Data App creation with private Git repo fails on Azure: missing KBC::ProjectSecureKV:: prefix

[Al-Geroth]

Summary

kbagent data-app create fails on Azure-backed Keboola stacks when creating a Data App from a private external Git repository via --git-pat-env.

Affected version: kbagent / keboola-cli 0.84.2
Environment: Keboola Azure stack (North Europe)
Affected path: private external Git repository authentication during Data App creation

Observed error

ENCRYPTION_FAILED: Encryption API did not return a project-scoped ciphertext for the git PAT; refusing to write plaintext to Storage.

The failure occurs after the Data Science API creates the initial app shell, but before the full Storage configuration is written. kbagent's failure cleanup then deletes the temporary shell, so no orphan Data App remains.

Root cause

In src/keboola_agent_cli/services/data_app_service.py, _build_git_block() encrypts the supplied Git PAT through the project's Encryption API and then validates the returned ciphertext against ENCRYPTED_PASSWORD_PREFIXES:

ENCRYPTED_PASSWORD_PREFIXES: tuple[str, ...] = (
    "KBC::ProjectSecure::",
    "KBC::ProjectSecureGKMS::",
    "KBC::ProjectSecureKMS::",
)

On Azure-backed stacks, the Encryption API returns project-scoped ciphertext with the prefix:

KBC::ProjectSecureKV::

This is documented by Keboola as the Azure variant of project-scoped encryption:

https://developers.keboola.com/overview/encryption/

Because KBC::ProjectSecureKV:: is absent from the whitelist, _build_git_block() rejects a legitimately encrypted value and raises ENCRYPTION_FAILED.

The Encryption API call itself succeeds and returns a well-formed KBC::ProjectSecureKV::... ciphertext. The failure is entirely in kbagent's client-side prefix validation. No PAT or ciphertext values are included here.

Proposed minimal fix

--- a/src/keboola_agent_cli/services/data_app_service.py
+++ b/src/keboola_agent_cli/services/data_app_service.py
@@
 ENCRYPTED_PASSWORD_PREFIXES: tuple[str, ...] = (
     "KBC::ProjectSecure::",
     "KBC::ProjectSecureGKMS::",
     "KBC::ProjectSecureKMS::",
+    "KBC::ProjectSecureKV::",
 )

Safety impact

This is only an additive whitelist change. The fail-closed behavior remains unchanged: arbitrary/unrecognized ciphertext formats and plaintext values are still rejected, and plaintext is still never written to Storage.

Verification

After applying only this one-line change to a local 0.84.2 installation:

• kbagent data-app create completed successfully,
• the private GitHub repository cloned and built successfully,
• the Data App deployed successfully on the expected commit,
• functional smoke tests passed for health, authenticated frontend load, live API data, default view behavior, filtering, and workspace/query wiring.

No other behavioral changes were required.

Suggested regression test

A narrow unit test around _build_git_block() would cover the actual failure path:

• mock the Encryption API result as KBC::ProjectSecureKV::... and assert that the Git block is accepted;
• verify that an arbitrary prefix and a plaintext-looking value still raise ENCRYPTION_FAILED.

That would test both the Azure fix and preservation of the fail-closed behavior.

[padak]

Confirmed and fixed in #611.

Reproduced live on an Azure stack (connection.north-europe.azure.keboola.com): kbagent encrypt values --component-id keboola.data-apps returns KBC::ProjectSecureKV::..., and the same data-app create --git-pat-env invocation fails with ENCRYPTION_FAILED on 0.85.0 and succeeds with the prefix added. Your diagnosis was exactly right — thank you for the precise write-up.

Two notes beyond the report:

The blast radius is wider than the reported path. ENCRYPTED_PASSWORD_PREFIXES is shared by five call sites, so on Azure the gap also broke data-app create --git-pat-encrypted (a valid Azure ciphertext was refused as input) and data-app secrets-set (same ENCRYPTION_FAILED abort), and made secrets-list --show-fingerprint / secrets-get report an empty fingerprint and encryption_prefix. The one-line addition repairs all of them.

Regression test as suggested, plus the fail-closed half: a look-alike prefix (KBC::ProjectSecureKVX::) still raises ENCRYPTION_FAILED and cleans up the shell app, and a component-scoped Azure ciphertext (KBC::ComponentSecureKV::) is still rejected as not project-bound.

Shipping in 0.85.1. Two adjacent gaps found while investigating are filed separately rather than bundled: #612 (sync/secrets.py knows only the AWS-era prefixes) and #613 (docs call encrypt values "ComponentSecure scope" when the API returns a ProjectSecure cipher).