fix(site-secrets): one shared secret: reference parser for scanner and MxGateway adapter

Final review M3: SecretReferenceScanner.TryParseSecretReference (trimmed, case-insensitive prefix, trimmed name, empty = not a reference, ${secret:} never matches) is used by the scanner and by MxGatewayDataConnection's ApiKey resolution, so a padded or case-variant reference resolves the name central ships. A bare 'secret:' ApiKey now fails closed. M7: unit test pins stamped hash == ComputeCurrentArtifactHashesAsync with a non-empty Secrets list.
2026-09-28 21:08:34 -04:00
parent b1b49bb36c
commit 67a3950f74
5 changed files with 149 additions and 7 deletions
@@ -46,4 +46,40 @@ public class SecretReferenceScannerTests
        Assert.Equal(["mxgw-key"], refs.Select(r => r.Name));
        Assert.Equal(["GW1"], refs.Single(r => r.Name == "mxgw-key").ReferencedBy);
    }
+
+    // ── Shared parser (final review M3) ──
+
+    [Theory]
+    [InlineData("secret:mxgw-key", "mxgw-key")]
+    [InlineData("SECRET:mxgw-key", "mxgw-key")]
+    [InlineData("  Secret: mxgw-key  ", "mxgw-key")]
+    [InlineData("secret:a/b/c", "a/b/c")]
+    public void TryParseSecretReference_ParsesTrimmedCaseInsensitive(string value, string expected)
+    {
+        Assert.True(SecretReferenceScanner.TryParseSecretReference(value, out var name));
+        Assert.Equal(expected, name);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("secret:")]
+    [InlineData("secret:   ")]
+    [InlineData("${secret:node-local}")]
+    [InlineData("literal-api-key")]
+    [InlineData("see secret:x in docs")]
+    public void TryParseSecretReference_RejectsNonReferences(string? value)
+    {
+        Assert.False(SecretReferenceScanner.TryParseSecretReference(value, out var name));
+        Assert.Equal(string.Empty, name);
+    }
+
+    [Fact]
+    public void Scan_AndParser_AgreeOnThePaddedCaseVariantName()
+    {
+        const string value = " SECRET: mxgw-key ";
+        var shipped = Assert.Single(SecretReferenceScanner.Scan([Dc("GW", $$"""{"ApiKey":"{{value}}"}""")])).Name;
+        Assert.True(SecretReferenceScanner.TryParseSecretReference(value, out var parsed));
+        Assert.Equal(shipped, parsed);
+    }
 }