feat(auth): add migrate=False readonly dep; fix test fixtures for get_credential_manager_readonly

- Add migrate parameter to CredentialManager.__init__ (default True) so
  GET-only endpoints skip the machine-wide migration on read paths
- Add get_credential_manager_readonly dependency in settings_v2 and
  github_integrations_v2 routers; wire it to list_key_status, verify_key,
  get_status, and get_issues
- Update all test fixtures that override get_credential_manager to also
  override get_credential_manager_readonly, preventing test hangs caused
  by the unoverridden dep hitting the real keyring/CredentialStore

Author: frankbria

codeframe/core/credentials.py

@@ -638,17 +638,26 @@ class CredentialManager:
     ``user_id=None`` is the machine-wide store itself and never migrates.
     """
 
-    def __init__(self, storage_dir: Optional[Path] = None, user_id: Optional[int] = None):
+    def __init__(
+        self,
+        storage_dir: Optional[Path] = None,
+        user_id: Optional[int] = None,
+        migrate: bool = True,
+    ):
         """Initialize credential manager.
 
         Args:
             storage_dir: Directory for credential storage
             user_id: Scope credentials to this user; None keeps the machine-wide store
+            migrate: Whether to run the machine-wide → per-user migration on first
+                construction for this user.  Pass ``False`` from read-only endpoints
+                so that a plain GET cannot write credentials into a new tenant store
+                (the admin-scoped PUT/POST paths keep the default ``True``).
         """
         self._user_id = user_id
         self._storage_dir = storage_dir
         self._store = CredentialStore(storage_dir, user_id=user_id)
-        if user_id is not None:
+        if migrate and user_id is not None:
             if self._store.storage_dir not in _MIGRATION_COMPLETE:
                 self._migrate_machine_wide_entries()
                 _MIGRATION_COMPLETE.add(self._store.storage_dir)

codeframe/ui/routers/github_integrations_v2.py

@@ -59,8 +59,18 @@ def get_credential_manager(auth: dict = Depends(require_auth)) -> CredentialMana
 
     ``user_id=None`` (auth disabled / self-hosted) yields the machine-wide
     store. Overridden in tests to point at an isolated temp directory.
+    Runs the machine-wide migration — use only on write paths.
     """
-    return CredentialManager(user_id=auth.get("user_id"))
+    return CredentialManager(user_id=auth.get("user_id"), migrate=True)
+
+
+def get_credential_manager_readonly(auth: dict = Depends(require_auth)) -> CredentialManager:
+    """Read-only variant: scoped to the authenticated user but skips migration.
+
+    Used on GET endpoints so that a plain status check cannot trigger a
+    credential write into a new tenant's store (#790).
+    """
+    return CredentialManager(user_id=auth.get("user_id"), migrate=False)
 
 
 class ConnectRequest(BaseModel):
@@ -178,7 +188,7 @@ def _issue_cache_invalidate(repo: str, user_id: Optional[int]) -> None:
 async def get_status(
     request: Request,
     workspace: Workspace = Depends(get_v2_workspace),
-    manager: CredentialManager = Depends(get_credential_manager),
+    manager: CredentialManager = Depends(get_credential_manager_readonly),
 ) -> StatusResponse:
     """Report whether a GitHub repo is connected for this workspace.
 
@@ -339,7 +349,7 @@ async def get_issues(
     search: str = Query("", description="Free-text title/body search"),
     label: str = Query("", description="Filter by a single label name"),
     workspace: Workspace = Depends(get_v2_workspace),
-    manager: CredentialManager = Depends(get_credential_manager),
+    manager: CredentialManager = Depends(get_credential_manager_readonly),
     auth: dict = Depends(require_auth),
 ) -> GitHubIssuesResponse:
     """List the connected repository's **open** issues for the import browser.

codeframe/ui/routers/settings_v2.py

@@ -83,8 +83,18 @@ def get_credential_manager(auth: dict = Depends(require_auth)) -> CredentialMana
 
     ``user_id=None`` (auth disabled / self-hosted) yields the machine-wide
     store. Overridden in tests to point at an isolated temp directory.
+    Runs the machine-wide migration — use only on write (admin-scoped) paths.
     """
-    return CredentialManager(user_id=auth.get("user_id"))
+    return CredentialManager(user_id=auth.get("user_id"), migrate=True)
+
+
+def get_credential_manager_readonly(auth: dict = Depends(require_auth)) -> CredentialManager:
+    """Read-only variant: scoped to the authenticated user but skips migration.
+
+    Used on GET endpoints so that a plain status check cannot trigger a
+    credential write into a new tenant's store (#790).
+    """
+    return CredentialManager(user_id=auth.get("user_id"), migrate=False)
 
 
 def _config_to_response(config: EnvironmentConfig) -> AgentSettingsResponse:
@@ -236,7 +246,7 @@ def _build_status(
 @rate_limit_standard()
 async def list_key_status(
     request: Request,
-    manager: CredentialManager = Depends(get_credential_manager),
+    manager: CredentialManager = Depends(get_credential_manager_readonly),
 ) -> list[KeyStatusResponse]:
     """Return status of each known API key without exposing plaintext."""
     return [_build_status(p, manager) for p in KEY_PROVIDERS]
@@ -392,7 +402,7 @@ def _verify_openai_sync(key: str) -> tuple[bool, str]:
 async def verify_key(
     body: VerifyKeyRequest,
     request: Request,
-    manager: CredentialManager = Depends(get_credential_manager),
+    manager: CredentialManager = Depends(get_credential_manager_readonly),
 ) -> VerifyKeyResponse:
     """Live-verify a key against its provider.
 

