Accept a version argument only if the secret has that version (closes #67)

version rm, version promote and get --version joined the version argument into a path unchecked, so "", ".", "..", "../../.." removed or read every version, the secret, the vault or directories above it. A version is now accepted only if it is one of the versions ListVersions lists for the secret, compared by name before any path is built (secret.VersionExists, used by all three). An empty --version is rejected instead of meaning the current version: GetSecretVersion no longer treats "" as current, and GetSecret looks the current version up itself. Model: opus-5-5
2026-10-04 00:14:27 +00:00
parent 51e3731076
commit c497aaa7f3
11 changed files with 193 additions and 73 deletions
@@ -49,7 +49,7 @@ var (

 	// ErrVersionNotFound indicates the requested secret version does not
 	// exist. Composed as
-	// "version <version> not found for secret <name>".
+	// "version '<version>' not found for secret '<name>'".
 	ErrVersionNotFound = errors.New("not found for secret")

 	// ErrNoVersions indicates the source secret has no versions. Composed