From 0faf4c838cde62506455e882e7a2add8b25c6f43 Mon Sep 17 00:00:00 2001 From: Teknium <127238744+teknium1@users.noreply.github.com> Date: Wed, 22 Jul 2026 03:50:57 -0700 Subject: [PATCH] fix(secrets): unify encrypted-cache fallback with the merged stale-cache path Rework the encrypted cache onto the fallback that landed in #69051: one transport-only gate, encrypted tier replaces (never accompanies) the plaintext tier when enabled, warning carries the failure + cache age, in-process cache promoted on a stale hit, and clear_caches() (token rotation) also removes the encrypted file since its key derives from the rotated token. --- tests/test_bitwarden_secrets.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/test_bitwarden_secrets.py b/tests/test_bitwarden_secrets.py index c6918951e81f..85671b2ad751 100644 --- a/tests/test_bitwarden_secrets.py +++ b/tests/test_bitwarden_secrets.py @@ -1061,9 +1061,9 @@ def test_encrypted_cache_falls_back_on_network_error(monkeypatch, tmp_path): ) assert second == {"K1": "cached"} assert calls["n"] == 2 - assert warnings == [ - "Using stale encrypted Bitwarden cache after network fetching BWS secrets" - ] + assert len(warnings) == 1 + assert "stale ENCRYPTED disk cache" in warnings[0] + assert "bws live fetch failed" in warnings[0] def test_encrypted_cache_does_not_fallback_on_auth_failure(monkeypatch, tmp_path):