feat(cli): reject duplicate secret material keys

Signed-off-by: Hung Le <hple@nvidia.com>

Author: hunglp6d

crates/openshell-cli/src/run.rs

@@ -4037,6 +4037,11 @@ pub fn parse_secret_material_env_pairs(items: &[String]) -> Result<HashMap<Strin
             ));
         }
 
+        if map.contains_key(key) {
+            return Err(miette::miette!(
+                "--secret-material-env key '{key}' supplied more than once"
+            ));
+        }
         map.insert(key.to_string(), value);
     }
 
@@ -5331,8 +5336,14 @@ pub async fn provider_refresh_config(
     let strategy = provider_refresh_strategy(input.strategy)?;
     let mut material = parse_key_value_pairs(input.material, "--material")?;
     let mut secret_material_keys = input.secret_material_keys.to_vec();
-    // Env-resolved secrets override `--material` duplicates and are auto-marked secret.
+    // Env-resolved secrets are auto-marked secret; duplicate keys are an
+    // error rather than a precedence order.
     for (key, value) in parse_secret_material_env_pairs(input.secret_material_env)? {
+        if material.contains_key(&key) {
+            return Err(miette!(
+                "duplicate material key '{key}': supplied via both --material and --secret-material-env"
+            ));
+        }
         if !secret_material_keys.contains(&key) {
             secret_material_keys.push(key.clone());
         }
@@ -8091,6 +8102,21 @@ mod tests {
         assert!(err.to_string().contains("key cannot be empty"));
     }
 
+    #[test]
+    fn parse_secret_material_env_pairs_rejects_duplicate_keys() {
+        let _guard = EnvVarGuard::set("NAV_PARSE_SME_DUP", "value");
+
+        let err = parse_secret_material_env_pairs(&[
+            "private_key=NAV_PARSE_SME_DUP".to_string(),
+            "private_key=NAV_PARSE_SME_DUP".to_string(),
+        ])
+        .expect_err("duplicate key should error");
+        assert!(
+            err.to_string()
+                .contains("key 'private_key' supplied more than once")
+        );
+    }
+
     #[test]
     fn parse_credential_expiry_pairs_accepts_epoch_millis_and_rfc3339() {
         let parsed = parse_credential_expiry_pairs(&[

crates/openshell-cli/tests/provider_commands_integration.rs

@@ -1258,18 +1258,15 @@ async fn provider_refresh_configure_reads_secret_material_from_env_off_argv() {
     .await
     .expect("provider create");
 
-    // The env value overrides the `--material` duplicate and is auto-marked secret.
+    // The env value reaches the request and is auto-marked secret.
     let guard = EnvVarGuard::set(&[("OPENSHELL_ITEST_SME_PRIVATE_KEY", "pem-from-env")]);
     run::provider_refresh_config(
         &ts.endpoint,
         run::ProviderRefreshConfigInput {
             name: "gc-bridge",
             credential_key: "GOOGLE_CHAT_ACCESS_TOKEN",
             strategy: "google_service_account_jwt",
-            material: &[
-                "client_email=bot@p.iam.gserviceaccount.com".to_string(),
-                "private_key=argv-value-must-be-overridden".to_string(),
-            ],
+            material: &["client_email=bot@p.iam.gserviceaccount.com".to_string()],
             secret_material_env: &["private_key=OPENSHELL_ITEST_SME_PRIVATE_KEY".to_string()],
             secret_material_keys: &[],
             credential_expires_at_ms: None,
@@ -1299,6 +1296,36 @@ async fn provider_refresh_configure_reads_secret_material_from_env_off_argv() {
     );
 }
 
+#[tokio::test]
+async fn provider_refresh_configure_rejects_key_supplied_via_both_material_and_env() {
+    let ts = run_server().await;
+
+    let guard = EnvVarGuard::set(&[("OPENSHELL_ITEST_SME_DUP_KEY", "pem-from-env")]);
+    let err = run::provider_refresh_config(
+        &ts.endpoint,
+        run::ProviderRefreshConfigInput {
+            name: "gc-bridge",
+            credential_key: "GOOGLE_CHAT_ACCESS_TOKEN",
+            strategy: "google_service_account_jwt",
+            material: &["private_key=argv-value".to_string()],
+            secret_material_env: &["private_key=OPENSHELL_ITEST_SME_DUP_KEY".to_string()],
+            secret_material_keys: &[],
+            credential_expires_at_ms: None,
+        },
+        &ts.tls,
+    )
+    .await
+    .expect_err("duplicate key across --material and --secret-material-env should fail");
+    drop(guard);
+
+    assert!(
+        err.to_string()
+            .contains("duplicate material key 'private_key'")
+    );
+    // Rejected client-side: nothing reached the gateway.
+    assert!(ts.state.refresh_requests.lock().await.is_empty());
+}
+
 #[tokio::test]
 async fn provider_refresh_configure_fails_closed_when_secret_material_env_is_unset() {
     let ts = run_server().await;