fix rotate paths roundtripping

[nyobe]

As part of adding the retry-rotation button to the console, I realized that the rotation paths that we output as part of rotation results cannot be directly used as rotation path inputs. This is because rotation path inputs get implicitly prefixed by values., while the result paths are physical docpaths that already have the values prefix.

Right now the frontend works around this by strip the values.? prefix from the result paths, but this just exposes the fact that the prefixing doesn't actually work correctly for quoted keys like ["rotated-creds"] -> values.["rotated-creds"] -> invalid path

I think that doing this prefixing in eval.RotateEnvironment is probably a mistake. It was done to try to match the behavior of the paths used by the CLI. So, while this is technically a breaking change, I propose moving the prefixing behavior to the CLI instead, and have the eval apis just use physical docpaths consistently.

[IaroslavTitov]

Would this break anything in pulumi-service? Probably have to manually update to the new version and fix up where you add values. in the console?

[nyobe]

Would this break anything in pulumi-service? Probably have to manually update to the new version and fix up where you add values. in the console?

yeah, we'll need to update the frontend at the same time as bumping the ESC version to back out this workaround

I don't believe we're inputting rotation paths anywhere else. The biggest concern I have is that the rotate command in the current version of the CLI won't send the paths with the values prefix to the API, so it won't work correctly. But I suppose we could add a check in the rotate api handler to see if paths are prefixed or not, and try to fix them up if not.

[IaroslavTitov]

I suppose we could add a check in the rotate api handler to see if paths are prefixed or not, and try to fix them up if not.

Yeah, def need to make sure this doesn't break any of the callers, like frontend, CLI, ESC SDK. The frontend you can change at the same time easily, and if it doesn't break others, should be fine to just go in?