Classify source version evidence at original paths

2026-10-15 15:55:16 +00:00
parent 1f95cf905a
commit fed591183b
4 changed files with 185 additions and 13 deletions
--- a/internal/engine/secret_classification_test.go
+++ b/internal/engine/secret_classification_test.go
@@ -1,6 +1,9 @@
 package engine

-import "testing"
+import (
+	"reflect"
+	"testing"
+)

 func TestSecretPathCollectionKeepsParsedContributions(t *testing.T) {
 	for _, pointer := range []string{"", "/", "/records/0", "/records/a~1b~0/01"} {
@@ -77,3 +80,92 @@ func TestSecretPredicateReceivesDetachedHistoricalPath(t *testing.T) {
 		t.Fatalf("classification after predicate mutation = %#v, predicate called: %v", classified, seen)
 	}
 }
+
+func TestSourceVersionEvidenceSensitivityUsesOriginalMountedPaths(t *testing.T) {
+	const canary = "PRIVATE-VERSION-CANARY"
+	type credential struct {
+		Value  string `yaml:"credential" configkit:"secret"`
+		Public string `yaml:"public"`
+	}
+	type account struct {
+		Token string `yaml:"token"`
+	}
+	type tenant struct {
+		Groups   map[string][]credential `yaml:"groups"`
+		Account  account                 `yaml:"account" configkit:"secret"`
+		Settings map[string]string       `yaml:"settings"`
+		Labels   map[string]string       `yaml:"labels"`
+	}
+	type configuration struct {
+		Tenant tenant `yaml:"tenant"`
+	}
+	schema, issue := buildSchema(reflect.TypeFor[configuration](), testSecretBinding())
+	if issue != nil {
+		t.Fatal(issue)
+	}
+
+	destination := Keys("tenant")
+	sequencePath := Keys("groups").Key("blue").Index(2).Key("credential")
+	accountPath := Keys("account", "token")
+	predicatePath := Keys("settings", "private")
+	nullPath := Keys("settings", "nullable")
+	absentPath := Keys("settings", "missing")
+	publicPath := Keys("labels", "public")
+	evidence := []*sourceVersionEvidence{
+		{
+			path: sequencePath.clone(), resolvedPath: sequencePath.clone(), destination: destination.clone(),
+			version:   Version{Present: true, Text: canary},
+			ancestors: []sourceVersionAncestor{{}, {path: Keys("groups")}, {path: Keys("groups").Key("blue")}, {path: Keys("groups").Key("blue").Index(2)}, {path: sequencePath.clone()}},
+		},
+		{
+			path: accountPath.clone(), resolvedPath: accountPath.clone(), destination: destination.clone(),
+			version:   Version{Present: true, Text: canary},
+			ancestors: []sourceVersionAncestor{{}, {path: Keys("account")}, {path: accountPath.clone()}},
+		},
+		{path: predicatePath.clone(), resolvedPath: predicatePath.clone(), destination: destination.clone(), version: Version{Present: true, Text: canary}},
+		{path: nullPath.clone(), resolvedPath: nullPath.clone(), destination: destination.clone(), version: Version{Present: true, Null: true}},
+		{path: absentPath.clone(), resolvedPath: absentPath.clone(), destination: destination.clone()},
+		{path: publicPath.clone(), resolvedPath: publicPath.clone(), destination: destination.clone(), version: Version{Present: true, Text: canary}},
+	}
+
+	final := parseCompositionDocument(t, "final", "tenant:\n  groups:\n    blue:\n      - public: shifted-neighbor\n  labels:\n    public: visible\n")
+	var sawOriginalSequencePath, sawAncestorPredicate bool
+	classified := classifySecretPathsWithEvidence(schema, func(path Path) bool {
+		if path.String() == appendDestination(destination, predicatePath).String() {
+			return true
+		}
+		if path.String() == appendDestination(destination, nullPath).String() {
+			return true
+		}
+		if path.String() == appendDestination(destination, absentPath).String() {
+			return true
+		}
+		if path.String() == appendDestination(destination, Keys("account")).String() {
+			sawAncestorPredicate = true
+			return true
+		}
+		if path.String() == appendDestination(destination, sequencePath).String() {
+			sawOriginalSequencePath = len(path.segments) == 5 && path.segments[3].kind == pathSegmentIndex && path.segments[3].index == 2
+		}
+		return false
+	}, Metadata{}, final, []historyApplication{{path: destination, value: final}}, evidence)
+
+	for _, path := range []Path{
+		appendDestination(destination, sequencePath),
+		appendDestination(destination, Keys("account")),
+		appendDestination(destination, predicatePath),
+		appendDestination(destination, nullPath),
+		appendDestination(destination, absentPath),
+	} {
+		if !classified[path.String()] {
+			t.Errorf("evidence path %s was not classified: %#v", path, classified)
+		}
+	}
+	shiftedNeighbor := appendDestination(destination, Keys("groups").Key("blue").Index(0).Key("public"))
+	if classified[shiftedNeighbor.String()] {
+		t.Fatalf("shifted neighboring payload was classified from declaration evidence: %#v", classified)
+	}
+	if classified[appendDestination(destination, publicPath).String()] || !sawOriginalSequencePath || !sawAncestorPredicate {
+		t.Fatalf("unclassified or semantic evidence candidates = %#v; original path seen %v, ancestor predicate seen %v", classified, sawOriginalSequencePath, sawAncestorPredicate)
+	}
+}