@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/rb/test/feature/secrets/secrets_feature_test.rb

@@ -574,6 +574,69 @@ class SecretsFeatureTest < Minitest::Test
       "after the chain reports a miss the retracted credential must not go out; the wire saw #{last['auth'].inspect}")
   end
 
+  # A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+  # feature used to override from the layer above.
+  #
+  # DEFAULT caching here, which is the whole point: `cache: true` is about
+  # holding a HIT, and keeping the settled resolution after a miss meant the
+  # chain was never asked again for the life of the client. A secret
+  # provisioned after startup (a mounted file, a vault policy granted a
+  # minute late) was invisible forever, and the only workaround was giving
+  # up hit caching entirely.
+  def test_a_cached_miss_is_reasked
+    present = false
+    calls = 0
+    wire = Wire.new
+    client = secrets_client(wire, {
+      "feature" => { "secrets" => {
+        "active" => true,
+        "providers" => [CustomProvider.new { |_name|
+          calls += 1
+          present ? "LATEKEY01" : nil
+        }],
+      } },
+    })
+
+    drive_op(client, wire)
+    first = wire.api[0]
+    refute(first["has"] && !first["auth"].to_s.empty?,
+      "the chain has nothing yet, so no credential should go out")
+
+    asked = calls
+    assert_operator asked, :>, 0
+
+    # The secret is provisioned while the client is live.
+    present = true
+
+    drive_op(client, wire)
+    assert_credential(wire.api[-1]["auth"], "LATEKEY01")
+
+    assert_operator calls, :>, asked,
+      "the MISS was cached: a secret that appears later can never be picked up"
+  end
+
+  # The other half of the same rule: a HIT is still cached by default, so
+  # the fix above must not turn every request into a chain walk.
+  def test_a_cached_hit_is_kept
+    calls = 0
+    wire = Wire.new
+    client = secrets_client(wire, {
+      "feature" => { "secrets" => {
+        "active" => true,
+        "providers" => [CustomProvider.new { |_name|
+          calls += 1
+          "STABLEKEY01"
+        }],
+      } },
+    })
+
+    drive_op(client, wire)
+    drive_op(client, wire)
+
+    assert_equal 1, calls,
+      "a hit must be cached under the default cache: true"
+  end
+
   def test_auth_nil_suppresses_the_credential_chain_or_no_chain
     setenv("APIKEY", "ENVKEY03")
     wire = Wire.new
@@ -697,6 +760,36 @@ class SecretsFeatureTest < Minitest::Test
     clearenv("REFRESH_TOKEN")
   end
 
+  # `auth: nil` SUPPRESSES THE PURCHASE, not just the retry.
+  #
+  # resolve runs before _with_refresh's suppression check, so the refresh
+  # token used to go to the token endpoint in a request body even here.
+  # Stopping the retry does not unsend it - this asserts on the token
+  # endpoint, which is the half the API-header assertions cannot see.
+  def test_auth_nil_buys_no_token_at_all
+    setenv("REFRESH_TOKEN", "REFRESH01")
+    wire = Wire.new
+    wire.apistatus = [401]
+
+    client = secrets_client(wire, {
+      "auth" => nil,
+      "feature" => secrets_opts({
+        "name" => "refresh_token",
+        "exchange" => { "active" => true },
+      }),
+    })
+
+    drive_op(client, wire)
+
+    assert_equal 0, wire.token.length,
+      "auth nil suppressed the credential but the refresh token was still " \
+      "POSTed to the exchange endpoint"
+    refute wire.api[0]["has"],
+      "no credential may be sent when auth is suppressed"
+  ensure
+    clearenv("REFRESH_TOKEN")
+  end
+
   # A second refusal on a token bought moments ago is a real failure, not a
   # spin: exactly one rebuy, and the refusal is returned as it stands.
   def test_a_second_refusal_is_returned_as_is

package/project/.sdk/tm/rust/feature/secrets.rs

@@ -507,9 +507,17 @@ fn secrets_call(state: &Rc<RefCell<SecretsState>>, arg: &Value) -> Value {
 
