From 0b4f74ffcf8ac5b5963758c9a39c35b60cf80755 Mon Sep 17 00:00:00 2001 From: saif <11242541+saifsmailbox98@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:11:43 +0530 Subject: [PATCH 1/4] feat(agent-vault): read database and SSH services, and services typed by type --- infisical_sdk/api_types.py | 18 ++++++++++++++---- tests/test_agent_vault.py | 31 +++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+), 4 deletions(-) diff --git a/infisical_sdk/api_types.py b/infisical_sdk/api_types.py index 80eb8f1..fa85110 100644 --- a/infisical_sdk/api_types.py +++ b/infisical_sdk/api_types.py @@ -567,11 +567,16 @@ class AgentVaultSessionAccessBundle(BaseModel): @dataclass class AgentVaultInlineService(BaseModel): - """A service sent with an Agent Vault session, without its token, password or values. Its nested settings, such as credential, are left as the API returns them.""" + """A service sent with an Agent Vault session, without its token, password or values. type is http, mcp, postgres, mysql or ssh, and the API returns only that type's fields: hostPattern, allowedMethods and allowedPathPrefixes for http; serverUrl, transport and hostPattern for mcp; host, port, database and tls for postgres and mysql; host and port for ssh. Its nested settings, such as credential and tls, are left as the API returns them.""" id: str name: str type: str - hostPattern: str + description: Optional[str] = None + hostPattern: Optional[str] = None + host: Optional[str] = None + port: Optional[int] = None + database: Optional[str] = None + tls: Optional[Dict[str, Any]] = None serverUrl: Optional[str] = None transport: Optional[str] = None allowedMethods: Optional[List[str]] = None @@ -682,12 +687,17 @@ class AgentVaultAccessBundleRef(BaseModel): @dataclass class AgentVaultService(BaseModel): - """A service in an Agent Vault access bundle. Its nested settings, such as credential, are left as the API returns them.""" + """A service in an Agent Vault access bundle. type is http, mcp, postgres, mysql or ssh, and the API returns only that type's fields: hostPattern, allowedMethods and allowedPathPrefixes for http; serverUrl, transport, hostPattern and allowedTools for mcp; host, port, database and tls for postgres and mysql; host and port for ssh. Its nested settings, such as credential and tls ({"enabled", "verify", "ca"}), are left as the API returns them.""" id: str accessBundleId: str name: str type: str - hostPattern: str + description: Optional[str] = None + hostPattern: Optional[str] = None + host: Optional[str] = None + port: Optional[int] = None + database: Optional[str] = None + tls: Optional[Dict[str, Any]] = None serverUrl: Optional[str] = None transport: Optional[str] = None allowedMethods: Optional[List[str]] = None diff --git a/tests/test_agent_vault.py b/tests/test_agent_vault.py index 99c3f9d..41eba30 100644 --- a/tests/test_agent_vault.py +++ b/tests/test_agent_vault.py @@ -450,6 +450,37 @@ def test_access_bundles_get_reads_the_tools_an_mcp_service_allows(api, agent_vau assert agent_vault.access_bundles.get(BUNDLE["id"]).services[0].allowedTools == ["list_issues"] +def test_access_bundles_get_reads_database_and_ssh_services_without_http_fields(api, agent_vault, json_response): + shared = { + "accessBundleId": BUNDLE["id"], "description": None, "customHeaders": [], "substitutions": [], + "variableReferences": [], "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], + } + postgres = dict(shared, id=SERVICE_ID, name="orders-db", type="postgres", host="db.internal", port=5432, + database="orders", tls={"enabled": True, "verify": True, "ca": None}, + credential={"type": "basic", "memberProvidedFields": []}) + ssh = dict(shared, id="7d1e3f5a-9b2c-4d6e-8f0a-1b3c5d7e9f2a", name="bastion", type="ssh", + host="bastion.internal", port=22, credential={"type": "ssh-key", "hasCertificate": False}) + api.session.get.return_value = json_response({"accessBundle": dict(BUNDLE, services=[postgres, ssh])}) + database, server = agent_vault.access_bundles.get(BUNDLE["id"]).services + assert (database.host, database.port, database.database) == ("db.internal", 5432, "orders") + assert database.tls == {"enabled": True, "verify": True, "ca": None} + assert database.hostPattern is None + assert (server.host, server.port, server.tls) == ("bastion.internal", 22, None) + + +def test_sessions_read_an_inline_database_service(api, agent_vault, json_response): + inline = { + "id": INLINE_SERVICE["id"], "name": "orders-db", "description": "Orders replica", "type": "mysql", "host": "db.internal", "port": 3306, + "database": "orders", "tls": {"enabled": False, "verify": False, "ca": None}, + "credential": {"type": "basic"}, "customHeaders": [], "substitutions": [], + } + api.session.get.return_value = json_response({"session": dict(SESSION, services=[inline])}) + service = agent_vault.sessions.get(SESSION["id"]).services[0] + assert service == AgentVaultInlineService(**inline) + assert service.hostPattern is None + assert