Skip to content

fix: strip unresolved keyword placeholders from API payloads before deploy #1360

Open
ankita10119 wants to merge 3 commits intomasterfrom
DXCDT-1590
Open

fix: strip unresolved keyword placeholders from API payloads before deploy #1360
ankita10119 wants to merge 3 commits intomasterfrom
DXCDT-1590

Conversation

@ankita10119
Copy link
Copy Markdown
Contributor

@ankita10119 ankita10119 commented Apr 13, 2026

🔧 Changes

When a keyword placeholder (e.g. ##MY_SECRET##) is not resolved, because the corresponding environment variable is absent or the keyword file is missing, the raw ##...## string was previously forwarded to the Auth0 Management API, silently overwriting real tenant values with literal placeholder strings.

New utility: stripUnresolvedPlaceholders (src/tools/utils.ts)

  • Recursively scans an asset object and removes any string field whose value matches the ##...## pattern.
  • Emits a log.warn for each stripped field, including the full dotted field path, resource type, resource name, and the offending placeholder value, so operators have a clear audit trail.

src/tools/auth0/handlers/default.ts

  • stripUnresolvedPlaceholders is now applied in all three create/update payload construction paths, chained after stripObfuscatedFieldsFromPayload.
  • Fields with unresolved placeholders are dropped from the payload; the existing tenant value is preserved rather than overwritten.

📚 References

closes #1344

🔬 Testing

Unit tests covering:

  • A field containing ##PLACEHOLDER## is stripped and a warning is logged.
  • A nested field (e.g. options.secret) containing an unresolved placeholder is stripped with the correct dotted path in the warning.
  • Fields with resolved values pass through unchanged.
  • null inputs and array values are returned as-is without modification.
  • Both create and update code paths strip unresolved placeholders before the API call is made.

📝 Checklist

  • All new/changed/fixed functionality is covered by tests (or N/A)
  • I have added documentation for all new/changed functionality (or N/A)

@ankita10119 ankita10119 requested a review from a team as a code owner April 13, 2026 07:55
@codecov-commenter
Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.14%. Comparing base (8fe0e28) to head (5188d81).

Files with missing lines Patch % Lines
src/tools/auth0/handlers/default.ts 66.66% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1360      +/-   ##
==========================================
+ Coverage   80.10%   80.14%   +0.03%     
==========================================
  Files         152      152              
  Lines        6212     6229      +17     
  Branches     1290     1295       +5     
==========================================
+ Hits         4976     4992      +16     
- Misses        702      703       +1     
  Partials      534      534              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Deploy CLI re-imports generated connection secret placeholders as literal client_secret values

2 participants