(feat) Secret store harness

[WhitWaldo]

Description

Adding support for a secret-store harness using local files

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #[issue number]

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

• Code compiles correctly
• Created/updated tests
• Extended the documentation

[Copilot]

🟡 Changes recommended

Address the unresolved moderate findings in DaprContainer and SecretStoreHarness before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds local-file-backed Dapr secret-store support and a SecretStoreHarness for integration testing.

Changes:

• Adds secret-store validation, serialization, and file helpers.
• Integrates stores with DaprContainer and exposes harness APIs.
• Adds tests, fixtures, exports, and documentation.

File summaries

File	Summary	Final review comments
src/SecretStoreHarness.ts	Dapr Secrets testing harness	Moderate (1): align missing-key behavior with documentation. Moderate (1): model or reject nested multi-valued results. Nit (1): add end-to-end multi-valued retrieval coverage.
src/SecretStoreHarness.test.ts	Harness integration tests	—
src/SecretStore.ts	Secret-store configuration and utilities	—
src/SecretStore.test.ts	Secret-store unit tests	—
src/index.ts	Public API exports	—
src/DaprContainer.ts	Secret-store registration and file provisioning	Moderate (3): prevent duplicate component names. Moderate (1): handle reserved kvstore/pubsub names.
src/Constants.ts	Default secret-store name	—
src/__fixtures__/dapr-resources/secrets.json	Secret fixture data	—
README.md	Secret-store usage documentation	Nit (1): fix the standalone example’s missing network setup.

Review details

Suppressed comments (5)

README.md:101

• This standalone snippet references network without importing or creating it. Since DaprContainer.start() requires a configured network, copying the example either fails TypeScript compilation or throws at runtime; add the Network setup/cleanup or show the harness-based approach instead.

const dapr = new DaprContainer()
  .withNetwork(network)
  .withSecretStore({ secrets: { alpha: "one" } })
  .withSecretStore({ name: "second-store", secrets: { beta: "two" } });

src/DaprContainer.ts:461

• A store named kvstore or pubsub is currently overwritten at startup: beforeContainerCreated adds those fallback components whenever no state/pubsub component exists (src/DaprContainer.ts:233-240), then the resource-writing loop writes the fallback YAML to the same /dapr-resources/<name>.yaml path after this component. Reject these reserved names or make the generated fallback names collision-safe.

    this.secretStores.push(resolved);
    this.components.push(resolved.component);

src/SecretStoreHarness.ts:35

• The new multiValued option is only covered by checking that metadata contains multiValued: true; none of the integration tests retrieves a multi-valued secret. Since this option changes the response shape while getSecretValue and the public casts assume flat string maps, add an end-to-end assertion for getSecret/getBulkSecrets so a runtime shape or handling regression cannot pass the suite.

  /** When true, nested secrets are returned as multi-valued secrets rather than flattened. */
  multiValued?: boolean;

src/SecretStoreHarness.ts:185

• The @returns documentation promises undefined for a missing key, but getSecret propagates Dapr's not-found exception; the direct-container test in SecretStoreHarness.test.ts:184 demonstrates that secret.get rejects for a missing secret. Catch only the not-found case (or change the return type and documentation), rather than leaving callers with a rejection contrary to this public contract.

   * @returns The secret value, or undefined if not present.
   */
  public async getSecretValue(key: string): Promise<string | undefined> {
    const secret = await this.getSecret(key);
    return secret?.[key];

src/SecretStoreHarness.ts:185

• With multiValued: true, a top-level nested secret can be returned as an object, so secret?.[key] may be an object even though this method promises string | undefined (and getSecret declares all values as strings). The exported API is therefore unsound for an option this PR exposes; model the multi-valued response or explicitly reject/return undefined for object values.

  public async getSecretValue(key: string): Promise<string | undefined> {
    const secret = await this.getSecret(key);
    return secret?.[key];

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.