fix: complete raw secret provider coverage

Author: shirkevich

cmd/secret/set_test.go

@@ -107,6 +107,13 @@ func TestRunSecretSet_GlobalScopeWithoutComponentPreservesType(t *testing.T) {
 	svc := newFakeSecretService()
 	svc.scopes = map[string]secrets.Scope{"SHARED_TOKEN": secrets.ScopeGlobal}
 	installService(t, svc, nil)
+	originalLoadService := loadServiceFn
+	var loadedScope secretScope
+	loadServiceFn = func(scope secretScope) (secretService, error) {
+		loadedScope = scope
+		return originalLoadService(scope)
+	}
+	t.Cleanup(func() { loadServiceFn = originalLoadService })
 	overrideEnumerateScopes(t, []scopeEntry{
 		{
 			Stack:         "dev",
@@ -122,75 +129,96 @@ func TestRunSecretSet_GlobalScopeWithoutComponentPreservesType(t *testing.T) {
 	err := runSecretSubcommand(t, "set", "SHARED_TOKEN=v1", "--stack", "dev", "--type", "helm")
 	require.NoError(t, err)
 	require.Len(t, svc.setCalls, 1)
+	assert.Equal(t, "helm", loadedScope.ComponentType)
 }
 
 func TestFindGlobalSetContext(t *testing.T) {
-	t.Run("enumeration error", func(t *testing.T) {
-		sentinel := errors.New("stack enumeration failed")
-		overrideEnumerateScopes(t, nil, sentinel)
-
-		_, _, err := findGlobalSetContext(secretScope{Stack: "dev"}, "SHARED_TOKEN")
-		require.ErrorIs(t, err, errUtils.ErrRequiredFlagNotProvided)
-	})
-
-	t.Run("no matching declaration", func(t *testing.T) {
-		overrideEnumerateScopes(t, []scopeEntry{
-			{
-				Stack:         "prod",
-				Component:     "other-stack-service",
-				ComponentType: "helm",
-				Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"}),
-			},
-			{
-				Stack:         "dev",
-				Component:     "other-type-service",
-				ComponentType: "terraform",
-				Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"}),
-			},
-			{
-				Stack:         "dev",
-				Component:     "example-service",
-				ComponentType: "helm",
-				Section:       secretDeclarationSection("OTHER_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"}),
+	sharedSection := secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"})
+	tests := []struct {
+		name              string
+		entries           []scopeEntry
+		enumerationErr    error
+		scope             secretScope
+		expectedComponent string
+		expectedType      string
+		expectedErr       error
+	}{
+		{
+			name:           "enumeration error",
+			enumerationErr: errors.New("stack enumeration failed"),
+			scope:          secretScope{Stack: "dev"},
+			expectedErr:    errUtils.ErrRequiredFlagNotProvided,
+		},
+		{
+			name: "no matching declaration",
+			entries: []scopeEntry{
+				{
+					Stack:         "prod",
+					Component:     "other-stack-service",
+					ComponentType: "helm",
+					Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"}),
+				},
+				{
+					Stack:         "dev",
+					Component:     "other-type-service",
+					ComponentType: "terraform",
+					Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"}),
+				},
+				{
+					Stack:         "dev",
+					Component:     "example-service",
+					ComponentType: "helm",
+					Section:       secretDeclarationSection("OTHER_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"}),
+				},
 			},
-		}, nil)
-
-		_, _, err := findGlobalSetContext(secretScope{Stack: "dev", ComponentType: "helm"}, "SHARED_TOKEN")
-		require.ErrorIs(t, err, errUtils.ErrRequiredFlagNotProvided)
-	})
-
-	t.Run("inconsistent declarations", func(t *testing.T) {
-		overrideEnumerateScopes(t, []scopeEntry{
-			{
-				Stack:         "dev",
-				Component:     "example-service-a",
-				ComponentType: "helm",
-				Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets-a", "scope": "global"}),
+			scope:       secretScope{Stack: "dev", ComponentType: "helm"},
+			expectedErr: errUtils.ErrRequiredFlagNotProvided,
+		},
+		{
+			name: "inconsistent declarations",
+			entries: []scopeEntry{
+				{
+					Stack:         "dev",
+					Component:     "example-service-a",
+					ComponentType: "helm",
+					Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets-a", "scope": "global"}),
+				},
+				{
+					Stack:         "dev",
+					Component:     "example-service-b",
+					ComponentType: "helm",
+					Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets-b", "scope": "global"}),
+				},
 			},
-			{
-				Stack:         "dev",
-				Component:     "example-service-b",
-				ComponentType: "helm",
-				Section:       secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets-b", "scope": "global"}),
+			scope:       secretScope{Stack: "dev"},
+			expectedErr: errUtils.ErrRequiredFlagNotProvided,
+		},
+		{
+			name: "identical declarations select first component",
+			entries: []scopeEntry{
+				{Stack: "dev", Component: "example-service-a", ComponentType: "helm", Section: sharedSection},
+				{Stack: "dev", Component: "example-service-b", ComponentType: "helm", Section: sharedSection},
 			},
-		}, nil)
-
-		_, _, err := findGlobalSetContext(secretScope{Stack: "dev"}, "SHARED_TOKEN")
-		require.ErrorIs(t, err, errUtils.ErrRequiredFlagNotProvided)
-	})
+			scope:             secretScope{Stack: "dev"},
+			expectedComponent: "example-service-a",
+			expectedType:      "helm",
+		},
+	}
 
