Key Vault expiration reminders and reliable secret rotation

[Bionic711]

Summary

Add Key Vault-backed secret expiration tracking/reminders throughout SimpleChat, and fix reliability gaps when rotating existing Key Vault-backed action secrets.

User Value

Admins and workspace owners need a reliable way to know when app-managed client secrets, passwords, API keys, and connection strings are approaching expiration. Azure Key Vault alerts can identify expiring secret names, but SimpleChat also needs an inventory that maps generated Key Vault secret names back to the owning user, group, action, identity, model endpoint, field, and remediation path.

This also addresses a reported issue where replacing a service principal secret for an existing global action did not update the corresponding Key Vault secret. The same behavior should be validated for global, group, and personal actions.

Proposed Behavior

• Add per-secret expiration tracking controls wherever SimpleChat captures Key Vault-backed expiring secrets.
• Store SimpleChat-owned reminder metadata and admin-facing inventory records with owner/scope/source/field context.
• Set Azure Key Vault secret expiration metadata when creating or rotating secret values so Azure-native SecretNearExpiry/SecretExpired alerts can be used.
• Provide admin Key Vault UI visibility into expiring/expired secrets, sync status, and remediation context.
• Use in-app notifications as a supplemental reminder path while supporting Azure Monitor/action group email alerting through Key Vault expiration metadata.
• Ensure replacing an existing Key Vault-backed action secret writes a new Key Vault secret version instead of preserving the old value.

Acceptance Criteria

• Existing Key Vault-backed global action secrets are updated in Key Vault when a new literal secret value is saved.
• The same update behavior is validated for group and personal actions.
• Placeholder values such as Stored_In_KeyVault preserve existing references only when a valid existing reference exists.
• Key Vault write failures are surfaced and do not silently save raw secret values.
• Secret expiration tracking can be enabled with expiration date, lead days, contact email, and friendly/remediation context.
• Key Vault secret expiration metadata is written or clearly marked as sync-failed when permissions/configuration prevent updating it.
• Admins can view an inventory of tracked secrets with owner, scope, source object, field, expiration, notification state, and remediation context.
• In-app reminder notifications are generated without duplicate spam for expiring tracked secrets.
• Feature/fix documentation and functional regression tests are added.

Notes

• Initial implementation should use managed identity / existing Key Vault credential patterns and avoid adding a SimpleChat email sender.
• Azure Monitor/Event Grid/action group email configuration can remain customer-managed; SimpleChat should provide the inventory/context needed when those alerts fire.
• Likely affected areas include Key Vault helpers, global/group/personal action save flows, workspace identities, model endpoints, file sync secrets, admin Key Vault settings/UI, notification scheduling, and route/test coverage.

[Bionic711]

Implemented Key Vault expiration reminders and reliable secret rotation in v0.250.121.\n\nSummary:\n- Added SimpleChat Key Vault reminder inventory, admin APIs, background sweep, and in-app notification type.\n- Added Admin Settings > Security > Key Vault reminder configuration and inventory dashboard.\n- Added action modal reminder controls that store per-action metadata for Key Vault-backed secrets.\n- Fixed shared Key Vault action save behavior so literal replacement secrets write new Key Vault versions, placeholders without existing references are rejected, and write failures no longer fall back to raw secret persistence.\n- Added feature/fix docs and release notes entries.\n\nValidation:\n- functional_tests\test_sql_plugin_key_vault_secret_storage.py: 7/7 passed\n- functional_tests\test_model_endpoints_key_vault_secret_storage.py: 2/2 passed\n- functional_tests\test_keyvault_plugin_secret_scope_enforcement.py: 6/6 passed\n- functional_tests\route_tests policy trio: 12/12 passed\n- ui_tests\test_admin_key_vault_reminders_ui.py: 2/2 passed\n- Targeted py_compile, node --check, and git diff --check passed\n\nFollow-up note: SimpleChat still does not send email directly; Azure Monitor/Event Grid action groups remain the email alert path, with SimpleChat inventory providing owner/source context.

[Bionic711]

Implemented the external notification follow-up for Key Vault expiration reminders.

What changed:

• Added privacy-safe, queryable Application Insights telemetry via log_external_event().
• Emitted key_vault_secret_expiration_reminder_triggered whenever the reminder sweep successfully creates a Key Vault expiration notification.
• Included safe categorical fields plus hashed owner/source/contact identifiers, while avoiding raw secret names and email values in telemetry dimensions.
• Added admin UI and feature documentation guidance for Azure Monitor scheduled query alerts, action groups, Logic Apps, Functions, and webhooks.
• Bumped app version to 0.250.122.

Validation:

• python functional_tests\test_keyvault_external_notification_telemetry.py passed.
• python -m pytest ui_tests\test_admin_key_vault_reminders_ui.py -q passed.
• python -m py_compile application\single_app\functions_appinsights.py application\single_app\functions_keyvault_reminders.py functional_tests\test_keyvault_external_notification_telemetry.py ui_tests\test_admin_key_vault_reminders_ui.py passed.
• $env:PYTHONUTF8='1'; python functional_tests\test_sql_plugin_key_vault_secret_storage.py passed.
• git --no-pager diff --check passed.

[Bionic711]

Added the contact-email routing opt-in for external Key Vault reminder automation.

What changed:

• Added default-off admin setting key_vault_secret_expiration_emit_contact_email_in_telemetry.
• When enabled, the key_vault_secret_expiration_reminder_triggered Application Insights event includes contact_email so Azure Monitor/Logic Apps/Functions/webhooks can route directly to the configured reminder contact.
• When disabled, telemetry continues to emit only safe categorical fields and hashed identifiers.
• Raw Key Vault secret names remain redacted from external telemetry even when contact email routing is enabled.
• Added Reminder ID visibility/search in the admin reminder inventory for fixed admin-channel alert workflows.
• Updated admin KQL guidance, feature docs, and release notes.
• Bumped app version to 0.250.123.

Validation:

• python functional_tests\test_keyvault_external_notification_telemetry.py passed.
• python -m pytest ui_tests\test_admin_key_vault_reminders_ui.py -q passed.
• python -m py_compile application\single_app\functions_appinsights.py application\single_app\functions_keyvault_reminders.py application\single_app\functions_settings.py application\single_app\route_frontend_admin_settings.py functional_tests\test_keyvault_external_notification_telemetry.py ui_tests\test_admin_key_vault_reminders_ui.py passed.
• node --check application\single_app\static\js\admin\admin_settings.js passed.
• $env:PYTHONUTF8='1'; python functional_tests\test_sql_plugin_key_vault_secret_storage.py passed.
• git --no-pager diff --check passed.