Update secrets in place

[tiran]

Custodia has no HTTP method to update a secret in place. Secrets must be deleted first with DELETE and then re-added with PUT. For integration with another system I need an add-or-update API.

[simo5]

We can probably allow a PUT with a query option to indicate we want to replace, or just simply always allow to replace.

[tiran]

Which variant do you prefer as default?

In the long run it might be useful to have compare-and-swap feature. For some storage engines CAS can be implemented atomic, e.g. SQL.

[simo5]

Replace is probably the better semantic, otherwise 2 concurrent clients can end up stomping on each other.

[simo5]

I am tempted to say we want CAS, but probably a simple replace is fine, as long as at all times the secret actually "exists", I want to avoid the case where client 1 deletes the secret, and before it recreates it client 2 checks for existence, does not find it and does something we do not want it to do.