@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/perl/feature/secrets_feature.pm

@@ -325,10 +325,18 @@ sub transport {
 }
 
 
-# One resolution, shared by every request. A settled SUCCESS is kept only
-# when caching is on (`cache: false` means every resolve asks the chain
-# again); a FAILURE is never kept, so a transient vault outage cannot
-# poison the client permanently - the next request asks the chain again.
+# One resolution, shared by every request. A settled HIT is kept only when
+# caching is on (`cache: false` means every resolve asks the chain again);
+# a FAILURE is never kept, so a transient vault outage cannot poison the
+# client permanently - the next request asks the chain again.
+#
+# A MISS is not kept either, however caching is set. That rule is
+# sekreto's, not this feature's: `A miss is never cached: the next read
+# asks again`, in sekreto's own source. Keeping a settled miss here would
+# override that from the layer above, and a secret provisioned after
+# startup - a mounted file, a policy granted a minute late - would never be
+# picked up for the life of the client. `cache` is about caching a HIT; it
+# was never a promise to keep saying no.
 #
 # Returns an error MESSAGE (a string) or undef.
 sub resolve {
@@ -337,23 +345,26 @@ sub resolve {
   return $self->{initerr} if defined $self->{initerr};
   return undef if $self->{resolved} && $self->{cache};
 
-  my $err = $self->_resolve_once();
-  $self->{resolved} = defined($err) ? 0 : 1;
+  my ($err, $hit) = $self->_resolve_once();
+  $self->{resolved} = (defined($err) || !$hit) ? 0 : 1;
 
   return $err;
 }
 
 
+# Resolve once, answering ($err, $hit): whether a credential came out of
+# it. That flag is the whole of what resolve needs to tell a cacheable HIT
+# from a miss it must not keep.
 sub _resolve_once {
   my ($self) = @_;
 
-  return undef unless defined $self->{sek};
+  return (undef, 0) unless defined $self->{sek};
 
   # sekreto's miss-vs-error rule, inherited: `try` returns undef on a MISS
   # and dies on a provider ERROR.
   my $found;
   my $ok = eval { $found = $self->{sek}->try($self->{secretname}); 1 };
-  return _trim(defined $@ && '' ne "$@" ? "$@" : 'secrets: provider failed')
+  return (_trim(defined $@ && '' ne "$@" ? "$@" : 'secrets: provider failed'), 0)
     if !$ok;
 
   if (!defined $self->{exchange}) {
@@ -363,7 +374,7 @@ sub _resolve_once {
     # way - it seats FIRST in the chain as a memory provider, so the chain
     # HITS while one is set and this branch is unreachable.)
     $self->{cred} = defined $found ? "$found" : '';
-    return undef;
+    return (undef, defined($found) ? 1 : 0);
   }
 
   # Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -381,13 +392,23 @@ sub _resolve_once {
   # A starting access token was supplied. Spend it: if it is stale the API
   # answers with an expiry status and the wrapper buys another, which is
   # the same path expiry takes anyway.
-  return undef if '' ne $self->{cred};
+  return (undef, 1) if '' ne $self->{cred};
+
+  # `auth => undef` is the documented way to send NO credential, and a
+  # purchase is a credential-bearing call: the refresh token goes to the
+  # token endpoint in the request body. _with_refresh honours suppression
+  # for the RETRY, but it runs after this - by then the refresh token has
+  # already left the process, and no later check can call it back. The
+  # suppression has to be honoured here, before the first purchase, or it
+  # only ever half-held.
+  return (undef, 0)
+    if !defined ProjectNameHelpers::gp($self->{liveopts}, 'auth');
 
   my ($token, $err) = $self->_buy();
-  return $err if defined $err;
+  return ($err, 0) if defined $err;
 
