Fix: saving an existing private key returned a 500

backend/src/apiserver/data/features/private_kv.py

@@ -20,8 +20,14 @@ def get_private_record(store: Storage, key: str) -> bytes | None:
 
 
 def set_private_record(store: Storage, key: str, record_bytes: bytes) -> None:
-    """Store the encoded ``{role, value}`` record under ``key``."""
-    store.add(PRIVATE_TABLE, key, record_bytes, expires_at=0)
+    """Store the encoded ``{role, value}`` record under ``key``.
+
+    Creates the key, or replaces its current record: the admin Private tab
+    re-saves the whole JSON document every time, so replacing is the normal
+    case. (``store.add`` only inserts and raised ``EntryAlreadyExists`` for an
+    existing key, so every save after the first one failed with a 500.)
+    """
+    store.overwrite(PRIVATE_TABLE, key, record_bytes, expires_at=0)
 
 
 def list_private_keys(store: Storage) -> list[str]:

backend/tests/test_private_kv.py

@@ -0,0 +1,35 @@
+"""Regression test: saving an existing private key must replace it."""
+
+from test_spec import (
+    ADMIN_COOKIE_HEADERS_BY_CREDS,
+    get_admin_cookie_headers,
+    post_json,
+)
+
+
+def test_admin_can_save_an_existing_private_key_again(
+    command, backend_url, auth_client
+) -> None:
+    ADMIN_COOKIE_HEADERS_BY_CREDS.clear()
+    admin = get_admin_cookie_headers(command, auth_client)
+
+    first = post_json(
+        backend_url,
+        "/admin/private_kv/set/",
+        {"key": "hordes_join", "value": {"Koers": "a"}, "role": "member"},
+        admin,
+    )
+    assert first.status_code == 200, first.text
+
+    # Used to fail with a 500 (EntryAlreadyExists from store.add)
+    second = post_json(
+        backend_url,
+        "/admin/private_kv/set/",
+        {"key": "hordes_join", "value": {"Koers": "b"}},
+        admin,
+    )
+    assert second.status_code == 200, second.text
+    assert second.json()["required_role"] == "member"
+
+    read = post_json(backend_url, "/members/private/", {"key": "hordes_join"}, admin)
+    assert read.json() == {"value": {"Koers": "b"}}