fix: preserve selected enum variants and reject secrets

[robjtede]

Summary

• Preserve explicitly selected enum variants when no variant fields are supplied.
• Reject selected variants in secret fields when the source does not allow secrets.
• Add regression coverage and changelog entries for both cases.

Testing

• Not run.

Summary by CodeRabbit

• Bug Fixes
  • Explicitly selected unit enum variants now override configured defaults when loading configuration.
  • Enum variants provided by a non-secret source are rejected when the destination field is marked secret.
  • Enum variants with no fields are correctly recognized as containing non-secret data.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f6215f2b-b98c-4a83-910a-dce7bae30d7b

📥 Commits

Reviewing files that changed from the base of the PR and between b9ac247 and 84d43a8.

📒 Files selected for processing (4)

• confik-macros/src/lib.rs
• confik/CHANGELOG.md
• confik/tests/defaulting_containers/mod.rs
• confik/tests/secret/mod.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7c1ac189-064a-4e0e-9605-a0972a1fca19

📥 Commits

Reviewing files that changed from the base of the PR and between f339080 and b9ac247.

📒 Files selected for processing (4)

• confik-macros/src/lib.rs
• confik/CHANGELOG.md
• confik/tests/defaulting_containers/mod.rs
• confik/tests/secret/mod.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Enum variant checks now treat selected variants as containing non-secret data. Added TOML tests verify that an explicitly supplied variant replaces a default and that a non-secret source cannot set a secret enum field.

Changes

Selected enum variant handling

Layer / File(s)	Summary
Selected variant handling confik-macros/src/lib.rs, confik/tests/defaulting_containers/mod.rs, confik/tests/secret/mod.rs, confik/CHANGELOG.md	The macro initializes enum variant checks as true while retaining field checks and variant-name error context. TOML tests cover replacing a default variant and rejecting a variant from a non-secret source in a secret field. The changelog records both behaviors.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b9ac2

The change preserves explicitly selected TOML variants and rejects selected variants from non-secret sources in secret fields. No concrete merge-blocking risk is evident in the supplied context; the added regression tests have not been run.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b9ac2

The change preserves explicit enum choices and tightens rejection of secret configuration from unauthorized sources. No new security bypass was identified in the inspected code. Trust in custom configuration sources remains application-dependent.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected control applies to downstream configurations using regenerated enum builders, including enums nested inside secret fields. The demonstrated exposure is acceptance of selected enum configuration from a source that disallows secrets; the supplied evidence does not establish a particular production tenant, asset, environment, or credential scope.

Trust Boundaries and Controls

• observed — The new true initializer does not short-circuit nested secret checks: bitwise OR retains evaluation of field checks, and errors propagate with field and variant paths. SecretBuilder rejects either detected data or an inner secret error. This supports tightening the existing boundary rather than bypassing it.
• inferred — A custom Source can authorize secrets by returning true, so correctness of that decision remains a caller and source-implementation responsibility. The PR does not add a configuration-input path that changes this authorization; external implementations and deployment policy remain outside the inspected evidence.

Resilience and Maintainability Implications

• inferred — Within the library build operation, a rejected source cannot be masked by a conflicting source or become a successful partially built configuration. This failure containment follows from validation before merge and propagated errors. It does not make external effects performed by custom sources transactional.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both main changes: preserving explicitly selected enum variants and rejecting disallowed secrets.
Docstring Coverage	✅ Passed	Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 3 files. (1 skipped: 1 u…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}