Runtime state guard: a name holding an object is data, not a credential, so a placement's binding of the provision secret is kept (issue 1126)

node-tools/internal/bus/state.go

@@ -391,7 +391,9 @@ func valueOf(raw []byte) json.RawMessage {
 var credentialEndings = []string{"password", "passwd", "secret", "token", "credential", "credentials",
 	"authorization", "apikey", "privatekey", "accesskey", "cookie"}
 
-// credentialField is the first field anywhere in a JSON value whose name says it is a credential, or "".
+// credentialField is the first field anywhere in a JSON value whose name says it is a credential, or "". A credential is
+// a value, so a name counts only where it holds one or a list of them: a name holding an object is data naming a structure (a
+// placement's binding of the provision "secret" to the vault, issue 1126), whose own fields are looked at in turn.
 func credentialField(value json.RawMessage) string {
 	var v any
 	if json.Unmarshal(value, &v) != nil {
@@ -408,8 +410,9 @@ func credentialField(value json.RawMessage) string {
 			sort.Strings(keys)
 			for _, k := range keys {
 				norm := strings.NewReplacer("-", "", "_", "", " ", "").Replace(strings.ToLower(k))
+				_, object := t[k].(map[string]any)
 				for _, end := range credentialEndings {
-					if strings.HasSuffix(norm, end) {
+					if strings.HasSuffix(norm, end) && !object {
 						return k
 					}
 				}

node-tools/internal/bus/state_test.go

@@ -15,6 +15,11 @@ func TestACredentialNamedFieldIsFoundAnywhereInAValue(t *testing.T) {
 		`{"clientSecret":"s"}`:                                      "clientSecret",
 		`{"maxTokens":4096,"name":"a","generation":3}`:              "",
 		`"just a string"`:                                           "",
+		// Issue 1126: a placement binds the provision "secret" to the vault; the name holds a structure, not a value.
+		`{"bindings":{"secret":{"node":"anchor","module":"mesh-vault"}}}`: "",
+		`{"secret":{"value":"s"}}`:              "",
+		`{"secret":["s"]}`:                      "secret",
+		`{"bindings":{"secret":{"token":"s"}}}`: "token",
 	} {
 		if got := credentialField(json.RawMessage(value)); got != want {
 			t.Errorf("%s: found %q, want %q", value, got, want)