SecretResourceApi.PutSecret serializes string body as JSON, storing secrets with extra quotes

[nthmost-orkes]

Summary

PutSecret / PutSecretWithHttpInfo stores secret values wrapped in extra JSON quotes (e.g. VERY SECRET is stored as "VERY SECRET"), making them unusable for authentication.

Root cause

Two defects compound in Conductor/Api/SecretResourceApi.cs (PutSecretWithHttpInfo):

1. Wrong Content-Type (line ~718)

String[] localVarHttpContentTypes = new String[] {
    "application/json"   // ← wrong
};

The server endpoint declares consumes = {MediaType.TEXT_PLAIN_VALUE, MediaType.ALL_VALUE}. It reads the body as raw bytes, not as JSON.

2. String body is JSON-serialized (line ~731-733)

if (body != null && body.GetType() != typeof(byte[]))
{
    localVarPostBody = this.Configuration.ApiClient.Serialize(body); // wraps string in JSON quotes
}

Because string is not byte[], this branch always runs for PutSecret, JSON-encoding the value and adding surrounding double-quotes before it hits the wire.

The same pattern exists in EnvironmentResourceApi — some methods there already declare text/plain but still call Serialize().

Fix

In PutSecretWithHttpInfo:

// Change content type
String[] localVarHttpContentTypes = new String[] {
    "text/plain"
};

// Skip serialization — string body passed as-is
localVarPostBody = body;

Workaround (until fixed)

Call the endpoint directly using HttpClient:

var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-Authorization", yourToken);
var content = new StringContent("VERY SECRET", Encoding.UTF8, "text/plain");
await client.PutAsync("https://your-server/api/secrets/MY_KEY", content);