() -> None:
@@ -18,7 +18,7 @@ def test_aws_secrets_schema_invalid_access_key_length() -> None:
         AWSSecrets.model_validate(invalid_creds["credentials"])
 
 
-def test_aws_secrets_schema_missing_access_key_length() -> None:
+def test_aws_secrets_schema_missing_access_key() -> None:
     """Test that the AWS Secrets schema fails when aws_access_key is missing."""
     invalid_creds = copy.deepcopy(aws_secrets_payload)
     invalid_creds["credentials"][
@@ -40,7 +40,7 @@ def test_aws_secrets_schema_invalid_secret_key_length() -> None:
         AWSSecrets.model_validate(invalid_creds["credentials"])
 
 
-def test_aws_secrets_schema_missing_secret_key_length() -> None:
+def test_aws_secrets_schema_missing_secret_key() -> None:
     """Test that the AWS Secrets schema fails when aws_secret_key is missing."""
     invalid_creds = copy.deepcopy(aws_secrets_payload)
     invalid_creds["credentials"][

From 168f099acee120874dea82931b8ad0d23cc36e6b Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 17:19:16 -0400
Subject: [PATCH 33/43] fix(secrets verification): Update secrets functionality
 to use discriminated union.

---
 api/src/app/cloud/aws_creds.py     | 25 +++++++++++--------------
 api/src/app/cloud/base_creds.py    |  6 +++---
 api/src/app/cloud/creds_factory.py | 13 +++++--------
 3 files changed, 19 insertions(+), 25 deletions(-)

diff --git a/api/src/app/cloud/aws_creds.py b/api/src/app/cloud/aws_creds.py
index 1105fd5c..38d6c8e6 100644
--- a/api/src/app/cloud/aws_creds.py
+++ b/api/src/app/cloud/aws_creds.py
@@ -1,6 +1,6 @@
 import logging
 from datetime import UTC, datetime
-from typing import Any, List, Tuple
+from typing import List, Tuple
 
 import boto3
 from botocore.exceptions import ClientError
@@ -19,9 +19,9 @@ class AWSCreds(AbstractBaseCreds):
 
     credentials: AWSSecrets
 
-    def __init__(self, credentials: dict[str, Any]) -> None:
+    def __init__(self, credentials: AWSSecrets) -> None:
         """Initialize AWS credentials verification object."""
-        self.credentials = AWSSecrets.model_validate(credentials)
+        self.credentials = credentials
 
     def get_user_creds(self) -> dict[str, str]:
         """Convert user AWS secrets to dictionary for encryption."""
@@ -132,23 +132,20 @@ def verify_creds(self) -> Tuple[bool, MessageSchema]:
                 if result["EvalDecision"] != "allowed":
                     denied_actions.append(result["EvalActionName"])
 
-            if not denied_actions:
-                logger.info(
-                    "All simulated actions were allowed for ARN: %s", caller_arn
-                )
+            if denied_actions:
+                error_message = f"Authentication succeeded, but the user/group is missing required permissions. The following actions were denied: {', '.join(denied_actions)}"
+                logger.error(error_message)
                 return (
-                    True,
+                    False,
                     MessageSchema(
-                        message="AWS credentials authenticated and all required permissions are present."
+                        message=f"Insufficient permissions for your AWS account user/group. Please ensure the following permissions are added: {', '.join(denied_actions)}"
                     ),
                 )
-
-            error_message = f"Authentication succeeded, but the user/group is missing required permissions. The following actions were denied: {', '.join(denied_actions)}"
-            logger.error(error_message)
+            logger.info("All simulated actions were allowed for ARN: %s", caller_arn)
             return (
-                False,
+                True,
                 MessageSchema(
-                    message=f"Insufficient permissions for your AWS account user/group. Please ensure the following permissions are added: {', '.join(denied_actions)}"
+                    message="AWS credentials authenticated and all required permissions are present."
                 ),
             )
         except ClientError as e:
diff --git a/api/src/app/cloud/base_creds.py b/api/src/app/cloud/base_creds.py
index d5430b2f..d09ffc58 100644
--- a/api/src/app/cloud/base_creds.py
+++ b/api/src/app/cloud/base_creds.py
@@ -1,15 +1,15 @@
 from abc import ABC, abstractmethod
-from typing import Any, Tuple
+from typing import Tuple
 
 from src.app.schemas.message_schema import MessageSchema
-from src.app.schemas.secret_schema import SecretSchema
+from src.app.schemas.secret_schema import AnySecrets, SecretSchema
 
 
 class AbstractBaseCreds(ABC):
     """Abstract class to enforce common credential verification functionality across range cloud providers."""
 
     @abstractmethod
-    def __init__(self, credentials: dict[str, Any]) -> None:
+    def __init__(self, credentials: AnySecrets) -> None:
         """Expected constructor for all credential subclasses."""  # noqa: D401
         pass
 
diff --git a/api/src/app/cloud/creds_factory.py b/api/src/app/cloud/creds_factory.py
index 5ff7ec89..af9f5d90 100644
--- a/api/src/app/cloud/creds_factory.py
+++ b/api/src/app/cloud/creds_factory.py
@@ -1,6 +1,7 @@
 import logging
-from typing import Any, ClassVar, Type
+from typing import ClassVar, Type
 
+from src.app.schemas.secret_schema import AnySecrets
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.cloud.base_creds import AbstractBaseCreds
 from src.app.enums.providers import OpenLabsProvider
@@ -17,9 +18,7 @@ class CredsFactory:
     }
 
     @classmethod
-    def create_creds_verification(
-        cls, provider: OpenLabsProvider, credentials: dict[str, Any]
-    ) -> AbstractBaseCreds:
+    def create_creds_verification(cls, credentials: AnySecrets) -> AbstractBaseCreds:
         """Create creds object.
 
         **Note:** This function accepts a creation schema as the OpenLabs resource ID is not required
@@ -36,12 +35,10 @@ def create_creds_verification(
             AbstractBaseCreds: Creds object that will be used to verify the user cloud credentials provided
 
         """
-        creds_class = cls._registry.get(provider)
+        creds_class = cls._registry.get(credentials.provider)
 
         if creds_class is None:
-            msg = (
-                f"Failed to build creds object. Non-existent provider given: {provider}"
-            )
+            msg = f"Failed to build creds object. Non-existent provider given: {credentials.provider}"
             logger.error(msg)
             raise ValueError(msg)
 

From 0d3dc84f05f91c317500733ea48291e88d294c1e Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 17:20:52 -0400
Subject: [PATCH 34/43] fix(secrets verification): Update endpoint to use newly
 created secrets discriminated union.