 // ---- resolution ---------------------------------------------------------
 
-// One resolution, shared by every request. A settled SUCCESS is kept only
-// when caching is on; a FAILURE is never kept, so a transient vault outage
-// never poisons the client permanently - the next operation asks again.
+// One resolution, shared by every request. A settled HIT is kept only when
+// caching is on; a FAILURE is never kept, so a transient vault outage never
+// poisons the client permanently - the next operation asks again.
+//
+// A MISS is not kept either, however caching is set. That rule is
+// sekreto's, not this feature's: `A miss is never cached: the next read
+// asks again`, in sekreto's own source. Keeping a settled miss here would
+// override that from the layer above, and a secret provisioned after
+// startup - a mounted file, a policy granted a minute late - would never be
+// picked up for the life of the client. `cache` is about caching a HIT; it
+// was never a promise to keep saying no.
 fn resolve(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
     {
         let s = state.borrow();
@@ -522,9 +530,9 @@ fn resolve(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
     }
 
     match resolve_once(state) {
-        Ok(()) => {
+        Ok(hit) => {
             let cache = state.borrow().cache;
-            if cache {
+            if cache && hit {
                 state.borrow_mut().resolved = true;
             }
             Ok(())
@@ -536,11 +544,14 @@ fn resolve(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
     }
 }
 
-fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameError> {
+// Resolve once, answering whether a credential came out of it. That bool is
+// the whole of what resolve needs to tell a cacheable HIT from a miss it
+// must not keep.
+fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<bool, ProjectNameError> {
     let name = {
         let s = state.borrow();
         if s.sek.is_none() {
-            return Ok(());
+            return Ok(false);
         }
         s.secretname.clone()
     };
@@ -568,8 +579,9 @@ fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameErro
             // apikey OPTION is never lost here - it seats FIRST in the
             // chain as a memory provider, so the chain HITS while one is
             // set and the miss branch is unreachable.)
+            let hit = found.is_some();
             s.cred = found.unwrap_or_default();
-            return Ok(());
+            return Ok(hit);
         }
 
         // Exchanging: what the chain resolved is the REFRESH token, kept
@@ -589,11 +601,22 @@ fn resolve_once(state: &Rc<RefCell<SecretsState>>) -> Result<(), ProjectNameErro
             // A starting access token was supplied. Spend it: if it is
             // stale the API answers with an expiry status and the wrapper
             // buys another, which is the same path expiry takes anyway.
-            return Ok(());
+            return Ok(true);
+        }
+
+        // `auth: null` is the documented way to send NO credential, and a
+        // purchase is a credential-bearing call: the refresh token goes to
+        // the token endpoint in the request body. with_refresh honours
+        // suppression for the RETRY, but it runs after this - by then the
+        // refresh token has already left the process, and no later check
+        // can call it back. The suppression has to be honoured here, before
+        // the first purchase, or it only ever half-held.
+        if !authactive(&s.options) {
+            return Ok(false);
         }
     }
 
-    buy(state).map(|_| ())
+    buy(state).map(|_| true)
 }
 
 // ---- the transport seam -------------------------------------------------

package/project/.sdk/tm/rust/tests/feature/secrets/main.rs

@@ -989,6 +989,90 @@ fn cache_false_asks_the_chain_on_every_request() {
     credential_is(call_auth(&wire.api(), 1), "KEY2");
 }
 
+// A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this feature
+// used to override from the layer above.
+//
+// DEFAULT caching here, which is the whole point: `cache: true` is about
+// holding a HIT (the test below pins that half), and keeping the settled
+// resolution after a miss meant the chain was never asked again for the life
+// of the client. A secret provisioned after startup (a mounted file, a vault
+// policy granted a minute late) was invisible forever.
+#[test]
+fn cache_true_re_asks_after_a_miss() {
+    let wire = Wire::new();
+    let calls = Rc::new(RefCell::new(0i64));
+    let present = Rc::new(RefCell::new(false));
+    let n = calls.clone();
+    let p = present.clone();
+
+    let client = sdk(
+        &wire,
+        vec![providers(vec![callable(move |_name| {
+            *n.borrow_mut() += 1;
+            if *p.borrow() {
+                Value::str("LATEKEY01")
+            } else {
+                Value::Noval
+            }
+        })])],
+    );
+
+    client
+        .direct(jo(vec![("path", Value::str("/one"))]))
+        .expect("direct");
+    assert_eq!(
+        call_auth(&wire.api(), 0),
+        None,
+        "the chain has nothing yet, so no credential should go out: {}",
+        wire.trace()
+    );
+
+    let asked = *calls.borrow();
+    assert!(0 < asked, "the chain was never asked");
+
+    // The secret is provisioned while the client is live.
+    *present.borrow_mut() = true;
+
+    client
+        .direct(jo(vec![("path", Value::str("/two"))]))
+        .expect("direct");
+
+    assert!(
+        asked < *calls.borrow(),
+        "the MISS was cached: a secret that appears later can never be picked up"
+    );
+    credential_is(call_auth(&wire.api(), 1), "LATEKEY01");
+}
+
+// The other half of the same rule: a HIT is still cached by default, so the
+// fix above must not turn every request into a chain walk.
+#[test]
+fn cache_true_keeps_a_hit() {
+    let wire = Wire::new();
+    let calls = Rc::new(RefCell::new(0i64));
+    let n = calls.clone();
+
+    let client = sdk(
+        &wire,
+        vec![providers(vec![callable(move |_name| {
+            *n.borrow_mut() += 1;
+            Value::str("STABLEKEY01")
+        })])],
+    );
+
+    for _ in 0..2 {
+        client
+            .direct(jo(vec![("path", Value::str("/thing"))]))
+            .expect("direct");
+    }
+
+    assert_eq!(
+        *calls.borrow(),
+        1,
+        "a hit must be cached under the default cache: true"
+    );
+}
+
 // An UNCACHED miss after a hit is a revocation: the resolved value must
 // stop going out.
 #[test]
@@ -1403,6 +1487,18 @@ fn exchange_auth_null_suppresses_and_is_never_retried() {
         "no credential may be sent when auth is suppressed: {}",
         wire.trace()
     );
+
+    // AND NO PURCHASE. resolve() runs before with_refresh's suppression
+    // check, so the refresh token used to go to the token endpoint in a
+    // request body even here. Stopping the retry does not unsend it, and
+    // only the token endpoint can see this.
+    assert_eq!(
+        wire.token().len(),
+        0,
+        "auth null suppressed the credential but the refresh token was still \
+         POSTed to the exchange endpoint: {}",
+        wire.trace()
+    );
 }
 