   $self->{cred} = $token;
-  return undef;
+  return (undef, 1);
 }
 
 

package/project/.sdk/tm/perl/t/feature/secrets/secrets.t

@@ -510,6 +510,45 @@ SKIP: {
 
 # --- cache -----------------------------------------------------------------
 
+# A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this feature
+# used to override from the layer above.
+#
+# DEFAULT caching here, which is the whole point: `cache: true` is about
+# holding a HIT (the block after next pins that half), and keeping the
+# settled resolution after a miss meant the chain was never asked again for
+# the life of the client. A secret provisioned after startup (a mounted
+# file, a vault policy granted a minute late) was invisible forever.
+{
+  clear_env();
+
+  my $calls = 0;
+  my $present = 0;
+  my $late = {
+    'lookup' => sub { $calls++; return $present ? 'LATEKEY01' : undef },
+    'describe' => sub { 'late:test' },
+  };
+
+  my $stub = counting_fetch();
+  my $sdk = secrets_sdk($stub, { 'providers' => [$late] });
+
+  $sdk->direct({ 'path' => '/one' });
+  no_credential($stub->{calls}[0]{auth},
+    'the chain has nothing yet, so no credential should go out');
+
+  my $asked = $calls;
+  ok(0 < $asked, 'the chain was asked at least once');
+
+  # The secret is provisioned while the client is live.
+  $present = 1;
+
+  $sdk->direct({ 'path' => '/two' });
+
+  ok($asked < $calls,
+    'the MISS was cached: a secret that appears later can never be picked up');
+  credential_is($stub->{calls}[1]{auth}, 'LATEKEY01', 'the late secret goes out');
+}
+
+
 {
   clear_env();
 
@@ -907,6 +946,14 @@ sub exchange_sdk {
     'exchange: a suppressed request must not be retried');
   no_credential(api_calls($stub)->[0]{auth},
     'exchange: no credential may be sent when auth is suppressed');
+
+  # AND NO PURCHASE. resolve runs before _with_refresh's suppression check,
+  # so the refresh token used to go to the token endpoint in a request body
+  # even here. Stopping the retry does not unsend it, and only the token
+  # endpoint can see this.
+  is(scalar @{ token_calls($stub) }, 0,
+    'exchange: auth undef suppressed the credential but the refresh token '
+      . 'was still POSTed to the exchange endpoint');
 }
 
 {

package/project/.sdk/tm/php/feature/SecretsFeature.php

@@ -309,6 +309,14 @@ class ProjectNameSecretsFeature extends ProjectNameBaseFeature
     // is never cached, so a transient vault outage does not poison the
     // client after the vault recovers.
     //
+    // A MISS is not cached either, however caching is set. That rule is
+    // sekreto's, not this feature's: `A miss is never cached: the next read
+    // asks again`, in sekreto's own source. Caching a settled miss here
+    // would override that from the layer above, and a secret provisioned
+    // after startup - a mounted file, a policy granted a minute late -
+    // would never be picked up for the life of the client. `cache` is about
+    // caching a HIT; it was never a promise to keep saying no.
+    //
     // Answers the error rather than throwing it: the caller is the
     // transport gate, whose contract is a [value, err] pair.
     public function resolve(): ?\Throwable
@@ -321,22 +329,25 @@ class ProjectNameSecretsFeature extends ProjectNameBaseFeature
         }
 
         try {
-            $this->resolve_once();
+            $hit = $this->resolve_once();
         } catch (\Throwable $e) {
             return $e;
         }
 
-        if ($this->cache) {
+        if ($this->cache && $hit) {
             $this->resolved = true;
         }
 
         return null;
     }
 
-    private function resolve_once(): void
+    // Resolve once, answering whether a credential came out of it. That
+    // bool is the whole of what resolve() needs to tell a cacheable HIT
+    // from a miss it must not cache.
+    private function resolve_once(): bool
     {
         if (null === $this->sekreto) {
-            return;
+            return false;
         }
 
         // Miss-vs-error: `try` answers null for "no store has it" and
@@ -355,7 +366,7 @@ class ProjectNameSecretsFeature extends ProjectNameBaseFeature
             // chain as a memory provider, so the chain HITS while one is
             // set and the miss branch is unreachable.)
             $this->setcred($found);
-            return;
+            return null !== $found;
         }
 
         // Exchanging: what the chain resolved is the REFRESH token, kept
@@ -377,10 +388,23 @@ class ProjectNameSecretsFeature extends ProjectNameBaseFeature
             // A starting access token was supplied. Spend it: if it is
             // stale the API answers with an expiry status and the wrapper
             // buys another, which is the same path expiry takes anyway.
-            return;
+            return true;
+        }
+
+        // `auth: null` is the documented way to send NO credential, and a
+        // purchase is a credential-bearing call: the refresh token goes to
+        // the token endpoint in the request body. with_refresh honours
+        // suppression for the RETRY, but it runs after this - by then the
+        // refresh token has already left the process, and no later check
+        // can call it back. The suppression has to be honoured here, before
+        // the first purchase, or it only ever half-held.
+        if (null === ($this->liveopts['auth'] ?? null)) {
+            return false;
         }
 
         $this->buy();
+
+        return true;
     }
 
     // Buy a token and try the request again when the API says the current

package/project/.sdk/tm/php/test/feature/secrets/SecretsTest.php

@@ -595,6 +595,74 @@ class ProjectNameSecretsTest extends TestCase
             'the wire saw ' . var_export($last['auth'], true));
     }
 
+    // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+    // feature used to override from the layer above.
+    //
+    // DEFAULT caching here, which is the whole point: `cache: true` is
+    // about holding a HIT, and caching the settled resolution after a miss
+    // meant the chain was never asked again for the life of the client. A
+    // secret provisioned after startup (a mounted file, a vault policy
+    // granted a minute late) was invisible forever, and the only workaround
+    // was giving up hit caching entirely.
+    public function testACachedMissIsReasked(): void
+    {
+        $present = false;
+        $calls = 0;
+        $wire = new ProjectNameSecretsWire();
+        $client = $this->secretsClient($wire, [
+            'feature' => ['secrets' => [
+                'active' => true,
+                'providers' => [$this->customProvider(
+                    function (string $_name) use (&$present, &$calls) {
+                        $calls++;
+                        return $present ? 'LATEKEY01' : null;
+                    })],
+            ]],
+        ]);
+
+        $this->driveOp($client, $wire);
+        $first = $wire->api()[0];
+        $this->assertFalse($first['has'] && '' !== (string)$first['auth'],
+            'the chain has nothing yet, so no credential should go out');
+
+        $asked = $calls;
+        $this->assertGreaterThan(0, $asked);
+
+        // The secret is provisioned while the client is live.
+        $present = true;
+
+        $this->driveOp($client, $wire);
+        $api = $wire->api();
+        $this->assertCredential($api[count($api) - 1]['auth'], 'LATEKEY01');
+
+        $this->assertGreaterThan($asked, $calls,
+            'the MISS was cached: a secret that appears later can never be picked up');
+    }
+
+    // The other half of the same rule: a HIT is still cached by default, so
+    // the fix above must not turn every request into a chain walk.
+    public function testACachedHitIsKept(): void
+    {
+        $calls = 0;
+        $wire = new ProjectNameSecretsWire();
+        $client = $this->secretsClient($wire, [
+            'feature' => ['secrets' => [
+                'active' => true,
+                'providers' => [$this->customProvider(
+                    function (string $_name) use (&$calls) {
+                        $calls++;
+                        return 'STABLEKEY01';
+                    })],
+            ]],
+        ]);
+
+        $this->driveOp($client, $wire);
+        $this->driveOp($client, $wire);
+
+        $this->assertSame(1, $calls,
+            'a hit must be cached under the default cache: true');
+    }
+
     public function testAuthNullSuppressesTheCredentialChainOrNoChain(): void
     {
         $this->setenv('APIKEY', 'ENVKEY03');
@@ -708,6 +776,36 @@ class ProjectNameSecretsTest extends TestCase
         $this->assertCredential($api[1]['auth'], 'ACCESS02');
     }
 
