fix(secrets-cli): reference auditor — InvalidName containment, comment-key parity, name normalization

2026-07-19 09:27:13 -04:00
parent 21f6a0df92
commit e60f2d5dad
2 changed files with 124 additions and 21 deletions
@@ -157,6 +157,50 @@ public sealed class ReferenceAuditorTests : IDisposable
        Assert.Equal(ReferenceStatus.Undecryptable, Assert.Single(findings).Status);
    }

+    [Fact]
+    public async Task Malformed_reference_yields_InvalidName_finding_without_aborting_audit()
+    {
+        SecretsSession session = await Open(EnvKey(), Config(
+            ("Bad:Ref", "${secret:REPLACE ME!}"),
+            ("Good:Ref", "${secret:api/key}")));
+
+        IReadOnlyList<ReferenceFinding> findings =
+            await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
+
+        Assert.Equal(2, findings.Count);
+        Assert.Equal(ReferenceStatus.InvalidName, findings.Single(f => f.SecretName == "REPLACE ME!").Status);
+        Assert.Equal(ReferenceStatus.Missing, findings.Single(f => f.SecretName == "api/key").Status);
+    }
+
+    [Fact]
+    public async Task Comment_keys_are_skipped_like_the_expander()
+    {
+        SecretsSession session = await Open(EnvKey(), Config(
+            ("Docs:_comment", "Reference a secret like ${secret:example/thing}"),
+            ("Real:Key", "${secret:api/key}")));
+
+        IReadOnlyList<ReferenceFinding> findings =
+            await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
+
+        ReferenceFinding finding = Assert.Single(findings);
+        Assert.Equal("api/key", finding.SecretName);
+    }
+
+    [Fact]
+    public async Task Case_variant_references_collapse_to_one_normalized_finding()
+    {
+        SecretsSession session = await Open(EnvKey(), Config(
+            ("A:Conn", "${secret:Db/Pw}"),
+            ("B:Conn", "${secret:db/pw}")));
+
+        IReadOnlyList<ReferenceFinding> findings =
+            await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
+
+        ReferenceFinding finding = Assert.Single(findings);
+        Assert.Equal("db/pw", finding.SecretName);
+        Assert.Equal(["A:Conn", "B:Conn"], finding.ConfigPaths);
+    }
+
    [Fact]
    public async Task Degraded_session_reports_PresenceOnly_status()
    {