Skip to content

fix: resolve UUID secret refs with host contract#192

Open
steingran wants to merge 1 commit into
alvarosanchez:mainfrom
steingran:fix/structured-secret-ref-host-compat
Open

fix: resolve UUID secret refs with host contract#192
steingran wants to merge 1 commit into
alvarosanchez:mainfrom
steingran:fix/structured-secret-ref-host-compat

Conversation

@steingran

Copy link
Copy Markdown
Contributor

What changed

  • Convert UUID-backed saved secret references to the structured { type: "secret_ref", secretId } form required by newer Paperclip hosts.
  • Preserve legacy non-UUID references unchanged.
  • Permit the existing company-scoped token fallback only for documented host-unavailable/invalid-secret-reference errors; unrelated secret-provider failures still fail closed.
  • Add focused regression coverage for structured refs, scoped fallback behavior, and fail-closed provider errors.

Root cause

The published worker normalizes saved secret refs to UUID strings and passes those strings directly to ctx.secrets.resolve. Newer Paperclip hosts require UUID-backed refs as structured secret_ref objects, so configured GitHub operations fail before the already provisioned company-scoped fallback can be considered.

Impact

This restores compatibility with the current host secret-reference contract without rotating, reconnecting, or logging credentials. It does not widen fallback behavior for permission failures or arbitrary resolver errors.

Validation

The originating implementation run passed:

  • pnpm typecheck
  • focused structured-ref/fallback tests (3/3)
  • full pnpm test
  • pnpm build
  • git diff --check

Publication recovery verified this branch is exactly one commit ahead of upstream main and changes only src/worker.ts and tests/plugin.spec.ts (104 insertions, 9 deletions).

@steingran
steingran marked this pull request as ready for review July 24, 2026 02:04
Copilot AI review requested due to automatic review settings July 24, 2026 02:04

Copy link
Copy Markdown
Contributor Author

Ready for review at b1a747ca4089c2362c9970d80761ba6ba00ed8d6 (one commit ahead of main; only src/worker.ts and tests/plugin.spec.ts). CI run 552 passed. The change keeps non-UUID refs unchanged and limits fallback to documented host-unavailable/invalid-ref cases; unrelated secret-provider errors remain fail-closed. No credentials were changed, logged, rotated, or reconnected.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the plugin worker to be compatible with newer Paperclip hosts that require UUID-backed secret references to be passed as structured { type: "secret_ref", secretId } objects (rather than raw UUID strings), while keeping legacy non-UUID references unchanged. It also tightens fallback behavior so the company-scoped token fallback is only used for specific “secret ref unavailable/invalid ref” host errors, and adds targeted regression tests.

Changes:

  • Add a wrapper (resolvePluginSecret) that converts UUID-shaped secret refs into structured secret_ref objects before calling ctx.secrets.resolve.
  • Refine the “secret refs unavailable” error classification to include the documented invalid-secret-reference host error.
  • Add regression tests for structured secret refs, scoped fallback behavior, and fail-closed resolver/provider errors.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
src/worker.ts Adds UUID→structured secret ref conversion and narrows fallback eligibility to specific host error cases.
tests/plugin.spec.ts Adds regression tests covering structured secret refs, fallback gating, and fail-closed resolver errors.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/worker.ts
return typeof value === 'string' && value.trim() ? value.trim() : undefined;
}

const SECRET_REF_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
Comment thread src/worker.ts
Comment on lines +2933 to +2934
const resolveSecret = ctx.secrets.resolve as unknown as (ref: string | HostSecretRef) => Promise<string>;
return await resolveSecret(toHostSecretRef(secretRef));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants