test(secrets): cover ReferencedBy dedup within one connection and case-insensitive bootstrap exclusion

2026-09-28 17:29:52 -04:00
parent 01cb1f5652
commit 738e458755
1 changed files with 14 additions and 0 deletions
@@ -30,6 +30,20 @@ public class SecretReferenceScannerTests
    [InlineData("""{"Port":5000}""")]
    [InlineData("not json")]
    [InlineData("""{"Psk":"secret:SB-GRPC-PSK-site-a"}""")]
+    [InlineData("""{"Psk":"secret:sb-grpc-psk-site-a"}""")]
    public void IgnoresNonReferences(string json)
        => Assert.Empty(SecretReferenceScanner.Scan([Dc("C", json)]));
+
+    [Fact]
+    public void ReferencedBy_DeduplicatesWhenOneConnectionRefsTheSameSecretMultipleTimes()
+    {
+        var refs = SecretReferenceScanner.Scan([
+            Dc(
+                "GW1",
+                """{"a":"secret:mxgw-key","b":["secret:mxgw-key","secret:mxgw-key"]}""",
+                """{"ApiKey":"secret:mxgw-key"}"""),
+        ]);
+        Assert.Equal(["mxgw-key"], refs.Select(r => r.Name));
+        Assert.Equal(["GW1"], refs.Single(r => r.Name == "mxgw-key").ReferencedBy);
+    }
 }