 // The exchange with NO system.fetch: the ordinary case, where make_options

package/project/.sdk/tm/scala/feature/SecretsFeature.scala

@@ -264,18 +264,29 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
     else withrefresh(ctx, url, fetchdef, inner)
   }
 
-  // One resolution, shared by every concurrent caller. A settled SUCCESS is
+  // One resolution, shared by every concurrent caller. A settled HIT is
   // kept only when caching is on; a FAILURE is never kept, so the next
   // operation asks the chain again.
+  //
+  // A MISS is not kept either, however caching is set. That rule is
+  // sekreto's, not this feature's: `A miss is never cached: the next read
+  // asks again`, in sekreto's own source. Keeping a settled miss here would
+  // override that from the layer above, and a secret provisioned after
+  // startup - a mounted file, a policy granted a minute late - would never
+  // be picked up for the life of the client. `cache` is about caching a
+  // HIT; it was never a promise to keep saying no.
   private def resolve(): Unit = lock.synchronized {
     if (!this.settled) {
-      resolveonce()
-      if (this.docache) this.settled = true
+      val hit = resolveonce()
+      if (this.docache && hit) this.settled = true
     }
   }
 
-  private def resolveonce(): Unit = {
-    if (this.sek == null) return
+  // Resolve once, reporting whether a credential came out of it. That
+  // boolean is the whole of what resolve() needs to tell a cacheable HIT
+  // from a miss it must not keep.
+  private def resolveonce(): Boolean = {
+    if (this.sek == null) return false
 
     // tryget returns None for a MISS and RAISES for an ERROR. That is the
     // whole miss-vs-error rule, and it is sekreto's, not this feature's.
@@ -288,7 +299,7 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
       // here - it seats FIRST in the chain as a memory provider, so the
       // chain HITS while one is set and this branch is unreachable.)
       this.cred = found.getOrElse("")
-      return
+      return found.isDefined
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -302,9 +313,20 @@ class SecretsFeature extends BaseFeature("secrets", "0.1.0", true) {
     // A starting access token was supplied. Spend it: if it is stale the API
     // answers with an expiry status and the wrapper buys another, which is
     // the same path expiry takes anyway.
-    if ("" != this.cred) return
+    if ("" != this.cred) return true
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. withrefresh honours suppression
+    // for the RETRY, but it runs after this - by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (this.liveopts == null || this.liveopts.get("auth") == null) return false
 
     buyonce()
+
+    true
   }
 
   // Buy a token and try the request again when the API says the current one

package/project/.sdk/tm/scala/sdktest/feature/secrets/SecretsTestMain.scala

@@ -612,6 +612,69 @@ object SecretsTestMain {
         "out; the wire saw \"" + w.authof(last) + "\"")
   }
 
