feat: password v2 component #90
Conversation
| program: () => import('./infrastructure'), | ||
| }; | ||
|
|
||
| describe('Password component deployment', () => { |
There was a problem hiding this comment.
Not sure if we'll be able to test this, but it is worth to investigate - is the password value masked in the output of the Pulumi program?
Note: it should be due to additionalSecretOutputs option sent to the super, but having that test would be beneficial to capture potential leaks.
There was a problem hiding this comment.
I've done some investigation and seems like additionalSecretOutputs isn't even working for custom components as it states in the docs.
I had to wrap the value in pulumi.secret() which behaves the same as output except the returned output is marked as containing sensitive data.
I also implemented a test to verify that the password is treated as a secret. To make that test work, I had to export the password output directly from the infrastructure index file. The reason is that the automation api unwraps values, and for objects it only keeps the secret flag at the top level. Because of that, there’s no reliable way to check whether nested properties are secrets once they’re unwrapped.
This PR copies the password component into the v2 folder and adds integration tests for it.