Hierarchy Bugs with fnox set

[theutz]

When you run fnox set from a "child" directory, it copies the all the secrets from the "parent" file into the child. Also, value in the child is "empty". Best illustrated with an example:

Initial State

Directory Structure

| fnox.toml
| service/
|--- fnox.toml

Root fnox.toml

[providers.age]
type = "age"
recipients = ["foo", "bar"]

[secrets]
PARENT_SECRET = { provider = "age", value = "parent..." }

service/fnox.toml

[providers.age]
type = "age"
recipients = ["foo", "bar", "baz"] # Note the different recipients. Not sure if that's relevant

[secrets]
CHILD_SECRET = { provider = "age", value = "child...." }

Run fnox set

cd service
fnox set CHILD_SECRET_2 "blerb"

Final State

service/fnox.toml

[providers.age]
type = "age"
recipients = ["foo", "bar", "baz"] # Recipients are preserved properly in the child.

[secrets]
PARENT_SECRET = { provider = "age", value = "parent..." }
CHILD_SECRET = { provider = "age", value = "child...." }
CHILD_SECRET_2 = { provider = "age", value = "some invalid string that looks right but isn't" }

Run fnox get

# pwd = service/
fnox get CHILD_SECRET_2

Returns error:

Error: fnox::encryption::age::decrypt_failed

  × Age decryption failed
  help: Ensure you have the correct age identity file or FNOX_AGE_KEY environment variable set

[davidolrik]

I'm seeing the same using the keychain provider

I do fnox set LINODE_API_KEY --provider keychain -v, it prompts be for the secret, then stores it in the keychain and copies the full configuration from the parent to local fnox.toml file.

[jdx]

Fixed in #122.

I originally thought the previous behavior (updating secrets in their source file) was the correct approach - it seemed logical that if a secret came from a parent config, updating it should update that parent. But after reading through this discussion and reflecting on it, I agree that behavior was confusing and unexpected.

The hierarchical config model should work like CSS or other layered config systems - child configs override parent configs, they don't modify them. When you run fnox set SECRET value from a child directory, you expect it to affect your local config, not silently reach up and modify a parent directory's config.

The fix makes fnox set always write to the local config file, creating a local override if the secret exists in a parent. If you genuinely need to update a parent config, you can cd to that directory or use -c ../fnox.toml explicitly.