-	t.Run("identical declarations select first component", func(t *testing.T) {
-		section := secretDeclarationSection("SHARED_TOKEN", map[string]any{"store": "example-secrets", "scope": "global"})
-		overrideEnumerateScopes(t, []scopeEntry{
-			{Stack: "dev", Component: "example-service-a", ComponentType: "helm", Section: section},
-			{Stack: "dev", Component: "example-service-b", ComponentType: "helm", Section: section},
-		}, nil)
-
-		component, componentType, err := findGlobalSetContext(secretScope{Stack: "dev"}, "SHARED_TOKEN")
-		require.NoError(t, err)
-		assert.Equal(t, "example-service-a", component)
-		assert.Equal(t, "helm", componentType)
-	})
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			overrideEnumerateScopes(t, tt.entries, tt.enumerationErr)
+
+			component, componentType, err := findGlobalSetContext(tt.scope, "SHARED_TOKEN")
+			if tt.expectedErr != nil {
+				require.ErrorIs(t, err, tt.expectedErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.expectedComponent, component)
+			assert.Equal(t, tt.expectedType, componentType)
+		})
+	}
 }
 
 func TestRunSecretSet_NonGlobalScopeStillRequiresComponent(t *testing.T) {

pkg/component/helm/secret_values_integration_test.go

@@ -50,6 +50,16 @@ func (s *jsonDecodingStore) GetRaw(stack, component, key string) (string, error)
 }
 
 func TestNativeHelmSecretRawAndStructuredValuesMaskIndentedMultilineValues(t *testing.T) {
+	fixture, atmosConfig, info := prepareHelmSecretValuesFixture(t)
+	assertResolvedHelmSecretValues(t, info)
+	rendered, renderedEnv := renderHelmSecretValuesFixture(t, fixture, atmosConfig, info)
+	assert.Equal(t, serviceAccountJSON, envValue(t, renderedEnv, "SERVICE_ACCOUNT_JSON"), "Helm env.value must remain a scalar string")
+	assertMaskedHelmSecretValues(t, rendered)
+}
+
+func prepareHelmSecretValuesFixture(t *testing.T) (string, *schema.AtmosConfiguration, schema.ConfigAndStacksInfo) {
+	t.Helper()
+
 	fixture, err := filepath.Abs(filepath.Join("..", "..", "..", "tests", "fixtures", "scenarios", "helm-secret-values"))
 	require.NoError(t, err)
 	t.Chdir(fixture)
@@ -80,6 +90,11 @@ func TestNativeHelmSecretRawAndStructuredValuesMaskIndentedMultilineValues(t *te
 	info.SecretsMaskOnly = false
 	info, err = e.ProcessStacks(&atmosConfig, info, true, true, true, nil, auth.AuthManager(nil))
 	require.NoError(t, err)
+	return fixture, &atmosConfig, info
+}
+
+func assertResolvedHelmSecretValues(t *testing.T, info schema.ConfigAndStacksInfo) {
+	t.Helper()
 
