@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/go/test/feature/secrets/secrets_feature_test.go

@@ -488,6 +488,89 @@ func TestSecretsChain(t *testing.T) {
 	})
 }
 
+// A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+// feature used to override from the layer above.
+//
+// DEFAULT caching here, which is the whole point: `cache: true` is about
+// holding a HIT, and holding the settled resolution after a miss meant the
+// chain was never asked again for the life of the client. A secret
+// provisioned after startup (a mounted file, a vault policy granted a
+// minute late) was invisible forever, and the only workaround was giving up
+// hit caching entirely.
+func TestSecretsCachedMissIsReasked(t *testing.T) {
+	var mu sync.Mutex
+	calls := 0
+
+	w := makewire()
+	client := secretsClient(w, map[string]any{
+		"feature": map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						mu.Lock()
+						defer mu.Unlock()
+						calls++
+						// Absent on the first ask, present on the second.
+						if 1 < calls {
+							return "LATEKEY01", true, nil
+						}
+						return "", false, nil
+					},
+				},
+			},
+		}},
+	})
+
+	driveEntityOp(t, client, w)
+	if first := w.api()[0]; first.has && "" != first.auth {
+		t.Fatalf("the first resolve missed, so no credential should go out; got %q", first.auth)
+	}
+
+	driveEntityOp(t, client, w)
+	credentialIs(t, w.api()[len(w.api())-1].auth, "LATEKEY01")
+
+	mu.Lock()
+	defer mu.Unlock()
+	if 1 >= calls {
+		t.Fatal("the chain was asked once and the MISS cached: a secret " +
+			"that appears later can never be picked up")
+	}
+}
+
+// The other half of the same rule: a HIT is still cached by default, so the
+// fix above must not turn every request into a chain walk.
+func TestSecretsCachedHitIsKept(t *testing.T) {
+	var mu sync.Mutex
+	calls := 0
+
+	w := makewire()
+	client := secretsClient(w, map[string]any{
+		"feature": map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						mu.Lock()
+						defer mu.Unlock()
+						calls++
+						return "STABLEKEY01", true, nil
+					},
+				},
+			},
+		}},
+	})
+
+	driveEntityOp(t, client, w)
+	driveEntityOp(t, client, w)
+
+	mu.Lock()
+	defer mu.Unlock()
+	if 1 != calls {
+		t.Fatalf("a hit must be cached under the default cache: true, chain asked %d times", calls)
+	}
+}
+
 // customProvider is a sekreto.Provider built in code (the interface is
 // structural: Lookup + Describe).
 type customProvider struct {
@@ -538,6 +621,39 @@ func TestSecretsExchange(t *testing.T) {
 		credentialIs(t, api[1].auth, "ACCESS02")
 	})
 
+	// `auth: nil` SUPPRESSES THE PURCHASE, not just the retry.
+	//
+	// resolve() runs before withrefresh's suppression check, so the refresh
+	// token used to go to the token endpoint in a request body even here.
+	// Stopping the retry does not unsend it - this asserts on the token
+	// endpoint, which is the half the API-call assertions cannot see.
+	t.Run("auth nil buys no token at all", func(t *testing.T) {
+		os.Setenv(envprefix+"REFRESH_TOKEN", "REFRESH01")
+		defer os.Unsetenv(envprefix + "REFRESH_TOKEN")
+
+		w := makewire()
+		w.apistatus = []int{401}
+
+		client := secretsClient(w, map[string]any{
+			"auth": nil,
+			"feature": secretsOpts(map[string]any{
+				"name":     "refresh_token",
+				"exchange": map[string]any{"active": true},
+			}),
+		})
+
+		driveEntityOp(t, client, w)
+
+		if 0 != len(w.token()) {
+			t.Fatalf("auth nil suppressed the credential but the refresh "+
+				"token was still POSTed to the exchange endpoint (%d calls)",
+				len(w.token()))
+		}
+		if call := w.api()[0]; call.has {
+			t.Fatalf("no credential may be sent when auth is suppressed, got %q", call.auth)
+		}
+	})
+
 	t.Run("test mode buys nothing and needs no token endpoint", func(t *testing.T) {
 		os.Setenv(envprefix+"REFRESH_TOKEN", "REFRESH01")
 		defer os.Unsetenv(envprefix + "REFRESH_TOKEN")
@@ -732,6 +848,129 @@ func TestSecretsDirectPath(t *testing.T) {
 	}
 }
 
+// FAIL CLOSED ON A CONSTRUCTION FAILURE. The chain a project configures
+// can be wrong before a single lookup happens, and Init cannot fail the
+// client construction the way ts's throwing init does - so it HOLDS the
+// error (initerr) and the transport gate refuses to send.
+//
+// The entry pinned here is a bare kind name where a spec belongs. Init's
+// type switch over the providers list had cases for a *ProviderSpec, a
+// Provider and a map, and no default - so the entry was silently DROPPED,
+// the chain got SHORTER rather than broken, and every request went out
+// unauthenticated while the gate had nothing to refuse. That is fail-open
+// by omission, and it survived every other case in this file because each
+// of them configures the chain correctly.
+//
+// Both wire paths - the entity pipeline and Direct - each with a CONTROL
+// leg through the SAME live transport, so a zero means REFUSED and not
+// UNWIRED. The refusal is matched on sekreto's OWN message, so an
+// unrelated failure cannot stand in for it.
+func TestSecretsMalformedProviderEntry(t *testing.T) {
+	// A kind NAME where a provider or spec belongs.
+	malformed := []any{"hashicorp"}
+	const notaprovider = "not a provider or a provider spec"
+
+	workingchain := func(value string) map[string]any {
+		return map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						if "apikey" == name {
+							return value, true, nil
+						}
+						return "", false, nil
+					},
+				},
+			},
+		}}
+	}
+	malformedchain := map[string]any{"secrets": map[string]any{
+		"active":    true,
+		"providers": malformed,
+	}}
+
+	t.Run("fails the entity op and nothing reaches the wire", func(t *testing.T) {
+		// CONTROL FIRST, so the zero below is known to be observable at all.
+		control := makewire()
+		ok := secretsClient(control, map[string]any{"feature": workingchain("INITKEY01")})
+		driveEntityOp(t, ok, control)
+		if 1 != len(control.api()) {
+			t.Fatalf("the control operation did not reach system.fetch exactly once,"+
+				" so this test cannot observe a request going out at all: got %d",
+				len(control.api()))
+		}
+		credentialIs(t, control.api()[0].auth, "INITKEY01")
+
+		// THE RULE.
+		w := makewire()
+		client := secretsClient(w, map[string]any{"feature": malformedchain})
+
+		// The feature must still be INSTALLED: a construction failure that
+		// silently uninstalled it would be the same fail-open by another
+		// route, with nothing downstream gating anything.
+		if nil == secretsFeatureOf(client) {
+			t.Fatal("the secrets feature must stay installed on a construction failure")
+		}
+
+		// Every op the control leg could have taken: the gate sits at the
+		// transport, so an op that never reached it proves nothing either way.
+		driveEntityOpUntil(t, client, "was driven", func() bool { return true })
+
+		if 0 != len(w.api()) {
+			t.Fatalf("a malformed providers entry was DROPPED and the shortened chain"+
+				" sent an UNAUTHENTICATED request: %d calls went out, first %q auth=%q",
+				len(w.api()), w.api()[0].url, w.api()[0].auth)
+		}
+	})
+
+	t.Run("fails Direct rather than sending, with sekreto's own message", func(t *testing.T) {
+		// CONTROL FIRST.
+		control := makewire()
+		res, err := secretsClient(control, map[string]any{
+			"allow":   map[string]any{"op": "direct"},
+			"feature": workingchain("INITKEY01"),
+		}).Direct(map[string]any{"path": "/thing"})
+		if nil != err {
+			t.Fatalf("the control request failed: %v", err)
+		}
+		if ok, _ := res["ok"].(bool); !ok {
+			t.Fatalf("the control request was refused: %v", res["err"])
+		}
+		if 1 != len(control.api()) {
+			t.Fatalf("the control request did not reach system.fetch exactly once,"+
+				" so this test cannot observe a request going out at all: got %d",
+				len(control.api()))
+		}
+		credentialIs(t, control.api()[0].auth, "INITKEY01")
+
+		// THE RULE. Direct runs no feature hook at all, so the ONLY thing
+		// that can refuse it is the transport gate.
+		w := makewire()
+		out, err := secretsClient(w, map[string]any{
+			"allow":   map[string]any{"op": "direct"},
+			"feature": malformedchain,
+		}).Direct(map[string]any{"path": "/thing"})
+		if nil != err {
+			t.Fatalf("direct must report the refusal in-band: %v", err)
+		}
+
+		if 0 != len(w.api()) {
+			t.Fatalf("a malformed providers entry was DROPPED and the shortened chain"+
+				" sent an UNAUTHENTICATED direct request: %d calls went out, first %q auth=%q",
+				len(w.api()), w.api()[0].url, w.api()[0].auth)
+		}
+		if ok, _ := out["ok"].(bool); ok {
+			t.Fatal("a chain that could not be built must refuse the raw path fail-closed")
+		}
+		msg := fmt.Sprint(out["err"])
+		if !strings.Contains(msg, notaprovider) {
+			t.Fatalf("the refusal must carry sekreto's own message (%s), got: %s",
+				notaprovider, msg)
+		}
+	})
+}
+
 // A provider failure closes the transport gate; a later retry that
 // SUCCEEDS reopens it and every waiting operation goes out with the FRESH
 // credential - never the stale pre-failure header, and never nothing.

package/project/.sdk/tm/go/test/omni/omni.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (go/omni.go)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (go/omni.go)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni: the shared multi-language test runner.
 //

package/project/.sdk/tm/go/test/omni/util.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/omni sdk-20260907-0029-0 (go/util.go)
-// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260907-0029-0]
+// VENDORED: @voxgig/omni sdk-20260908-1556-0 (go/util.go)
+// Source: https://github.com/voxgig/omni @ 274708cc2d12b21707d975543953f845f8444be0  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // Omni internal JSON utilities.
 //

package/project/.sdk/tm/go/utility/struct/voxgigstruct.go

@@ -1,5 +1,5 @@
 // VENDORED: @voxgig/struct 0.1.0 (go/voxgigstruct.go)
-// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260907-0029-0]
+// Source: https://github.com/voxgig/struct @ adda9521c828147573df5a8878408a3f2193ddf4  [tag: sdk-20260908-1556-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 /* Copyright (c) 2025 Voxgig Ltd. MIT LICENSE. */