fix: validate masked secret declarations

Author: shirkevich

internal/exec/describe_stacks_component_processor_test.go

@@ -1351,6 +1351,7 @@ func TestProcessComponentEntry_SecretResolutionMode(t *testing.T) {
 	tests := []struct {
 		name           string
 		resolveSecrets bool
+		secretName     string
 		storeValue     any
 		storeErr       error
 		expectError    error
@@ -1359,17 +1360,26 @@ func TestProcessComponentEntry_SecretResolutionMode(t *testing.T) {
 		{
 			name:           "inspection masks without retrieving",
 			resolveSecrets: false,
+			secretName:     "API_KEY",
 			expectValue:    iolib.GetContext().Masker().Replacement(),
 		},
+		{
+			name:           "inspection rejects undeclared without retrieving",
+			resolveSecrets: false,
+			secretName:     "UNDECLARED_KEY",
+			expectError:    secrets.ErrSecretNotDeclared,
+		},
 		{
 			name:           "execution fails for a missing required secret",
 			resolveSecrets: true,
+			secretName:     "API_KEY",
 			storeErr:       errors.New("secret not found"),
 			expectError:    secrets.ErrSecretMissing,
 		},
 		{
 			name:           "execution resolves and registers the secret for masking",
 			resolveSecrets: true,
+			secretName:     "API_KEY",
 			storeValue:     "api-secret-value",
 			expectValue:    "api-secret-value",
 		},
@@ -1398,7 +1408,7 @@ func TestProcessComponentEntry_SecretResolutionMode(t *testing.T) {
 						"API_KEY": map[string]any{"store": "app-secrets", "required": true},
 					},
 				},
-				"vars": map[string]any{"api_key": "!secret API_KEY"},
+				"vars": map[string]any{"api_key": "!secret " + tt.secretName},
 			}
 			processor := newDescribeStacksProcessor(
 				atmosConfig,

pkg/secrets/resolver.go

@@ -17,10 +17,11 @@ const secretTag = "!secret"
 // Resolve resolves a `!secret NAME [| path ...] [| default ...]` expression to a value.
 //
 // Behavior (in order):
-//  1. If the processing scope is an inspection command with masking enabled
+//  1. It validates that the secret is declared in the component section.
+//  2. If the processing scope is an inspection command with masking enabled
 //     (stackInfo.SecretsMaskOnly), it returns the mask replacement WITHOUT retrieving the
 //     value from the backend — no provider call, no credentials required.
-//  2. Otherwise it looks up the declaration in the component section, resolves the backend
+//  3. Otherwise it resolves the backend
 //     provider, retrieves the value, applies the optional path/default modifiers, registers
 //     the value (recursively) with the I/O masker, and returns it.
 func Resolve(atmosConfig *schema.AtmosConfiguration, input, currentStack string, stackInfo *schema.ConfigAndStacksInfo) (any, error) {
@@ -31,11 +32,6 @@ func Resolve(atmosConfig *schema.AtmosConfiguration, input, currentStack string,
 		return nil, err
 	}
 
-	// Mask-without-retrieval fast path for inspection commands.
-	if stackInfo != nil && stackInfo.SecretsMaskOnly {
-		return io.GetContext().Masker().Replacement(), nil
-	}
-
 	component := componentName(stackInfo)
 
 	var componentSection map[string]any
@@ -48,6 +44,12 @@ func Resolve(atmosConfig *schema.AtmosConfiguration, input, currentStack string,
 		return nil, fmt.Errorf("%w: %q (declare it under the component's secrets.vars)", ErrSecretNotDeclared, name)
 	}
 
+	// Mask-without-retrieval fast path for inspection commands. Declaration lookup happens
+	// first so masked inspection still catches misspelled or malformed secret references.
+	if stackInfo != nil && stackInfo.SecretsMaskOnly {
+		return io.GetContext().Masker().Replacement(), nil
+	}
+
 	provider, err := providerFor(atmosConfig, &decl, componentSection)
 	if err != nil {
 		return nil, fmt.Errorf("%w (secret %q)", err, name)

pkg/secrets/resolver_test.go

@@ -59,6 +59,29 @@ func TestResolve_MaskOnly_SkipsRetrieval(t *testing.T) {
 	assert.Equal(t, iolib.GetContext().Masker().Replacement(), got)
 }
 
+// TestResolve_MaskOnly_RejectsUndeclared proves that masked inspection validates the local
+// declaration registry without contacting the backend.
+func TestResolve_MaskOnly_RejectsUndeclared(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().Get(gomock.Any(), gomock.Any(), gomock.Any()).Times(0)
+
+	cfg, componentSection := newSecretTestConfig(mockStore)
+	require.NoError(t, iolib.Initialize())
+
+	info := &schema.ConfigAndStacksInfo{
+		Stack:            "prod",
+		Component:        "api",
+		ComponentSection: componentSection,
+		SecretsMaskOnly:  true,
+	}
+
+	_, err := Resolve(cfg, "!secret UNDECLARED_KEY", "prod", info)
+	require.ErrorIs(t, err, ErrSecretNotDeclared)
+}
+
 // TestResolve_RealValue retrieves the real value when masking does not skip retrieval.
 func TestResolve_RealValue(t *testing.T) {
 	ctrl := gomock.NewController(t)