Runtime state guard: hold a provider reference's node and module to the mesh's name pattern, so no credential rides in one (issue 1126)

2026-10-28 21:49:52 +01:00
parent 1a0424117a
commit 2966c1e32c
2 changed files with 8 additions and 4 deletions
@@ -20,8 +20,9 @@ func TestACredentialNamedFieldIsFoundAnywhereInAValue(t *testing.T) {
 		`{"secret":{"value":"s"}}`:                                       "secret",
 		`{"secret":{"node":"anchor","module":"mesh-vault","value":"s"}}`: "secret",
 		`{"secret":{"node":"anchor","module":7}}`:                        "secret",
-		`{"secret":["s"]}`:                                               "secret",
-		`{"bindings":{"secret":{"token":"s"}}}`:                          "secret",
+		`{"secret":{"node":"anchor","module":"hunter2 Bearer s3cr3t"}}`:  "secret",
+		`{"secret":["s"]}`:                      "secret",
+		`{"bindings":{"secret":{"token":"s"}}}`: "secret",
 	} {
 		if got := credentialField(json.RawMessage(value)); got != want {
 			t.Errorf("%s: found %q, want %q", value, got, want)