tests/ui/test_credential_tenant_isolation.py

@@ -87,7 +87,9 @@ def _workspace_dep(auth: dict = Depends(require_auth)):
         return workspaces[uid]
 
     app.dependency_overrides[settings_v2.get_credential_manager] = _manager_dep
+    app.dependency_overrides[settings_v2.get_credential_manager_readonly] = _manager_dep
     app.dependency_overrides[github_integrations_v2.get_credential_manager] = _manager_dep
+    app.dependency_overrides[github_integrations_v2.get_credential_manager_readonly] = _manager_dep
     app.dependency_overrides[get_v2_workspace] = _workspace_dep
 
     client = TestClient(app)
@@ -124,7 +126,7 @@ class TestManagerDependencyScoping:
     """The production dependency builds the manager from auth["user_id"]."""
 
     class _FakeCM:
-        def __init__(self, storage_dir=None, user_id=None):
+        def __init__(self, storage_dir=None, user_id=None, migrate=True):
             self.user_id = user_id
 
     def test_settings_manager_dep_scopes_to_auth_user(self, monkeypatch):

tests/ui/test_github_integrations_v2.py

@@ -63,6 +63,9 @@ def client(workspace, manager):
     app.dependency_overrides[github_integrations_v2.get_credential_manager] = (
         lambda: manager
     )
+    app.dependency_overrides[github_integrations_v2.get_credential_manager_readonly] = (
+        lambda: manager
+    )
     return TestClient(app)
 
 

tests/ui/test_hosted_credential_block.py

@@ -62,17 +62,23 @@ def hosted_client(tmp_path, monkeypatch):
 
     app = server.app
     app.dependency_overrides[settings_v2.get_credential_manager] = lambda: manager
+    app.dependency_overrides[settings_v2.get_credential_manager_readonly] = lambda: manager
     app.dependency_overrides[github_integrations_v2.get_credential_manager] = (
         lambda: manager
     )
+    app.dependency_overrides[github_integrations_v2.get_credential_manager_readonly] = (
+        lambda: manager
+    )
     app.dependency_overrides[get_v2_workspace] = lambda: workspace
 
     yield TestClient(app)
 
     # Restore the shared app for other tests in this process.
     for dep in (
         settings_v2.get_credential_manager,
+        settings_v2.get_credential_manager_readonly,
         github_integrations_v2.get_credential_manager,
+        github_integrations_v2.get_credential_manager_readonly,
         get_v2_workspace,
     ):
         app.dependency_overrides.pop(dep, None)

tests/ui/test_settings_v2.py

@@ -87,6 +87,9 @@ def keys_client(temp_credentials_dir):
     app.dependency_overrides[settings_v2.get_credential_manager] = (
         lambda: temp_credentials_dir
     )
+    app.dependency_overrides[settings_v2.get_credential_manager_readonly] = (
+        lambda: temp_credentials_dir
+    )
     yield TestClient(app)
 
 

tests/ui/test_v2_auth_enforcement.py

@@ -103,7 +103,9 @@ def _build_auth_app(tmp_path, monkeypatch, *, enable_test_endpoints):
     cred_manager._store = cred_store
     for dep in (
         settings_v2.get_credential_manager,
+        settings_v2.get_credential_manager_readonly,
         github_integrations_v2.get_credential_manager,
+        github_integrations_v2.get_credential_manager_readonly,
     ):
         server.app.dependency_overrides[dep] = lambda: cred_manager
 
@@ -115,7 +117,9 @@ def _pop_credential_overrides(app) -> None:
 
     for dep in (
         settings_v2.get_credential_manager,
+        settings_v2.get_credential_manager_readonly,
         github_integrations_v2.get_credential_manager,
+        github_integrations_v2.get_credential_manager_readonly,
     ):
         app.dependency_overrides.pop(dep, None)
 

tests/ui/test_v2_scope_enforcement.py

@@ -69,7 +69,9 @@ def scoped_app(tmp_path, monkeypatch):
     cred_manager._store = cred_store
     cred_deps = (
         settings_v2.get_credential_manager,
+        settings_v2.get_credential_manager_readonly,
         github_integrations_v2.get_credential_manager,
+        github_integrations_v2.get_credential_manager_readonly,
     )
     for dep in cred_deps:
         server.app.dependency_overrides[dep] = lambda: cred_manager