mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-25 00:51:28 +02:00
8643faeed5
The OpenAPI change is the 422 both provider routes can now answer, plus what decides it: the create path checks the pair before storing, the update path checks only when the upstream or the key moved, and an update omitting the key is checked against the stored one. The live tests cover what a unit test structurally cannot. Mocked refusals prove the classifier maps a status to a message; they cannot show that these vendors refuse a bad key on their listing endpoint at all, which is the assumption the feature rests on. The good-key case earns its place beside the bad one — a check that refused everything would satisfy a test asserting only the refusal. The rotation case pins the state worth the most: after a rejected key, an edit that reuses the stored one still passes. The API never returns a key, so that is the only way to show the working credential is still there.