+    // `auth: null` SUPPRESSES THE PURCHASE, not just the retry.
+    //
+    // resolve() runs before with_refresh's suppression check, so the
+    // refresh token used to go to the token endpoint in a request body even
+    // here. Stopping the retry does not unsend it - this asserts on the
+    // token endpoint, which is the half the API-header assertions cannot
+    // see.
+    public function testAuthNullBuysNoTokenAtAll(): void
+    {
+        $this->setenv('REFRESH_TOKEN', 'REFRESH01');
+        $wire = new ProjectNameSecretsWire();
+        $wire->apistatus = [401];
+
+        $client = $this->secretsClient($wire, [
+            'auth' => null,
+            'feature' => $this->secretsOpts([
+                'name' => 'refresh_token',
+                'exchange' => ['active' => true],
+            ]),
+        ]);
+
+        $this->driveOp($client, $wire);
+
+        $this->assertCount(0, $wire->token(),
+            'auth null suppressed the credential but the refresh token was ' .
+            'still POSTed to the exchange endpoint');
+        $this->assertFalse($wire->api()[0]['has'],
+            'no credential may be sent when auth is suppressed');
+    }
+
     // A second refusal on a token bought moments ago is a real failure, not
     // a spin: exactly one rebuy, and the refusal is returned as it stands.
     public function testASecondRefusalIsReturnedAsIs(): void

package/project/.sdk/tm/py/pkg/feature/secrets_feature.py

@@ -201,21 +201,31 @@ class ProjectNameSecretsFeature(ProjectNameBaseFeature):
     def PreSpec(self, _ctx):
         return self.resolve()
 
-    # Resolve the apikey before the first request. A successful resolve is
+    # Resolve the apikey before the first request. A successful HIT is
     # reused while caching is on; with `cache: False` the chain is asked
     # again on every call - holding the first answer forever would make
     # the documented option a lie. A provider ERROR raises (fails the op)
     # and leaves nothing cached, so a transient vault outage does not
     # poison the client after the vault recovers.
+    #
+    # A MISS is not marked resolved either, however caching is set. That
+    # rule is sekreto's, not this feature's: `A miss is never cached: the
+    # next read asks again`, in sekreto's own source. Marking a settled
+    # miss here would override that from the layer above, and a secret
+    # provisioned after startup - a mounted file, a policy granted a minute
+    # late - would never be picked up for the life of the client. `cache`
+    # is about caching a HIT; it was never a promise to keep saying no.
     def resolve(self):
         if self._resolved and self._cache:
             return
-        self._resolve_once()
-        self._resolved = True
+        self._resolved = self._resolve_once()
 
+    # Resolve once, reporting whether a credential came out of it. That
+    # bool is the whole of what resolve() needs to tell a cacheable HIT
+    # from a miss it must not retain.
     def _resolve_once(self):
         if self._sekreto is None:
-            return
+            return False
 
         # Miss-vs-error: `try_` answers None for "no store has it" and
         # RAISES for "a store could not answer" - only the miss falls
@@ -242,7 +252,7 @@ class ProjectNameSecretsFeature(ProjectNameBaseFeature):
                 if self._client.options.get("apikey") == self._lastset:
                     self._client.options["apikey"] = ""
                 self._lastset = None
-            return
+            return found is not None
 
         # Exchanging: what the chain resolved is the REFRESH token, kept
         # for every later purchase. A miss is not fatal here - an explicit
@@ -255,10 +265,22 @@ class ProjectNameSecretsFeature(ProjectNameBaseFeature):
             # A starting access token was supplied. Spend it: if it is
             # stale the API answers 401 and the transport wrapper buys
             # another, which is the same path expiry takes anyway.
-            return
+            return True
+
+        # `auth: None` is the documented way to send NO credential, and a
+        # purchase is a credential-bearing call: the refresh token goes to
+        # the token endpoint in the request body. _with_refresh honours
+        # suppression for the RETRY, but it runs after this - by then the
+        # refresh token has already left the process, and no later check
+        # can call it back. The suppression has to be honoured here, before
+        # the first purchase, or it only ever half-held.
+        if self._client.options_map().get("auth") is None:
+            return False
 
         self._client.options["apikey"] = self._buy()
 
