eric/ConfigKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Preserve header sensitivity across colliding path shapes

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-15 22:17:49 +00:00
parent 25cb3c47e7
commit e5a6df7af7
5 changed files with 134 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
internal/engine/secret.go
View File

@@ -75,6 +75,19 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
classifyProjection(tree)
}
classifyProjection(final)
classifyPath := func(path Path) {
if root, ok := schemaSecretRoot(schema, path); ok {
secret[root.String()] = true
}
if predicate != nil && predicate(path.clone()) {
secret[path.String()] = true
}
}
for _, path := range paths {
classifyPath(path)
}
// Classify each original evidence shape before folding results into pointer
// sensitivity. Numeric mapping keys and sequence indices can share a pointer.
for _, item := range evidence {
if item == nil {
continue
@@ -83,25 +96,18 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
if !candidate.valid() {
candidate = item.path
}
addSecretEvidencePath(paths, item.destination, candidate)
classifyPath(addSecretEvidencePath(paths, item.destination, candidate))
for _, ancestor := range item.ancestors {
addSecretEvidencePath(paths, item.destination, ancestor.path)
}
}
for pointer, path := range paths {
if root, ok := schemaSecretRoot(schema, path); ok {
secret[root.String()] = true
}
if predicate != nil && predicate(path.clone()) {
secret[pointer] = true
classifyPath(addSecretEvidencePath(paths, item.destination, ancestor.path))
}
}
return closeSecretDependencies(paths, secret, dependencies, inherited)
}
func addSecretEvidencePath(paths map[string]Path, destination, local Path) {
func addSecretEvidencePath(paths map[string]Path, destination, local Path) Path {
path := appendDestination(destination, local)
paths[path.String()] = path.clone()
addSecretPath(paths, path.String())
return path
}
func addSecretPath(paths map[string]Path, pointer string) {