feat: a vault's settings come with the vault list, with no requests of their own

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/azure/azure_test.go

@@ -419,37 +419,48 @@ func ecPoint(t *testing.T, k *ecdsa.PrivateKey) (x, y []byte) {
 	return b[1 : 1+size], b[1+size:]
 }
 
-func TestVaultDetails(t *testing.T) {
-	id := "/subscriptions/s/resourceGroups/rg-sec/providers/Microsoft.KeyVault/vaults/kv"
-	p, _ := fakeAzure(t, staticCred{}, func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != id {
-			http.NotFound(w, r)
-			return
-		}
-		writeJSON(w, 200, map[string]any{"id": id, "name": "kv", "location": "norwayeast",
-			"tags": map[string]any{"team": "platform", "env": "prod"},
-			"properties": map[string]any{
-				"tenantId": "t", "sku": map[string]any{"family": "A", "name": "premium"},
-				"enableRbacAuthorization": true, "enablePurgeProtection": true, "softDeleteRetentionInDays": 30,
-				"networkAcls":                map[string]any{"defaultAction": "Deny", "ipRules": []any{map[string]any{"value": "10.0.0.0/8"}}},
-				"privateEndpointConnections": []any{map[string]any{"id": "pe1"}},
-			}})
-	})
-	attrs, err := p.Details(context.Background(), provider.Container{ID: id})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var got []string
-	for _, a := range attrs {
-		got = append(got, a.Label+"="+a.Value)
-	}
+func TestVaultSettings(t *testing.T) {
 	want := []string{"group=rg-sec", "location=norwayeast", "SKU=premium", "access=Azure roles (RBAC)",
 		"soft delete=on, 30 days", "purge prot.=on", "network=selected networks (1 IP ranges, 0 subnets)",
 		"private=1 endpoint", "tags=env: prod", "=team: platform"}
-	if !slices.Equal(got, want) {
-		t.Errorf("details\n got %q\nwant %q", got, want)
+	check := func(name string, attrs []provider.Attr) {
+		t.Helper()
+		var got []string
+		for _, a := range attrs {
+			got = append(got, a.Label+"="+a.Value)
+		}
+		if !slices.Equal(got, want) {
+			t.Errorf("%s\n got %q\nwant %q", name, got, want)
+		}
 	}
-	if _, err := p.Details(context.Background(), provider.Container{ID: "https://kv.vault.azure.net/"}); !errors.Is(err, provider.ErrUnsupported) {
-		t.Errorf("pinned vault: %v", err)
+
+	// Resource Graph: the query's columns, as JSON gives them.
+	c, ok := graphVault(provider.Source{ID: "s"}, map[string]any{
+		"id": "/x/kv", "name": "kv", "uri": "https://kv.vault.azure.net/", "location": "norwayeast",
+		"resourceGroup": "rg-sec", "tags": map[string]any{"team": "platform", "env": "prod"},
+		"sku": "premium", "rbac": true, "softDelete": nil, "retention": 30.0, "purge": true,
+		"publicAccess": "", "defaultAction": "Deny", "ipRules": 1.0, "subnets": 0.0, "endpoints": 1.0, "policies": 0.0,
+	})
+	if !ok {
+		t.Fatal("row not read")
 	}
+	check("resource graph", c.Attrs)
+
+	// The management API, when Resource Graph fails.
+	id := "/subscriptions/s/resourceGroups/rg-sec/providers/Microsoft.KeyVault/vaults/kv"
+	p, _ := fakeAzure(t, staticCred{}, func(w http.ResponseWriter, r *http.Request) {
+		writeJSON(w, 200, map[string]any{"value": []any{map[string]any{"id": id, "name": "kv", "location": "norwayeast",
+			"tags": map[string]any{"team": "platform", "env": "prod"},
+			"properties": map[string]any{
+				"tenantId": "t", "vaultUri": "https://kv.vault.azure.net/", "sku": map[string]any{"family": "A", "name": "premium"},
+				"enableRbacAuthorization": true, "enablePurgeProtection": true, "softDeleteRetentionInDays": 30,
+				"networkAcls":                map[string]any{"defaultAction": "Deny", "ipRules": []any{map[string]any{"value": "10.0.0.0/8"}}},
+				"privateEndpointConnections": []any{map[string]any{"id": "pe1"}},
+			}}}})
+	})
+	vaults, err := p.armVaults(context.Background(), provider.Source{ID: "s"})
+	if err != nil || len(vaults) != 1 {
+		t.Fatalf("arm: %v %v", vaults, err)
+	}
+	check("management API", vaults[0].Attrs)
 }