---
 api/src/app/api/v1/users.py                | 16 ++++---------
 api/src/app/schemas/creds_verify_schema.py | 19 ---------------
 api/src/app/schemas/secret_schema.py       | 27 +++++++++++++++++-----
 3 files changed, 25 insertions(+), 37 deletions(-)
 delete mode 100644 api/src/app/schemas/creds_verify_schema.py

diff --git a/api/src/app/api/v1/users.py b/api/src/app/api/v1/users.py
index 9f868de9..222b4821 100644
--- a/api/src/app/api/v1/users.py
+++ b/api/src/app/api/v1/users.py
@@ -2,12 +2,10 @@
 
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.responses import JSONResponse
-from pydantic import ValidationError
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio.session import AsyncSession
 
 from src.app.cloud.creds_factory import CredsFactory
-from src.app.schemas.creds_verify_schema import CredsVerifySchema
 
 from ...core.auth.auth import get_current_user
 from ...core.config import settings
@@ -21,6 +19,7 @@
     UpdatePasswordMessageSchema,
 )
 from ...schemas.secret_schema import (
+    AnySecrets,
     CloudSecretStatusSchema,
     UserSecretResponseSchema,
 )
@@ -173,7 +172,7 @@ async def fetch_user_secrets(
 
 @router.post("/me/secrets")
 async def update_user_secrets(
-    creds: CredsVerifySchema,
+    creds: AnySecrets,
     current_user: UserModel = Depends(get_current_user),  # noqa: B008
     db: AsyncSession = Depends(async_get_db),  # noqa: B008
 ) -> MessageSchema:
@@ -181,7 +180,7 @@ async def update_user_secrets(
 
     Args:
     ----
-        creds (CredsVerifySchema): The provider credentials to store.
+        creds (AnySecrets): The provider credentials to store.
         current_user (UserModel): The authenticated user.
         db (Session): Database connection.
 
@@ -199,14 +198,7 @@ async def update_user_secrets(
         )
 
     # Verify credentials are valid before storing
-    try:
-        creds_obj = CredsFactory.create_creds_verification(
-            provider=creds.provider, credentials=creds.credentials
-        )
-    except (ValidationError, ValueError) as e:
-        # Handles Pydantic schema validation errors (e.g., bad format/length of credentials) or invalid providers in payload
-        error_msg = f"Invalid {creds.provider.value.upper()} credentials payload."
-        raise HTTPException(status_code=400, detail=error_msg) from e
+    creds_obj = CredsFactory.create_creds_verification(credentials=creds)
 
     verified, msg = creds_obj.verify_creds()
 
diff --git a/api/src/app/schemas/creds_verify_schema.py b/api/src/app/schemas/creds_verify_schema.py
deleted file mode 100644
index ed25132b..00000000
--- a/api/src/app/schemas/creds_verify_schema.py
+++ /dev/null
@@ -1,19 +0,0 @@
-from typing import Any
-
-from pydantic import BaseModel, Field
-
-from src.app.enums.providers import OpenLabsProvider
-
-
-class CredsVerifySchema(BaseModel):
-    """Base creds object for OpenLabs credential verification."""
-
-    provider: OpenLabsProvider = Field(
-        ...,
-        description="Cloud provider",
-        examples=[OpenLabsProvider.AWS, OpenLabsProvider.AZURE],
-    )
-
-    credentials: dict[str, Any] = Field(
-        ..., description="Cloud provider credentials to verify"
-    )
diff --git a/api/src/app/schemas/secret_schema.py b/api/src/app/schemas/secret_schema.py
index 1cde759b..eba78cee 100644
--- a/api/src/app/schemas/secret_schema.py
+++ b/api/src/app/schemas/secret_schema.py
@@ -1,7 +1,10 @@
 from datetime import datetime, timezone
+from typing import Annotated, Literal, Union
 
 from pydantic import BaseModel, ConfigDict, Field, field_validator
 
+from src.app.enums.providers import OpenLabsProvider
+
 
 class SecretBaseSchema(BaseModel):
     """Base secret object for OpenLabs."""
@@ -54,9 +57,16 @@ class SecretSchema(SecretBaseSchema):
     model_config = ConfigDict(from_attributes=True)
 
 
-class AWSSecrets(BaseModel):
+class BaseSecrets(BaseModel):
+    """Base secret object for setting secrets on OpenLabs."""
+
+    provider: OpenLabsProvider
+
+
+class AWSSecrets(BaseSecrets):
     """AWS secret object for setting secrets on OpenLabs."""
 
+    provider: Literal[OpenLabsProvider.AWS] = OpenLabsProvider.AWS
     aws_access_key: str = Field(
         ...,
         description="Access key for AWS account",
@@ -83,10 +93,10 @@ def validate_access_key(cls, aws_access_key: str) -> str:
         """
         access_key_length = 20
         if len(aws_access_key.strip()) == 0:
-            msg = "Partial credentials or no credentials provided. Please ensure you are providing proper AWS credentials."
+            msg = "No AWS access key provided. Please ensure you are providing proper AWS credentials."
             raise ValueError(msg)
         if len(aws_access_key.strip()) != access_key_length:
-            msg = "Invalid credential format. Please ensure your AWS credentials are of proper length."
+            msg = "Invalid AWS access key format. Please ensure your AWS credentials are of proper length."
             raise ValueError(msg)
         return aws_access_key
 
@@ -107,17 +117,19 @@ def validate_secret_key(cls, aws_secret_key: str) -> str:
         """
         secret_key_length = 40
         if len(aws_secret_key.strip()) == 0:
-            msg = "Partial credentials or no credentials provided. Please ensure you are providing proper AWS credentials."
+            msg = "No AWS secret key provided. Please ensure you are providing proper AWS credentials."
             raise ValueError(msg)
         if len(aws_secret_key.strip()) != secret_key_length:
-            msg = "Invalid credential format. Please ensure your AWS credentials are of proper length."
+            msg = "Invalid AWS secret key format. Please ensure your AWS credentials are of proper length."
             raise ValueError(msg)
         return aws_secret_key
 
 
-class AzureSecrets(BaseModel):
+class AzureSecrets(BaseSecrets):
     """Azure secret object for setting secrets on OpenLabs."""
 
+    provider: Literal[OpenLabsProvider.AZURE] = OpenLabsProvider.AZURE
+
     azure_client_id: str = Field(
         ...,
         description="Client ID for Azure",
@@ -136,6 +148,9 @@ class AzureSecrets(BaseModel):
     )
 
 
+AnySecrets = Annotated[Union[AWSSecrets, AzureSecrets], Field(discriminator="provider")]
+
+
 class CloudSecretStatusSchema(BaseModel):
     """General response schema for a single cloud provider."""
 

From 9c68d2aa10fc583dc260bcdaaee067ad78ad09ae Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 17:29:55 -0400
Subject: [PATCH 35/43] fix(secrets verification): Update provider enum for
 discriminated union to work.

---
 api/src/app/enums/providers.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/src/app/enums/providers.py b/api/src/app/enums/providers.py
index 23ae894b..012032a3 100644
--- a/api/src/app/enums/providers.py
+++ b/api/src/app/enums/providers.py
@@ -1,7 +1,7 @@
 from enum import Enum
 
 
-class OpenLabsProvider(Enum):
+class OpenLabsProvider(str, Enum):
     """OpenLabs supported cloud providers."""
 
     AWS = "aws"

From 08a52cf107627f15927ee98e49ef5e0776ed027b Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 17:30:19 -0400
Subject: [PATCH 36/43] fix(tests): Update secrets tests to use new
 discriminated union logic.

