Propagate source evidence sensitivity through history

internal/engine/secret.go

@@ -75,19 +75,6 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
 		classifyProjection(tree)
 	}
 	classifyProjection(final)
-	evidenceSecrets := make(map[string]bool)
-	seenEvidence := make(map[string][]Path)
-	classifyEvidence := func(destination, local Path) {
-		path := appendDestination(destination, local)
-		pointer := path.String()
-		for _, seen := range seenEvidence[pointer] {
-			if sameSecretPath(seen, path) {
-				return
-			}
-		}
-		seenEvidence[pointer] = append(seenEvidence[pointer], path.clone())
-		classifyEvidencePath(evidenceSecrets, schema, predicate, path)
-	}
 	for _, item := range evidence {
 		if item == nil {
 			continue
@@ -96,9 +83,9 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
 		if !candidate.valid() {
 			candidate = item.path
 		}
-		classifyEvidence(item.destination, candidate)
+		addSecretEvidencePath(paths, item.destination, candidate)
 		for _, ancestor := range item.ancestors {
-			classifyEvidence(item.destination, ancestor.path)
+			addSecretEvidencePath(paths, item.destination, ancestor.path)
 		}
 	}
 	for pointer, path := range paths {
@@ -109,36 +96,12 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
 			secret[pointer] = true
 		}
 	}
-	classified := closeSecretDependencies(paths, secret, dependencies, inherited)
-	for pointer, sensitive := range evidenceSecrets {
-		if sensitive {
-			classified[pointer] = true
-		}
-	}
-	return classified
+	return closeSecretDependencies(paths, secret, dependencies, inherited)
 }
 
-func classifyEvidencePath(secret map[string]bool, schema *schemaDescriptor, predicate func(Path) bool, path Path) {
-	pointer := path.String()
-	if root, ok := schemaSecretRoot(schema, path); ok {
-		secret[root.String()] = true
-	}
-	if predicate != nil && predicate(path.clone()) {
-		secret[pointer] = true
-	}
-}
-
-func sameSecretPath(left, right Path) bool {
-	if len(left.segments) != len(right.segments) {
-		return false
-	}
-	for index, segment := range left.segments {
-		other := right.segments[index]
-		if segment.kind != other.kind || segment.key != other.key || segment.index != other.index {
-			return false
-		}
-	}
-	return true
+func addSecretEvidencePath(paths map[string]Path, destination, local Path) {
+	path := appendDestination(destination, local)
+	paths[path.String()] = path.clone()
 }
 
 func addSecretPath(paths map[string]Path, pointer string) {