fix(credentials): fix retry loop guard and remove unprotected validation

Remove attempt-count guard from 409/Aborted match arms in retry loops
so the post-loop Status::aborted error is reachable after exhausting
retries. Previously, last-attempt conflicts fell through to the
catch-all error arm, producing misleading Status::unavailable errors.

Remove duplicate validation calls that ran after
prepare_provider_credential_update but outside the cleanup-protected
async block, which would leak pre-stored handles on failure.

Signed-off-by: Varsha Prasad <varshaprasad96@gmail.com>
Signed-off-by: Varsha Prasad Narsing <varshaprasad96@gmail.com>

Author: varshaprasad96

crates/openshell-driver-db-credstore/src/lib.rs

@@ -235,7 +235,7 @@ impl DbCredstoreCredentialDriver {
             &request.credential_key,
         )?;
 
-        for attempt in 0..CONFLICT_RETRY_LIMIT {
+        for _attempt in 0..CONFLICT_RETRY_LIMIT {
             let record = self
                 .store
                 .get_credential_object(OBJECT_TYPE, &id, "load credential for deletion")
@@ -263,9 +263,7 @@ impl DbCredstoreCredentialDriver {
                 .await
             {
                 Ok(()) => return Ok(()),
-                Err(err)
-                    if err.code() == tonic::Code::Aborted && attempt + 1 < CONFLICT_RETRY_LIMIT => {
-                }
+                Err(err) if err.code() == tonic::Code::Aborted => {}
                 Err(err) => return Err(err),
             }
         }

crates/openshell-driver-kubernetes-secrets/src/lib.rs

@@ -199,7 +199,7 @@ impl KubernetesSecretsCredentialDriver {
         )?;
         let owner_id = credential_owner_id(&request.provider_name, &request.credential_key);
         let api: Api<Secret> = Api::namespaced(self.client.clone(), &reference.namespace);
-        for attempt in 0..CONFLICT_RETRY_LIMIT {
+        for _attempt in 0..CONFLICT_RETRY_LIMIT {
             let secret = match api.get(&reference.secret_name).await {
                 Ok(secret) => secret,
                 Err(kube::Error::Api(api_err)) if api_err.code == 404 => return Ok(()),
@@ -222,8 +222,7 @@ impl KubernetesSecretsCredentialDriver {
             match api.delete(&reference.secret_name, &delete_params).await {
                 Ok(_) => return Ok(()),
                 Err(kube::Error::Api(api_err)) if api_err.code == 404 => return Ok(()),
-                Err(kube::Error::Api(api_err))
-                    if api_err.code == 409 && attempt + 1 < CONFLICT_RETRY_LIMIT => {}
+                Err(kube::Error::Api(api_err)) if api_err.code == 409 => {}
                 Err(kube::Error::Api(api_err)) if api_err.code == 403 => {
                     return Err(Status::permission_denied(format!(
                         "gateway is not allowed to delete Kubernetes Secret '{}' in namespace '{}'",
@@ -298,7 +297,7 @@ impl KubernetesSecretsCredentialDriver {
         value: &str,
     ) -> Result<(), Status> {
         let api: Api<Secret> = Api::namespaced(self.client.clone(), &reference.namespace);
-        for attempt in 0..CONFLICT_RETRY_LIMIT {
+        for _attempt in 0..CONFLICT_RETRY_LIMIT {
             let secret = match api.get(&reference.secret_name).await {
                 Ok(secret) => secret,
                 Err(kube::Error::Api(api_err)) if api_err.code == 404 => {
@@ -325,8 +324,7 @@ impl KubernetesSecretsCredentialDriver {
                 .await
             {
                 Ok(_) => return Ok(()),
-                Err(kube::Error::Api(api_err))
-                    if api_err.code == 409 && attempt + 1 < CONFLICT_RETRY_LIMIT => {}
+                Err(kube::Error::Api(api_err)) if api_err.code == 409 => {}
                 Err(err) => {
                     return Err(kube_write_error_to_status(
                         &reference.namespace,

crates/openshell-server/src/grpc/provider.rs

@@ -377,11 +377,6 @@ async fn update_provider_record_validating(
     for key in credential_update.deferred_store_values.keys() {
         candidate.credentials.remove(key);
     }
-    validate_provider_mutable_fields(&candidate)?;
-    validate_provider_update_against_attached_sandboxes_with_catalog(
-        store, catalog, workspace, &candidate,
-    )
-    .await?;
     if credentials.is_some_and(crate::credentials::CredentialRuntime::stores_provider_credentials) {
         for key in updated_credential_values.keys() {
             candidate.credentials.remove(key);