Introduce an error for trying to fetch a secret of the wrong type.

secrets/errors.go

@@ -37,3 +37,18 @@ type SecretNotFoundError string
 func (path SecretNotFoundError) Error() string {
 	return "secrets: no secret has been found for " + string(path)
 }
+
+type SecretWrongTypeError struct {
+	Path         string
+	DeclaredType string
+	CorrectType  string
+}
+
+func (e SecretWrongTypeError) Error() string {
+	return fmt.Sprintf(
+		"secrets: requested secret at path %q of type '%s' does not exist, but a secret of type '%s' does, consider using the correct API to retrieve the secret",
+		e.Path,
+		e.DeclaredType,
+		e.CorrectType,
+	)
+}

secrets/secrets.go

@@ -49,6 +49,22 @@ func (s *Secrets) GetSimpleSecret(path string) (SimpleSecret, error) {
 	}
 	secret, ok := s.simpleSecrets[path]
 	if !ok {
+		_, ok := s.versionedSecrets[path]
+		if ok {
+			return secret, SecretWrongTypeError{
+				Path:         path,
+				DeclaredType: SimpleType,
+				CorrectType:  VersionedType,
+			}
+		}
+		_, ok = s.credentialSecrets[path]
+		if ok {
+			return secret, SecretWrongTypeError{
+				Path:         path,
+				DeclaredType: SimpleType,
+				CorrectType:  CredentialType,
+			}
+		}
 		return secret, SecretNotFoundError(path)
 	}
 
@@ -62,6 +78,22 @@ func (s *Secrets) GetVersionedSecret(path string) (VersionedSecret, error) {
 	}
 	secret, ok := s.versionedSecrets[path]
 	if !ok {
+		_, ok := s.simpleSecrets[path]
+		if ok {
+			return secret, SecretWrongTypeError{
+				Path:         path,
+				DeclaredType: VersionedType,
+				CorrectType:  SimpleType,
+			}
+		}
+		_, ok = s.credentialSecrets[path]
+		if ok {
+			return secret, SecretWrongTypeError{
+				Path:         path,
+				DeclaredType: VersionedType,
+				CorrectType:  CredentialType,
+			}
+		}
 		return secret, SecretNotFoundError(path)
 	}
 
@@ -76,6 +108,22 @@ func (s *Secrets) GetCredentialSecret(path string) (CredentialSecret, error) {
 	}
 	secret, ok := s.credentialSecrets[path]
 	if !ok {
+		_, ok := s.simpleSecrets[path]
+		if ok {
+			return secret, SecretWrongTypeError{
+				Path:         path,
+				DeclaredType: CredentialType,
+				CorrectType:  SimpleType,
+			}
+		}
+		_, ok = s.versionedSecrets[path]
+		if ok {
+			return secret, SecretWrongTypeError{
+				Path:         path,
+				DeclaredType: CredentialType,
+				CorrectType:  VersionedType,
+			}
+		}
 		return secret, SecretNotFoundError(path)
 	}
 

secrets/secrets_test.go

@@ -118,3 +118,126 @@ func TestNewSecrets(t *testing.T) {
 		})
 	}
 }
+
+func TestSecretsWrongType(t *testing.T) {
+	rawSecrets := `
+		{
+			"secrets": {
+				"secret/myservice/external-account-key": {
+					"type": "versioned",
+					"current": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU=",
+					"previous": "aHVudGVyMg=="
+				},
+				"secret/myservice/some-api-key": {
+					"type": "simple",
+					"value": "Y2RvVXhNMVdsTXJma3BDaHRGZ0dPYkVGSg==",
+					"encoding": "base64"
+				},
+				"secret/myservice/some-database-credentials": {
+					"type": "credential",
+					"username": "spez",
+					"password": "hunter2"
+				}
+			},
+			"vault": {
+				"url": "vault.reddit.ue1.snooguts.net",
+				"token": "17213328-36d4-11e7-8459-525400f56d04"
+			}
+		}
+	`
+
+	tests := []struct {
+		name          string
+		input         string
+		function      func(*Secrets) (interface{}, error)
+		expectedError error
+	}{
+		{
+			name:  "Simple vs Versioned",
+			input: rawSecrets,
+			function: func(s *Secrets) (interface{}, error) {
+				return s.GetSimpleSecret("secret/myservice/external-account-key")
+			},
+			expectedError: SecretWrongTypeError{
+				Path:         "secret/myservice/external-account-key",
+				DeclaredType: "simple",
+				CorrectType:  "versioned",
+			},
+		},
+		{
+			name:  "Versioned vs Simple",
+			input: rawSecrets,
+			function: func(s *Secrets) (interface{}, error) {
+				return s.GetVersionedSecret("secret/myservice/some-api-key")
+			},
+			expectedError: SecretWrongTypeError{
+				Path:         "secret/myservice/some-api-key",
+				DeclaredType: "versioned",
+				CorrectType:  "simple",
+			},
+		},
+		{
+			name:  "Credential vs Simple",
+			input: rawSecrets,
+			function: func(s *Secrets) (interface{}, error) {
+				return s.GetCredentialSecret("secret/myservice/some-api-key")
+			},
+			expectedError: SecretWrongTypeError{
+				Path:         "secret/myservice/some-api-key",
+				DeclaredType: "credential",
+				CorrectType:  "simple",
+			},
+		},
+		{
+			name:  "Simple vs Credential",
+			input: rawSecrets,
+			function: func(s *Secrets) (interface{}, error) {
+				return s.GetSimpleSecret("secret/myservice/some-database-credentials")
+			},
+			expectedError: SecretWrongTypeError{
+				Path:         "secret/myservice/some-database-credentials",
+				DeclaredType: "simple",
+				CorrectType:  "credential",
+			},
+		},
+		{
+			name:  "Versioned vs Credential",
+			input: rawSecrets,
+			function: func(s *Secrets) (interface{}, error) {
+				return s.GetVersionedSecret("secret/myservice/some-database-credentials")
+			},
+			expectedError: SecretWrongTypeError{
+				Path:         "secret/myservice/some-database-credentials",
+				DeclaredType: "versioned",
+				CorrectType:  "credential",
+			},
+		},
+		{
+			name:  "Credential vs Versioned",
+			input: rawSecrets,
+			function: func(s *Secrets) (interface{}, error) {
+				return s.GetCredentialSecret("secret/myservice/external-account-key")
+			},
+			expectedError: SecretWrongTypeError{
+				Path:         "secret/myservice/external-account-key",
+				DeclaredType: "credential",
+				CorrectType:  "versioned",
+			},
+		},
+	}
+	for _, tt := range tests {
+		tt := tt // capture range variable for parallel testing
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			buf := bytes.NewBuffer([]byte(tt.input))
+			secrets, err := NewSecrets(buf)
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, err = tt.function(secrets)
+			if tt.expectedError != nil && err.Error() != tt.expectedError.Error() {
+				t.Fatalf("expected error %v, actual: %v", tt.expectedError, err)
+			}
+		})
+	}
+}