A file's secrets are kept entry by entry: the box that runs at one secret is reused only there, where it opens to the same value; pin mesh-sdk 70de942 (issue 1126, C1; the seed-7 probe)

internal/selfcompose/selfcompose_test.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"slices"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -505,6 +506,39 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	if got := delivery.SealsIn(New(coreEnv).keepRunning(ownComp, nil))["core-box#sealed"]; got != rotatedBox {
 		t.Errorf("the node's own core box after a restart is %s, want the one its key holds %s", got, rotatedBox)
 	}
+	// Issue 1126, C1, the seed-7 probe: each entry of a file's secrets (catalogue's intoFile, the shape captured from it
+	// with the module a composition names) is a slot of its own: the box that runs at that entry is kept where it opens
+	// to the same value; one at another entry is not, though it opens to the same.
+	b.mu.Lock()
+	sealedAt["box-again"] = sealedAt[rotatedBox]
+	sealedAt["box-other"] = sealedAt[rotatedBox] + 100
+	b.mu.Unlock()
+	ini := func(db, key string) delivery.Composed {
+		return delivery.Composed{Node: "n1", Module: "grafana", Resources: []json.RawMessage{json.RawMessage(
+			`{"content":"[database]\npassword = ${secret:postgres-database}\n[security]\nsecret_key = ${secret:secret-key}\n",` +
+				`"id":"grafana.ini","mode":"0600","module":"grafana","path":"/etc/grafana/grafana.ini","secrets":{"postgres-database":` +
+				strconv.Quote(db) + `,"secret-key":` + strconv.Quote(key) + `},"type":"file"}`)}}
+	}
+	for _, row := range []struct {
+		name string
+		held delivery.Seals
+		want string
+	}{
+		{"the box that runs at its entry", delivery.Seals{"grafana.ini#secrets.postgres-database": rotatedBox}, rotatedBox},
+		{"a box at another entry", delivery.Seals{"grafana.ini#secrets.secret-key": rotatedBox}, "box-again"},
+	} {
+		secretsEnv := coreEnv
+		secretsEnv.Held = func(module string) (delivery.Seals, []string) {
+			if module == "grafana" {
+				return row.held, nil
+			}
+			return nil, nil
+		}
+		got := delivery.SealsIn(New(secretsEnv).keepRunning(ini("box-again", "box-other"), nil))
+		if got["grafana.ini#secrets.postgres-database"] != row.want || got["grafana.ini#secrets.secret-key"] != "box-other" {
+			t.Errorf("%s: the secrets kept are %v", row.name, got)
+		}
+	}
 
 	// The pair credentials asked (ADR 0550 §5): the keys go to the vault's own with their role, a consumer's comes back as
 	// a credential held, a provider's as the grant's copy, each sealed to n1's key, the value first had kept.