fix(vault,datastore): reject unknown config keys with strict schema validation (#2095) #268

Merged

stack72 merged 1 commit from fix/strict-config-schemas into main 2026-09-10 14:06:00 +00:00

Conversation 2 Commits 1 Files changed 18 +84 -12

stack72 commented 2026-09-10 13:07:39 +00:00

Owner

Copy link

Summary

• Add .strict() to all 6 vault and datastore extension configSchema definitions so unknown config keys raise a clear ZodError with "Unrecognized key" instead of being silently stripped during parse
• Add configSchema rejects unknown keys tests to all 6 extensions (aws-sm, azure-kv, gcp-sm, 1password, s3, gcs)
• Bump all 6 manifest versions to 2026.09.10.0

Fixes swamp-club #2095 — profile and other unsupported keys in vault YAML were silently discarded, causing invisible config drift.

Test plan

• New configSchema rejects unknown keys test passes in all 6 extensions
• All existing test suites pass (68 aws-sm, 33 azure-kv, 45 gcp-sm, 47 1password, 278 s3, 268 gcs)
• deno check, deno lint, deno fmt --check, deno install --frozen pass for all 6
• CI matrix covers all modified extensions

🤖 Generated with Claude Code

## Summary - Add `.strict()` to all 6 vault and datastore extension `configSchema` definitions so unknown config keys raise a clear `ZodError` with `"Unrecognized key"` instead of being silently stripped during parse - Add `configSchema rejects unknown keys` tests to all 6 extensions (aws-sm, azure-kv, gcp-sm, 1password, s3, gcs) - Bump all 6 manifest versions to `2026.09.10.0` Fixes swamp-club #2095 — `profile` and other unsupported keys in vault YAML were silently discarded, causing invisible config drift. ## Test plan - [x] New `configSchema rejects unknown keys` test passes in all 6 extensions - [x] All existing test suites pass (68 aws-sm, 33 azure-kv, 45 gcp-sm, 47 1password, 278 s3, 268 gcs) - [x] `deno check`, `deno lint`, `deno fmt --check`, `deno install --frozen` pass for all 6 - [ ] CI matrix covers all modified extensions 🤖 Generated with [Claude Code](https://claude.com/claude-code)

stack72 added 1 commit 2026-09-10 13:07:39 +00:00

fix(vault,datastore): reject unknown config keys with strict schema validation (#2095) ... 868fffdc48

All vault and datastore extension configSchemas used plain z.object()
which silently strips unknown keys during parse. This caused config
drift — keys like `profile` in vault YAML looked authoritative but were
silently discarded, with no error or warning.

Add .strict() to all 6 extension configSchemas (aws-sm, azure-kv,
gcp-sm, 1password, s3, gcs) so unknown keys raise a clear validation
error at create/edit time.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

stack72 commented 2026-09-10 13:20:26 +00:00

Author

Owner

Copy link

Code Review

Blocking Issues

None.

Suggestions

1. GCS test uses a key that looks plausible but may confuse future readers. credentials_file looks like it could be an intended field (GCS does use service-account key files). A brief inline comment explaining the choice — e.g., // credentials_file is not a config key; ADC handles auth — would make the test self-documenting. Same note for the GCP SM test which also uses credentials_file. Minor style preference only.

2. Test error-message check is format-coupled. All six assertThrows calls assert on the substring "Unrecognized key", which is part of Zod's internal error formatting ("Unrecognized key(s) in object: '...'"). This is consistent with the existing test style in the repo and will work fine against current Zod, but a Zod major version that changes this wording would silently pass even if the strict behavior broke. Not blocking — just worth noting.

---

Overall the PR is correct and well-scoped. All six config schemas now use .strict(), the tests exercise the actual rejection path with keys that are genuinely absent from each schema (verified against the schema definitions), and the version bumps are appropriate for the behavioral change. No CLAUDE.md violations, no type issues, no security concerns.

## Code Review ### Blocking Issues None. ### Suggestions 1. **GCS test uses a key that looks plausible but may confuse future readers.** `credentials_file` looks like it could be an intended field (GCS does use service-account key files). A brief inline comment explaining the choice — e.g., `// credentials_file is not a config key; ADC handles auth` — would make the test self-documenting. Same note for the GCP SM test which also uses `credentials_file`. Minor style preference only. 2. **Test error-message check is format-coupled.** All six `assertThrows` calls assert on the substring `"Unrecognized key"`, which is part of Zod's internal error formatting (`"Unrecognized key(s) in object: '...'"`). This is consistent with the existing test style in the repo and will work fine against current Zod, but a Zod major version that changes this wording would silently pass even if the strict behavior broke. Not blocking — just worth noting. --- Overall the PR is correct and well-scoped. All six config schemas now use `.strict()`, the tests exercise the actual rejection path with keys that are genuinely absent from each schema (verified against the schema definitions), and the version bumps are appropriate for the behavioral change. No CLAUDE.md violations, no type issues, no security concerns.

stack72 commented 2026-09-10 13:21:02 +00:00

Author

Owner

Copy link

Adversarial Review

Critical / High

No critical or high severity findings.

Medium

No medium severity findings.

Low

No low severity findings.

Verdict

PASS — Clean, mechanical change that adds .strict() to all 8 extension config schemas (GCS, S3, 1Password, AWS SM, Azure KV, GCP SM) with matching tests. Each test uses a plausible-but-invalid key alongside valid required fields and asserts on Zod's "Unrecognized key" substring. Schema placement is correct in all cases (.strict() applied to the outermost z.object()). Version bumps in all manifest.yaml files are consistent (2026.09.10.0). No logic errors, no security issues, no edge cases missed.

## Adversarial Review ### Critical / High No critical or high severity findings. ### Medium No medium severity findings. ### Low No low severity findings. ### Verdict **PASS** — Clean, mechanical change that adds `.strict()` to all 8 extension config schemas (GCS, S3, 1Password, AWS SM, Azure KV, GCP SM) with matching tests. Each test uses a plausible-but-invalid key alongside valid required fields and asserts on Zod's `"Unrecognized key"` substring. Schema placement is correct in all cases (`.strict()` applied to the outermost `z.object()`). Version bumps in all `manifest.yaml` files are consistent (`2026.09.10.0`). No logic errors, no security issues, no edge cases missed.

stack72 merged commit f69c46c734 into main 2026-09-10 14:06:00 +00:00

stack72 deleted branch fix/strict-config-schemas 2026-09-10 14:06:00 +00:00

stack72 referenced this pull request from a commit 2026-09-10 14:06:01 +00:00

fix(vault,datastore): reject unknown config keys with strict schema validation (#2095) (#268)

stack72 referenced this pull request 2026-09-10 14:52:22 +00:00

fix(datastore): revert strict schema validation for s3 and gcs #269

stack72 referenced this pull request 2026-09-10 14:58:09 +00:00

fix(datastore): revert strict schema validation for s3 and gcs #269

stack72 referenced this pull request from a commit 2026-09-10 16:56:33 +00:00

fix(datastore): revert strict schema validation for s3 and gcs (#269)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

swamp-club/swamp-extensions!268

No description provided.