Close cross-cutting sequence regression gaps
This commit is contained in:
@@ -1,8 +1,10 @@
|
||||
package configkit_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
configkit "gitea.maximumdirect.net/eric/ConfigKit"
|
||||
@@ -321,3 +323,157 @@ func TestFacadeSourceInfoPlacementCopiesAndZeroValues(t *testing.T) {
|
||||
t.Fatalf("source evidence changed after caller mutation: %#v", again)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFacadeSequenceReplacementKeepsTypedAndHistoricalEvidenceAligned(t *testing.T) {
|
||||
type record struct {
|
||||
ID string `yaml:"id"`
|
||||
Count int `yaml:"count"`
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Empty string `yaml:"empty"`
|
||||
Nullable *string `yaml:"nullable"`
|
||||
Token string `yaml:"token"`
|
||||
Omitted string `yaml:"omitted"`
|
||||
}
|
||||
type configuration struct {
|
||||
Entries []record `yaml:"entries"`
|
||||
}
|
||||
|
||||
directory := t.TempDir()
|
||||
mainPath := filepath.Join(directory, "main.yml")
|
||||
underlayPath := filepath.Join(directory, "underlay.yml")
|
||||
if err := os.WriteFile(mainPath, []byte(`entries:
|
||||
- id: current
|
||||
count: 0
|
||||
enabled: false
|
||||
empty: ""
|
||||
nullable: null
|
||||
token: CURRENT-SECRET-CANARY
|
||||
`), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(underlayPath, []byte(`configkit:
|
||||
imports:
|
||||
- glob: records/*.yml
|
||||
destination: [entries]
|
||||
placement: sequence-item
|
||||
`), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
recordsDir := filepath.Join(directory, "records")
|
||||
if err := os.MkdirAll(recordsDir, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for name, body := range map[string]string{
|
||||
"a.yml": "id: old-a\ntoken: OLD-SECRET-CANARY-A\n",
|
||||
"b.yml": "id: old-b\ntoken: OLD-SECRET-CANARY-B\n",
|
||||
} {
|
||||
if err := os.WriteFile(filepath.Join(recordsDir, name), []byte(body), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
var callbackItems []configkit.SourceInfo
|
||||
var callbackContexts []configkit.ResourceContext
|
||||
result, err := configkit.LoadLayered(configkit.Input{Source: configkit.File(mainPath)}, configkit.LayeredOptions[configuration]{
|
||||
Underlays: []configkit.Underlay{{Inputs: []configkit.Input{{Source: configkit.File(underlayPath), Imports: true}}}},
|
||||
Definition: configkit.Definition[configuration]{
|
||||
SequenceCompositions: []configkit.SequenceComposition{{Path: configkit.Keys("entries"), IdentityField: "id"}},
|
||||
Secret: func(path configkit.Path) bool {
|
||||
return path.String() == "/entries/0/token" || path.String() == "/entries/1/token"
|
||||
},
|
||||
Resolve: func(value *configuration, resolution *configkit.Resolution) error {
|
||||
for _, field := range []string{"count", "enabled", "empty", "nullable"} {
|
||||
path := configkit.Keys("entries").Index(0).Key(field)
|
||||
if !resolution.IsExplicit(path) {
|
||||
t.Errorf("resolver did not see explicit %s", path.String())
|
||||
}
|
||||
}
|
||||
if resolution.IsExplicit(configkit.Keys("entries").Index(0).Key("omitted")) {
|
||||
t.Error("resolver treated an omitted field as explicit")
|
||||
}
|
||||
info, found := resolution.InputInfo(configkit.Keys("entries").Index(0).Key("count"))
|
||||
if !found || info.Origin.Layer != configkit.LayerBase {
|
||||
t.Errorf("resolver current-record input info = %#v, %v", info, found)
|
||||
}
|
||||
for _, id := range []string{"source-3", "source-4"} {
|
||||
source, ok := resolution.Source(id)
|
||||
if !ok {
|
||||
t.Errorf("resolver could not query %s", id)
|
||||
continue
|
||||
}
|
||||
context, contextOK := resolution.SourceContext(id)
|
||||
if !contextOK || context.FS == nil || context.BaseDir != "records" {
|
||||
t.Errorf("resolver context for %s = %#v, %v", id, context, contextOK)
|
||||
}
|
||||
callbackItems = append(callbackItems, source)
|
||||
callbackContexts = append(callbackContexts, context)
|
||||
}
|
||||
return nil
|
||||
},
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
if loadError, ok := err.(*configkit.LoadError); ok {
|
||||
t.Fatalf("layered item replacement: %#v", loadError.Diagnostics())
|
||||
}
|
||||
t.Fatalf("layered item replacement: %v", err)
|
||||
}
|
||||
if len(result.Config.Entries) != 1 || result.Config.Entries[0].ID != "current" || result.Config.Entries[0].Count != 0 ||
|
||||
result.Config.Entries[0].Enabled || result.Config.Entries[0].Empty != "" || result.Config.Entries[0].Nullable != nil {
|
||||
t.Fatalf("typed replacement result = %#v", result.Config)
|
||||
}
|
||||
if len(callbackItems) != 2 || len(callbackContexts) != 2 {
|
||||
t.Fatalf("callback sources = %#v; contexts = %#v", callbackItems, callbackContexts)
|
||||
}
|
||||
for _, source := range callbackItems {
|
||||
if source.PlacementMode != configkit.PlacementModeSequenceItem || source.Destination.String() != "/entries" || source.DestinationUnresolved {
|
||||
t.Errorf("callback item source = %#v", source)
|
||||
}
|
||||
}
|
||||
metadata := result.Metadata()
|
||||
for _, field := range []string{"count", "enabled", "empty", "nullable"} {
|
||||
path := configkit.Keys("entries").Index(0).Key(field)
|
||||
if info, ok := metadata.Lookup(path); !ok || !info.Explicit || (field == "nullable") != info.Null {
|
||||
t.Errorf("explicit metadata at %s = %#v, %v", path.String(), info, ok)
|
||||
}
|
||||
}
|
||||
if info, ok := metadata.Lookup(configkit.Keys("entries").Index(0).Key("omitted")); ok && info.Explicit {
|
||||
t.Errorf("metadata marked an omitted zero-valued field explicit: %#v", info)
|
||||
}
|
||||
mainID := ""
|
||||
for _, source := range result.Sources() {
|
||||
if source.Path == mainPath {
|
||||
mainID = source.ID
|
||||
}
|
||||
}
|
||||
currentOrigin, ok := metadata.Lookup(configkit.Keys("entries").Index(0).Key("id"))
|
||||
if !ok || len(currentOrigin.Origin.Locations) != 1 || currentOrigin.Origin.Locations[0].SourceID != mainID || mainID == "" {
|
||||
t.Fatalf("replacement origin = %#v, main source %q", currentOrigin, mainID)
|
||||
}
|
||||
oldRecord, ok := result.Explain(configkit.Keys("entries").Index(1).Key("token"))
|
||||
if !ok || oldRecord.Effective.Present {
|
||||
t.Fatalf("removed appended item explanation = %#v, %v", oldRecord, ok)
|
||||
}
|
||||
maskedHistory := false
|
||||
for _, change := range oldRecord.History {
|
||||
maskedHistory = maskedHistory || change.Before.Redacted || change.After.Redacted
|
||||
}
|
||||
if !maskedHistory {
|
||||
t.Fatal("removed appended item lost historical sensitivity")
|
||||
}
|
||||
var effective bytes.Buffer
|
||||
if err := result.WriteEffective(&effective); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var explanation bytes.Buffer
|
||||
if err := result.WriteExplanation(&explanation, configkit.Keys("entries").Index(1).Key("token")); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, output := range []string{effective.String(), explanation.String()} {
|
||||
for _, canary := range []string{"CURRENT-SECRET-CANARY", "OLD-SECRET-CANARY-A", "OLD-SECRET-CANARY-B"} {
|
||||
if strings.Contains(output, canary) {
|
||||
t.Fatalf("sensitive sequence value leaked: %s", output)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user