Collect sensitivity directly from document trees

internal/engine/secret_classification_test.go

@@ -0,0 +1,23 @@
+package engine
+
+import "testing"
+
+func TestSecretPredicateReceivesDetachedHistoricalPath(t *testing.T) {
+	path := Keys("records").Key("1")
+	metadata := Metadata{history: map[string][]Change{
+		path.String(): {{Path: path}},
+	}}
+	seen := false
+	classified := classifySecretPaths(nil, func(candidate Path) bool {
+		if candidate.String() != path.String() {
+			return false
+		}
+		seen = true
+		candidate.segments[0].key = "changed"
+		return true
+	}, metadata, nil, nil)
+
+	if !seen || !classified[path.String()] || classified["/changed/1"] {
+		t.Fatalf("classification after predicate mutation = %#v, predicate called: %v", classified, seen)
+	}
+}