Add safe historical configuration explanations

secret_reference.go

@@ -64,12 +64,13 @@ type secretLookupResult struct {
 
 type secretResolutionResult struct {
 	lookups     map[string]secretLookupResult
+	references  map[string]string
 	diagnostics []Diagnostic
 }
 
 func resolveSecretReferences(root reflect.Value, schema *schemaDescriptor, input *document.Node, lookup secretLookup) secretResolutionResult {
 	result := secretResolutionResult{
-		lookups: make(map[string]secretLookupResult),
+		lookups: make(map[string]secretLookupResult), references: make(map[string]string),
 	}
 	if schema == nil || schema.root == nil || !root.IsValid() || root.Type() != schema.root.typeOf {
 		result.diagnostics = []Diagnostic{{Code: CodeSecretRequired, Severity: SeverityError, Message: "configuration value does not match its secret-reference schema"}}
@@ -124,6 +125,7 @@ func resolveSecretValue(value reflect.Value, descriptor *typeDescriptor, path Pa
 			return
 		}
 		value.Set(reflect.ValueOf(Secret{name: name, value: found.value, specified: true, resolved: true}))
+		result.references[path.String()] = name
 	case descriptorStruct:
 		for _, member := range descriptor.members {
 			memberPath := path