Resolvable secrets

model/src/commonMain/kotlin/ResolvableSecret.kt

@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2025 The ORT Server Authors (See <https://github.com/eclipse-apoapsis/ort-server/blob/main/NOTICE>)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+package org.eclipse.apoapsis.ortserver.model
+
+import kotlinx.serialization.KSerializer
+import kotlinx.serialization.KeepGeneratedSerializer
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.SerializationException
+import kotlinx.serialization.descriptors.SerialDescriptor
+import kotlinx.serialization.encoding.Decoder
+import kotlinx.serialization.encoding.Encoder
+import kotlinx.serialization.json.JsonDecoder
+import kotlinx.serialization.json.JsonPrimitive
+
+@KeepGeneratedSerializer
+@Serializable(with = ResolvableSecretSerializer::class)
+data class ResolvableSecret(
+    /** The name of the secret. */
+    val name: String,
+
+    /** The source of the secret. */
+    val source: SecretSource
+)
+
+/**
+ * A custom deserializer for backward compatibility that allows deserializing a [ResolvableSecret] from either a string
+ * or an object. If the value is deserialized from a string, the source is set to [SecretSource.ADMIN] because that was
+ * the only available source before the introduction of [ResolvableSecret].
+ */
+object ResolvableSecretSerializer : KSerializer<ResolvableSecret> {
+    private val delegate = ResolvableSecret.generatedSerializer()
+
+    override val descriptor = SerialDescriptor(
+        serialName = "org.eclipse.apoapsis.ortserver.model.ResolvableSecret.Custom",
+        original = delegate.descriptor
+    )
+
+    override fun serialize(encoder: Encoder, value: ResolvableSecret) {
+        encoder.encodeSerializableValue(delegate, value)
+    }
+
+    override fun deserialize(decoder: Decoder): ResolvableSecret {
+        val jsonDecoder = decoder as? JsonDecoder
+            ?: throw SerializationException("ResolvableSecret can only be deserialized from JSON.")
+
+        return when (val element = jsonDecoder.decodeJsonElement()) {
+            is JsonPrimitive -> {
+                if (!element.isString) {
+                    throw SerializationException("Expected string or object for ResolvableSecret.")
+                }
+                ResolvableSecret(
+                    name = element.content,
+                    source = SecretSource.ADMIN
+                )
+            }
+
+            else -> {
+                jsonDecoder.json.decodeFromJsonElement(delegate, element)
+            }
+        }
+    }
+}

model/src/commonMain/kotlin/SecretSource.kt

@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2025 The ORT Server Authors (See <https://github.com/eclipse-apoapsis/ort-server/blob/main/NOTICE>)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+package org.eclipse.apoapsis.ortserver.model
+
+/** An enum class to describe the different sources for secrets. */
+enum class SecretSource {
+    /** The secret is resolved from the admin secrets. */
+    ADMIN,
+
+    /** The secret is resolved from the user secrets configured in the hierarchy. */
+    USER
+}

model/src/jvmTest/kotlin/ResolvableSecretTest.kt

@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2025 The ORT Server Authors (See <https://github.com/eclipse-apoapsis/ort-server/blob/main/NOTICE>)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+package org.eclipse.apoapsis.ortserver.model
+
+import io.kotest.core.spec.style.WordSpec
+import io.kotest.matchers.shouldBe
+
+import kotlinx.serialization.json.Json
+
+class ResolvableSecretTest : WordSpec({
+    "deserialization" should {
+        "work for an object" {
+            Json.decodeFromString<ResolvableSecret>(
+                """
+                {
+                  "name": "admin-secret",
+                  "source": "ADMIN"
+                }
+                """.trimIndent()
+            ) shouldBe ResolvableSecret(name = "admin-secret", source = SecretSource.ADMIN)
+
+            Json.decodeFromString<ResolvableSecret>(
+                """
+                {
+                  "name": "user-secret",
+                  "source": "USER"
+                }
+                """.trimIndent()
+            ) shouldBe ResolvableSecret(name = "user-secret", source = SecretSource.USER)
+        }
+
+        "work for a string" {
+            val input = "\"admin-secret\""
+
+            Json.decodeFromString<ResolvableSecret>(input) shouldBe
+                    ResolvableSecret(name = "admin-secret", source = SecretSource.ADMIN)
+        }
+    }
+})