Hide runtime settings on secret fields when they are not secure

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 2.9.1
+
+### Fixed
+
+- Fixed a bug where the web UI showed runtime settings as valid data sources for secret fields even when `UltraSettings.runtime_settings_secure` was set to `false`.
+
 ## 2.9.0
 
 ### Added

VERSION

@@ -1 +1 @@
-2.9.0
+2.9.1

config.ru

@@ -28,6 +28,7 @@ else
 end
 
 UltraSettings.fields_secret_by_default = false
+UltraSettings.runtime_settings_secure = false
 UltraSettings.yaml_config_path = File.join(__dir__, "spec", "config")
 UltraSettings.runtime_settings_url = ENV.fetch("RUNTIME_SETTINGS_URL", "http://localhost:9494#edit=${name}&type=${type}&description=${description}")
 

lib/ultra_settings/configuration.rb

@@ -560,7 +560,7 @@ def __available_sources__(name)
 
       sources = []
       sources << :env if field.env_var
-      sources << :settings if !field.static? && field.runtime_setting && UltraSettings.__runtime_settings__
+      sources << :settings if __runtime_setting_allowed?(field)
       sources << :yaml if field.yaml_key && self.class.configuration_file
       sources << :default unless field.default.nil?
       sources
@@ -646,5 +646,14 @@ def __use_default?(value, default_if)
     def __yaml_config__
       @ultra_settings_yaml_config ||= self.class.load_yaml_config || {}
     end
+
+    def __runtime_setting_allowed?(field)
+      return false unless UltraSettings.__runtime_settings__
+      return false if field.static?
+      return false unless field.runtime_setting
+      return false if field.secret? && !UltraSettings.runtime_settings_secure?
+
+      true
+    end
   end
 end

spec/ultra_settings/configuration_spec.rb

@@ -326,6 +326,21 @@
       config = TestConfiguration.instance
       expect(config.__available_sources__(:static)).not_to include(:settings)
     end
+
+    it "does not include runtime settings for secret fields when runtime_settings_secure is false", settings: {"my_service.host" => "host"} do
+      config = MyServiceConfiguration.instance
+      expect(config.__available_sources__(:host)).to include(:settings)
+      UltraSettings.runtime_settings_secure = false
+      begin
+        # non-secret field still includes :settings
+        expect(config.__available_sources__(:host)).to include(:settings)
+        # secret field should exclude :settings when runtime_settings_secure is false
+        test_config = TestConfiguration.instance
+        expect(test_config.__available_sources__(:secret)).not_to include(:settings)
+      ensure
+        UltraSettings.runtime_settings_secure = true
+      end
+    end
   end
 
   describe "__value_from_source__" do

test_app/config/initializers/ultra_settings.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 UltraSettings.fields_secret_by_default = false
+UltraSettings.runtime_settings_secure = false
 
 UltraSettings.runtime_settings = {
   "app.service_timeout" => 2.0