eric/ConfigKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Detach callback values before publishing configuration

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-06 19:05:28 -05:00
parent 9c94f2b70a
commit f7ca150a7f
5 changed files with 91 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/config.md
View File

@@ -34,7 +34,10 @@ root `T` must satisfy the application schema contract below. With no options it
starts from the Go zero value. A `Definition[T].Defaults` factory, when supplied,
runs exactly once after successful source parsing, schema construction, optional
schema-version checking, and selected-profile loading. Its result is detached before
input is applied.
input is applied. Resolver-provided mutable values are detached before secret lookup
and validation, and a final detached copy prevents equal-valued aliases introduced
by validators from escaping into the returned configuration. The publication copy
preserves already validated secret state without rereading the environment.
The current lifecycle is:

5
docs/roadmap/remediation.md
View File

@@ -76,6 +76,11 @@ regular-file, permitted symlink, containment, and permission tests passing.
## 3. P1 — Detach mutable values introduced by resolution before publication
Status: complete. Added post-resolution and publication ownership copies; the latter
preserves already validated secret state. Regressions cover nested maps/slices,
pointers, direct/helper assignments, validator aliases, and one lookup per load.
Full tests pass with the issue-8 TMPDIR workaround; vet, build and whitespace pass.
Evidence: [resolution.go](../../resolution.go), `Default`/`Normalize`, directly
assign supplied values; `runResolution` projects them but does not clone the typed
object. [load.go](../../load.go) publishes that same object in `Result.Config`.