promptkit/internal/configuration/inspection.go

package configuration

import (
	"io"
	"strconv"
	"strings"

	"go.maximumdirect.net/configkit"
)

// Inspection is the read-only subset of the retained ConfigKit result used by
// the facade. It does not expose typed configuration or resource contexts.
type Inspection interface {
	Metadata() configkit.Metadata
	Sources() []configkit.SourceInfo
	Diagnostics() []configkit.Diagnostic
	Explain(configkit.Path) (configkit.Explanation, bool)
	WriteEffective(io.Writer) error
	WriteExplanation(io.Writer, configkit.Path) error
	capturedResult() *configkit.Result[document]
}

type inspectionResult struct {
	*configkit.Result[document]
}

func (inspection inspectionResult) capturedResult() *configkit.Result[document] {
	return inspection.Result
}

// Inspection returns only the retained result's inspection operations.
func (state *loaded) Inspection() Inspection {
	if state == nil {
		return nil
	}
	return inspectionResult{Result: state.result}
}

// Diff compares two captured ConfigKit results without reconstructing them.
func Diff(left, right Inspection) ([]configkit.Difference, error) {
	var leftResult, rightResult *configkit.Result[document]
	if left != nil {
		leftResult = left.capturedResult()
	}
	if right != nil {
		rightResult = right.capturedResult()
	}
	return configkit.Diff(leftResult, rightResult)
}

func secretProviderPath(path configkit.Path) bool {
	pointer := path.String()
	if pointer == "" {
		return false
	}
	parts := strings.Split(strings.TrimPrefix(pointer, "/"), "/")
	if !providerExtraParamsPath(parts) {
		return false
	}
	key := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(parts[len(parts)-1], "~1", "/"), "~0", "~"))
	switch key {
	case "api_key", "apikey", "authorization", "credential", "credentials", "password", "secret", "token", "access_token":
		return true
	default:
		return false
	}
}

func providerExtraParamsPath(parts []string) bool {
	if len(parts) >= 4 && sequenceIndex(parts[1]) &&
		(parts[0] == "backends" || parts[0] == "profiles") && parts[2] == "extra_params" {
		return true
	}
	return len(parts) >= 6 && parts[0] == "collections" && parts[1] != "" &&
		(parts[2] == "backends" || parts[2] == "profiles") &&
		sequenceIndex(parts[3]) && parts[4] == "extra_params"
}

func sequenceIndex(segment string) bool {
	index, err := strconv.Atoi(segment)
	return err == nil && index >= 0 && strconv.Itoa(index) == segment
}