Classify source version evidence at original paths

internal/engine/secret.go

@@ -8,6 +8,10 @@ type secretDependency struct {
 }
 
 func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, metadata Metadata, final *document.Node, applications []historyApplication, projections ...*document.Node) map[string]bool {
+	return classifySecretPathsWithEvidence(schema, predicate, metadata, final, applications, nil, projections...)
+}
+
+func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Path) bool, metadata Metadata, final *document.Node, applications []historyApplication, evidence []*sourceVersionEvidence, projections ...*document.Node) map[string]bool {
 	paths := make(map[string]Path)
 	for _, application := range applications {
 		walkDocument(application.value, application.path, func(path Path, _ *document.Node) {
@@ -71,6 +75,32 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 		classifyProjection(tree)
 	}
 	classifyProjection(final)
+	evidenceSecrets := make(map[string]bool)
+	seenEvidence := make(map[string][]Path)
+	classifyEvidence := func(destination, local Path) {
+		path := appendDestination(destination, local)
+		pointer := path.String()
+		for _, seen := range seenEvidence[pointer] {
+			if sameSecretPath(seen, path) {
+				return
+			}
+		}
+		seenEvidence[pointer] = append(seenEvidence[pointer], path.clone())
+		classifyEvidencePath(evidenceSecrets, schema, predicate, path)
+	}
+	for _, item := range evidence {
+		if item == nil {
+			continue
+		}
+		candidate := item.resolvedPath
+		if !candidate.valid() {
+			candidate = item.path
+		}
+		classifyEvidence(item.destination, candidate)
+		for _, ancestor := range item.ancestors {
+			classifyEvidence(item.destination, ancestor.path)
+		}
+	}
 	for pointer, path := range paths {
 		if root, ok := schemaSecretRoot(schema, path); ok {
 			secret[root.String()] = true
@@ -79,7 +109,36 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 			secret[pointer] = true
 		}
 	}
-	return closeSecretDependencies(paths, secret, dependencies, inherited)
+	classified := closeSecretDependencies(paths, secret, dependencies, inherited)
+	for pointer, sensitive := range evidenceSecrets {
+		if sensitive {
+			classified[pointer] = true
+		}
+	}
+	return classified
+}
+
+func classifyEvidencePath(secret map[string]bool, schema *schemaDescriptor, predicate func(Path) bool, path Path) {
+	pointer := path.String()
+	if root, ok := schemaSecretRoot(schema, path); ok {
+		secret[root.String()] = true
+	}
+	if predicate != nil && predicate(path.clone()) {
+		secret[pointer] = true
+	}
+}
+
+func sameSecretPath(left, right Path) bool {
+	if len(left.segments) != len(right.segments) {
+		return false
+	}
+	for index, segment := range left.segments {
+		other := right.segments[index]
+		if segment.kind != other.kind || segment.key != other.key || segment.index != other.index {
+			return false
+		}
+	}
+	return true
 }
 
 func addSecretPath(paths map[string]Path, pointer string) {