[jira] [Created] (NIFI-16250) hasPropertyValue and fromValueReference treat an unconfigured SECRET_REFERENCE as a configured secret

["Matt Gilman (Jira)" <ji...@apache.org>]

Matt Gilman created NIFI-16250:
----------------------------------

             Summary: hasPropertyValue and fromValueReference treat an unconfigured SECRET_REFERENCE as a configured secret
                 Key: NIFI-16250
                 URL: https://issues.apache.org/jira/browse/NIFI-16250
             Project: Apache NiFi
          Issue Type: Bug
          Components: Core UI
            Reporter: Matt Gilman
            Assignee: Matt Gilman


{{buildSecretKey}} ({{nifi-frontend/src/main/frontend/libs/shared/src/types/index.ts:570}}) joins its three parts with a {{::}} delimiter:

{code:javascript}
return [providerId ?? '', providerName ?? '', fullyQualifiedName ?? ''].join('::');
{code}

It therefore never returns an empty string. For an entirely empty reference it returns {{"::::"}}, and for a reference carrying only a provider name it returns {{"::Provider Name::"}}. Two callers assume the opposite and misbehave as a result.

h3. 1. Required-property validation accepts an unconfigured secret

The SECRET branch of {{hasPropertyValue}} ({{libs/shared/src/utils/connector-validation.utils.ts:44-57}}) guards with {{secretKey !== ''}}. Because the key is never empty, that check is always true, so any object with {{valueType: 'SECRET_REFERENCE'}} is reported as having a value -- including one with no {{fullyQualifiedSecretName}} and no {{secretName}}.

The connector configuration summary step uses this function for its required-field check ({{libs/shared/src/components/connector-configuration-summary-step/connector-configuration-summary-step.component.ts:167}}), so {{hasMissingRequiredFields}} returns false and the user can proceed to apply a configuration in which a required secret was never selected.

h3. 2. The secret dropdown shows "(no longer available)" instead of its placeholder

{{fromValueReference}} ({{libs/shared/src/services/value-reference.helper.ts:174-182}}) returns the composite key verbatim for a {{SECRET_REFERENCE}}. For an unconfigured reference the resulting non-empty string is written into the form control, so {{ConnectorPropertyInput}} treats it as a saved selection. Finding no matching secret, it appends a disabled orphan option ({{libs/shared/src/components/connector-property-input/connector-property-input.component.ts:622-629}}) labelled from the parsed fully-qualified name -- which is empty, producing a bare " (no longer available)" entry where the user should simply see the "Select a secret" placeholder.

h3. Steps to reproduce

# Configure a connector having a required SECRET property whose stored value reference is {{{ valueType: 'SECRET_REFERENCE', secretProviderName: '<some provider>' \}}} with no {{fullyQualifiedSecretName}} and no {{secretName}}.
# Open the connector configuration wizard and go to the step containing that property.
# Observe the secret dropdown.
# Advance to the summary step.

h3. Expected

The dropdown shows its "Select a secret" placeholder, and the summary step reports the required secret as missing, blocking apply.

h3. Actual

The dropdown shows a disabled "(no longer available)" option with an empty name, and the summary step reports no missing required fields, allowing apply.

h3. Suggested fix

In the SECRET branch of {{hasPropertyValue}}, check the identifying fields directly rather than the joined key, treating a reference with neither {{fullyQualifiedSecretName}} nor {{secretName}} as unset. In {{fromValueReference}}, return {{undefined}} for a {{SECRET_REFERENCE}} with no secret selected so the select component falls back to its placeholder. The {{secretKey !== ''}} comparison should be removed rather than left in place, since it cannot be false.

Note that {{libs/shared/src/utils/}} currently has no {{connector-validation.utils.spec.ts}}, so {{hasPropertyValue}} is untested. This fix is a good opportunity to add one, covering at minimum: a fully configured reference, a provider-name-only reference, an all-empty-strings reference, a reference with {{secretName}} but no {{fullyQualifiedSecretName}}, and a cleared secret arriving as {{STRING_LITERAL}} with a null value.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)