Runtime state guard: a name holding an object is data, not a credential, so a placement's binding of the provision secret is kept (issue 1126)

2026-10-28 21:47:06 +01:00
parent 27266f99a3
commit 23f5babe33
2 changed files with 10 additions and 2 deletions
@@ -15,6 +15,11 @@ func TestACredentialNamedFieldIsFoundAnywhereInAValue(t *testing.T) {
 		`{"clientSecret":"s"}`:                                      "clientSecret",
 		`{"maxTokens":4096,"name":"a","generation":3}`:              "",
 		`"just a string"`:                                           "",
+		// Issue 1126: a placement binds the provision "secret" to the vault; the name holds a structure, not a value.
+		`{"bindings":{"secret":{"node":"anchor","module":"mesh-vault"}}}`: "",
+		`{"secret":{"value":"s"}}`:              "",
+		`{"secret":["s"]}`:                      "secret",
+		`{"bindings":{"secret":{"token":"s"}}}`: "token",
 	} {
 		if got := credentialField(json.RawMessage(value)); got != want {
 			t.Errorf("%s: found %q, want %q", value, got, want)