Credentials: Using Hard Delete & Updating is_active logic

backend/app/alembic/versions/27c271ab6dd0_drop_deleted_at_credentials.py

@@ -0,0 +1,37 @@
+"""drop column deleted_at from credentials
+
+Revision ID: 27c271ab6dd0
+Revises: 93d484f5798e
+Create Date: 2025-10-15 11:10:02.554097
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = "27c271ab6dd0"
+down_revision = "93d484f5798e"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # Drop only deleted_at column from credential table, keep is_active for flexibility
+    op.drop_column("credential", "deleted_at")
+
+    # Add unique constraint on organization_id, project_id, provider
+    op.create_unique_constraint(
+        "uq_credential_org_project_provider",
+        "credential",
+        ["organization_id", "project_id", "provider"],
+    )
+
+
+def downgrade():
+    # Add back deleted_at column to credential table
+    op.add_column("credential", sa.Column("deleted_at", sa.DateTime(), nullable=True))
+
+    # Drop the unique constraint
+    op.drop_constraint(
+        "uq_credential_org_project_provider", "credential", type_="unique"
+    )

backend/app/api/routes/credentials.py

@@ -3,18 +3,18 @@
 from fastapi import APIRouter, Depends
 
 from app.api.deps import SessionDep, get_current_user_org_project
+from app.core.exception_handlers import HTTPException
+from app.core.providers import validate_provider
 from app.crud.credentials import (
     get_creds_by_org,
     get_provider_credential,
     remove_creds_for_org,
+    remove_provider_credential,
     set_creds_for_org,
     update_creds_for_org,
-    remove_provider_credential,
 )
 from app.models import CredsCreate, CredsPublic, CredsUpdate, UserProjectOrg
 from app.utils import APIResponse
-from app.core.providers import validate_provider
-from app.core.exception_handlers import HTTPException
 
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/credentials", tags=["credentials"])
@@ -33,28 +33,8 @@ def create_new_credential(
     _current_user: UserProjectOrg = Depends(get_current_user_org_project),
 ):
     # Project comes from API key context; no cross-org check needed here
+    # Database unique constraint ensures no duplicate credentials per provider-org-project combination
 
-    # Prevent duplicate credentials
-    for provider in creds_in.credential.keys():
-        existing_cred = get_provider_credential(
-            session=session,
-            org_id=_current_user.organization_id,
-            provider=provider,
-            project_id=_current_user.project_id,
-        )
-        if existing_cred:
-            logger.warning(
-                f"[create_new_credential] Credentials for provider already exist | organization_id: {_current_user.organization_id}, project_id: {_current_user.project_id}, provider: {provider}"
-            )
-            raise HTTPException(
-                status_code=400,
-                detail=(
-                    f"Credentials for provider '{provider}' already exist "
-                    f"for this organization and project combination"
-                ),
-            )
-
-    # Create credentials
     created_creds = set_creds_for_org(
         session=session,
         creds_add=creds_in,
@@ -86,12 +66,6 @@ def read_credential(
         org_id=_current_user.organization_id,
         project_id=_current_user.project_id,
     )
-    if not creds:
-        logger.error(
-            f"[read_credential] No credentials found | organization_id: {_current_user.organization_id}, project_id: {_current_user.project_id}"
-        )
-        raise HTTPException(status_code=404, detail="Credentials not found")
-
     return APIResponse.success_response([cred.to_public() for cred in creds])
 
 
@@ -114,9 +88,6 @@ def read_provider_credential(
         provider=provider_enum,
         project_id=_current_user.project_id,
     )
-    if credential is None:
-        raise HTTPException(status_code=404, detail="Provider credentials not found")
-
     return APIResponse.success_response(credential)
 
 
@@ -165,18 +136,6 @@ def delete_provider_credential(
     _current_user: UserProjectOrg = Depends(get_current_user_org_project),
 ):
     provider_enum = validate_provider(provider)
-    provider_creds = get_provider_credential(
-        session=session,
-        org_id=_current_user.organization_id,
-        provider=provider_enum,
-        project_id=_current_user.project_id,
-    )
-    if provider_creds is None:
-        logger.error(
-            f"[delete_provider_credential] Provider credentials not found | organization_id: {_current_user.organization_id}, provider: {provider}, project_id: {_current_user.project_id}"
-        )
-        raise HTTPException(status_code=404, detail="Provider credentials not found")
-
     remove_provider_credential(
         session=session,
         org_id=_current_user.organization_id,
@@ -193,25 +152,18 @@ def delete_provider_credential(
     "/",
     response_model=APIResponse[dict],
     summary="Delete all credentials for current org and project",
-    description="Removes all credentials for the caller's organization and project. This is a soft delete operation that marks credentials as inactive.",
+    description="Removes all credentials for the caller's organization and project. This is a hard delete operation that permanently removes credentials from the database.",
 )
 def delete_all_credentials(
     *,
     session: SessionDep,
     _current_user: UserProjectOrg = Depends(get_current_user_org_project),
 ):
-    creds = remove_creds_for_org(
+    remove_creds_for_org(
         session=session,
         org_id=_current_user.organization_id,
         project_id=_current_user.project_id,
     )
-    if not creds:
-        logger.error(
-            f"[delete_all_credentials] Credentials not found | organization_id: {_current_user.organization_id}, project_id: {_current_user.project_id}"
-        )
-        raise HTTPException(
-            status_code=404, detail="Credentials for organization/project not found"
-        )
 
     return APIResponse.success_response(
         {"message": "All credentials deleted successfully"}