service.description == "Orders replica" + + def test_access_bundles_list_grantees_reads_a_pending_organization_membership(api, agent_vault, json_response): grantee = dict({key: ON_BEHALF_OF[key] for key in ("type", "id", "username", "email", "firstName", "lastName")}, isOrgMembershipPending=True, grantedAt="2026-10-27T00:00:00.000Z") From b3054554cbc947607e8c9dc48ef9c67ca90680d1 Mon Sep 17 00:00:00 2001 From: saif <11242541+saifsmailbox98@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:54:19 +0530 Subject: [PATCH 2/4] fix(agent-vault): keep the existing field order and add the new fields at the end --- infisical_sdk/api_types.py | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/infisical_sdk/api_types.py b/infisical_sdk/api_types.py index fa85110..c4eb6f5 100644 --- a/infisical_sdk/api_types.py +++ b/infisical_sdk/api_types.py @@ -571,12 +571,7 @@ class AgentVaultInlineService(BaseModel): id: str name: str type: str - description: Optional[str] = None hostPattern: Optional[str] = None - host: Optional[str] = None - port: Optional[int] = None - database: Optional[str] = None - tls: Optional[Dict[str, Any]] = None serverUrl: Optional[str] = None transport: Optional[str] = None allowedMethods: Optional[List[str]] = None @@ -584,6 +579,11 @@ class AgentVaultInlineService(BaseModel): credential: Optional[Dict[str, Any]] = None customHeaders: Optional[List[Dict[str, Any]]] = None substitutions: Optional[List[Dict[str, Any]]] = None + description: Optional[str] = None + host: Optional[str] = None + port: Optional[int] = None + database: Optional[str] = None + tls: Optional[Dict[str, Any]] = None @dataclass class AgentVaultSession(BaseModel): @@ -692,12 +692,7 @@ class AgentVaultService(BaseModel): accessBundleId: str name: str type: str - description: Optional[str] = None hostPattern: Optional[str] = None - host: Optional[str] = None - port: Optional[int] = None - database: Optional[str] = None - tls: Optional[Dict[str, Any]] = None serverUrl: Optional[str] = None transport: Optional[str] = None allowedMethods: Optional[List[str]] = None @@ -710,6 +705,11 @@ class AgentVaultService(BaseModel): createdAt: Optional[str] = None updatedAt: Optional[str] = None allowedTools: Optional[List[str]] = None + description: Optional[str] = None + host: Optional[str] = None + port: Optional[int] = None + database: Optional[str] = None + tls: Optional[Dict[str, Any]] = None @dataclass class AgentVaultAccessBundle(BaseModel): From 064bbe6ab019ed8133a1bea75fede4926eb9dcc7 Mon Sep 17 00:00:00 2001 From: saif <11242541+saifsmailbox98@users.noreply.github.com> Date: Wed, 11 Nov 2026 03:16:55 +0530 Subject: [PATCH 3/4] docs(agent-vault): name the types that return custom headers and substitutions --- infisical_sdk/api_types.py | 4 ++-- tests/test_agent_vault.py | 11 +++++------ 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/infisical_sdk/api_types.py b/infisical_sdk/api_types.py index c4eb6f5..85b9eb0 100644 --- a/infisical_sdk/api_types.py +++ b/infisical_sdk/api_types.py @@ -567,7 +567,7 @@ class AgentVaultSessionAccessBundle(BaseModel): @dataclass class AgentVaultInlineService(BaseModel): - """A service sent with an Agent Vault session, without its token, password or values. type is http, mcp, postgres, mysql or ssh, and the API returns only that type's fields: hostPattern, allowedMethods and allowedPathPrefixes for http; serverUrl, transport and hostPattern for mcp; host, port, database and tls for postgres and mysql; host and port for ssh. Its nested settings, such as credential and tls, are left as the API returns them.""" + """A service sent with an Agent Vault session, without its token, password or values. type is http, mcp, postgres, mysql or ssh, and the API returns only that type's fields: hostPattern, allowedMethods, allowedPathPrefixes, customHeaders and substitutions for http; serverUrl, transport, hostPattern and customHeaders for mcp; host, port, database and tls for postgres and mysql; host and port for ssh. Its nested settings, such as credential and tls, are left as the API returns them.""" id: str name: str type: str @@ -687,7 +687,7 @@ class AgentVaultAccessBundleRef(BaseModel): @dataclass class AgentVaultService(BaseModel): - """A service in an Agent Vault access bundle. type is http, mcp, postgres, mysql or ssh, and the API returns only that type's fields: hostPattern, allowedMethods and allowedPathPrefixes for http; serverUrl, transport, hostPattern and allowedTools for mcp; host, port, database and tls for postgres and mysql; host and port for ssh. Its nested settings, such as credential and tls ({"enabled", "verify", "ca"}), are left as the API returns them.""" + """A service in an Agent Vault access bundle. type is http, mcp, postgres, mysql or ssh, and the API returns only that type's fields: hostPattern, allowedMethods, allowedPathPrefixes, customHeaders and substitutions for http; serverUrl, transport, hostPattern, allowedTools and customHeaders for mcp; host, port, database