| @@ -64,6 +64,7 @@ const makeMetadata = ( · 63 unmodified lines |
| 64 | const makeFakeClient = (options?: { | 64 | const makeFakeClient = (options?: { |
| 65 | readonly conflictOnNextSecretUpdate?: boolean; | 65 | readonly conflictOnNextSecretUpdate?: boolean; |
| 66 | readonly rejectNamesWithColon?: boolean; | 66 | readonly rejectNamesWithColon?: boolean; |
| | 67 | readonly rejectReadNamesLongerThan?: number; |
| 67 | }): WorkOSVaultClient => { | 68 | }): WorkOSVaultClient => { |
| 68 | const objects = new Map<string, WorkOSVaultObject>(); | 69 | const objects = new Map<string, WorkOSVaultObject>(); |
| 69 | let sequence = 0; | 70 | let sequence = 0; |
| @@ -106,6 +107,12 @@ const makeFakeClient = (options?: { · 36 unmodified lines |
| 106 | if (options?.rejectNamesWithColon && name.includes(":")) { | 107 | if (options?.rejectNamesWithColon && name.includes(":")) { |
| 107 | throw new FakeInvalidRequestError(`Invalid object name "${name}"`); | 108 | throw new FakeInvalidRequestError(`Invalid object name "${name}"`); |
| 108 | } | 109 | } |
| | 110 | if ( |
| | 111 | options?.rejectReadNamesLongerThan !== undefined && |
| | 112 | name.length > options.rejectReadNamesLongerThan |
| | 113 | ) { |
| | 114 | throw new FakeInvalidRequestError(`Invalid object name "${name}"`); |
| | 115 | } |
| 109 | const object = objects.get(name); | 116 | const object = objects.get(name); |
| 110 | if (!object) throw new FakeNotFoundError(`Object "${name}" not found`); | 117 | if (!object) throw new FakeNotFoundError(`Object "${name}" not found`); |
| 111 | return object; | 118 | return object; |
| @@ -260,6 +267,29 @@ describe("WorkOS Vault secret provider", () => { · 148 unmodified lines |
| 260 | }), | 267 | }), |
| 261 | ); | 268 | ); |
| 262 | | 269 | |
| | 270 | it.effect("treats invalid Vault object names as missing during removal", () => |
| | 271 | Effect.gen(function* () { |
| | 272 | const client = makeFakeClient({ rejectReadNamesLongerThan: 80 }); |
| | 273 | const executor = yield* makeExecutor(client); |
| | 274 | const longSecretId = SecretId.make( |
| | 275 | "openapi-oauth-dealcloud-api-oauth2-user-org-user-01kp6xm1zpvqvtpj77f0yv4eax.access_token", |
| | 276 | ); |
| | 277 | |
| | 278 | yield* executor.secrets.set( |
| | 279 | new SetSecretInput({ |
| | 280 | id: longSecretId, |
| | 281 | scope: ScopeId.make("test-scope"), |
| | 282 | name: "Long connection token", |
| | 283 | value: "token", |
| | 284 | }), |
| | 285 | ); |
| | 286 | |
| | 287 | yield* executor.secrets.remove(longSecretId); |
| | 288 | |
| | 289 | expect(yield* executor.secrets.list()).toHaveLength(0); |
| | 290 | }), |
| | 291 | ); |
| | 292 | |
| 263 | it.effect("retries secret value writes on 409 version conflicts", () => | 293 | it.effect("retries secret value writes on 409 version conflicts", () => |
| 264 | Effect.gen(function* () { | 294 | Effect.gen(function* () { |
| 265 | // Inject one conflict on the next update against `/secrets/conflict`. | 295 | // Inject one conflict on the next update against `/secrets/conflict`. |