DR-1386 Add support for new objectStorageBucket field for USS config.

keepercommander/api.py

@@ -108,7 +108,7 @@ def accept_account_transfer_consent(params):     # type: (KeeperParams) -> bool
         responses = execute_batch(params, requests)
         if isinstance(responses, list):
             for response in responses:
-                if response['result_code'] != 'success':
+                if response['result'] != 'success':
                     logging.warning('Account Transfer policy acceptance error: %s',
                                     response.get('message') or response['result_code'])
                     ok = False

keepercommander/commands/folder.py

@@ -2022,6 +2022,9 @@ def _nsf_folder_share_data(params, folder_uid, *, include_uids=False):
         abbrev = _nsf_role_abbrev(a)
         auid = a.get('accessor_uid') or ''
 
+        if a.get('denied_access'):
+            continue
+
         if at == 'AT_OWNER':
             if not owner:
                 email = _resolve_nsf_user_email(params, a)

keepercommander/commands/nested_share_folder/display_commands.py

@@ -460,7 +460,10 @@ def _nsf_folder_path(uid):
             for fr in result.get('results', []):
                 if not fr.get('success'):
                     continue
-                accessors = fr.get('accessors', [])
+                accessors = [
+                    a for a in fr.get('accessors', [])
+                    if not a.get('denied_access')
+                ]
                 if not accessors:
                     continue
                 user_perms = []
@@ -541,7 +544,10 @@ def _print_folder_permissions(params, folder_uid, verbose):
                     logging.warning("  Access error: %s — %s",
                                     err.get('status'), err.get('message'))
                     continue
-                accessors = fr.get('accessors', [])
+                accessors = [
+                    a for a in fr.get('accessors', [])
+                    if not a.get('denied_access')
+                ]
                 if not accessors:
                     continue
 

keepercommander/commands/pam_import/README.md

@@ -39,13 +39,16 @@ Notes:
 
 
 Adding new PAM resources and users to an existing PAM configuration from an import file. The command validates folders and records, then creates only new items (match by title, existing records are skipped). The import JSON format is the same.  
-`pam project extend --config=<uid_or_title> --filename=/path/to/import.json [--dry-run]`
+`pam project extend --config=<uid_or_title> --filename=/path/to/import.json [--resources-folder=<uid_or_path>] [--users-folder=<uid_or_path>] [--dry-run]`
 
 - `--config`, `-c` → PAM Configuration record UID or title.
 - `--filename`, `-f` → JSON file to load import data from.
+- `--resources-folder` → Existing folder (UID or folder path) for new resources. Overrides `folder_path` of resources in the JSON (a warning is printed).
+- `--users-folder` → Existing folder (UID or folder path) for new users, incl. users nested in resources. Overrides `folder_path` of users in the JSON (a warning is printed).
 - `--dry-run`, `-d` → Test import without modifying vault.
 
 > **Notes:**
+- Folder for new records: 1) `--resources-folder`/`--users-folder`, 2) `folder_path` in the JSON, 3) autodetect — folders named `<project> - Resources`/`<project> - Users`, otherwise the folder where existing resources (pamMachine, pamDatabase, pamDirectory, pamRemoteBrowser) or users (pamUser, login) live. If autodetect is ambiguous or finds nothing the command fails; add `folder_path` or use the options above.
 - Use **`--dry-run`** to preview what would be created and to see detailed validation output without changing the vault.
 - If the command reports errors, run it again with **`--dry-run`** for more detailed error messages.
 

keepercommander/commands/pam_import/edit.py

@@ -1759,9 +1759,11 @@ def _resolve_folder_uid(obj, default_uid: str) -> str:
                             args["pwd_complexity"]=user.rotation_settings.password_complexity
                         prc.execute(params, silent=True, **args)
             # Launch credentials: link for pamMachine, pamDatabase, pamDirectory (not RBI)
+            # Also runs for admin-only (no launch): re-asserts the admin as the last write,
+            # after the JIT/AI/meta writes and after nested users are created.
             launch_uid = get_launch_credential(mach, True)
-            if launch_uid and not isinstance(mach, PamRemoteBrowserObject):
-                tdag.set_launch_credentials(mach.uid, launch_uid=launch_uid, admin_uid=(admin_uid or None))
+            if (launch_uid or admin_uid) and not isinstance(mach, PamRemoteBrowserObject):
+                tdag.set_launch_credentials(mach.uid, launch_uid=(launch_uid or None), admin_uid=(admin_uid or None))
         if resources: print(f"{len(resources)}/{len(resources)}\n")
 
         # link machine -> pamDirectory (LINK, path=domain) for jit_settings.pam_directory_uid