| @@ -64,6 +64,7 @@ const makeMetadata = ( · 63 unmodified lines |
| 64 | 64 | const makeFakeClient = (options?: { |
| 65 | 65 | readonly conflictOnNextSecretUpdate?: boolean; |
| 66 | 66 | readonly rejectNamesWithColon?: boolean; |
| 67 | + readonly rejectReadNamesLongerThan?: number; |
| 67 | 68 | }): WorkOSVaultClient => { |
| 68 | 69 | const objects = new Map<string, WorkOSVaultObject>(); |
| 69 | 70 | let sequence = 0; |
| @@ -106,6 +107,12 @@ const makeFakeClient = (options?: { · 36 unmodified lines |
| 106 | 107 | if (options?.rejectNamesWithColon && name.includes(":")) { |
| 107 | 108 | throw new FakeInvalidRequestError(`Invalid object name "${name}"`); |
| 108 | 109 | } |
| 110 | + if ( |
| 111 | + options?.rejectReadNamesLongerThan !== undefined && |
| 112 | + name.length > options.rejectReadNamesLongerThan |
| 113 | + ) { |
| 114 | + throw new FakeInvalidRequestError(`Invalid object name "${name}"`); |
| 115 | + } |
| 109 | 116 | const object = objects.get(name); |
| 110 | 117 | if (!object) throw new FakeNotFoundError(`Object "${name}" not found`); |
| 111 | 118 | return object; |
| @@ -260,6 +267,29 @@ describe("WorkOS Vault secret provider", () => { · 148 unmodified lines |
| 260 | 267 | }), |
| 261 | 268 | ); |
| 262 | 269 | |
| 270 | + it.effect("treats invalid Vault object names as missing during removal", () => |
| 271 | + Effect.gen(function* () { |
| 272 | + const client = makeFakeClient({ rejectReadNamesLongerThan: 80 }); |
| 273 | + const executor = yield* makeExecutor(client); |
| 274 | + const longSecretId = SecretId.make( |
| 275 | + "openapi-oauth-dealcloud-api-oauth2-user-org-user-01kp6xm1zpvqvtpj77f0yv4eax.access_token", |
| 276 | + ); |
| 277 | + |
| 278 | + yield* executor.secrets.set( |
| 279 | + new SetSecretInput({ |
| 280 | + id: longSecretId, |
| 281 | + scope: ScopeId.make("test-scope"), |
| 282 | + name: "Long connection token", |
| 283 | + value: "token", |
| 284 | + }), |
| 285 | + ); |
| 286 | + |
| 287 | + yield* executor.secrets.remove(longSecretId); |
| 288 | + |
| 289 | + expect(yield* executor.secrets.list()).toHaveLength(0); |
| 290 | + }), |
| 291 | + ); |
| 292 | + |
| 263 | 293 | it.effect("retries secret value writes on 409 version conflicts", () => |
| 264 | 294 | Effect.gen(function* () { |
| 265 | 295 | // Inject one conflict on the next update against `/secrets/conflict`. |