+  // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // DEFAULT caching here, which is the whole point: `cache: true` is about
+  // holding a HIT, and keeping the settled resolution after a miss meant the
+  // chain was never asked again for the life of the client. A secret
+  // provisioned after startup (a mounted file, a vault policy granted a
+  // minute late) was invisible forever, and the only workaround was giving
+  // up hit caching entirely.
+  private def testCachedMissIsReasked(): Unit = {
+    var present = false
+    var calls = 0
+    val prov = new CodeProvider(_ => {
+      calls += 1
+      if (present) Some("LATEKEY01") else None
+    }, "late")
+
+    val w = new Wire()
+    val client = secretsClient(w, "feature" -> secretsOpts(jlist(prov)))
+
+    check("cachedmiss.drive", driveOneCall(client, w),
+      "no entity op reached the transport")
+    if (w.api().nonEmpty) {
+      val first = w.api().head
+      check("cachedmiss.nocred", !w.hasauth(first) || "" == w.authof(first),
+        "the chain has nothing yet, so no credential should go out")
+    }
+
+    val asked = calls
+    check("cachedmiss.asked", 0 < asked, "the chain was never asked")
+
+    // The secret is provisioned while the client is live.
+    present = true
+    check("cachedmiss.drive2", driveOneCall(client, w),
+      "the second op never reached the transport")
+
+    check("cachedmiss.reasked", asked < calls,
+      "the MISS was cached: a secret that appears later can never be picked up")
+    if (w.api().nonEmpty) {
+      credentialIs("cachedmiss.late", w.authof(w.api().last), "LATEKEY01")
+    }
+  }
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  private def testCachedHitIsKept(): Unit = {
+    var calls = 0
+    val prov = new CodeProvider(_ => {
+      calls += 1
+      Some("STABLEKEY01")
+    }, "counting")
+
+    val w = new Wire()
+    val client = secretsClient(w, "feature" -> secretsOpts(jlist(prov)))
+
+    check("cachedhit.drive", driveOneCall(client, w),
+      "no entity op reached the transport")
+    check("cachedhit.drive2", driveOneCall(client, w),
+      "the second op never reached the transport")
+
+    eqi("cachedhit.once", 1, calls)
+  }
+
   private def testSecretNameConfigurable(): Unit = {
     val w = new Wire()
     val client = secretsClient(w,
@@ -899,6 +962,12 @@ object SecretsTestMain {
         "no credential may be sent when auth is suppressed, got \"" +
           w.authof(w.api().head) + "\"")
     }
+
+    // AND NO PURCHASE. resolve() runs before withrefresh's suppression
+    // check, so the refresh token used to go to the token endpoint in a
+    // request body even here. Stopping the retry does not unsend it, and
+    // only the token endpoint can see this.
+    eqi("exchange.authnull.nobuy", 0, w.token().length)
   }
 
   // No refresh token anywhere is an ERROR, not an unauthenticated call.
@@ -945,6 +1014,8 @@ object SecretsTestMain {
       "failClosedUnbuildableChain" -> testFailClosedUnbuildableChain,
       "transientRecovery" -> testTransientRecovery,
       "uncachedMissRetracts" -> testUncachedMissRetracts,
+      "cachedMissIsReasked" -> testCachedMissIsReasked,
+      "cachedHitIsKept" -> testCachedHitIsKept,
       "secretNameConfigurable" -> testSecretNameConfigurable,
       "sekretoIsLive" -> testSekretoIsLive,
       "pluginVocabulary" -> testPluginVocabulary,

package/project/.sdk/tm/ts/src/feature/secrets/SecretsFeature.ts

@@ -167,18 +167,25 @@ class SecretsFeature extends BaseFeature {
   // the op — sekreto's miss-vs-error rule: never fall through to an
   // unauthenticated request because a store was broken.
   //
-  // The promise is cleared on REJECTION, and after success when caching is
-  // off. Holding a settled promise forever would mean a transient vault
-  // outage poisoned the client permanently — every later operation failing
-  // with the original error long after the vault recovered — and it would
-  // make the documented `cache: false` a lie, since the chain would never
-  // be asked a second time.
+  // The promise is cleared on REJECTION, after success when caching is off,
+  // and after a MISS however caching is set. Holding a settled promise
+  // forever would mean a transient vault outage poisoned the client
+  // permanently — every later operation failing with the original error long
+  // after the vault recovered — and it would make the documented
+  // `cache: false` a lie, since the chain would never be asked a second time.
+  //
+  // The MISS rule is sekreto's, not this feature's: `A miss is never cached:
+  // the next read asks again`, in sekreto's own source. Retaining a settled
+  // miss here would override that from the layer above, and a secret
+  // provisioned after startup — a mounted file, a policy granted a minute
+  // late — would never be picked up for the life of the client. `cache` is
+  // about caching a HIT; it was never a promise to keep saying no.
   resolve(): Promise<void> {
     if (null == this._resolving) {
       const inflight = this._resolveonce()
         .then(
-          () => {
-            if (!this._cache) {
+          (hit: boolean) => {
+            if (!this._cache || !hit) {
               this._resolving = undefined
             }
           },
@@ -194,9 +201,12 @@ class SecretsFeature extends BaseFeature {
   }
 
 
-  private async _resolveonce(): Promise<void> {
+  // Resolve once, reporting whether a credential came out of it. That
+  // boolean is the whole of what resolve() needs to tell a cacheable HIT
+  // from a miss it must not retain.
+  private async _resolveonce(): Promise<boolean> {
     if (null == this._sekreto) {
-      return
+      return false
     }
 
     const found = await this._sekreto.try(this._secretname)
@@ -208,7 +218,7 @@ class SecretsFeature extends BaseFeature {
         // resolved value lands where the sync auth path already looks.
         this._client._options.apikey = found
       }
-      return
+      return undefined !== found
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -222,10 +232,23 @@ class SecretsFeature extends BaseFeature {
       // A starting access token was supplied. Spend it: if it is stale the
       // API answers 401 and the transport wrapper buys another, which is
       // the same path expiry takes anyway.
-      return
+      return true
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. _withRefresh honours suppression
+    // for the RETRY, but it runs after this — by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (null == this._client.options().auth) {
+      return false
     }
 
     this._client._options.apikey = await this._buy()
+
+    return true
   }
 
 

package/project/.sdk/tm/ts/test/feature/secrets/Secrets.test.ts

@@ -260,6 +260,71 @@ describe('secrets', () => {
   })
 
 
+  // A MISS IS NOT A CACHEABLE ANSWER — sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // Default caching here, deliberately: `cache: true` is about holding a
+  // HIT, and holding the settled promise after a miss meant the chain was
+  // never asked again for the life of the client. A secret provisioned
+  // after startup (a mounted file, a vault policy granted a minute late)
+  // was invisible forever, and the only workaround was giving up hit
+  // caching entirely.
+  test('active: a MISS is re-asked, so a late secret is picked up',
+    async () => {
+      let calls = 0
+      const sdk = (SDK as any).test({}, {
+        feature: {
+          secrets: {
+            active: true,
+            providers: [{
+              lookup(_name: string): string | undefined {
+                calls++
+                // Absent on the first ask, present on the second.
+                return 1 < calls ? 'LATEKEY' : undefined
+              },
+              describe() { return 'late:test' },
+            }],
+          },
+        },
+      })
+
+      const first = await sdk.prepare({ path: '/' })
+      assert.equal(first.headers['authorization'], undefined,
+        'the first resolve missed, so no credential should go out')
+
+      const second = await sdk.prepare({ path: '/' })
+      credentialIs(second.headers['authorization'], 'LATEKEY')
+
+      assert.ok(1 < calls,
+        'the chain was asked once and the MISS cached: a secret that ' +
+        'appears later can never be picked up')
+    })
+
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  test('active: a HIT is still cached by default', async () => {
+    let calls = 0
+    const sdk = (SDK as any).test({}, {
+      feature: {
+        secrets: {
+          active: true,
+          providers: [{
+            lookup(_name: string): string { calls++; return 'KEY' + calls },
+            describe() { return 'counting:test' },
+          }],
+        },
+      },
+    })
+
+    await sdk.prepare({ path: '/' })
+    await sdk.prepare({ path: '/' })
+
+    assert.equal(calls, 1,
+      'a hit must be cached under the default cache: true')
+  })
+
+
   test('active: secret name is configurable', async () => {
     process.env[ENVPREFIX + 'API_TOKEN'] = 'TOKKEY01'
     try {
@@ -679,6 +744,14 @@ describe('secrets exchange', () => {
     assert.equal(stub.api().length, 1, 'a suppressed request must not be retried')
     assert.equal(stub.api()[0].auth, undefined,
       'no credential may be sent when auth is suppressed')
+
+    // AND NO PURCHASE. This is the half the API-call assertions cannot see:
+    // resolve() runs before _withRefresh's suppression check, so the
+    // refresh token used to go to the token endpoint in a request body
+    // even here. Stopping the retry does not unsend it.
+    assert.equal(stub.token().length, 0,
+      'auth: null suppressed the credential but the refresh token was ' +
+      'still POSTed to the exchange endpoint')
   })