[BUG] Requesting `/secrets/?....` should return same response as `/secrets?...`

[ahsanu123]

Short Explanation

I was trying to explore Azure Key Vault with floci-az (dotnet c# client), it was working in SecretClient level, but when trying to add dotnet configuration from keyvault with

   builder.Configuration.AddAzureKeyVault(secretClient, new AzureKeyVaultConfigurationOptions());

it fail to list all secret from /secrets/ endpoint, as far as i understand, internally C# azure library will concat /secrets/ with ?api-version=...., it work without slash / but azure dotnet source code was use slash /

 // internally AddAzureKeyVault() is calling this 
 public Uri CreateFirstPageUri(string path)
    {
        RequestUriBuilder requestUriBuilder = new RequestUriBuilder();
        requestUriBuilder.Reset(VaultUri);
        requestUriBuilder.AppendPath(path, escape: false);
        requestUriBuilder.AppendQuery("api-version", ApiVersion);
        return requestUriBuilder.ToUri();
    }


public virtual Pageable<SecretProperties> GetPropertiesOfSecrets(CancellationToken cancellationToken = default(CancellationToken))
    {
        Uri firstPageUri = _pipeline.CreateFirstPageUri("/secrets/");
        return PageResponseEnumerator.CreateEnumerable((string? nextLink) => _pipeline.GetPage(firstPageUri, nextLink, () => new SecretProperties(), "SecretClient.GetPropertiesOfSecrets", cancellationToken));
    }

• Secret Client Source -> https://github.com/Azure/azure-sdk-for-net/blob/Azure.Security.KeyVault.Secrets_4.11.0/sdk/keyvault/Azure.Security.KeyVault.Secrets/src/SecretClient.cs#L303
• KeyVaultPipeLine -> https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/keyvault/Azure.Security.KeyVault.Shared/src/KeyVaultPipeline.cs

Service

KeyVault

Azure API Action

Expected behavior

requesting /secrets/?.... should return same as /secrets?....

PS  > curl.exe -k `
>>   -H "Authorization: Bearer $token" `
>>   "https://localhost:4577/devstoreaccount1-keyvault/secrets?api-version=7.4"
{"value":[{"id":"https://devstoreaccount1.vault.azure.net/secrets/asdf","attributes":{"enabled":true,"nbf":null,"exp":null,"created":1787905426,"updated":1787905426,"recoveryLevel":"Purgeable","recoverableDays":7},"contentType":"text/plain","tags":{}}],"nextLink":null}

Actual behavior

currently requesting /secrets/?.... return error as follow

PS  > curl.exe -k `
>>   -H "Authorization: Bearer $token" `
>>   "https://localhost:4577/devstoreaccount1-keyvault/secrets/?api-version=7.4"
{"error":{"code":"SecretNotFound","message":"A secret with (name/id)  was not found in this key vault. If you recently deleted this secret, it may still be recoverable. For more information, see https://docs.microsoft.com/en-us/rest/api/keyvault/getsecret."}}

Reproduction

• start floci-az
• and make request with curl inside powershell as described above

Environment

• Floci-az version / image tag:
• Java SDK version (if applicable):

PS  > java --version
openjdk 11.0.20.1 2023-08-24 LTS
OpenJDK Runtime Environment Microsoft-8297088 (build 11.0.20.1+1-LTS)
OpenJDK 64-Bit Server VM Microsoft-8297088 (build 11.0.20.1+1-LTS, mixed mode)

• How you're running Floci-az (Docker / native / mvn quarkus:dev): run with Docker

[github-actions]

👋 Thanks for opening your first issue in floci-az!

A maintainer will triage this and add the right service label. If you included a minimal reproduction and the floci-az version, that is everything we need — no action required from you right now.

Come say hi in Slack if you want to talk it through with maintainers and other contributors. Questions about Azure behaviour, design tradeoffs, and rough proposals are all welcome there.

[ahsanu123]

simple fix that i know

PS  >  curl.exe -k `
>>   -H "Authorization: Bearer $token" `
>>   "https://localhost:4577/devstoreaccount1-keyvault/secrets/?api-version=7.4"
{"value":[{"id":"https://devstoreaccount1.vault.azure.net/secrets/asdf","attributes":{"enabled":true,"nbf":1788046162,"exp":1788046162,"created":1788046162,"updated":1788046162,"recoveryLevel":"Purgeable","recoverableDays":7},"contentType":"","tags":{}}],"nextLink":null}


PS  > curl.exe -k `
>>    -H "Authorization: Bearer $token" `
>>    "https://localhost:4577/devstoreaccount1-keyvault/secrets?api-version=7.4"
{"value":[{"id":"https://devstoreaccount1.vault.azure.net/secrets/asdf","attributes":{"enabled":true,"nbf":1788046162,"exp":1788046162,"created":1788046162,"updated":1788046162,"recoveryLevel":"Purgeable","recoverableDays":7},"contentType":"","tags":{}}],"nextLink":null} 

• Fixed by this simple patching in KeyVaultHandler.java Line 97

- if ("secrets".equals(path)) { 
+ if ("secrets".equals(path) || "secrets/".equals(path)) {
    return "GET".equals(method) ? listSecrets(account) : methodNotAllowed();
}

// in service configuration 
    builder.Configuration.AddAzureKeyVault(secretClient, new AzureKeyVaultConfigurationOptions());


// sample controller code 
[ApiController]
[Route("api/managed-identity")]
public sealed class ManagedIdentityController(
    IConfiguration configuration,
    SecretClient secretClient) : ControllerBase
{

  [HttpGet]
  [Route("configuration")]
  public async Task<IActionResult> GetConfiguration([FromQuery] string configurationKey)
  {
    var configurationValue = _configuration.GetValue<string>(configurationKey);
    if (configurationValue == null) return NotFound();

    return Ok(configurationValue);
  }
}