---
 api/tests/api_test_utils.py                  | 11 +++-----
 api/tests/common/api/v1/config.py            |  7 +++--
 api/tests/common/api/v1/test_users.py        |  6 ++---
 api/tests/conftest.py                        |  6 ++---
 api/tests/unit/cloud/test_aws_creds.py       |  6 ++---
 api/tests/unit/cloud/test_creds_factory.py   | 19 +++++--------
 api/tests/unit/schemas/test_secret_schema.py | 28 +++++++++-----------
 7 files changed, 33 insertions(+), 50 deletions(-)

diff --git a/api/tests/api_test_utils.py b/api/tests/api_test_utils.py
index 95dbf5b5..222d21c5 100644
--- a/api/tests/api_test_utils.py
+++ b/api/tests/api_test_utils.py
@@ -9,10 +9,10 @@
 from fastapi import status
 from httpx import AsyncClient
 
+from src.app.schemas.secret_schema import AnySecrets
 from src.app.enums.job_status import OpenLabsJobStatus
 from src.app.enums.providers import OpenLabsProvider
 from src.app.enums.regions import OpenLabsRegion
-from src.app.schemas.creds_verify_schema import CredsVerifySchema
 from src.app.schemas.job_schemas import JobSchema, JobSubmissionResponseSchema
 from src.app.schemas.range_schemas import (
     BlueprintRangeHeaderSchema,
@@ -225,8 +225,7 @@ async def is_logged_in(client: AsyncClient) -> bool:
 
 async def add_cloud_credentials(
     auth_client: AsyncClient,
-    provider: OpenLabsProvider,
-    credentials: dict[str, Any],
+    credentials: AnySecrets,
 ) -> bool:
     """Add cloud credentials to the authenticated client's account.
 
@@ -247,10 +246,6 @@ async def add_cloud_credentials(
         logger.error("Failed to add cloud credentials. Payload empty!")
         return False
 
-    credentials_payload = CredsVerifySchema(
-        provider=provider, credentials=credentials
-    ).model_dump(mode="json")
-
     # Verify we are logged in
     logged_in = await is_logged_in(auth_client)
     if not logged_in:
@@ -261,7 +256,7 @@ async def add_cloud_credentials(
 
     # Submit credentials
     response = await auth_client.post(
-        f"{base_route}/users/me/secrets", json=credentials_payload
+        f"{base_route}/users/me/secrets", json=credentials.model_dump(mode="json")
     )
     if response.status_code != status.HTTP_200_OK:
         logger.error(
diff --git a/api/tests/common/api/v1/config.py b/api/tests/common/api/v1/config.py
index 3628b80b..64bed83f 100644
--- a/api/tests/common/api/v1/config.py
+++ b/api/tests/common/api/v1/config.py
@@ -338,14 +338,13 @@
 # Test data for AWS secrets
 aws_secrets_payload: dict[str, Any] = {
     "provider": "aws",
-    "credentials": {
-        "aws_access_key": "AKIAIOSFODNN7EXAMPLE",
-        "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-    },
+    "aws_access_key": "AKIAIOSFODNN7EXAMPLE",
+    "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
 }
 
 # Test data for Azure secrets
 azure_secrets_payload = {
+    "provider": "azure",
     "azure_client_id": "00000000-0000-0000-0000-000000000000",
     "azure_client_secret": "example-client-secret-value",
     "azure_tenant_id": "00000000-0000-0000-0000-000000000000",
diff --git a/api/tests/common/api/v1/test_users.py b/api/tests/common/api/v1/test_users.py
index 2fc79488..bd00fe6b 100644
--- a/api/tests/common/api/v1/test_users.py
+++ b/api/tests/common/api/v1/test_users.py
@@ -53,13 +53,13 @@ async def test_update_secrets_with_invalid_payload(
         # Try update with invalid secrets format - Use AWS secrets specifically for this test
         invalid_payload = copy.deepcopy(aws_secrets_payload)
         # Using incorrect credentials to test validation - submit payload without required fields
-        invalid_payload["credentials"] = {}
+        invalid_payload["aws_secret_key"] = ""
 
         update_response = await auth_api_client.post(
             f"{BASE_ROUTE}/users/me/secrets", json=invalid_payload
         )
-        assert update_response.status_code == status.HTTP_400_BAD_REQUEST
-        assert update_response.json()["detail"] == "Invalid AWS credentials payload."
+        assert update_response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
+        assert "No AWS secret key provided." in str(update_response.json()["detail"])
 
     async def test_update_secrets_with_invalid_credentials(
         self, auth_api_client: AsyncClient
diff --git a/api/tests/conftest.py b/api/tests/conftest.py
index 4601f9c9..5867dde9 100644
--- a/api/tests/conftest.py
+++ b/api/tests/conftest.py
@@ -36,7 +36,7 @@
     DeployedRangeCreateSchema,
     DeployedRangeSchema,
 )
-from src.app.schemas.secret_schema import SecretSchema
+from src.app.schemas.secret_schema import AnySecrets, SecretSchema
 from src.app.utils.api_utils import get_api_base_route
 from src.app.utils.cdktf_utils import create_cdktf_dir
 from src.app.utils.path_utils import find_git_root
@@ -564,8 +564,8 @@ async def provider_deployed_ranges_for_provider(
             creds = get_provider_test_creds(provider)
             if not creds:
                 pytest.skip(f"Credentials for {provider_upper} not set.")
-
-            added_creds = await add_cloud_credentials(client, provider, creds)
+            creds = AnySecrets.model_validate(**creds, provider=provider)
+            added_creds = await add_cloud_credentials(client, creds)
             if not added_creds:
                 pytest.fail(f"Failed configure cloud credentials for {provider_upper}")
 
diff --git a/api/tests/unit/cloud/test_aws_creds.py b/api/tests/unit/cloud/test_aws_creds.py
index b492cee0..ac48093b 100644
--- a/api/tests/unit/cloud/test_aws_creds.py
+++ b/api/tests/unit/cloud/test_aws_creds.py
@@ -11,7 +11,7 @@
 @pytest.fixture(scope="module")
 def aws_creds_class() -> AWSCreds:
     """Create a AWS creds class object."""
-    return AWSCreds(aws_secrets_payload["credentials"])
+    return AWSCreds(AWSSecrets.model_validate(aws_secrets_payload))
 
 
 def test_init(aws_creds_class: AWSCreds) -> None:
@@ -27,8 +27,8 @@ def test_get_user_creds(aws_creds_class: AWSCreds) -> None:
     access_key = "aws_access_key"
     secret_key = "aws_secret_key"  # noqa: S105
 
-    assert user_creds[access_key] == aws_secrets_payload["credentials"][access_key]
-    assert user_creds[secret_key] == aws_secrets_payload["credentials"][secret_key]
+    assert user_creds[access_key] == aws_secrets_payload[access_key]
+    assert user_creds[secret_key] == aws_secrets_payload[secret_key]
 
 
 def test_update_secret_schema(aws_creds_class: AWSCreds) -> None:
diff --git a/api/tests/unit/cloud/test_creds_factory.py b/api/tests/unit/cloud/test_creds_factory.py
index e6ce06db..4f3a7317 100644
--- a/api/tests/unit/cloud/test_creds_factory.py
+++ b/api/tests/unit/cloud/test_creds_factory.py
@@ -2,6 +2,7 @@
 
 import pytest
 
+from src.app.schemas.secret_schema import AWSSecrets
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.cloud.creds_factory import CredsFactory
 from src.app.schemas.creds_verify_schema import CredsVerifySchema
@@ -12,27 +13,19 @@ def test_creds_factory_non_existent_provider_type() -> None:
     """Test that CredsFactory.create_creds_verification() raises a ValueError when invalid provider is provided."""
     # Set provider to non-existent provider
     bad_provider_creds_payload = copy.deepcopy(aws_secrets_payload)
-
-    invalid_creds_verify_schema = CredsVerifySchema.model_validate(
-        bad_provider_creds_payload
-    )
-    # Ignore invalid string assignment since we are triggering a ValueError
-    invalid_creds_verify_schema.provider = "FakeProvider"  # type: ignore
+    aws_secrets = AWSSecrets.model_validate(bad_provider_creds_payload)
+    aws_secrets.provider = "Fake Provider"  # type: ignore
 
     with pytest.raises(ValueError):
         _ = CredsFactory.create_creds_verification(
-            provider=invalid_creds_verify_schema.provider,
-            credentials=invalid_creds_verify_schema.credentials,
+            credentials=aws_secrets,
         )
 
 
 def test_creds_factory_build_aws_creds() -> None:
     """Test that CredsFactory can build an AWSCreds."""
     # Use AWS secrets payload with provider already set to AWS
-    aws_creds = CredsVerifySchema.model_validate(aws_secrets_payload)
-
-    creds_object = CredsFactory.create_creds_verification(
-        provider=aws_creds.provider, credentials=aws_creds.credentials
-    )
+    aws_secrets = AWSSecrets.model_validate(aws_secrets_payload)
+    creds_object = CredsFactory.create_creds_verification(credentials=aws_secrets)
 
     assert type(creds_object) is AWSCreds
diff --git a/api/tests/unit/schemas/test_secret_schema.py b/api/tests/unit/schemas/test_secret_schema.py
index 2b3a8e21..7fe133ab 100644
--- a/api/tests/unit/schemas/test_secret_schema.py
+++ b/api/tests/unit/schemas/test_secret_schema.py
@@ -11,42 +11,38 @@
 def test_aws_secrets_schema_invalid_access_key_length() -> None:
     """Test that the AWS Secrets schema fails when aws_access_key is invalid length."""
     invalid_creds = copy.deepcopy(aws_secrets_payload)
-    invalid_creds["credentials"]["aws_access_key"] = "string"
+    invalid_creds["aws_access_key"] = "string"
 
-    expected_msg = re.compile(r"Invalid credential format", re.IGNORECASE)
+    expected_msg = re.compile(r"Invalid AWS access key format.", re.IGNORECASE)
     with pytest.raises(ValidationError, match=expected_msg):
-        AWSSecrets.model_validate(invalid_creds["credentials"])
+        AWSSecrets.model_validate(invalid_creds)
 
 
 def test_aws_secrets_schema_missing_access_key() -> None:
     """Test that the AWS Secrets schema fails when aws_access_key is missing."""
     invalid_creds = copy.deepcopy(aws_secrets_payload)
-    invalid_creds["credentials"][
-        "aws_access_key"
-    ] = ""  # Empty string = missing access key
+    invalid_creds["aws_access_key"] = ""  # Empty string = missing access key
 
-    expected_msg = re.compile(r"Partial credentials", re.IGNORECASE)
+    expected_msg = re.compile(r"No AWS access key provided.", re.IGNORECASE)
     with pytest.raises(ValidationError, match=expected_msg):
-        AWSSecrets.model_validate(invalid_creds["credentials"])
+        AWSSecrets.model_validate(invalid_creds)
 
 
 def test_aws_secrets_schema_invalid_secret_key_length() -> None:
     """Test that the AWS Secrets schema fails when aws_secret_key is invalid length."""
     invalid_creds = copy.deepcopy(aws_secrets_payload)
-    invalid_creds["credentials"]["aws_secret_key"] = "string"  # noqa: S105
+    invalid_creds["aws_secret_key"] = "string"  # noqa: S105
 
-    expected_msg = re.compile(r"Invalid credential format", re.IGNORECASE)
+    expected_msg = re.compile(r"Invalid AWS secret key format.", re.IGNORECASE)
     with pytest.raises(ValidationError, match=expected_msg):
-        AWSSecrets.model_validate(invalid_creds["credentials"])
+        AWSSecrets.model_validate(invalid_creds)
 
 
 def test_aws_secrets_schema_missing_secret_key() -> None:
     """Test that the AWS Secrets schema fails when aws_secret_key is missing."""
     invalid_creds = copy.deepcopy(aws_secrets_payload)
-    invalid_creds["credentials"][
-        "aws_secret_key"
-    ] = ""  # Empty string = missing secret key
+    invalid_creds["aws_secret_key"] = ""  # Empty string = missing secret key
 
-    expected_msg = re.compile(r"Partial credentials", re.IGNORECASE)
+    expected_msg = re.compile(r"No AWS secret key provided.", re.IGNORECASE)
     with pytest.raises(ValidationError, match=expected_msg):
-        AWSSecrets.model_validate(invalid_creds["credentials"])
+        AWSSecrets.model_validate(invalid_creds)

From ac16d3777ea361a64d6c23857e2f7c8a868cbaaa Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 17:35:41 -0400
Subject: [PATCH 37/43] fix(tests): Fix usage of old CredsVerify Schema to use
 new discriminated union.

---
 api/tests/api_test_utils.py                | 8 ++++++--
 api/tests/conftest.py                      | 6 +++---
 api/tests/unit/cloud/test_creds_factory.py | 1 -
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/api/tests/api_test_utils.py b/api/tests/api_test_utils.py
index 222d21c5..2d1446ae 100644
--- a/api/tests/api_test_utils.py
+++ b/api/tests/api_test_utils.py
@@ -225,7 +225,8 @@ async def is_logged_in(client: AsyncClient) -> bool:
 
 async def add_cloud_credentials(
     auth_client: AsyncClient,
-    credentials: AnySecrets,
+    provider: OpenLabsProvider,
+    credentials: dict[str, Any],
 ) -> bool:
     """Add cloud credentials to the authenticated client's account.
 
@@ -246,6 +247,9 @@ async def add_cloud_credentials(
         logger.error("Failed to add cloud credentials. Payload empty!")
         return False
 
+    credentials_payload = credentials
+    credentials_payload["provider"] = provider
+
     # Verify we are logged in
     logged_in = await is_logged_in(auth_client)
     if not logged_in:
@@ -256,7 +260,7 @@ async def add_cloud_credentials(
 
     # Submit credentials
     response = await auth_client.post(
-        f"{base_route}/users/me/secrets", json=credentials.model_dump(mode="json")
+        f"{base_route}/users/me/secrets", json=credentials_payload
     )
     if response.status_code != status.HTTP_200_OK:
         logger.error(
diff --git a/api/tests/conftest.py b/api/tests/conftest.py
index 5867dde9..4601f9c9 100644
--- a/api/tests/conftest.py
+++ b/api/tests/conftest.py
@@ -36,7 +36,7 @@
     DeployedRangeCreateSchema,
     DeployedRangeSchema,
 )
-from src.app.schemas.secret_schema import AnySecrets, SecretSchema
+from src.app.schemas.secret_schema import SecretSchema
 from src.app.utils.api_utils import get_api_base_route
 from src.app.utils.cdktf_utils import create_cdktf_dir
 from src.app.utils.path_utils import find_git_root
@@ -564,8 +564,8 @@ async def provider_deployed_ranges_for_provider(
             creds = get_provider_test_creds(provider)
             if not creds:
                 pytest.skip(f"Credentials for {provider_upper} not set.")
-            creds = AnySecrets.model_validate(**creds, provider=provider)
-            added_creds = await add_cloud_credentials(client, creds)
+
+            added_creds = await add_cloud_credentials(client, provider, creds)
             if not added_creds:
                 pytest.fail(f"Failed configure cloud credentials for {provider_upper}")
 
diff --git a/api/tests/unit/cloud/test_creds_factory.py b/api/tests/unit/cloud/test_creds_factory.py
index 4f3a7317..1e76746a 100644
--- a/api/tests/unit/cloud/test_creds_factory.py
+++ b/api/tests/unit/cloud/test_creds_factory.py
@@ -5,7 +5,6 @@
 from src.app.schemas.secret_schema import AWSSecrets
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.cloud.creds_factory import CredsFactory
-from src.app.schemas.creds_verify_schema import CredsVerifySchema
 from tests.common.api.v1.config import aws_secrets_payload
 
 

From 8c9136f021ddc01f6533f332c2f4983f1097b8b8 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 17:47:42 -0400
Subject: [PATCH 38/43] fix(secrets verification): Ruff fixes.

---
 api/src/app/cloud/creds_factory.py            | 2 +-
 api/tests/api_test_utils.py                   | 1 -
 api/tests/integration/cloud/test_aws_creds.py | 5 ++++-
 api/tests/unit/cloud/test_aws_creds.py        | 2 +-
 api/tests/unit/cloud/test_creds_factory.py    | 2 +-
 5 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/api/src/app/cloud/creds_factory.py b/api/src/app/cloud/creds_factory.py
index af9f5d90..0efdf92d 100644
--- a/api/src/app/cloud/creds_factory.py
+++ b/api/src/app/cloud/creds_factory.py
@@ -1,10 +1,10 @@
 import logging
 from typing import ClassVar, Type
 
-from src.app.schemas.secret_schema import AnySecrets
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.cloud.base_creds import AbstractBaseCreds
 from src.app.enums.providers import OpenLabsProvider
+from src.app.schemas.secret_schema import AnySecrets
 
 # Configure logging
 logger = logging.getLogger(__name__)
diff --git a/api/tests/api_test_utils.py b/api/tests/api_test_utils.py
index 2d1446ae..797417f5 100644
--- a/api/tests/api_test_utils.py
+++ b/api/tests/api_test_utils.py
@@ -9,7 +9,6 @@
 from fastapi import status
 from httpx import AsyncClient
 
-from src.app.schemas.secret_schema import AnySecrets
 from src.app.enums.job_status import OpenLabsJobStatus
 from src.app.enums.providers import OpenLabsProvider
 from src.app.enums.regions import OpenLabsRegion
diff --git a/api/tests/integration/cloud/test_aws_creds.py b/api/tests/integration/cloud/test_aws_creds.py
index cb8d4dfd..ff6741eb 100644
--- a/api/tests/integration/cloud/test_aws_creds.py
+++ b/api/tests/integration/cloud/test_aws_creds.py
@@ -9,6 +9,7 @@
 from botocore.exceptions import ClientError
 
 from src.app.cloud.aws_creds import AWSCreds
+from src.app.schemas.secret_schema import AWSSecrets
 from tests.aws_test_utils import set_test_boto_creds
 
 from .aws_config import VERIFY_CREDS_TEST_CASES
@@ -56,6 +57,7 @@ def all_test_credentials(
 
             # Store credentials for the test to use
             credentials_by_id[test_id] = {
+                "provider": "aws",
                 "aws_access_key": access_key["AccessKeyId"],
                 "aws_secret_key": access_key["SecretAccessKey"],
             }
@@ -118,8 +120,9 @@ def test_verify_aws_creds(
     """Test the AWS verify_creds method with various scenarios."""
     # The test now receives exactly the arguments it needs. No unpacking!
     credentials = all_test_credentials[test_id]
+    aws_creds = AWSSecrets.model_validate(credentials)
 
-    aws_verifier = AWSCreds(credentials=credentials)
+    aws_verifier = AWSCreds(credentials=aws_creds)
     is_valid, message_schema = aws_verifier.verify_creds()
 
     assert is_valid is expected_result
diff --git a/api/tests/unit/cloud/test_aws_creds.py b/api/tests/unit/cloud/test_aws_creds.py
index ac48093b..256b6907 100644
--- a/api/tests/unit/cloud/test_aws_creds.py
+++ b/api/tests/unit/cloud/test_aws_creds.py
@@ -1,6 +1,6 @@
 import pytest
-from pytest_mock import MockerFixture
 from botocore.exceptions import ClientError
+from pytest_mock import MockerFixture
 
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.schemas.secret_schema import AWSSecrets, SecretSchema
diff --git a/api/tests/unit/cloud/test_creds_factory.py b/api/tests/unit/cloud/test_creds_factory.py
index 1e76746a..f0366836 100644
--- a/api/tests/unit/cloud/test_creds_factory.py
+++ b/api/tests/unit/cloud/test_creds_factory.py
@@ -2,9 +2,9 @@
 
 import pytest
 
-from src.app.schemas.secret_schema import AWSSecrets
 from src.app.cloud.aws_creds import AWSCreds
 from src.app.cloud.creds_factory import CredsFactory
+from src.app.schemas.secret_schema import AWSSecrets
 from tests.common.api.v1.config import aws_secrets_payload
 
 

From 22551ddb6cb383866c86898343777c4661c4178c Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 19:18:08 -0400
Subject: [PATCH 39/43] fix:(cli): Updated cli to use updated credential
 payload.

---
 cli/internal/client/auth.go | 62 +++++++++++++++++++++++--------------
 1 file changed, 39 insertions(+), 23 deletions(-)

diff --git a/cli/internal/client/auth.go b/cli/internal/client/auth.go
index f6db6f12..843f5832 100644
--- a/cli/internal/client/auth.go
+++ b/cli/internal/client/auth.go
@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"regexp"
+	"strings"
 
 	"github.com/OpenLabsHQ/OpenLabs/cli/internal/logger"
 )
@@ -114,40 +116,56 @@ func (c *Client) GetUserSecrets() (*UserSecretResponse, error) {
 	return &secrets, nil
 }
 
-type AWSCredentials struct {
+type AWSSecretsPayload struct {
+	Provider  string `json:"provider"`
 	AccessKey string `json:"aws_access_key"`
 	SecretKey string `json:"aws_secret_key"`
 }
 
-type AWSSecretsPayload struct {
-	Provider    string         `json:"provider"`
-	Credentials AWSCredentials `json:"credentials"`
-}
-
-type AzureCredentials struct {
+type AzureSecretsPayload struct {
+	Provider       string `json:"provider"`
 	ClientID       string `json:"azure_client_id"`
 	ClientSecret   string `json:"azure_client_secret"`
 	TenantID       string `json:"azure_tenant_id"`
 	SubscriptionID string `json:"azure_subscription_id"`
 }
 
-type AzureSecretsPayload struct {
-	Provider    string           `json:"provider"`
-	Credentials AzureCredentials `json:"credentials"`
+// ParseValidationErrors extracts and cleans user-facing messages from a validation error string.
+func ParseValidationErrors(errString string) string {
+	re := regexp.MustCompile(`msg:(.*?) type:`)
+	matches := re.FindAllStringSubmatch(errString, -1)
+
+	if len(matches) == 0 {
+		return errString
+	}
+
+	var errorMessages []string
+	for _, match := range matches {
+		if len(match) > 1 {
+			message := strings.TrimSpace(match[1])
+			message = strings.TrimSuffix(message, ",")
+
+			// **This is the new line to remove the prefix**
+			message = strings.TrimPrefix(message, "Value error, ")
+
+			errorMessages = append(errorMessages, message)
+		}
+	}
+
+	return strings.Join(errorMessages, "; ")
 }
 
 func (c *Client) UpdateAWSSecrets(accessKey, secretKey string) error {
 	payload := AWSSecretsPayload{
-		Provider: "aws",
-		Credentials: AWSCredentials{
-			AccessKey: accessKey,
-			SecretKey: secretKey,
-		},
+		Provider:  "aws",
+		AccessKey: accessKey,
+		SecretKey: secretKey,
 	}
 
 	var response Message
 	if err := c.makeRequest("POST", "/api/v1/users/me/secrets", payload, &response); err != nil {
-		return fmt.Errorf("failed to update AWS secrets: %w", err)
+		message := ParseValidationErrors(err.Error())
+		return fmt.Errorf("failed to update AWS secrets: %s", message)
 	}
 
 	return nil
@@ -155,13 +173,11 @@ func (c *Client) UpdateAWSSecrets(accessKey, secretKey string) error {
 
 func (c *Client) UpdateAzureSecrets(clientID, clientSecret, tenantID, subscriptionID string) error {
 	payload := AzureSecretsPayload{
-		Provider: "azure",
-		Credentials: AzureCredentials{
-			ClientID:       clientID,
-			ClientSecret:   clientSecret,
-			TenantID:       tenantID,
-			SubscriptionID: subscriptionID,
-		},
+		Provider:       "azure",
+		ClientID:       clientID,
+		ClientSecret:   clientSecret,
+		TenantID:       tenantID,
+		SubscriptionID: subscriptionID,
 	}
 
 	var response Message

From 89a90d9db33f5967e22f6a72d8d588d4e52dbc23 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Sun, 3 Aug 2025 19:20:10 -0400
Subject: [PATCH 40/43] fix(frontend): Updated endpoint calls to use new
 credential payload.

---
 frontend/src/lib/api.ts                   | 9 ++-------
 frontend/src/lib/types/api.ts             | 4 ----
 frontend/src/routes/settings/+page.svelte | 4 +++-
 3 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index f8b3fb0a..44f86ff9 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -14,7 +14,6 @@ import type {
   BlueprintRange,
   PasswordUpdateRequest,
   PasswordUpdateResponse,
-  SecretsRequest,
   SecretsResponse,
   DeployRangeRequest
 } from '$lib/types/api'
@@ -160,15 +159,11 @@ export const userApi = {
     )
   },
 
-  updateSecrets: async (credentialprovider: string, payload: any): Promise<ApiResponse<SecretsResponse>> => {
-    const request: SecretsRequest = {
-      provider: credentialprovider,
-      credentials: payload,
-    }
+  updateSecrets: async (payload: any): Promise<ApiResponse<SecretsResponse>> => {
     return await apiRequest<SecretsResponse>(
       '/api/v1/users/me/secrets',
       'POST',
-      request
+      payload
     )
   },
 }
diff --git a/frontend/src/lib/types/api.ts b/frontend/src/lib/types/api.ts
index faf56e69..9fe4619e 100644
--- a/frontend/src/lib/types/api.ts
+++ b/frontend/src/lib/types/api.ts
@@ -192,10 +192,6 @@ export interface PasswordUpdateResponse {
 }
 
 // Secrets verification response
-export interface SecretsRequest {
-  provider: string;
-  credentials: any;
-}
 export interface SecretsResponse {
   message: string;
 }
diff --git a/frontend/src/routes/settings/+page.svelte b/frontend/src/routes/settings/+page.svelte
index 90054d57..d676f92e 100644
--- a/frontend/src/routes/settings/+page.svelte
+++ b/frontend/src/routes/settings/+page.svelte
@@ -184,7 +184,7 @@
 
     try {
       // Call single, common endpoint
-      const result = await userApi.updateSecrets(provider, payload)
+      const result = await userApi.updateSecrets(payload)
 
       if (result.error) {
         if (provider === 'aws') awsError = result.error
@@ -228,6 +228,7 @@
     
     // Construct the AWS-specific payload
     const payload = {
+        provider: "aws",
         aws_access_key: awsAccessKey,
         aws_secret_key: awsSecretKey,
     }
@@ -252,6 +253,7 @@
     
     // Construct the Azure-specific payload
     const payload = {
+        provider: "azure",
         azure_client_id: azureClientId,
         azure_client_secret: azureClientSecret,
         azure_tenant_id: azureTenantId,

From 687218295c4fb7a43ad72602d38a75ea58809eaf Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Tue, 5 Aug 2025 21:46:51 -0400
Subject: [PATCH 41/43] fix(schemas): Updated error message for aws secrets
 validators.

---
 api/src/app/schemas/secret_schema.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/api/src/app/schemas/secret_schema.py b/api/src/app/schemas/secret_schema.py
index eba78cee..37a4f6ae 100644
--- a/api/src/app/schemas/secret_schema.py
+++ b/api/src/app/schemas/secret_schema.py
@@ -93,10 +93,10 @@ def validate_access_key(cls, aws_access_key: str) -> str:
         """
         access_key_length = 20
         if len(aws_access_key.strip()) == 0:
-            msg = "No AWS access key provided. Please ensure you are providing proper AWS credentials."
+            msg = "No AWS access key provided."
             raise ValueError(msg)
         if len(aws_access_key.strip()) != access_key_length:
-            msg = "Invalid AWS access key format. Please ensure your AWS credentials are of proper length."
+            msg = "Invalid AWS access key format."
             raise ValueError(msg)
         return aws_access_key
 
@@ -117,10 +117,10 @@ def validate_secret_key(cls, aws_secret_key: str) -> str:
         """
         secret_key_length = 40
         if len(aws_secret_key.strip()) == 0:
-            msg = "No AWS secret key provided. Please ensure you are providing proper AWS credentials."
+            msg = "No AWS secret key provided."
             raise ValueError(msg)
         if len(aws_secret_key.strip()) != secret_key_length:
-            msg = "Invalid AWS secret key format. Please ensure your AWS credentials are of proper length."
+            msg = "Invalid AWS secret key format."
             raise ValueError(msg)
         return aws_secret_key
 

From d6adab55ede1fe35dc140f266763e5be343c0c5e Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Tue, 5 Aug 2025 21:47:36 -0400
Subject: [PATCH 42/43] feat(frontend): Added additional parsing for pydantic
 validation errors when submitting credentials to properly extract and return
 the error messages to the user.

---
 frontend/src/lib/utils/error.ts           |  12 ++
 frontend/src/routes/settings/+page.svelte | 144 +++++++++++-----------
 2 files changed, 86 insertions(+), 70 deletions(-)

diff --git a/frontend/src/lib/utils/error.ts b/frontend/src/lib/utils/error.ts
index 12389dd1..b3f032d7 100644
--- a/frontend/src/lib/utils/error.ts
+++ b/frontend/src/lib/utils/error.ts
@@ -49,6 +49,18 @@ export function formatErrorMessage(error: unknown, fallbackMessage: string = 'An
   return fallbackMessage
 }
 
+// Used specifically for pydantic errors thrown back to the user at the endpoint before the endpoint function is executed
+export function extractPydanticErrors(error: any): string {
+  let errorObj = error;
+
+  // 2. Map over the array to get just the 'msg' string from each object.
+  const messages = errorObj.map((err: any) =>err.msg.replace(/^Value error,\s*/i, ''))
+
+  // 3. Join the array of messages into a single string, separated by newlines.
+  return messages.join('\n');
+}
+
+
 /**
  * Creates a safe error handler function that always returns a string
  * @param fallbackMessage - Default message for unhandled errors
diff --git a/frontend/src/routes/settings/+page.svelte b/frontend/src/routes/settings/+page.svelte
index d676f92e..0dbed19a 100644
--- a/frontend/src/routes/settings/+page.svelte
+++ b/frontend/src/routes/settings/+page.svelte
@@ -6,6 +6,7 @@
   import LoadingSpinner from '$lib/components/LoadingSpinner.svelte'
   import { fade } from 'svelte/transition'
   import logger from '$lib/utils/logger'
+  import { extractPydanticErrors } from '$lib/utils/error'
 
   // Active tab state
   let activeTab: 'aws' | 'azure' = 'aws'
@@ -185,10 +186,17 @@
     try {
       // Call single, common endpoint
       const result = await userApi.updateSecrets(payload)
+      let errorMsg = ""
 
       if (result.error) {
-        if (provider === 'aws') awsError = result.error
-        else azureError = result.error
+        if (typeof result.error === 'object'){ // Pydantic validation error
+          const formattedError = extractPydanticErrors(result.error)
+          errorMsg = formattedError
+          errorMsg = `${errorMsg}\nPlease ensure you are providing proper AWS credentials.`
+        }
+        else errorMsg = result.error
+        if (provider === 'aws') awsError = errorMsg
+        else azureError = errorMsg
         return
       }
 
@@ -436,77 +444,73 @@
             <!-- Tab Content -->
             <div class="pt-4" style="min-height: 380px;">
               {#if activeTab === 'aws'}
-                <div transition:fade={{ duration: 150, delay: 100 }}>
-                  <div class="mb-4 flex items-center justify-between">
-                    <h3 class="text-xl font-medium">AWS Credentials</h3>
-                    <span
-                      role="status"
-                      aria-label={secretsStatus.aws.configured ? formatDateForTooltip(secretsStatus.aws.createdAt) : 'AWS credentials not configured'}
-                      class={`${secretsStatus.aws.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
-                      on:mouseenter={handleMouseEnter}
-                      on:mouseleave={handleMouseLeave}
-                    >
-                      {secretsStatus.aws.configured ? 'Configured' : 'Not Configured'}
-                    </span>
-                  </div>
-                  <form on:submit|preventDefault={handleAwsSecretsUpdate} class="space-y-4">
-                    <div>
-                      <label for="aws-access-key" class="mb-1 block text-sm font-medium text-gray-300">Access Key</label>
-                      <input id="aws-access-key" type="text" bind:value={awsAccessKey} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-yellow-500" placeholder="Enter AWS Access Key" />
-                    </div>
-                    <div>
-                      <label for="aws-secret-key" class="mb-1 block text-sm font-medium text-gray-300">Secret Key</label>
-                      <input id="aws-secret-key" type="password" bind:value={awsSecretKey} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-yellow-500" placeholder="Enter AWS Secret Key" />
-                    </div>
-                    {#if awsError}<div class="text-sm text-red-500">{awsError}</div>{/if}
-                    {#if awsSuccess}<div class="text-sm text-green-500">{awsSuccess}</div>{/if}
-                    <div class="pt-4">
-                      <button type="submit" disabled={isAwsLoading} class="w-full rounded-md bg-yellow-600 px-4 py-2 font-medium text-white hover:bg-yellow-700 focus:outline-none focus:ring-2 focus:ring-yellow-500 focus:ring-offset-2 focus:ring-offset-gray-900 disabled:cursor-not-allowed disabled:opacity-50">
-                        {#if isAwsLoading}<span class="mr-2 inline-block"><LoadingSpinner size="sm" color="white" /></span>Updating...{:else}{secretsStatus.aws.configured ? 'Update' : 'Set'} AWS Credentials{/if}
-                      </button>
-                    </div>
-                  </form>
+                <div class="mb-4 flex items-center justify-between">
+                  <h3 class="text-xl font-medium">AWS Credentials</h3>
+                  <span
+                    role="status"
+                    aria-label={secretsStatus.aws.configured ? formatDateForTooltip(secretsStatus.aws.createdAt) : 'AWS credentials not configured'}
+                    class={`${secretsStatus.aws.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
+                    on:mouseenter={handleMouseEnter}
+                    on:mouseleave={handleMouseLeave}
+                  >
+                    {secretsStatus.aws.configured ? 'Configured' : 'Not Configured'}
+                  </span>
                 </div>
-              {:else if activeTab === 'azure'}
-                <div transition:fade={{ duration: 150, delay: 100 }}>
-                   <div class="mb-4 flex items-center justify-between">
-                    <h3 class="text-xl font-medium">Azure Credentials</h3>
-                    <span
-                      role="status"
-                      aria-label={secretsStatus.azure.configured ? formatDateForTooltip(secretsStatus.azure.createdAt) : 'Azure credentials not configured'}
-                      class={`${secretsStatus.azure.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
-                      on:mouseenter={handleMouseEnter}
-                      on:mouseleave={handleMouseLeave}
-                    >
-                      {secretsStatus.azure.configured ? 'Configured' : 'Not Configured'}
-                    </span>
+                <form on:submit|preventDefault={handleAwsSecretsUpdate} class="space-y-4">
+                  <div>
+                    <label for="aws-access-key" class="mb-1 block text-sm font-medium text-gray-300">Access Key</label>
+                    <input id="aws-access-key" type="text" bind:value={awsAccessKey} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-yellow-500" placeholder="Enter AWS Access Key" />
                   </div>
-                  <form on:submit|preventDefault={handleAzureSecretsUpdate} class="space-y-4">
-                     <div>
-                      <label for="azure-client-id" class="mb-1 block text-sm font-medium text-gray-300">Client ID</label>
-                      <input id="azure-client-id" type="text" bind:value={azureClientId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Client ID" />
-                    </div>
-                    <div>
-                      <label for="azure-client-secret" class="mb-1 block text-sm font-medium text-gray-300">Client Secret</label>
-                      <input id="azure-client-secret" type="password" bind:value={azureClientSecret} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Client Secret" />
-                    </div>
-                    <div>
-                      <label for="azure-tenant-id" class="mb-1 block text-sm font-medium text-gray-300">Tenant ID</label>
-                      <input id="azure-tenant-id" type="text" bind:value={azureTenantId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Tenant ID" />
-                    </div>
-                    <div>
-                      <label for="azure-subscription-id" class="mb-1 block text-sm font-medium text-gray-300">Subscription ID</label>
-                      <input id="azure-subscription-id" type="text" bind:value={azureSubscriptionId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Subscription ID" />
-                    </div>
-                    {#if azureError}<div class="text-sm text-red-500">{azureError}</div>{/if}
-                    {#if azureSuccess}<div class="text-sm text-green-500">{azureSuccess}</div>{/if}
-                    <div class="pt-4">
-                       <button type="submit" disabled={isAzureLoading} class="w-full rounded-md bg-blue-600 px-4 py-2 font-medium text-white hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-gray-900 disabled:cursor-not-allowed disabled:opacity-50">
-                        {#if isAzureLoading}<span class="mr-2 inline-block"><LoadingSpinner size="sm" color="white" /></span>Updating...{:else}{secretsStatus.azure.configured ? 'Update' : 'Set'} Azure Credentials{/if}
-                      </button>
-                    </div>
-                  </form>
+                  <div>
+                    <label for="aws-secret-key" class="mb-1 block text-sm font-medium text-gray-300">Secret Key</label>
+                    <input id="aws-secret-key" type="password" bind:value={awsSecretKey} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-yellow-500" placeholder="Enter AWS Secret Key" />
+                  </div>
+                  {#if awsError}<div class="text-sm text-red-500">{awsError}</div>{/if}
+                  {#if awsSuccess}<div class="text-sm text-green-500">{awsSuccess}</div>{/if}
+                  <div class="pt-4">
+                    <button type="submit" disabled={isAwsLoading} class="w-full rounded-md bg-yellow-600 px-4 py-2 font-medium text-white hover:bg-yellow-700 focus:outline-none focus:ring-2 focus:ring-yellow-500 focus:ring-offset-2 focus:ring-offset-gray-900 disabled:cursor-not-allowed disabled:opacity-50">
+                      {#if isAwsLoading}<span class="mr-2 inline-block"><LoadingSpinner size="sm" color="white" /></span>Updating...{:else}{secretsStatus.aws.configured ? 'Update' : 'Set'} AWS Credentials{/if}
+                    </button>
+                  </div>
+                </form>
+              {:else if activeTab === 'azure'}
+                  <div class="mb-4 flex items-center justify-between">
+                  <h3 class="text-xl font-medium">Azure Credentials</h3>
+                  <span
+                    role="status"
+                    aria-label={secretsStatus.azure.configured ? formatDateForTooltip(secretsStatus.azure.createdAt) : 'Azure credentials not configured'}
+                    class={`${secretsStatus.azure.configured ? 'bg-green-500' : 'bg-gray-500'} relative cursor-pointer rounded-full px-2 py-1 text-xs font-semibold`}
+                    on:mouseenter={handleMouseEnter}
+                    on:mouseleave={handleMouseLeave}
+                  >
+                    {secretsStatus.azure.configured ? 'Configured' : 'Not Configured'}
+                  </span>
                 </div>
+                <form on:submit|preventDefault={handleAzureSecretsUpdate} class="space-y-4">
+                    <div>
+                    <label for="azure-client-id" class="mb-1 block text-sm font-medium text-gray-300">Client ID</label>
+                    <input id="azure-client-id" type="text" bind:value={azureClientId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Client ID" />
+                  </div>
+                  <div>
+                    <label for="azure-client-secret" class="mb-1 block text-sm font-medium text-gray-300">Client Secret</label>
+                    <input id="azure-client-secret" type="password" bind:value={azureClientSecret} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Client Secret" />
+                  </div>
+                  <div>
+                    <label for="azure-tenant-id" class="mb-1 block text-sm font-medium text-gray-300">Tenant ID</label>
+                    <input id="azure-tenant-id" type="text" bind:value={azureTenantId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Tenant ID" />
+                  </div>
+                  <div>
+                    <label for="azure-subscription-id" class="mb-1 block text-sm font-medium text-gray-300">Subscription ID</label>
+                    <input id="azure-subscription-id" type="text" bind:value={azureSubscriptionId} class="w-full rounded-md border border-gray-600 bg-gray-800 px-3 py-2 text-white focus:outline-none focus:ring-2 focus:ring-blue-500" placeholder="Enter Azure Subscription ID" />
+                  </div>
+                  {#if azureError}<div class="text-sm text-red-500">{azureError}</div>{/if}
+                  {#if azureSuccess}<div class="text-sm text-green-500">{azureSuccess}</div>{/if}
+                  <div class="pt-4">
+                      <button type="submit" disabled={isAzureLoading} class="w-full rounded-md bg-blue-600 px-4 py-2 font-medium text-white hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-gray-900 disabled:cursor-not-allowed disabled:opacity-50">
+                      {#if isAzureLoading}<span class="mr-2 inline-block"><LoadingSpinner size="sm" color="white" /></span>Updating...{:else}{secretsStatus.azure.configured ? 'Update' : 'Set'} Azure Credentials{/if}
+                    </button>
+                  </div>
+                </form>
               {/if}
             </div>
           </div>

From cc8d069f51bbb935107f91e48833d3f76dc01ab5 Mon Sep 17 00:00:00 2001
From: Nareshp1 <nareshp0331@yahoo.com>
Date: Tue, 5 Aug 2025 21:49:47 -0400
Subject: [PATCH 43/43] spacing fix.

---
 frontend/src/lib/utils/error.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/lib/utils/error.ts b/frontend/src/lib/utils/error.ts
index b3f032d7..c09bfd1b 100644
--- a/frontend/src/lib/utils/error.ts
+++ b/frontend/src/lib/utils/error.ts
@@ -54,7 +54,7 @@ export function extractPydanticErrors(error: any): string {
   let errorObj = error;
 
   // 2. Map over the array to get just the 'msg' string from each object.
-  const messages = errorObj.map((err: any) =>err.msg.replace(/^Value error,\s*/i, ''))
+  const messages = errorObj.map((err: any) => err.msg.replace(/^Value error,\s*/i, ''))
 
   // 3. Join the array of messages into a single string, separated by newlines.
   return messages.join('\n');