and tls for postgres and mysql; host and port for ssh. Its nested settings, such as credential and tls ({"enabled", "verify", "ca"}), are left as the API returns them.""" id: str accessBundleId: str name: str diff --git a/tests/test_agent_vault.py b/tests/test_agent_vault.py index 41eba30..d7711fb 100644 --- a/tests/test_agent_vault.py +++ b/tests/test_agent_vault.py @@ -442,8 +442,8 @@ def test_access_bundles_get_reads_the_tools_an_mcp_service_allows(api, agent_vau service = { "id": SERVICE_ID, "accessBundleId": BUNDLE["id"], "name": "linear", "type": "mcp", "serverUrl": "https://mcp.linear.app/mcp", "transport": "streamable-http", "hostPattern": "mcp.linear.app", - "allowedMethods": None, "allowedPathPrefixes": None, "allowedTools": ["list_issues"], - "credential": {"type": "bearer", "memberProvidedFields": []}, "customHeaders": [], "substitutions": [], + "allowedTools": ["list_issues"], + "credential": {"type": "bearer", "memberProvidedFields": []}, "customHeaders": [], "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], } api.session.get.return_value = json_response({"accessBundle": dict(BUNDLE, services=[service])}) @@ -452,8 +452,7 @@ def test_access_bundles_get_reads_the_tools_an_mcp_service_allows(api, agent_vau def test_access_bundles_get_reads_database_and_ssh_services_without_http_fields(api, agent_vault, json_response): shared = { - "accessBundleId": BUNDLE["id"], "description": None, "customHeaders": [], "substitutions": [], - "variableReferences": [], "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], + "accessBundleId": BUNDLE["id"], "description": None, "variableReferences": [], "createdAt": BUNDLE["createdAt"], "updatedAt": BUNDLE["updatedAt"], } postgres = dict(shared, id=SERVICE_ID, name="orders-db", type="postgres", host="db.internal", port=5432, database="orders", tls={"enabled": True, "verify": True, "ca": None}, @@ -472,12 +471,12 @@ def test_sessions_read_an_inline_database_service(api, agent_vault, json_respons inline = { "id": INLINE_SERVICE["id"], "name": "orders-db", "description": "Orders replica", "type": "mysql", "host": "db.internal", "port": 3306, "database": "orders", "tls": {"enabled": False, "verify": False, "ca": None}, - "credential": {"type": "basic"}, "customHeaders": [], "substitutions": [], + "credential": {"type": "basic"}, } api.session.get.return_value = json_response({"session": dict(SESSION, services=[inline])}) service = agent_vault.sessions.get(SESSION["id"]).services[0] assert service == AgentVaultInlineService(**inline) - assert service.hostPattern is None + assert service.hostPattern is None and service.customHeaders is None assert service.description == "Orders replica" From fca4ed1fa17bc3b9da7a537a85d9e3e7d61b0995 Mon Sep 17 00:00:00 2001 From: saif <11242541+saifsmailbox98@users.noreply.github.com> Date: Wed, 11 Nov 2026 04:57:36 +0530 Subject: [PATCH 4/4] docs(agent-vault): say which inline services need a name --- infisical_sdk/resources/agent_vault.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infisical_sdk/resources/agent_vault.py b/infisical_sdk/resources/agent_vault.py index 8069ad8..d7da6b9 100644 --- a/infisical_sdk/resources/agent_vault.py +++ b/infisical_sdk/resources/agent_vault.py @@ -346,7 +346,7 @@ def create( label: A short description of what the session is for, such as "nightly deploy". Up to 128 characters, without line breaks, tabs, or invisible characters. on_behalf_of_user_email: The email address of the user to start the session on behalf of. Can't be combined with on_behalf_of_user_id. on_behalf_of_user_id: The ID of the user to start the session on behalf of. Can't be combined with on_behalf_of_user_email. - services: Services the session carries itself, instead of or beside its access bundle's: up to 20 dicts with the API's field names, such as {"type": "http", "hostPattern": "api.github.com", "credential": {"type": "bearer", "value": token}}. Only Agent Vault admins can send them. Each has the same fields as a service in an access bundle, except that its name is optional, its values can't use variables, it can't use OAuth or member-provided values, and an MCP server can't be limited to some of its tools. To limit an MCP server's tools, add it to an access bundle instead. + services: Services the session carries itself, instead of or beside its access bundle's: up to 20 dicts with the API's field names, such as {"type": "http", "hostPattern": "api.github.com", "credential": {"type": "bearer", "value": token}}. Only Agent Vault admins can send them. Each has the same fields as a service in an access bundle, except that its name is optional for HTTP and MCP services (database and SSH services need one), its values can't use variables, it can't use OAuth or member-provided values, and an MCP server can't be limited to some of its tools. To limit an MCP server's tools, add it to an access bundle instead. project_id: The ID of the Agent Vault project to create the session in. Returns: