eric/ConfigKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Resolve inheritance between identified records

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-23 20:48:46 +00:00
parent 268fd03579
commit 33a51606da
10 changed files with 447 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

208
facade_inheritance_test.go
View File

@@ -91,6 +91,214 @@ func TestFacadeInheritancePreservesPresenceOriginsAndHistory(t *testing.T) {
}
}
func TestFacadeIdentifiedInheritanceResolvesChainsAndNestedCollections(t *testing.T) {
const secretName = "CONFIGKIT_IDENTIFIED_INHERITANCE_SECRET"
const canary = "IDENTIFIED-INHERITANCE-SECRET-CANARY"
t.Setenv(secretName, canary)
type step struct {
ID string `yaml:"id"`
Value string `yaml:"value"`
}
type job struct {
ID string `yaml:"id"`
Name string `yaml:"name"`
Credential configkit.Secret `yaml:"credential"`
Resource string `yaml:"resource"`
Steps []step `yaml:"steps"`
Settings map[string]map[string]string `yaml:"settings"`
}
type configuration struct {
Jobs []job `yaml:"jobs"`
}
input := []byte(`jobs:
- id: child
extends: {id: parent}
name: child-name
- id: parent
extends: {id: base}
- id: base
name: base-name
credential: CONFIGKIT_IDENTIFIED_INHERITANCE_SECRET
resource: icon.txt
steps:
- id: base-step
value: base-step-value
- id: second-step
value: second-step-value
settings:
primary: {value: base-setting}
secondary: {extends: primary}
`)
filesystem := configkit.NewFilesystem("identified-bundle", fstest.MapFS{
"config/identified.yml": &fstest.MapFile{Data: input},
"config/icon.txt": &fstest.MapFile{Data: []byte("identified-parent-resource")},
})
registrations := []configkit.SequenceComposition{
{Path: configkit.Keys("jobs"), IdentityField: "id"},
}
result, err := configkit.Load(filesystem.File("config/identified.yml"), configkit.Options[configuration]{
Definition: configkit.Definition[configuration]{
SequenceCompositions: registrations,
Secret: func(path configkit.Path) bool {
return path.String() == "/jobs/0/credential" || path.String() == "/jobs/1/credential" || path.String() == "/jobs/2/credential"
},
},
})
if err != nil {
if loadError, ok := err.(*configkit.LoadError); ok {
t.Fatalf("load identified inheritance: %v (%#v)", err, loadError.Diagnostics())
}
t.Fatal(err)
}
if len(result.Config.Jobs) != 3 || result.Config.Jobs[0].ID != "child" || result.Config.Jobs[1].ID != "parent" || result.Config.Jobs[2].ID != "base" {
t.Fatalf("inherited job positions and identities = %#v", result.Config.Jobs)
}
child := result.Config.Jobs[0]
if child.Name != "child-name" || child.Credential.Value() != canary || child.Resource != "icon.txt" || len(child.Steps) != 2 {
t.Fatalf("inherited child = %#v", child)
}
if got := []string{child.Steps[0].ID, child.Steps[1].ID}; strings.Join(got, ",") != "base-step,second-step" {
t.Fatalf("inherited nested steps = %v", got)
}
if child.Steps[0].Value != "base-step-value" || child.Steps[1].Value != "second-step-value" || child.Settings["secondary"]["value"] != "base-setting" {
t.Fatalf("inherited nested collection and mapping = %#v", child)
}
credentialPath := configkit.Keys("jobs").Index(0).Key("credential")
credentialInfo, found := result.Metadata().Lookup(credentialPath)
if !found || len(credentialInfo.Origin.Inheritance) != 2 {
t.Fatalf("inherited secret provenance = %#v, %v", credentialInfo, found)
}
resourceInfo, found := result.Metadata().Lookup(configkit.Keys("jobs").Index(0).Key("resource"))
if !found || len(resourceInfo.Origin.Inheritance) != 2 || len(resourceInfo.Origin.Locations) != 1 {
t.Fatalf("inherited resource provenance = %#v, %v", resourceInfo, found)
}
context, found := result.SourceContext(resourceInfo.Origin.Locations[0].SourceID)
if !found || context.BaseDir != "config" || context.FS == nil {
t.Fatalf("inherited resource context = %#v, %v", context, found)
}
resource, readErr := fs.ReadFile(context.FS, context.BaseDir+"/"+child.Resource)
if readErr != nil || string(resource) != "identified-parent-resource" {
t.Fatalf("inherited resource = %q, %v", resource, readErr)
}
resourceHistory, found := result.Explain(configkit.Keys("jobs").Index(0).Key("resource"))
if !found || len(resourceHistory.History) == 0 {
t.Fatalf("inherited resource history = %#v, %v", resourceHistory, found)
}
credentialHistory, found := result.Explain(credentialPath)
if !found || !credentialHistory.Effective.Redacted {
