Repository: aipotheosis-labs/aci
File: backend/aci/server/security_credentials_manager.py (Python)

Code before:
    if linked_account.security_scheme == SecurityScheme.API_KEY:
        return _get_api_key_credentials(app, linked_account)
    elif linked_account.security_scheme == SecurityScheme.OAUTH2:
        return await _get_oauth2_credentials(app, app_configuration, linked_account)
    elif linked_account.security_scheme == SecurityScheme.NO_AUTH:
        return _get_no_auth_credentials(app, linked_account)
    else:
        logger.error(
            "unsupported security scheme",
            extra={
                "linked_account": linked_account.id,
                "security_scheme": linked_account.security_scheme,
                "app": app.name,
            },
        )
        raise NoImplementationFound(
            f"unsupported security scheme={linked_account.security_scheme}, app={app.name}"
        )


async def get_and_update_security_credentials(
    db_session: Session,
    app: App,
    app_configuration: AppConfiguration,
    linked_account: LinkedAccount,
    commit: bool = True,
) -> SecurityCredentialsResponse:
    """
    Get security credentials and update them in the database if they were refreshed.

    Args:
        db_session: Database session
        app: App object
        app_configuration: App configuration object
        linked_account: Linked account object
        commit: Whether to commit the database transaction (default: True)

    Returns:
        SecurityCredentialsResponse: The security credentials response
    """
    security_credentials_response = await get_security_credentials(
        app, app_configuration, linked_account
    )

    logger.info(
        "fetched security credentials",
        extra={
            "app_name": app.name,
            "linked_account_id": linked_account.id,
            "is_app_default_credentials": security_credentials_response.is_app_default_credentials,
            "is_updated": security_credentials_response.is_updated,

Review comment (security):
let's try not to have db commit hidden in side other functions (having a flag make it slightly worse). Ideally it's better to just keep them on path function level.
There is a better way to combine the get & update (if we really want to), and some of the old code needs some clean up (is_app_default_credentials should probably be deprecated).

so let's not  refactor in this case, just keep the get & update function separate and copy them to where you need. 
I'll have a separate ticket to refactor this part.

Code after:
    if linked_account.security_scheme == SecurityScheme.API_KEY:
        return _get_api_key_credentials(app, linked_account)
    elif linked_account.security_scheme == SecurityScheme.OAUTH2:
        return await _get_oauth2_credentials(app, app_configuration, linked_account)
    elif linked_account.security_scheme == SecurityScheme.NO_AUTH:
        return _get_no_auth_credentials(app, linked_account)
    else:
        logger.error(
            f"Unsupported security scheme, linked_account_id={linked_account.id}, "
            f"security_scheme={linked_account.security_scheme}, app={app.name}"
        )
        raise NoImplementationFound(
            f"unsupported security scheme={linked_account.security_scheme}, app={app.name}"
        )


def update_security_credentials(
    db_session: Session,
    app: App,
    linked_account: LinkedAccount,
    security_credentials_response: SecurityCredentialsResponse,
) -> None:
    """
    Update security credentials in the database.

    Args:
        db_session: Database session
        app: App object
        linked_account: Linked account object
        security_credentials_response: The security credentials response to update
    """
    if not security_credentials_response.is_updated:
        return

    if security_credentials_response.is_app_default_credentials:
        crud.apps.update_app_default_security_credentials(
            db_session,
            app,
            linked_account.security_scheme,
            security_credentials_response.credentials.model_dump(),
        )
    else:
        crud.linked_accounts.update_linked_account_credentials(
            db_session,
            linked_account,
            security_credentials=security_credentials_response.credentials,
        )

    db_session.refresh(linked_account)