Resolve typed credentials safely

internal/config/credential_projection.go

@@ -0,0 +1,59 @@
+package config
+
+import configkit "gitea.maximumdirect.net/eric/ConfigKit"
+
+// MarshalYAML exposes only public credential reference names. Resolved values
+// remain available solely through ConfigKit's explicit trusted accessor.
+func (cfg StorageS3Config) MarshalYAML() (any, error) {
+	type safeStorageS3 struct {
+		Bucket          string  `yaml:"bucket"`
+		RootPrefix      string  `yaml:"root_prefix"`
+		Region          string  `yaml:"region"`
+		Endpoint        string  `yaml:"endpoint"`
+		ForcePathStyle  bool    `yaml:"force_path_style"`
+		AccessKeyID     *string `yaml:"access_key_id,omitempty"`
+		SecretAccessKey *string `yaml:"secret_access_key,omitempty"`
+	}
+	return safeStorageS3{
+		Bucket: cfg.Bucket, RootPrefix: cfg.RootPrefix, Region: cfg.Region,
+		Endpoint: cfg.Endpoint, ForcePathStyle: cfg.ForcePathStyle,
+		AccessKeyID: secretReferenceName(cfg.AccessKeyID), SecretAccessKey: secretReferenceName(cfg.SecretAccessKey),
+	}, nil
+}
+
+// MarshalYAML exposes only the public Audita credential reference name.
+func (cfg AuditaConfig) MarshalYAML() (any, error) {
+	type safeAudita struct {
+		Binary                   string   `yaml:"binary"`
+		Timeout                  string   `yaml:"timeout"`
+		LLMAPIKey                *string  `yaml:"llm_api_key,omitempty"`
+		Modules                  []string `yaml:"modules"`
+		BaseURL                  string   `yaml:"base_url"`
+		Model                    string   `yaml:"model"`
+		TotalLLMConcurrency      *int     `yaml:"total_llm_concurrency"`
+		ProposalLLMConcurrency   *int     `yaml:"proposal_llm_concurrency"`
+		ValidationModel          string   `yaml:"validation_model"`
+		ValidationLLMConcurrency *int     `yaml:"validation_llm_concurrency"`
+		TranscriptDescription    string   `yaml:"transcript_description"`
+		ConfigPath               string   `yaml:"config_path"`
+		OutputSchema             string   `yaml:"output_schema"`
+		WorkDirRetention         string   `yaml:"work_dir_retention"`
+		Report                   *bool    `yaml:"report"`
+	}
+	return safeAudita{
+		Binary: cfg.Binary, Timeout: cfg.Timeout, LLMAPIKey: secretReferenceName(cfg.LLMAPIKey),
+		Modules: cfg.Modules, BaseURL: cfg.BaseURL, Model: cfg.Model,
+		TotalLLMConcurrency: cfg.TotalLLMConcurrency, ProposalLLMConcurrency: cfg.ProposalLLMConcurrency,
+		ValidationModel: cfg.ValidationModel, ValidationLLMConcurrency: cfg.ValidationLLMConcurrency,
+		TranscriptDescription: cfg.TranscriptDescription, ConfigPath: cfg.ConfigPath,
+		OutputSchema: cfg.OutputSchema, WorkDirRetention: cfg.WorkDirRetention, Report: cfg.Report,
+	}, nil
+}
+
+func secretReferenceName(secret *configkit.Secret) *string {
+	if secret == nil {
+		return nil
+	}
+	name := secret.EnvName()
+	return &name
+}