+        return True
+
     # Buy an access token with the refresh token. (ts shares one in-flight
     # purchase between concurrent async callers; python resolves
     # synchronously, so the sharing that remains observable is the

package/project/.sdk/tm/py/test/feature/secrets/test_secrets.py

@@ -107,6 +107,18 @@ class TestSecrets(unittest.TestCase):
         self.assertEqual(1, len(transport.calls))
         return transport.calls[0]["fetchdef"].get("headers") or {}
 
+    def _lastwire(self, sdk, transport):
+        """Drive one operation and read the headers off the LAST call, so a
+        test can operate more than once on the same client."""
+        utility = sdk._utility
+        ctx = utility.make_context({"opname": "load"}, sdk.get_root_ctx())
+        utility.feature_hook(ctx, "PreSpec")
+
+        fetchdef = sdk.prepare({"path": "/"})
+        res, err = utility.fetcher(ctx, fetchdef["url"], fetchdef)
+        self.assertIsNone(err)
+        return transport.calls[-1]["fetchdef"].get("headers") or {}
+
     def assert_credential(self, headers, token):
         # The Authorization header carries the SPEC's credential prefix,
         # which a TEMPLATE cannot know - assert on the CREDENTIAL and let
@@ -196,6 +208,71 @@ class TestSecrets(unittest.TestCase):
         with self.assertRaises(RuntimeError):
             utility.feature_hook(ctx, "PreSpec")
 
+    # --- a miss is not a cacheable answer ---
+
+    # sekreto's own rule, which this feature used to override from the
+    # layer above: `A miss is never cached: the next read asks again`.
+    #
+    # DEFAULT caching in both tests below, which is the whole point.
+    # `cache: True` is about holding a HIT; holding the settled miss meant
+    # the chain was never asked again for the life of the client, so a
+    # secret provisioned after startup (a mounted file, a vault policy
+    # granted a minute late) was invisible forever.
+    def test_a_cached_miss_is_reasked(self):
+        state = {"present": False, "calls": 0}
+
+        def lookup(name):
+            state["calls"] += 1
+            return "LATEKEY01" if state["present"] else None
+
+        sdk, transport = self._sdk({
+            "feature": {"secrets": {
+                "active": True,
+                "providers": [{"lookup": lookup, "describe": lambda: "late:test"}],
+            }},
+        })
+
+        headers = self._lastwire(sdk, transport)
+        self.assertNotIn("authorization", headers,
+                         "the chain has nothing yet, so no credential "
+                         "should go out")
+
+        asked = state["calls"]
+        self.assertLess(0, asked)
+
+        # The secret is provisioned while the client is live.
+        state["present"] = True
+
+        headers = self._lastwire(sdk, transport)
+        self.assert_credential(headers, "LATEKEY01")
+
+        self.assertLess(asked, state["calls"],
+                        "the MISS was cached: a secret that appears later "
+                        "can never be picked up")
+
+    def test_a_cached_hit_is_kept(self):
+        # The other half of the same rule: a HIT is still cached by
+        # default, so the fix above must not turn every request into a
+        # chain walk.
+        state = {"calls": 0}
+
+        def lookup(name):
+            state["calls"] += 1
+            return "STABLEKEY01"
+
+        sdk, transport = self._sdk({
+            "feature": {"secrets": {
+                "active": True,
+                "providers": [{"lookup": lookup, "describe": lambda: "counting:test"}],
+            }},
+        })
+
+        self._lastwire(sdk, transport)
+        self._lastwire(sdk, transport)
+
+        self.assertEqual(1, state["calls"],
+                         "a hit must be cached under the default cache: True")
+
     # --- auth: None suppression ---
 
     def test_auth_none_still_suppresses_the_credential(self):
@@ -283,6 +360,43 @@ class TestSecretsReviewPins(unittest.TestCase):
             srv.shutdown()
             srv.server_close()
 
