Allow loading secret keys in mappings

smallrye · Jun 30, 2022 · 4b1dd3a · 4b1dd3a
1 parent 9d13639
commit 4b1dd3a
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 1 deletion.
diff --git a/implementation/src/main/java/io/smallrye/config/ConfigMappingProvider.java b/implementation/src/main/java/io/smallrye/config/ConfigMappingProvider.java
@@ -790,7 +790,7 @@ void mapConfiguration(SmallRyeConfig config) throws ConfigValidationException {
         }
 
         config.addPropertyNames(additionalMappedProperties(new HashSet<>(getProperties().keySet()), config));
-        mapConfiguration(config, config.getConfigMappings());
+        SecretKeys.doUnlocked(() -> mapConfiguration(config, config.getConfigMappings()));
     }
 
     private void mapConfiguration(SmallRyeConfig config, ConfigMappings mappings) throws ConfigValidationException {

diff --git a/implementation/src/test/java/io/smallrye/config/SecretKeysTest.java b/implementation/src/test/java/io/smallrye/config/SecretKeysTest.java
@@ -55,6 +55,26 @@ void lockAndUnlock() {
         });
     }
 
+    @ConfigMapping(prefix = "mapping")
+    interface MappingSecret {
+        String secret();
+    }
+
+    @Test
+    void mapping() {
+        SmallRyeConfig config = new SmallRyeConfigBuilder()
+                .addDefaultInterceptors()
+                .withMapping(MappingSecret.class)
+                .withSources(KeyValuesConfigSource.config("mapping.secret", "secret"))
+                .withSecretKeys("mapping.secret")
+                .build();
+
+        MappingSecret mapping = config.getConfigMapping(MappingSecret.class);
+        assertEquals("secret", mapping.secret());
+        assertThrows(SecurityException.class, () -> config.getRawValue("mapping.secret"),
+                "Not allowed to access secret key mapping.secret");
+    }
+
     private static Config buildConfig(String... keyValues) {
         return new SmallRyeConfigBuilder()
                 .addDefaultSources()