feat: admit existing OpenBao catalog lanes

src/secrets_engine/plan.py

@@ -21,7 +21,7 @@ from secrets_engine.roles import (
 
 @dataclass
 class PlanAction:
-    kind: str           # "kv-mount" | "policy" | "approle"
+    kind: str           # mutation or non-mutating check/preview action
     target: str         # human-readable target
     detail: dict[str, Any] = field(default_factory=dict)
 
@@ -87,19 +87,60 @@ def build_plan(entry: CatalogEntry, stage: str, *, decision_id: str = "") -> Pla
         assert_path_in_stage(entry)             # path must be in-stage, no wildcards
         policy_name, policy_hcl = consumer_policy_for(entry)  # runs assert_policy_safe
 
-        actions = [
-            PlanAction("kv-mount", entry.mount, {"type": "kv-v2"}),
-            PlanAction(
-                "policy",
-                policy_name,
-                {"paths": f"{entry.mount}/data/{entry.path}"},
-            ),
-            PlanAction(
-                "approle",
-                entry.role_name,
-                {"token_policies": policy_name, "auth": "approle"},
-            ),
-        ]
+        mount_action = (
+            PlanAction("kv-mount", entry.mount, {"type": "kv-v2", "management": "engine"})
+            if entry.manages_mount
+            else PlanAction(
+                "kv-mount-check",
+                entry.mount,
+                {"type": "kv-v2", "management": "existing", "mutation": "none"},
+            )
+        )
+        actions = [mount_action]
+        if entry.manages_delivery_auth:
+            actions.extend(
+                [
+                    PlanAction(
+                        "policy",
+                        policy_name,
+                        {"paths": f"{entry.mount}/data/{entry.path}"},
+                    ),
+                    PlanAction(
+                        "approle",
+                        entry.role_name,
+                        {
+                            "token_policies": policy_name,
+                            "auth": "approle",
+                            "token_ttl": entry.delivery_token_ttl,
+                            "token_max_ttl": entry.delivery_token_max_ttl,
+                            "token_num_uses": entry.delivery_token_num_uses,
+                        },
+                    ),
+                ]
+            )
+        elif entry.has_delivery_auth:
+            actions.extend(
+                [
+                    PlanAction(
+                        "policy-check",
+                        policy_name,
+                        {"paths": f"{entry.mount}/data/{entry.path}", "mutation": "none"},
+                    ),
+                    PlanAction(
+                        "approle-check",
+                        entry.role_name,
+                        {"auth": "approle", "management": "existing", "mutation": "none"},
+                    ),
+                ]
+            )
+        else:
+            actions.append(
+                PlanAction(
+                    "policy-preview",
+                    policy_name,
+                    {"paths": f"{entry.mount}/data/{entry.path}", "mutation": "none"},
+                )
+            )
     return Plan(
         catalog_id=entry.id,
         stage=stage,