From 6aa90a51d00d107c2aa6115ef48420c2160d1159 Mon Sep 17 00:00:00 2001
From: Kristin Laemmert <mildwonkey@users.noreply.github.com>
Date: Thu, 11 Feb 2021 10:32:31 -0500
Subject: [PATCH] ContainsSensitive must descend into nested objects

---
 configs/configschema/implied_type.go      |  3 ++
 configs/configschema/implied_type_test.go | 62 +++++++++++++++++++++++
 2 files changed, 65 insertions(+)

diff --git a/configs/configschema/implied_type.go b/configs/configschema/implied_type.go
index 729881a03..a9efa9658 100644
--- a/configs/configschema/implied_type.go
+++ b/configs/configschema/implied_type.go
@@ -71,6 +71,9 @@ func (o *Object) ContainsSensitive() bool {
 		if attrS.Sensitive {
 			return true
 		}
+		if attrS.NestedType != nil {
+			return attrS.NestedType.ContainsSensitive()
+		}
 	}
 	return false
 }
diff --git a/configs/configschema/implied_type_test.go b/configs/configschema/implied_type_test.go
index 56316eead..595d9dd32 100644
--- a/configs/configschema/implied_type_test.go
+++ b/configs/configschema/implied_type_test.go
@@ -178,3 +178,65 @@ func TestObjectImpliedType(t *testing.T) {
 		})
 	}
 }
+
+func TestObjectContainsSensitive(t *testing.T) {
+	tests := map[string]struct {
+		Schema *Object
+		Want   bool
+	}{
+		"object contains sensitive": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"sensitive": {Sensitive: true},
+				},
+			},
+			true,
+		},
+		"no sensitive attrs": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"insensitive": {},
+				},
+			},
+			false,
+		},
+		"nested object contains sensitive": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"nested": {
+						NestedType: &Object{
+							Attributes: map[string]*Attribute{
+								"sensitive": {Sensitive: true},
+							},
+						},
+					},
+				},
+			},
+			true,
+		},
+		"nested obj, no sensitive attrs": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"nested": {
+						NestedType: &Object{
+							Attributes: map[string]*Attribute{
+								"public": {},
+							},
+						},
+					},
+				},
+			},
+			false,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			got := test.Schema.ContainsSensitive()
+			if got != test.Want {
+				t.Errorf("wrong result\ngot:  %#v\nwant: %#v", got, test.Want)
+			}
+		})
+	}
+
+}