Propagate matched sensitivity with one work queue

internal/engine/resolution_remediation_test.go

@@ -1,6 +1,9 @@
 package engine
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestMovedRemovedFieldHasConsistentHistory(t *testing.T) {
 	type config struct {
@@ -94,3 +97,49 @@ func TestMovedInheritedHistoryUsesFinalRecordPrefix(t *testing.T) {
 		}
 	}
 }
+
+func TestCyclicMatchingProtectsRemovedAndDerivedValues(t *testing.T) {
+	type config struct {
+		Items   []map[string]any `yaml:"items"`
+		Derived string           `yaml:"derived"`
+	}
+	removed := Keys("items").Index(1).Key("extra")
+	definition := DefinitionWithSequenceIdentityRegistrations(Definition[config]{
+		Secret: func(path Path) bool { return path.String() == "/items/0/extra" },
+		Resolve: func(value *config, r *Resolution) error {
+			value.Derived = value.Items[0]["extra"].(string)
+			delete(value.Items[0], "extra")
+			last := value.Items[len(value.Items)-1]
+			copy(value.Items[1:], value.Items[:len(value.Items)-1])
+			value.Items[0] = last
+			r.RecordNormalization(Keys("items"), "remove field and rotate")
+			r.RecordDerivedDefault(Keys("derived"), "derive from removed value", removed)
+			return nil
+		},
+	}, []SequenceIdentityRegistrationInput{{ExactPath: pathPointer(Keys("items")), IdentityFields: []string{"id"}}})
+	result, err := testLoad(Bytes("records", []byte("items: [{id: a, extra: CYCLIC_PRIVATE_CANARY}, {id: b}, {id: c}, {id: d}]\n")), Options[config]{Definition: definition})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []Path{Keys("items"), removed, Keys("derived")} {
+		explanation, found := result.Inspection.Explain(path)
+		if !found {
+			t.Fatalf("missing explanation for %s", path.String())
+		}
+		if strings.Contains(explanation.Effective.YAML, "CYCLIC_PRIVATE_CANARY") {
+			t.Fatalf("effective value leaked at %s", path.String())
+		}
+		for _, change := range explanation.History {
+			if strings.Contains(change.Before.YAML, "CYCLIC_PRIVATE_CANARY") || strings.Contains(change.After.YAML, "CYCLIC_PRIVATE_CANARY") {
+				t.Fatalf("history leaked at %s", path.String())
+			}
+		}
+	}
+	var output strings.Builder
+	if err := result.Inspection.WriteEffective(&output); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(output.String(), "CYCLIC_PRIVATE_CANARY") {
+		t.Fatal("effective rendering leaked")
+	}
+}