t.Fatalf("inherited secret explanation = %#v, %v", credentialHistory, found)
}
identityInfo, found := result.Metadata().Lookup(configkit.Keys("jobs").Index(0).Key("id"))
if !found || !identityInfo.Explicit || len(identityInfo.Origin.Inheritance) != 0 ||
len(identityInfo.Origin.Locations) != 1 {
t.Fatalf("child identity origin and presence = %#v, %v", identityInfo, found)
}
if _, found := result.Metadata().Lookup(configkit.Keys("jobs").Index(0).Key("extends")); found {
t.Fatal("identified record relationship remained in effective metadata")
}
var rendered bytes.Buffer
if err := result.WriteEffective(&rendered); err != nil || strings.Contains(rendered.String(), canary) || strings.Contains(rendered.String(), "extends:") {
t.Fatalf("effective inherited configuration = %q, %v", rendered.String(), err)
}
}
func TestFacadeIdentifiedInheritanceFailureDoesNotRevealSecretCanary(t *testing.T) {
const secretName = "CONFIGKIT_IDENTIFIED_INHERITANCE_FAILURE_SECRET"
const canary = "IDENTIFIED-INHERITANCE-FAILURE-CANARY"
t.Setenv(secretName, canary)
type job struct {
ID string `yaml:"id"`
Credential configkit.Secret `yaml:"credential"`
}
type configuration struct {
Jobs []job `yaml:"jobs"`
}
input := []byte(`jobs:
- id: child
extends: {id: missing}
credential: CONFIGKIT_IDENTIFIED_INHERITANCE_FAILURE_SECRET
`)
_, err := configkit.Load(configkit.Bytes("identified-failure.yml", input), configkit.Options[configuration]{
Definition: configkit.Definition[configuration]{
SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("jobs"), IdentityField: "id"}},
Secret: func(path configkit.Path) bool { return path.String() == "/jobs/0/credential" },
},
})
if err == nil || strings.Contains(err.Error(), canary) {
t.Fatalf("identified inheritance failure = %v; secret canary must remain undisclosed", err)
}
}
func TestFacadeLayeredIdentifiedInheritanceUsesSurvivingRecords(t *testing.T) {
policy := func(mode string) string {
return "configkit:\n sequences:\n - destination: [jobs]\n key: id\n mode: " + mode + "\n"
}
tests := []struct {
name string
lower string
higher string
wantCode configkit.Code
wantValue string
wantSuccess bool
}{
{
name: "upserted parent supplies its final payload",
lower: policy("upsert") + "jobs: [{id: parent, value: lower}]\n",
higher: policy("upsert") + "jobs: [{id: parent, value: higher}, {id: child, extends: {id: parent}}]\n",
wantValue: "higher", wantSuccess: true,
},
{
name: "replacement removes a lower parent before lookup",
lower: policy("upsert") + "jobs: [{id: parent, value: lower}]\n",
higher: policy("replace") + "jobs: [{id: child, extends: {id: parent}}]\n",
wantCode: configkit.CodeInheritanceMissing,
},
{
name: "upserted child without a directive replaces the invalid lower child",
lower: policy("upsert") + "jobs: [{id: child, extends: {id: missing}, value: lower}]\n",
higher: policy("upsert") + "jobs: [{id: child, value: higher}]\n",
wantValue: "higher", wantSuccess: true,
},
{
name: "self-reference cannot resolve through a lower predecessor",
lower: policy("upsert") + "jobs: [{id: parent, value: lower}]\n",
higher: policy("upsert") + "jobs: [{id: parent, extends: {id: parent}, value: higher}]\n",
wantCode: configkit.CodeInheritanceCycle,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
result, err := configkit.LoadLayered(configkit.Input{Source: configkit.Bytes("main.yml", []byte(test.higher))}, configkit.LayeredOptions[map[string]any]{
Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.Bytes("lower.yml", []byte(test.lower))}}}},
})
if test.wantSuccess {
if err != nil {
t.Fatal(err)
}
jobs, ok := result.Config["jobs"].([]any)
if !ok || len(jobs) == 0 {
t.Fatalf("assembled jobs = %#v", result.Config["jobs"])
}
child, ok := jobs[len(jobs)-1].(map[string]any)
if !ok || child["value"] != test.wantValue {
t.Fatalf("surviving record = %#v, want inherited value %q", jobs[len(jobs)-1], test.wantValue)
}
return
}
loadError, ok := err.(*configkit.LoadError)
if !ok {
t.Fatalf("load error = %v, want code %s", err, test.wantCode)
}
for _, diagnostic := range loadError.Diagnostics() {
if diagnostic.Code == test.wantCode {
return
}
}
t.Fatalf("load diagnostics = %#v, want code %s", loadError.Diagnostics(), test.wantCode)
})
}
}
func TestFacadeInheritanceLayeredPrecedenceAndSourceContext(t *testing.T) {
filesystem := configkit.NewFilesystem("bundle", fstest.MapFS{
"config/main.yml": &fstest.MapFile{Data: []byte("entries: {child: {extends: parent}}\n")},