[jefryelb]

TL;DR

Saving a private key that already exists always failed with a 500. This PR makes the save replace the existing record. It's a one-line fix plus a regression test.

Context

The private store (private table, added in 3b0b6da) holds small admin-managed JSON content such as hordes_join. Admins edit it in /admin → Private: load the key, edit the JSON, click Save. Each save sends the whole JSON document again.

set_private_record used freetser's store.add, which only inserts. When the key already has a row, it raises EntryAlreadyExists, which surfaces as a 500. So:

• the first save of a key worked;
• every later save of that key failed, so admins could never update content after creating it.

The handler clearly intended updates (admin_set_private_handler reads the existing record to keep its role). Only the storage call was wrong, and no test saved a key twice.

Fix

set_private_record now uses store.overwrite, which inserts the row if it's missing and replaces it otherwise. freetser provides it for exactly this case.

Verification

• New tests/test_private_kv.py saves hordes_join twice through /admin/private_kv/set/. The second save returns 200, keeps the read role, and members read the new value. Without the fix, the second save returns a 500.
• uv run ty check, uv run ruff format and uv run ruff check all pass. uv run pytest: 44 passed, 2 skipped.
• Running the tests on macOS: run them as BACKEND_PRIVATE_LOCALHOST=1 FAROE_PRIVATE_HOST=127.0.0.1 uv run pytest.

Note

This PR first contained a larger change: letting committees write through the private store. That work moved to #58, which gives committees their own tables. This PR now holds only the bug fix found along the way: one commit, two files.

🤖 Generated with Claude Code

[jefryelb]

✅ Tested on demo (2026-10-17)

Deployed to demo.dsavdodeka.nl together with #58. For the test window, both PRs were merged into a temporary branch, which has since been deleted.

Check	Result
In /admin → Private, save a new key (test_pr57)	✅ "Saved."
Save the same key a second time with a new value: this used to fail with a 500	✅ "Saved."; /admin/private_kv/get/ returns the new value and keeps the read role member

Afterwards the server was restored. ~/dodeka is back on main and demo was restarted on main. Production was not restarted during the test.