Repository: markusressel/container-app-conf

Issue:
Mark configuration options as "secret"
**Is your feature request related to a problem? Please describe.**
Outputting the current configuration can leak secrets.

**Describe the solution you'd like**
Allow developers to mark individual config entries as `secret`. This information needs to be used in #29 to replace the values of such entries with a placeholder when generating the output.


Discussion:

Patch:
diff --git a/container_app_conf/entry/__init__.py b/container_app_conf/entry/__init__.py
index c892a15..6f8c63a 100644
--- a/container_app_conf/entry/__init__.py
+++ b/container_app_conf/entry/__init__.py
@@ -29,7 +29,7 @@ class ConfigEntry:
     _example = None
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None):
+                 required: bool = None, secret: bool = None):
         """
         Creates a config entry
         :param key_path: list of strings representing f.ex. the yaml tree path
@@ -37,7 +37,9 @@ class ConfigEntry:
         :param description: a description of this entry
         :param default: the default value
         :param required: Set to True if a 'None' value may be allowed, False if not,
-                             otherwise it will be True if the default value is not None.
+                            otherwise it will be True if the default value is not None.
+        :param secret: indicates whether this entry contains a secret and should be disguised when
+                        outputting the current configuration
         """
         if len(key_path) <= 0:
             raise ValueError("{}: key_path must contain at least one node".format(self.__class__.__name__))
@@ -56,6 +58,8 @@ class ConfigEntry:
             required = default is not None
         self._required = required
 
+        self.secret = False if secret is None else secret
+
         if default is not None:
             self.default = self._parse_value(default)
         else:
diff --git a/container_app_conf/entry/file.py b/container_app_conf/entry/file.py
index 6e3b957..199d74e 100644
--- a/container_app_conf/entry/file.py
+++ b/container_app_conf/entry/file.py
@@ -27,12 +27,12 @@ class FileConfigEntry(ConfigEntry):
     _example = "/tmp/temporary"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, check_existence: bool = False):
+                 required: bool = None, secret: bool = None, check_existence: bool = False):
         """
         See ConfigEntry
         :param check_existence: whether to check for file existence
         """
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
         self.check_existence = check_existence
 
     def _value_to_type(self, value: any) -> str or None:
diff --git a/container_app_conf/entry/float.py b/container_app_conf/entry/float.py
index 7a64e46..d04ff9c 100644
--- a/container_app_conf/entry/float.py
+++ b/container_app_conf/entry/float.py
@@ -26,9 +26,9 @@ class FloatConfigEntry(ConfigEntry):
     _example = "3.1415926535"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, range: Range = None):
+                 required: bool = None, secret: bool = None, range: Range = None):
         self.range = range
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> float or None:
         """
diff --git a/container_app_conf/entry/int.py b/container_app_conf/entry/int.py
index b08fca1..ad6648e 100644
--- a/container_app_conf/entry/int.py
+++ b/container_app_conf/entry/int.py
@@ -26,9 +26,9 @@ class IntConfigEntry(ConfigEntry):
     _example = "42"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, range: Range = None):
+                 required: bool = None, secret: bool = None, range: Range = None):
         self.range = range
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> int or None:
         """
diff --git a/container_app_conf/entry/list.py b/container_app_conf/entry/list.py
index 1cd7d5a..8214a2c 100644
--- a/container_app_conf/entry/list.py
+++ b/container_app_conf/entry/list.py
@@ -29,7 +29,9 @@ class ListConfigEntry(ConfigEntry):
 
     def __init__(self, item_type: Type[ConfigEntry], key_path: [str], example: any = None,
                  description: str or None = None,
-                 default: any = None, required: bool = None,
+                 default: any = None,
+                 required: bool = None,
+                 secret: bool = None,
                  item_args: dict = None,
                  delimiter: str = None):
         """
@@ -52,7 +54,8 @@ class ListConfigEntry(ConfigEntry):
             description=description,
             example=example,
             default=default,
-            required=required
+            required=required,
+            secret=secret,
         )
 
     @property
diff --git a/container_app_conf/entry/regex.py b/container_app_conf/entry/regex.py
index 148b6d7..6f2bf41 100644
--- a/container_app_conf/entry/regex.py
+++ b/container_app_conf/entry/regex.py
@@ -33,12 +33,12 @@ class RegexConfigEntry(ConfigEntry):
     _example = r"^[a-zA-z0-9]*$"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, flags: int or None = None):
+                 required: bool = None, secret: bool = None, flags: int or None = None):
         """
         :param flags: Regex flags to mandate or None if no flag restrictions should be made
         """
         self.flags = flags | re.UNICODE if flags is not None else None
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> Pattern or None:
         if value is None and self._required:
diff --git a/container_app_conf/entry/string.py b/container_app_conf/entry/string.py
index 96b04b5..9c23ea5 100644
--- a/container_app_conf/entry/string.py
+++ b/container_app_conf/entry/string.py
@@ -26,9 +26,9 @@ class StringConfigEntry(ConfigEntry):
     _example = "text"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, regex: str = None):
+                 required: bool = None, secret: bool = None, regex: str = None):
         self.regex = re.compile(regex) if regex is not None else None
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> str or None:
         """


Test patch:
diff --git a/tests/secret_test.py b/tests/secret_test.py
new file mode 100644
index 0000000..824e504
--- /dev/null
+++ b/tests/secret_test.py
@@ -0,0 +1,32 @@
+#  Copyright (c) 2019 Markus Ressel
+#  .
+#  Permission is hereby granted, free of charge, to any person obtaining a copy
+#  of this software and associated documentation files (the "Software"), to deal
+#  in the Software without restriction, including without limitation the rights
+#  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+#  copies of the Software, and to permit persons to whom the Software is
+#  furnished to do so, subject to the following conditions:
+#  .
+#  The above copyright notice and this permission notice shall be included in all
+#  copies or substantial portions of the Software.
+#  .
+#  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+#  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+#  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+#  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+#  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+#  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+#  SOFTWARE.
+from container_app_conf.entry.string import StringConfigEntry
+from tests import EntryTestBase
+
+
+class SecretTest(EntryTestBase):
+
+    def test_secret_entry(self):
+        config_entry = StringConfigEntry(key_path=["string"], required=False)
+        self.assertFalse(config_entry.secret)
+        config_entry = StringConfigEntry(key_path=["string"], required=False, secret=False)
+        self.assertFalse(config_entry.secret)
+        config_entry = StringConfigEntry(key_path=["string"], required=False, secret=True)
+        self.assertTrue(config_entry.secret)