Add NSF support for PAM config/rotation and KSM; drop duplicate rotation sync by mtyagi-ks · Pull Request #212 · Keeper-Security/keeper-sdk-python

mtyagi-ks · 2026-07-17T11:21:51Z

Summary

Extend PAM and KSM flows to resolve/use Nested Shared Folder (Keeper Drive) records for list/config and rotation setup.
Ingest classic + NSF record rotation data from the normal vault sync into PAM sqlite, and remove the extra dedicated sync_down used only for rotations.
Update protobufs and PAM config new/edit paths needed for NSF-aware PAM configuration.

Test plan

pam config list / pam config new / pam config edit work for NSF PAM configs
pam rotation list / info resolve NSF pamUser, config, and resource titles/UIDs
pam rotation edit against NSF pamUser (confirm revision behavior after sync)
Confirm no separate vault sync is triggered only to refresh record rotations
KSM list/share paths still work for NSF folders/records
Existing classic (non-NSF) PAM/KSM flows unchanged

…tations

adeshmukh-ks · 2026-07-22T09:30:09Z

+                return None
+            folder_uid = folder_uids[0]
+            if folder_uid == nsf_management.ROOT_FOLDER_UID:
+                return _PamFolderRef('My Drive', folder_uid)


change it to 'My Vault'

adeshmukh-ks · 2026-07-22T09:36:35Z

+                record_uid = nsf_management.resolve_nsf_record_uid(vault, identifier)
+            except nsf_management.NsfError:
+                record_uid = None
+        if not record_uid:


move this check before checking for records, move it to line 242

identifier is already validated above, so moving if not record_uid before get_record would be dead code. The post-resolve None check is the one that matters and should stay after resolve

adeshmukh-ks · 2026-07-22T09:38:34Z

+        return None
+
+    def _find_nsf_pam_configurations(self, vault: vault_online.VaultOnline):
+        """Yield TypedRecord PAM configs stored under NSF / Keeper Drive."""


remove drive mention from anywhere in the code

adeshmukh-ks · 2026-07-22T09:42:20Z

 common_parser.add_argument('--shared-folder', '-sf', dest='shared_folder_uid', action='store',
-                        help='Share Folder where this PAM Configuration is stored. Should be one of the folders to '
-                                'which the gateway has access to.')
+                        help='Classic shared folder or NSF / Keeper Drive folder (UID or name) where this PAM '


remove keeper drive mention

adeshmukh-ks · 2026-07-22T09:44:11Z

+                record_uid = nsf_management.resolve_nsf_record_uid(vault, identifier)
+            except nsf_management.NsfError:
+                record_uid = None
+        if not record_uid:


move record uid check to line 1200

identifier is already validated above, so moving if not record_uid before get_record would be dead code. The post-resolve None check is the one that matters and should stay after resolve

adeshmukh-ks · 2026-07-22T09:54:00Z

-                resource_id = utils.base64_url_encode(rri.resourceUid)
-                resource_ok = is_resource_ok(resource_id, vault, configuration_uid)
-                logger.info(f"Admin Resource Uid: {resource_id if resource_ok else 'FAIL'}")
+                # Always print the router resource UID (Commander parity). Do not


remove this comment

adeshmukh-ks · 2026-07-22T09:54:56Z

-        if not self._auth or not self._auth.auth_context.is_enterprise_admin:
-            return
-        if self._enterprise_loader is None:
+        """Copy rotations from the last vault sync into :attr:`pam_plugin` sqlite (no extra sync_down)."""


remove this comment

adeshmukh-ks · 2026-07-22T09:59:47Z

+        self._record_rotations.put_entities(_pam_rotation_to_domain(r) for r in row_list)

    def sync_down(self, *, reload: bool = False) -> None:
+        """Refresh controllers from PAM API; reload rotations from local sqlite only."""


remove this comment

adeshmukh-ks · 2026-07-22T10:22:06Z

-        if not uids_to_update:
+            classic_uids_to_readd.append(uid)
+
+        if classic_uids_to_readd:


correct typo from definition till here

adeshmukh-ks · 2026-07-22T10:27:25Z

+    def consume_rotations_cleared(self) -> bool:
+        """Return and clear the 'last sync cleared rotations' flag for PAM sqlite replace."""
+        cleared = self._pending_rotation_replace
+        self._pending_rotation_replace = False


this clears the cache and rebuild from sqlite?

this only returns and clears the _pending_rotation_replace flag (one-shot). The in-memory rotation cache is cleared during sync_down / _ingest_record_rotations. PAM sqlite replace vs merge is decided later by the CLI using this flag as replace_all.

adeshmukh-ks · 2026-07-22T10:29:24Z

+        *,
+        is_editable: bool = False,
+        request_sync: bool = True) -> Dict[str, Any]:
+    """Share an NSF (Keeper Drive) folder with a KSM application via AT_APPLICATION.


remove keeper drive

adeshmukh-ks · 2026-07-22T10:29:39Z

+        request_sync: bool = True) -> Dict[str, Any]:
+    """Share an NSF (Keeper Drive) folder with a KSM application via AT_APPLICATION.
+
+    Classic vault/app_share_add rejects Drive folders; this uses folders/v3/access_update.


remove this comment

sali-ks · 2026-07-22T14:52:24Z

                return sf_uid
-
+
+        if vault.nsf_data is None:


add log message No nsf data

mtyagi-ks and others added 4 commits July 14, 2026 13:40

added nsf support for ksm and pam list

6633e94

protobuff update

fdbd1a2

pam config edit and new

44495a6

rotatoin nsf support and removal of dual sync down call for record ro…

2340686

…tations

adeshmukh-ks requested review from adeshmukh-ks and sali-ks July 21, 2026 14:31

adeshmukh-ks reviewed Jul 22, 2026

View reviewed changes

mtyagi-ks added 2 commits July 22, 2026 17:35

comment resolution

625d504

removal of keeper drive in code comments/docstrings

400696f

sali-ks reviewed Jul 22, 2026

View reviewed changes

Comment thread keepercli-package/src/keepercli/commands/pam/pam_config.py

sali-ks reviewed Jul 22, 2026

View reviewed changes

Comment thread keepercli-package/src/keepercli/commands/pam/pam_config.py Outdated

sali-ks reviewed Jul 22, 2026

View reviewed changes

Comment thread keepercli-package/src/keepercli/commands/pam/pam_config.py

comment resolution- log messages

64ab58b

sali-ks approved these changes Jul 23, 2026

View reviewed changes

adeshmukh-ks approved these changes Jul 23, 2026

View reviewed changes

adeshmukh-ks added 2 commits July 24, 2026 11:54

bug fixes

2113c44

version support fix in cli

1fdf307

Uh oh!

Conversation

mtyagi-ks commented Jul 17, 2026

Summary

Test plan

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants