Detach callback values before publishing configuration

projection.go

@@ -34,10 +34,11 @@ type valueVisit struct {
 }
 
 type valueOperation struct {
-	schema *schemaDescriptor
-	limits projectionLimits
-	active map[valueVisit]bool
-	nodes  int
+	preserveSecrets bool
+	schema          *schemaDescriptor
+	limits          projectionLimits
+	active          map[valueVisit]bool
+	nodes           int
 }
 
 func projectConfiguration(schema *schemaDescriptor, value reflect.Value, limits projectionLimits) (*document.Node, *projectionIssue) {
@@ -49,10 +50,15 @@ func projectConfiguration(schema *schemaDescriptor, value reflect.Value, limits
 }
 
 func cloneConfiguration(schema *schemaDescriptor, value reflect.Value, limits projectionLimits) (reflect.Value, *projectionIssue) {
+	return cloneConfigurationState(schema, value, limits, false)
+}
+
+// Publication copies preserve only already-validated private reference state.
+func cloneConfigurationState(schema *schemaDescriptor, value reflect.Value, limits projectionLimits, preserveSecrets bool) (reflect.Value, *projectionIssue) {
 	if schema == nil || schema.root == nil || !value.IsValid() || value.Type() != schema.root.typeOf {
 		return reflect.Value{}, &projectionIssue{code: CodeSchemaUnsupportedType, message: "configuration value does not match its schema"}
 	}
-	operation := valueOperation{schema: schema, limits: limits, active: make(map[valueVisit]bool)}
+	operation := valueOperation{schema: schema, limits: limits, active: make(map[valueVisit]bool), preserveSecrets: preserveSecrets}
 	return operation.clone(value, schema.root, Path{}, 0)
 }
 
@@ -354,7 +360,9 @@ func (o *valueOperation) clone(value reflect.Value, descriptor *typeDescriptor,
 	case descriptorSecret:
 		result := reflect.New(value.Type()).Elem()
 		reference := value.Interface().(Secret)
-		if reference.specified {
+		if o.preserveSecrets {
+			result.Set(value)
+		} else if reference.specified {
 			result.Set(reflect.ValueOf(SecretEnv(reference.EnvName())))
 		}
 		return result, nil