fix(secrets): route the unset-token harness through the real hub composition (review drift-risk)

An internal validateEagerly seam on AddZbSecretsGrpcHub replaces the harness's hand-copied registration fragment, so the deny-all second-layer tests exercise the production wiring and cannot drift from it. Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1
2026-08-07 06:52:26 -04:00
parent 3e3748b985
commit 5f81e65684
2 changed files with 36 additions and 19 deletions
@@ -43,7 +43,20 @@ public static class SecretsGrpcHubServerExtensions
    public static IServiceCollection AddZbSecretsGrpcHub(
        this IServiceCollection services,
        IConfiguration configuration,
-        string sectionPath = "Secrets:GrpcHub")
+        string sectionPath = "Secrets:GrpcHub") =>
+        AddZbSecretsGrpcHubCore(services, configuration, sectionPath, validateEagerly: true);
+
+    /// <summary>
+    /// The whole composition, with the eager validation optionally skipped. Internal so the test
+    /// harness can exercise the interceptor's deny-all second layer over the wire through the REAL
+    /// registration path — a hand-copied fragment of this method in the harness would silently
+    /// drift when this method changes. Production callers always validate eagerly.
+    /// </summary>
+    internal static IServiceCollection AddZbSecretsGrpcHubCore(
+        IServiceCollection services,
+        IConfiguration configuration,
+        string sectionPath,
+        bool validateEagerly)
    {
        ArgumentNullException.ThrowIfNull(services);
        ArgumentNullException.ThrowIfNull(configuration);
@@ -74,10 +87,13 @@ public static class SecretsGrpcHubServerExtensions
        // startup failure and the runtime warning both name the key this host actually reads.
        services.PostConfigure<SecretsGrpcHubServerOptions>(options => options.SectionPath = sectionPath);

-        var eager = new SecretsGrpcHubServerOptions { SectionPath = sectionPath };
-        section.Bind(eager);
-        eager.SectionPath = sectionPath;
-        eager.Validate();
+        if (validateEagerly)
+        {
+            var eager = new SecretsGrpcHubServerOptions { SectionPath = sectionPath };
+            section.Bind(eager);
+            eager.SectionPath = sectionPath;
+            eager.Validate();
+        }

        // Singleton so the "unconfigured" warning is emitted once per process rather than once per
        // interceptor instance; the gRPC interceptor activator prefers a registered instance.
@@ -216,23 +216,24 @@ internal sealed class SecretsHubTestServer : IAsyncDisposable
    /// </summary>
    /// <remarks>
    /// <c>AddZbSecretsGrpcHub</c> refuses this configuration at registration — which is the intended
-    /// first line of defence and is pinned elsewhere — so the pieces are wired here the way that
-    /// extension wires them, minus the eager validation. That is precisely the case the interceptor's
-    /// deny-all exists for: a host that built the options some other way. Without this path the
-    /// second layer could only ever be tested against a hand-constructed interceptor, never over the
-    /// wire.
+    /// first line of defence and is pinned elsewhere — so this path goes through the REAL composition
+    /// via its internal <c>validateEagerly: false</c> seam, changing nothing else. That is precisely
+    /// the case the interceptor's deny-all exists for: a host that built the options some other way.
+    /// Without this path the second layer could only ever be tested against a hand-constructed
+    /// interceptor, never over the wire.
    /// </remarks>
    /// <param name="store">The store the hub would serve.</param>
    /// <returns>The running hub.</returns>
-    public static Task<SecretsHubTestServer> StartWithNoTokenConfiguredAsync(ISecretStore store) =>
-        StartAsync(store, services =>
-        {
-            services.Configure<SecretsGrpcHubServerOptions>(options => options.BearerToken = string.Empty);
-            services.AddSingleton<SecretsHubAuthInterceptor>();
-            services.AddGrpc()
-                .AddServiceOptions<SecretsHubService>(
-                    options => options.Interceptors.Add<SecretsHubAuthInterceptor>());
-        });
+    public static Task<SecretsHubTestServer> StartWithNoTokenConfiguredAsync(ISecretStore store)
+    {
+        IConfiguration configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>())
+            .Build();
+
+        return StartAsync(store, services =>
+            SecretsGrpcHubServerExtensions.AddZbSecretsGrpcHubCore(
+                services, configuration, "Secrets:GrpcHub", validateEagerly: false));
+    }

    private static async Task<SecretsHubTestServer> StartAsync(
        ISecretStore store, Action<IServiceCollection> registerHub)