TSYS Group COO
f638105614
CRITICAL FIX: The --enable-2fa flow was creating duplicate BW items
instead of updating in place, which led to ambiguous item resolution
and data integrity issues. This was a severe failure in core
credential lifecycle operations.
Changes:
- bw_helper.py: Complete rewrite with safety guarantees
- update_item(): modifies existing item in place by ID, preserves
all fields not being updated
- create_item(): refuses to create duplicates (raises if item exists)
- get_item_id(): resolves name to ID, raises on ambiguous matches
- get_item(): returns full item JSON
- NO delete_item method exists by design -- credential deletion
is a manual operation only
- provision-agent.py: --enable-2fa now uses update_item() instead
of create_item() to add TOTP to existing credentials
- Dockerfile: non-root user with correct BW state directory ownership
- docker-compose.yml: bind mount for BW state (proper permissions)
- test_bw_helper.py: 10 tests covering full lifecycle
(create, read, duplicate rejection, update password, update TOTP,
field preservation, no-delete verification)
Tests 1-4 verified passing against live Vaultwarden instance.
- requirements.txt: added pytest
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
14 lines
533 B
Markdown
14 lines
533 B
Markdown
# WORKING.md — Active Session Tracker
|
|
|
|
Agent work only. User actions (deploy, review, UAT) are NOT tracked here.
|
|
The human decides when the work is "done".
|
|
|
|
## Current Tasks
|
|
|
|
- [ ] Add update_item() to bw_helper.py (root cause of credential deletion)
|
|
- [ ] Fix --enable-2fa to update item in place, never create duplicates
|
|
- [ ] Add duplicate-prevention safeguard to create_item()
|
|
- [ ] Write credential lifecycle tests (create, read, update, never delete)
|
|
- [ ] Verify 2FA is enabled and working end-to-end
|
|
- [ ] Update STATUS.md
|