feat(secrets): source LDAP bind password via ${secret:ldap/mxgateway/bind}; drop plaintext defaults (G-4)

2026-07-16 10:40:07 -04:00
parent a2538039c0
commit b79e119ada
7 changed files with 113 additions and 11 deletions
@@ -32,6 +32,26 @@ public sealed class PreHostSecretExpansionTests
        Assert.Equal(plaintext, config["MxGateway:Ldap:ServiceAccountPassword"]);
    }

+    /// <summary>
+    /// G-4: the shipped <c>appsettings.json</c> sources the LDAP bind password from
+    /// <c>${secret:ldap/mxgateway/bind}</c>. Proves that exact reference at that exact key resolves to
+    /// the seeded plaintext through the same pre-host expander the host runs.
+    /// </summary>
+    [Fact]
+    public async Task ExpandConfiguration_LdapBindReference_ResolvesToSeededPassword()
+    {
+        using var fixture = SecretsFixture.Create();
+        const string bindPassword = "seeded-bind-password";
+        await fixture.SeedAsync("ldap/mxgateway/bind", bindPassword);
+
+        IConfigurationRoot config = fixture.BuildConfig(
+            ("MxGateway:Ldap:ServiceAccountPassword", "${secret:ldap/mxgateway/bind}"));
+
+        await new SecretReferenceExpander(fixture.Resolver).ExpandConfigurationAsync(config, default);
+
+        Assert.Equal(bindPassword, config["MxGateway:Ldap:ServiceAccountPassword"]);
+    }
+
    [Fact]
    public async Task ExpandConfiguration_MissingReference_ThrowsFailClosed()
    {