[rakdutta]

Closes #6799

When OAUTH_TOKEN_BACKEND=vault, the per-user Vault credential lookup was unconditional for every non-OAuth gateway invocation. A Vault outage or expired VAULT_TOKEN therefore blocked all non-OAuth tool calls — including gateways that carry no per-user credentials at all. The fix introduces an explicit opt-in flag on Gateway and routes the Vault lookup only through gateways that declare it.

Changes

Schema / DB

• Add requires_user_credentials: bool (default False) to the Gateway ORM model (db.py), Pydantic schemas (GatewayCreate, GatewayUpdate, GatewayRead), and common model (common/models.py).
• Add Alembic migration 8f6b2c4d9a10 that idempotently adds the column to existing databases.

Service layer

• tool_service.py — guard _resolve_vault_auth_headers behind gateway_requires_user_credentials. Gateways with the flag False bypass the Vault round-trip entirely and proceed directly to gateway-wide static auth (or no auth). Fail-closed behavior is preserved for gateways with the flag True.
• gateway_service.py — propagate the flag through GatewayRegistrationPreparation, gateway create, and gateway update paths.
• export_service.py / import_service.py — round-trip the field through export/import payloads.

Admin UI

• admin.html — add a checkbox to the gateway create/edit form.
• admin.py — read requires_user_credentials from the submitted form.
• gateways.js — wire the field into the JS gateway form handler.

Tests

• Six new parametrized unit tests in test_tool_service.py covering:
  • Vault resolver is not called when flag is False (both invoke_tool and prepare_rust_mcp_tool_execution).
  • Fail-closed behavior is retained for VaultConnectionError and VaultAuthError when flag is True.
  • A stale cache entry missing the field defaults to False (safe default, no regression).
• Additional schema coverage in test_schemas.py and test_vault_coverage_boost.py.

Behavior before / after

Scenario	Before	After
Vault down, gateway has no per-user creds	Tool invocation refused	Tool invocation succeeds via static auth
Vault down, gateway has per-user creds (requires_user_credentials=true)	Tool invocation refused	Tool invocation refused (unchanged, fail-closed)
Vault healthy	Unnecessary Vault round-trip on every non-OAuth call	Round-trip skipped unless flag is set

Notes

• Existing gateways default to requires_user_credentials=False. Operators who rely on per-user Vault credentials must set the flag explicitly on those gateways after upgrading.
• The flag is surfaced in the Admin UI, the REST API (GatewayCreate/GatewayUpdate), and export/import payloads.

---

Testing

All tests pass:

• Unit tests for schema, export/import, and tool service coverage.
• Six parametrized tests validate the per-gateway gating logic:
  • Skip Vault when requires_user_credentials=False.
  • Fail-closed when requires_user_credentials=True and Vault errors.
  • Safe default when flag is missing from cached entries.

---

Deployment Notes

1. Backward compatibility: Existing gateways default to requires_user_credentials=False — no per-user Vault lookup. Operators relying on per-user credentials must update those gateways to set the flag.
2. No breaking changes: The default preserves the fix (gateways without per-user creds are not blocked by Vault outages).
3. API surface: New field is optional in GatewayCreate and GatewayUpdate; present in GatewayRead responses.

---