Repository navigation
Conversation
Declare SecretContentType api_key_v2 on the secret return of all three issuance actions, move the existing action tests onto typed AAD, and add handler-level proof: schema declaration for every action and, for the service account application key, an actual SDK InvokeAction through a random-loopback provider fixture and SDK JWE with exact payload bytes. Missing, opaque, generic, wrong-type, wrong-purpose and wrong-version AAD refuse before any provider request. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…adog-declare-api-key-v2
The three Datadog issuance kinds encode through secretcontracts.APIKeyV2, so the validated content type and bytes travel together. The declaration and the plaintext schema come from the exported type ID and the helper's returned content type; a mismatch fails the action rather than being overwritten. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Generated by go mod vendor from the previous commit. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Squire (anthropic/claude-sonnet-5-5): Datadog's three credential issuance actions now declare
api_key_v2on their secret return, with handler-level proof that the declaration gates issuance.Parent: #53 (
highb/datadog-sdk-typed-secret-contract@612e8a59196d4e5fe17ad215ba75728d81811ab0), which itself stacks on #51 (da60e29c69975b2bb0dff6f85cd792ca500c1fc5). Review and merge order: #51, #53, this PR. Retarget to the parent's successor as each lands.Dependency:
baton-sdk v0.42.4-0.20261023162145-b4c6a5b06b11(commitb4c6a5b06b118bf6b74cf10a5dc5a3597e83138bof baton-sdk#1192), carried by #53. Unreleased; noreplace.What changes (one commit, 4 files under
pkg/connector)SecretContentType: "api_key_v2"on the secret return ofissue_service_account_application_key,issue_organization_api_keyandissue_service_account_access_token. Payload bytes, native header names, scopes and revocation are unchanged.purpose=c1/fk-credential-delivery,version=1,content_type=api_key_v2).TestDatadogIssuanceActionsDeclareAPIKeyV2: every issuance action declares exactly one secret return typedapi_key_v2.TestDatadogDeclaredSecretProof: actual connector registration,ListActionSchemas,InvokeActionand SDK JWE against a random-loopbackhttptestprovider. Missing, opaque, generic, wrong-type, wrong-purpose and wrong-version AAD each fail with zero provider requests; a valid request makes exactly one create and the decrypted bytes equal the expected canonical JSON. Requested scopes reach the HTTP body and granted scopes appear in the payload.CONNECTOR_SECRET_PROOF_INPUTand writeCONNECTOR_SECRET_PROOF_RESULTfiles so C1 can feed its prepared request through the real handler. This is a test port only, not a shipping interface.Verification (local, commit
2b8c6aa9)go build ./...exit 0;go test -count=1 ./...exit 0, no skips.golangci-lintv2.14.0 (CI's pin): 0 issues. Two//nolint:gosecannotations cover the test-only file ports whose paths come from the harness environment.api_key(compiles) makes both new tests fail on theapi_key_v2assertion; restoring the source gives an identical sha256 and the tests pass again.Limits: no live Datadog calls; the HTTP fixture is not a real provider. These tests do not prove the C1 to Multipass path. Only one action is exercised end to end here; the other two are covered by schema assertion plus the existing native payload test with typed AAD.
Supersession: replaces the typed-declaration portion of #52, which stays untouched until a decision is made on it.
🤖 Generated with Claude Code