Function rejectTaskSecretJSON

internal/task/block_service.go:505–520

(path string, value []byte)

}

func rejectTaskSecretJSON(path string, value []byte) error {
	if len(value) == 0 {
		return nil
	}
	decoded, ok := decodeTaskSecretJSON(value)
	if !ok {
		if redactTaskSecretText(string(value)) != string(value) {
			return fmt.Errorf("%w: %s must not embed raw secret material", ErrValidation, path)
		}
		return nil
	}
	if taskSecretValueContainsSecret(decoded) {
		return fmt.Errorf("%w: %s must not embed raw secret material", ErrValidation, path)
	}
	return nil
}

func redactTaskSecretText(value string) string {
	return diagnostics.Redact(RedactClaimTokens(value))