feat(artifacts): secrets and missing-secret markers in the artifact revision hash

2026-09-28 17:32:42 -04:00
parent 8aecd55db5
commit ebc55c5f72
3 changed files with 131 additions and 1 deletions
@@ -46,6 +46,48 @@ public class ArtifactRevisionHashServiceTests
            SmtpConfigurations: null,
            timestamp ?? DateTimeOffset.UtcNow);

+    private static SecretArtifact Secret(string name, long rev) =>
+        new(name, "text/plain",
+            Ciphertext: [1, 2, 3],
+            Nonce: [4, 5],
+            Tag: [6, 7],
+            WrappedDek: [8, 9],
+            WrapNonce: [10, 11],
+            WrapTag: [12, 13],
+            KekId: "kek-1",
+            Revision: rev,
+            CreatedUtc: DateTimeOffset.Parse("2026-01-01T00:00:00Z"),
+            UpdatedUtc: DateTimeOffset.Parse("2026-01-02T00:00:00Z"));
+
+    private static DeployArtifactsCommand Cmd(
+        IReadOnlyList<SecretArtifact>? secrets = null,
+        IReadOnlyList<string>? missing = null) =>
+        Command() with { Secrets = secrets, MissingSecrets = missing };
+
+    [Fact]
+    public void SecretChanges_MoveTheHash_ButOrderDoesNot()
+    {
+        var svc = new ArtifactRevisionHashService();
+        var a = Secret("A", rev: 1);
+        var b = Secret("B", rev: 1);
+        var baseline = svc.ComputeHash(Cmd(secrets: [a, b]));
+
+        Assert.Equal(baseline, svc.ComputeHash(Cmd(secrets: [b, a])));
+        Assert.NotEqual(baseline, svc.ComputeHash(Cmd(secrets: [a with { Revision = 2 }, b])));
+        Assert.NotEqual(baseline, svc.ComputeHash(Cmd(secrets: [a with { WrappedDek = [42] }, b])));
+        Assert.NotEqual(baseline, svc.ComputeHash(Cmd(secrets: [a with { KekId = "kek-B" }, b])));
+    }
+
+    [Fact]
+    public void MissingSecret_HashesDifferentlyFromPresent()
+    {
+        var svc = new ArtifactRevisionHashService();
+
+        Assert.NotEqual(
+            svc.ComputeHash(Cmd(secrets: [Secret("A", 1)])),
+            svc.ComputeHash(Cmd(missing: ["A"])));
+    }
+
    [Fact]
    public void ComputeHash_PreSecretsGoldenValue_IsUnchanged()
    {