---
id: w6/m4/t003
title: Implement secrets.WorkspacePurger
worker: worker6
status: done
estimate: 45m
depends_on: []
---

## Objective

Implement a concrete `workspaces.WorkspacePurger` for OpenBao-backed secrets, so deleting a workspace actually removes its env vars, environment groups, and secret files from OpenBao instead of leaving them orphaned.

## Context

- `lego/backend/internal/workspaces/service.go:107-113` — the `WorkspacePurger` interface: `PurgeWorkspace(ctx context.Context, tenantID string) error`.
- `lego/backend/internal/secrets/service.go` — owns the OpenBao-backed env-vars/env-groups/secret-files store (see `docs/ADR013-secrets.md` for the tenant secret tree layout, e.g. `tenants/<id>/...`).
- No purger implementation currently exists anywhere in the codebase (confirmed via grep) — this is a new type in the `secrets` package.

## Steps

1. Add a type in the `secrets` package (e.g. `WorkspacePurger`) implementing `PurgeWorkspace(ctx, tenantID) error` that deletes the tenant's entire OpenBao secret tree (`docs/ADR013-secrets.md`'s `tenants/<id>` prefix — env vars, env groups, secret files).
2. Make the purge idempotent: purging an already-gone/never-existed tenant tree is not an error (mirrors `workspaces/service.go:456`'s stated tolerance for "already-gone tuples/resources").
3. Construct the purger in `cmd/api/main.go` alongside the existing `secrets.Service` wiring (actual injection into `ServerDeps.WorkspacePurgers` happens in t005, to keep this task focused on the purger type itself and its unit tests).

## Files

- `lego/backend/internal/secrets/service.go` (or a new `purger.go` in the same package)

## Acceptance criteria

- [ ] `secrets.WorkspacePurger` (or equivalent) implements the `workspaces.WorkspacePurger` interface
- [ ] Purging a tenant with existing secrets removes its entire OpenBao tree
- [ ] Purging a tenant with no secrets (or already purged) is a no-op, not an error

## Out of scope

- Wiring into `ServerDeps.WorkspacePurgers` (t005).
- The Postgres/KeyValue purgers (t004).
