Reject secret scope permissions with no principal - #6215
Merged
Conversation
A secret scope permission that names no principal is accepted by `bundle validate` today, but the backend rejects a secret ACL with an empty principal. The direct engine only fails later while collapsing permissions, and Terraform creates the scope before the ACL call fails, leaving a partial deploy that `destroy` cannot clean up. Reject the input at validation time so both engines fail early with a located, actionable error. A principal of the wrong type counts as missing: normalization only warns and drops the value, so the permission would otherwise still reach the backend without a principal.
Collaborator
Integration test reportCommit: 65171ea
13 interesting tests: 5 flaky, 4 RECOVERED, 4 SKIP
Top 6 slowest tests (at least 2 minutes):
|
radakam
marked this pull request as ready for review
August 11, 2026 08:18
Drop dyn.MapByPattern in favor of iterating SecretScopes, and keep comments to the non-obvious bits (wrong-typed drop, without-fix behavior).
Collaborator
Integration test reportCommit: 1cfa6b6
38 interesting tests: 15 flaky, 15 FAIL, 4 KNOWN, 2 RECOVERED, 2 SKIP
Top 50 slowest tests (at least 2 minutes):
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Add
errorForInvalidSecretScopePermissionstovalidate.Required(). Validate and deploy fail early with:Diagnostics point at the scope (
ApplyBundlePermissionsdrops per-entry locations).sortDiagnosticsties on path when locations match.Why
A secret scope permission with no principal passes
bundle validate(only a type warning for wrong-typed values). Three shapes slip through: missing, empty-string, and wrong-typed principal (normalization warns and drops it).Without this check, failure is late and engine-specific:
Direct — deploy fails in
SecretScopeFixupsbefore any//secretscalls:Terraform — deploy succeeds and creates scopes plus ACLs with
"principal": "". Destroy then fails and cannot clean up:Found by fuzz testing.
Tests
New acceptance test
bundle/validate/secret_scope_required_principalcovering the three bad shapes plus a valid one. Asserts early rejection and zero//secretsrequests on deploy.