Add factory helpers for user and scoped secret providers#4242
Open
amirejaz wants to merge 2 commits intoscoped-secret-providersfrom
Open
Add factory helpers for user and scoped secret providers#4242amirejaz wants to merge 2 commits intoscoped-secret-providersfrom
amirejaz wants to merge 2 commits intoscoped-secret-providersfrom
Conversation
…elpers Expose convenience constructors that wrap the base secret provider in either a UserProvider (blocks system-reserved __thv_ keys for user-facing callers) or a ScopedProvider (namespaces all operations under a given scope for internal callers such as the registry or workloads subsystems). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
amirejaz
requested review from
ChrisJBurns,
JAORMX,
jhrozek and
yrobla
as code owners
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## scoped-secret-providers #4242 +/- ##
===========================================================
+ Coverage 68.82% 69.26% +0.43%
===========================================================
Files 469 469
Lines 47189 47137 -52
===========================================================
+ Hits 32480 32651 +171
+ Misses 12007 11975 -32
+ Partials 2702 2511 -191 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
ChrisJBurns
approved these changes
Mar 21, 2026
JAORMX
reviewed
Mar 23, 2026
pkg/secrets/factory_test.go
Outdated
| } | ||
|
|
||
| func TestCreateUserSecretProvider(t *testing.T) { //nolint:paralleltest | ||
| ctx := context.Background() |
pkg/secrets/factory_test.go
Outdated
| } | ||
|
|
||
| func TestCreateScopedSecretProvider(t *testing.T) { //nolint:paralleltest | ||
| ctx := context.Background() |
Collaborator
There was a problem hiding this comment.
t.Context() would be better.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
github-actions
bot
added
size/XS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CreateSecretProviderinUserProviderorScopedProvider; this PR adds dedicated constructors so the wrapping is consistent and boilerplate-free.CreateUserSecretProvider(providerType)— creates the base provider and wraps it inUserProvider, blocking all__thv_*keys. Intended for user-facing callers (CLI, API, MCP tool server).CreateScopedSecretProvider(providerType, scope)— creates the base provider and wraps it inScopedProvider, namespacing all key operations under__thv_<scope>_. Intended for internal callers such as the registry or workloads subsystem.This is Phase 2 of the scoped secret store implementation (part of #4188). Phase 1 (#4229) introduced
ScopedProviderandUserProvider; this PR exposes them through the factory layer.Type of change
Test plan
pkg/secrets/factory_test.gocovering both helpers for the environment provider type (the only provider that works without external dependencies in CI), system-key blocking, and the unknown-provider error path.go test ./pkg/secrets/...— all tests pass.golangci-lint run ./pkg/secrets/...— 0 issues.Special notes for reviewers
This PR is stacked on top of
scoped-secret-providers(Phase 1 #4229). The diff against that branch is a single commit touching onlyfactory.goandfactory_test.go.Generated with Claude Code