feat: add tools space access policy in system

config/templates/system/kv-tools-read.hcl.tpl

@@ -0,0 +1,14 @@
+# Write policy for tools space
+# Scope: apps/data/tools access
+
+path "<%= secretKvPath %>/data/tools/+/+" {
+  capabilities = ["read"]
+}
+
+path "<%= secretKvPath %>/metadata/tools/+/+" {
+  capabilities = ["read", "list"]
+}
+
+path "<%= secretKvPath %>/config" {
+  capabilities = ["read"]
+}

config/templates/system/kv-tools-read.name.tpl

@@ -0,0 +1 @@
+<%= secretKvPath %>-kv-tools-read

src/vault/policy-roots/impl/system-policy.service.ts

@@ -99,6 +99,12 @@ export class SystemPolicyService implements PolicyRootService<undefined> {
         templateName: 'kv-developer',
         data: { secretKvPath },
       });
+      if (secretKvPath == 'apps')
+        kvSpecs.push({
+        group: VAULT_ROOT_SYSTEM,
+        templateName: 'kv-tools-read',
+        data: { secretKvPath },
+      });
     }
     return kvSpecs;
   }