+    def test_auth_none_buys_no_token_at_all(self):
+        # `auth: None` SUPPRESSES THE PURCHASE, not just the retry.
+        #
+        # resolve() runs before _with_refresh's suppression check, so the
+        # refresh token used to go to the token endpoint in a request body
+        # even here. Stopping the retry does not unsend it - and only the
+        # token endpoint can see this, which is why the API-header
+        # assertion above is not enough.
+        tricky = "REFRESH01"
+        _TokenEndpoint.refresh_seen = None
+
+        srv = http.server.HTTPServer(("127.0.0.1", 0), _TokenEndpoint)
+        thread = threading.Thread(target=srv.serve_forever, daemon=True)
+        thread.start()
+        try:
+            sdk = secrets_sdk({
+                "base": "http://127.0.0.1:%d/api" % srv.server_port,
+                "auth": None,
+                "feature": {"secrets": {
+                    "active": True,
+                    "name": "refresh_token",
+                    "exchange": {"active": True, "refresh": tricky},
+                }},
+            })
+
+            utility = sdk._utility
+            ctx = utility.make_context({"opname": "load"}, sdk.get_root_ctx())
+            utility.feature_hook(ctx, "PreSpec")
+
+            self.assertIsNone(_TokenEndpoint.refresh_seen,
+                              "auth: None suppressed the credential but the "
+                              "refresh token was still POSTed to the "
+                              "exchange endpoint")
+        finally:
+            srv.shutdown()
+            srv.server_close()
+
     def test_uncached_miss_retracts_the_credential(self):
         # `cache: False` re-asks the chain per operation; when a provider
         # that answered once reports a MISS (a revoked secret), the value

package/project/.sdk/tm/rb/feature/secrets_feature.rb

@@ -222,11 +222,19 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
     _with_refresh(ctx, url, fetchdef, inner)
   end
 
-  # One resolution, shared by every concurrent caller. A settled SUCCESS is
+  # One resolution, shared by every concurrent caller. A settled HIT is
   # kept only when caching is on (`cache: false` means every request asks
   # the chain again); a FAILURE is never cached, so a transient vault
   # outage does not poison the client after the vault recovers.
   #
+  # A MISS is not kept either, however caching is set. That rule is
+  # sekreto's, not this feature's: `A miss is never cached: the next read
+  # asks again`, in sekreto's own source. Keeping a settled miss here would
+  # override that from the layer above, and a secret provisioned after
+  # startup - a mounted file, a policy granted a minute late - would never
+  # be picked up for the life of the client. `cache` is about caching a
+  # HIT; it was never a promise to keep saying no.
+  #
   # Answers the error rather than raising it: the caller is the transport
   # gate, whose contract is a [value, err] pair.
   def resolve
@@ -236,20 +244,23 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
       return nil if @resolved
 
       begin
-        _resolve_once
+        hit = _resolve_once
       rescue StandardError => e
         return e
       end
 
-      @resolved = true if @cache
+      @resolved = true if @cache && hit
       nil
     end
   end
 
   private
 
+  # Resolve once, answering whether a credential came out of it. That
+  # boolean is the whole of what resolve needs to tell a cacheable HIT from
+  # a miss it must not keep.
   def _resolve_once
-    return if @sekreto.nil?
+    return false if @sekreto.nil?
 
     # Miss-vs-error: `try` answers nil for "no store has it" and RAISES for
     # "a store could not answer" - only the miss falls through.
@@ -264,7 +275,7 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
       # the chain HITS while one is set and the miss branch is
       # unreachable.)
       _setcred(found)
-      return
+      return !found.nil?
     end
 
     # Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -283,9 +294,20 @@ class ProjectNameSecretsFeature < ProjectNameBaseFeature
     # A starting access token was supplied. Spend it: if it is stale the
     # API answers with an expiry status and the wrapper buys another, which
     # is the same path expiry takes anyway.
-    return unless apikey.nil? || apikey.empty?
+    return true unless apikey.nil? || apikey.empty?
+
+    # `auth: nil` is the documented way to send NO credential, and a
+    # purchase is a credential-bearing call: the refresh token goes to the
+    # token endpoint in the request body. _with_refresh honours suppression
+    # for the RETRY, but it runs after this - by then the refresh token has
+    # already left the process, and no later check can call it back. The
+    # suppression has to be honoured here, before the first purchase, or it
+    # only ever half-held.
+    return false if @liveopts["auth"].nil?
 
     _buy
+
+    true
   end
 
   # Buy a token and try the request again when the API says the current one