Carry sensitivity across matched records

internal/engine/resolution_compare_test.go

@@ -533,3 +533,58 @@ func TestRegisteredResolutionExplainsRemovedFieldOnMovedRecord(t *testing.T) {
 	}
 	t.Fatalf("removed field history = %#v", explanation.History)
 }
+
+func TestRegisteredResolutionTransfersSensitivityFromEntry(t *testing.T) {
+	type item struct {
+		ID    string `yaml:"id"`
+		Value string `yaml:"value"`
+	}
+	type config struct {
+		Items   []item `yaml:"items"`
+		Derived string `yaml:"derived"`
+	}
+	definition := DefinitionWithSequenceIdentityRegistrations(Definition[config]{
+		Secret: func(path Path) bool { return path.String() == "/items/0/value" },
+		Resolve: func(value *config, r *Resolution) error {
+			value.Items[0], value.Items[1] = value.Items[1], value.Items[0]
+			value.Derived = value.Items[1].Value
+			r.RecordNormalization(Keys("items"), "reorder")
+			r.RecordNormalization(Keys("derived"), "derive", Keys("items").Index(1).Key("value"))
+			return nil
+		},
+	}, []SequenceIdentityRegistrationInput{{ExactPath: pathPointer(Keys("items")), IdentityFields: []string{"id"}}})
+	result, err := testLoad(Bytes("records", []byte("items: [{id: a, value: confidential}, {id: b, value: visible}]\n")), Options[config]{Definition: definition})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []Path{Keys("items").Index(0).Key("value"), Keys("items").Index(1).Key("value"), Keys("derived")} {
+		if !pathIsSecret(result.Inspection.secrets, path) {
+			t.Errorf("sensitivity lost at %s", path.String())
+		}
+	}
+}
+
+func TestRegisteredResolutionKeepsRemovedSensitivity(t *testing.T) {
+	type item struct {
+		ID    string `yaml:"id"`
+		Value string `yaml:"value"`
+	}
+	type config struct {
+		Items []item `yaml:"items"`
+	}
+	definition := DefinitionWithSequenceIdentityRegistrations(Definition[config]{
+		Secret: func(path Path) bool { return path.String() == "/items/0/value" },
+		Resolve: func(value *config, r *Resolution) error {
+			value.Items = value.Items[1:]
+			r.RecordNormalization(Keys("items"), "remove record")
+			return nil
+		},
+	}, []SequenceIdentityRegistrationInput{{ExactPath: pathPointer(Keys("items")), IdentityFields: []string{"id"}}})
+	result, err := testLoad(Bytes("records", []byte("items: [{id: a, value: confidential}, {id: b, value: visible}]\n")), Options[config]{Definition: definition})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !pathIsSecret(result.Inspection.secrets, Keys("items").Index(0).Key("value")) {
+		t.Fatal("removed historical sensitivity lost")
+	}
+}