fix(secrets): harden SecretName (reject rooted paths, fail-fast on default) + keep SecretDecryptionException sealed

2026-07-15 16:37:21 -04:00
parent b784c7117f
commit 01911508b9
2 changed files with 36 additions and 4 deletions
@@ -18,4 +18,22 @@ public class SecretNameTests
    [InlineData("../escape")]
    public void RejectsInvalid(string input)
        => Assert.Throws<ArgumentException>(() => new SecretName(input));
+
+    [Theory]
+    [InlineData("/etc/passwd")]  // rooted / absolute
+    [InlineData("/")]            // rooted (starts and ends with '/')
+    [InlineData("sql//foo")]     // empty path segment
+    [InlineData("sql/foo/")]     // trailing '/'
+    public void RejectsRootedOrEmptySegment(string input)
+        => Assert.Throws<ArgumentException>(() => new SecretName(input));
+
+    [Fact]
+    public void DefaultInstance_ThrowsOnValue()
+        => Assert.Throws<InvalidOperationException>(() => _ = default(SecretName).Value);
+
+    [Fact]
+    public void ValidNestedName_RoundTrips()
+        => Assert.Equal(
+            "sql/historiangw/historian-password",
+            new SecretName("sql/historiangw/historian-password").Value);
 }