fix(secrets): ${secret:} expander skips comment keys (_-prefixed leaf) — 0.1.2

Live HistorianGateway boot caught that the expander scanned a '_secretsComment' appsettings value documenting the ${secret:...} syntax, tried to resolve the literal example token, and crashed boot. The family uses _*Comment keys pervasively, so skip any config key whose leaf segment starts with '_' (the _comment convention). Functional keys never lead with '_'.
2026-07-16 04:16:25 -04:00
parent 76124590f0
commit 9bd3c76d96
3 changed files with 47 additions and 2 deletions
@@ -103,4 +103,30 @@ public sealed class SecretReferenceExpanderTests
        await Assert.ThrowsAsync<SecretNotFoundException>(
            () => expander.ExpandConfigurationAsync(config, CancellationToken.None));
    }
+
+    [Fact]
+    public async Task ExpandConfigurationAsync_SkipsCommentKeys()
+    {
+        // A "_comment" key may document the ${secret:...} syntax with a literal (even malformed or
+        // not-yet-seeded) example token; it must be left untouched — never resolved, never throwing —
+        // while a real sibling key still expands. Regression: an unseeded/ellipsis example in a comment
+        // previously crashed boot (SecretName rejects '...').
+        SecretReferenceExpander expander = Expander(("sql/foo", "hunter2"));
+        IConfigurationRoot config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["_secretsComment"] = "e.g. Password=${secret:...} or ${secret:sql/not-seeded}",
+                ["Nested:_comment"] = "also skipped: ${secret:sql/also-absent}",
+                ["ConnectionStrings:Db"] = "Server=.;Password=${secret:sql/foo}",
+            })
+            .Build();
+
+        await expander.ExpandConfigurationAsync(config, CancellationToken.None);
+
+        // Comment keys untouched (literal token preserved, no throw despite absent/malformed names).
+        Assert.Equal("e.g. Password=${secret:...} or ${secret:sql/not-seeded}", config["_secretsComment"]);
+        Assert.Contains("${secret:sql/also-absent}", config["Nested:_comment"]);
+        // Real key still expanded.
+        Assert.Equal("Server=.;Password=hunter2", config["ConnectionStrings:Db"]);
+    }
 }