Only allow secrets in config in POST deployments

internal/config/types.go

@@ -104,6 +104,15 @@ type Config struct {
 	Connect       *Connect    `toml:"connect,omitempty" json:"connect,omitempty"`
 }
 
+func (c *Config) HasSecret(secret string) bool {
+	for _, s := range c.Secrets {
+		if s == secret {
+			return true
+		}
+	}
+	return false
+}
+
 type Environment = map[string]string
 
 type Python struct {

internal/services/api/post_deployment_test.go

@@ -130,6 +130,8 @@ func (s *PostDeploymentHandlerFuncSuite) TestPostDeploymentHandlerFuncStateErr()
 	handler := PostDeploymentHandlerFunc(s.cwd, log, nil, events.NewNullEmitter())
 	handler(rec, req)
 	s.Equal(http.StatusBadRequest, rec.Result().StatusCode)
+	body, _ := io.ReadAll(rec.Body)
+	s.Contains(string(body), "test error from state factory")
 }
 
 func (s *PostDeploymentHandlerFuncSuite) TestPostDeploymentHandlerFuncWrongServer() {

internal/state/state.go

@@ -145,6 +145,13 @@ func New(path util.AbsolutePath, accountName, configName, targetName string, sav
 		}
 	}
 
+	// Check that the secrets passed are in the config
+	for secret := range secrets {
+		if !cfg.HasSecret(secret) {
+			return nil, fmt.Errorf("secret '%s' is not in the configuration", secret)
+		}
+	}
+
 	return &State{
 		Dir:         path,
 		AccountName: accountName,

internal/state/state_test.go

@@ -274,6 +274,15 @@ func (s *StateSuite) makeConfiguration(name string) *config.Config {
 	return cfg
 }
 
+func (s *StateSuite) makeConfigurationWithSecrets(name string, secrets []string) *config.Config {
+	path := config.GetConfigPath(s.cwd, name)
+	cfg := s.makeConfiguration(name)
+	cfg.Secrets = secrets
+	err := cfg.WriteFile(path)
+	s.NoError(err)
+	return cfg
+}
+
 func (s *StateSuite) TestNew() {
 	accts := &accounts.MockAccountList{}
 	acct := accounts.Account{}
@@ -405,7 +414,7 @@ func (s *StateSuite) TestNewWithSecrets() {
 	accts := &accounts.MockAccountList{}
 	acct := accounts.Account{}
 	accts.On("GetAllAccounts").Return([]accounts.Account{acct}, nil)
-	s.makeConfiguration("default")
+	s.makeConfigurationWithSecrets("default", []string{"API_KEY", "DB_PASSWORD"})
 
 	secrets := map[string]string{
 		"API_KEY":     "secret123",
@@ -418,6 +427,22 @@ func (s *StateSuite) TestNewWithSecrets() {
 	s.Equal(secrets, state.Secrets)
 }
 
+func (s *StateSuite) TestNewWithInvalidSecret() {
+	accts := &accounts.MockAccountList{}
+	acct := accounts.Account{}
+	accts.On("GetAllAccounts").Return([]accounts.Account{acct}, nil)
+	s.makeConfiguration("default")
+
+	secrets := map[string]string{
+		"INVALID_SECRET": "secret123",
+	}
+
+	state, err := New(s.cwd, "", "", "", "", accts, secrets)
+	s.NotNil(err)
+	s.ErrorContains(err, "secret 'INVALID_SECRET' is not in the configuration")
+	s.Nil(state)
+}
+
 func (s *StateSuite) TestGetDefaultAccountNone() {
 	actual, err := getDefaultAccount([]accounts.Account{})
 	s.Nil(actual)