 	values, ok := info.ComponentSection[cfg.ValuesSectionName].(map[string]any)
 	require.True(t, ok)
@@ -93,26 +108,37 @@ func TestNativeHelmSecretRawAndStructuredValuesMaskIndentedMultilineValues(t *te
 	assert.Equal(t, "service@example.iam.gserviceaccount.com", envValue(t, env, "CLIENT_EMAIL"))
 	assert.Equal(t, plainSecret, envValue(t, env, "PLAIN_TOKEN"))
 	assert.Equal(t, privateKey, envValue(t, env, "SIGNING_KEY"))
+}
+
+func renderHelmSecretValuesFixture(
+	t *testing.T,
+	fixture string,
+	atmosConfig *schema.AtmosConfiguration,
+	info schema.ConfigAndStacksInfo,
+) (string, []any) {
+	t.Helper()
 
 	componentPath := filepath.Join(fixture, "components", "helm", "secret-values")
-	spec, err := buildChartSpec(&atmosConfig, &info, componentPath)
+	spec, err := buildChartSpec(atmosConfig, &info, componentPath)
 	require.NoError(t, err)
 	rendered, err := renderManifest(context.Background(), spec)
 	require.NoError(t, err)
 
 	objects, err := manifest.DecodeObjects([]byte(rendered))
 	require.NoError(t, err)
 	require.Len(t, objects, 1)
-	renderedEnv, found, err := unstructured.NestedSlice(objects[0].Object, "spec", "template", "spec", "containers", "0", "env")
-	if err != nil || !found {
-		// NestedSlice cannot index arrays by string; extract the container first.
-		containers, containersFound, containersErr := unstructured.NestedSlice(objects[0].Object, "spec", "template", "spec", "containers")
-		require.NoError(t, containersErr)
-		require.True(t, containersFound)
-		container := containers[0].(map[string]any)
-		renderedEnv = container["env"].([]any)
-	}
-	assert.Equal(t, serviceAccountJSON, envValue(t, renderedEnv, "SERVICE_ACCOUNT_JSON"), "Helm env.value must remain a scalar string")
+	containers, found, err := unstructured.NestedSlice(objects[0].Object, "spec", "template", "spec", "containers")
+	require.NoError(t, err)
+	require.True(t, found)
+	require.NotEmpty(t, containers)
+	require.IsType(t, map[string]any{}, containers[0])
+	container := containers[0].(map[string]any)
+	require.IsType(t, []any{}, container["env"])
+	return rendered, container["env"].([]any)
+}
+
+func assertMaskedHelmSecretValues(t *testing.T, rendered string) {
+	t.Helper()
 
 	masker := iolib.GetContext().Masker()
 	t.Cleanup(func() {

pkg/function/parser/parser.go

@@ -337,7 +337,7 @@ func ParseStoreGet(input string) (StoreGetArgs, error) {
 	return StoreGetArgs{Store: words[0], Key: words[1], Default: options.defaultValue, Query: options.query}, nil
 }
 
-// ParseSecret parses `name [| path expression] [| raw] [| default value]`.
+// ParseSecret parses `name [| path expression | raw] [| default value]`.
 func ParseSecret(input string) (SecretArgs, error) {
 	hasPath := false
 	tokens, err := tokenize(input)

pkg/function/parser/parser_test.go

@@ -194,33 +194,47 @@ func TestParseStoreGet(t *testing.T) {
 }
 
 func TestParseSecret(t *testing.T) {
-	actual, err := ParseSecret(`SERVICE_CONFIG | path ".credentials.token" | default "not set"`)
-	require.NoError(t, err)
-	assert.Equal(t, SecretArgs{Name: "SERVICE_CONFIG", Path: ".credentials.token", Default: stringPtr("not set")}, actual)
-
-	actual, err = ParseSecret(`SERVICE_CONFIG | path .credentials.token // "not set"`)
-	require.NoError(t, err)
-	assert.Equal(t, `.credentials.token // "not set"`, actual.Path)
+	tests := []struct {
+		name     string
+		input    string
+		expected SecretArgs
+		wantErr  bool
+	}{
+		{
+			name:     "path with default",
+			input:    `SERVICE_CONFIG | path ".credentials.token" | default "not set"`,
+			expected: SecretArgs{Name: "SERVICE_CONFIG", Path: ".credentials.token", Default: stringPtr("not set")},
+		},
+		{
+			name:     "path expression with spaces",
+			input:    `SERVICE_CONFIG | path .credentials.token // "not set"`,
+			expected: SecretArgs{Name: "SERVICE_CONFIG", Path: `.credentials.token // "not set"`},
+		},
+		{
+			name:     "compact raw with empty default",
+			input:    `SERVICE_CREDENTIALS |raw | default ""`,
+			expected: SecretArgs{Name: "SERVICE_CREDENTIALS", Raw: true, Default: stringPtr("")},
+		},
+		{name: "empty input", input: "", wantErr: true},
+		{name: "empty name", input: "| raw", wantErr: true},
+		{name: "missing delimiter", input: "SERVICE_CONFIG raw", wantErr: true},
+		{name: "raw with value", input: "SERVICE_CONFIG | raw value", wantErr: true},
+		{name: "path without value", input: "SERVICE_CONFIG | path", wantErr: true},
+		{name: "unknown option", input: "SERVICE_CONFIG | unknown value", wantErr: true},
+		{name: "raw path conflict", input: `SERVICE_CONFIG | raw | path ".token"`, wantErr: true},
+		{name: "empty path conflicts with raw", input: `SERVICE_CONFIG | path "" | raw`, wantErr: true},
+	}
 
-	actual, err = ParseSecret(`SERVICE_CREDENTIALS |raw | default ""`)
-	require.NoError(t, err)
-	assert.Equal(t, "SERVICE_CREDENTIALS", actual.Name)
-	assert.True(t, actual.Raw)
-	require.NotNil(t, actual.Default)
-	assert.Empty(t, *actual.Default)
-
-	for _, input := range []string{
-		"",
-		"| raw",
-		"SERVICE_CONFIG raw",
-		"SERVICE_CONFIG | raw value",
-		"SERVICE_CONFIG | path",
-		"SERVICE_CONFIG | unknown value",
-		`SERVICE_CONFIG | raw | path ".token"`,
-		`SERVICE_CONFIG | path "" | raw`,
-	} {
-		_, err = ParseSecret(input)
-		require.Error(t, err, input)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			actual, err := ParseSecret(tt.input)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, actual)
+		})
 	}
 }
 

pkg/secrets/providers/store_test.go

@@ -128,6 +128,34 @@ func TestStoreProvider_GetRawRejectsStructuredFallback(t *testing.T) {
 	require.ErrorIs(t, err, ErrRawNotSupported)
 }
 
+type rawFakeStore struct {
+	rawPayload string
+	getCalls   int
+	rawCalls   int
+}
+
+func (s *rawFakeStore) Set(_, _, _ string, _ any) error { return nil }
+func (s *rawFakeStore) Get(_, _, _ string) (any, error) {
+	s.getCalls++
+	return "decoded", nil
+}
+func (s *rawFakeStore) GetKey(_ string) (any, error) { return nil, nil }
+func (s *rawFakeStore) GetRaw(_, _, _ string) (string, error) {
+	s.rawCalls++
+	return s.rawPayload, nil
+}
+
+func TestStoreProvider_GetRawDelegatesToNativeRawStore(t *testing.T) {
+	rawStore := &rawFakeStore{rawPayload: `{"enabled":true}`}
+	p := &storeProvider{name: "app", kind: "example/raw", store: rawStore}
+
+	got, err := p.GetRaw(Coordinate{Stack: "prod", Component: "api", Key: "CONFIG"})
+	require.NoError(t, err)
+	assert.Equal(t, `{"enabled":true}`, got)
+	assert.Equal(t, 1, rawStore.rawCalls)
+	assert.Zero(t, rawStore.getCalls)
+}
+
 func TestStoreProvider_DeleteUnsupported(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()