From 23f5babe33c6b1d024e9118859445370a46dbbc7 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Wed, 28 Oct 2026 21:46:35 +0100
Subject: [PATCH] Runtime state guard: a name holding an object is data, not a
 credential, so a placement's binding of the provision secret is kept (issue
 1126)

---
 node-tools/internal/bus/state.go      | 7 +++++--
 node-tools/internal/bus/state_test.go | 5 +++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/node-tools/internal/bus/state.go b/node-tools/internal/bus/state.go
index e2db7b3..f4f6adb 100644
--- a/node-tools/internal/bus/state.go
+++ b/node-tools/internal/bus/state.go
@@ -391,7 +391,9 @@ func valueOf(raw []byte) json.RawMessage {
 var credentialEndings = []string{"password", "passwd", "secret", "token", "credential", "credentials",
 	"authorization", "apikey", "privatekey", "accesskey", "cookie"}
 
-// credentialField is the first field anywhere in a JSON value whose name says it is a credential, or "".
+// credentialField is the first field anywhere in a JSON value whose name says it is a credential, or "". A credential is
+// a value, so a name counts only where it holds one or a list of them: a name holding an object is data naming a structure (a
+// placement's binding of the provision "secret" to the vault, issue 1126), whose own fields are looked at in turn.
 func credentialField(value json.RawMessage) string {
 	var v any
 	if json.Unmarshal(value, &v) != nil {
@@ -408,8 +410,9 @@ func credentialField(value json.RawMessage) string {
 			sort.Strings(keys)
 			for _, k := range keys {
 				norm := strings.NewReplacer("-", "", "_", "", " ", "").Replace(strings.ToLower(k))
+				_, object := t[k].(map[string]any)
 				for _, end := range credentialEndings {
-					if strings.HasSuffix(norm, end) {
+					if strings.HasSuffix(norm, end) && !object {
 						return k
 					}
 				}
diff --git a/node-tools/internal/bus/state_test.go b/node-tools/internal/bus/state_test.go
index 9f191c4..f157be7 100644
--- a/node-tools/internal/bus/state_test.go
+++ b/node-tools/internal/bus/state_test.go
@@ -15,6 +15,11 @@ func TestACredentialNamedFieldIsFoundAnywhereInAValue(t *testing.T) {
 		`{"clientSecret":"s"}`:                                      "clientSecret",
 		`{"maxTokens":4096,"name":"a","generation":3}`:              "",
 		`"just a string"`:                                           "",
+		// Issue 1126: a placement binds the provision "secret" to the vault; the name holds a structure, not a value.
+		`{"bindings":{"secret":{"node":"anchor","module":"mesh-vault"}}}`: "",
+		`{"secret":{"value":"s"}}`:              "",
+		`{"secret":["s"]}`:                      "secret",
+		`{"bindings":{"secret":{"token":"s"}}}`: "token",
 	} {
 		if got := credentialField(json.RawMessage(value)); got != want {
 			t.Errorf("%s: found %q, want %q", value, got, want)