feat: admit existing OpenBao catalog lanes

tests/test_exec_delivery.py

@@ -1,4 +1,15 @@
-from secrets_engine.exec_delivery import _npm_userconfig, _registry_authkey
+import copy
+
+import pytest
+
+from secrets_engine.catalog import validate_entry
+from secrets_engine.errors import DeliveryError
+from secrets_engine.exec_delivery import (
+    _npm_userconfig,
+    _registry_authkey,
+    exec_with_secret,
+)
+from tests.test_catalog import VALID
 
 
 def test_registry_authkey_strips_scheme_and_trails_slash():
@@ -22,3 +33,40 @@ def test_npm_userconfig_writes_registry_and_token_ref_not_value():
         assert (path.stat().st_mode & 0o077) == 0
     # cleaned up on context exit
     assert not path.exists()
+
+
+def test_exec_env_injects_only_selected_declared_field(monkeypatch):
+    data = copy.deepcopy(VALID)
+    data["fields"] = ["primary", "selected_value"]
+    entry = validate_entry(data)
+
+    def fake_fetch(_client, got_entry, field):
+        assert got_entry == entry
+        assert field == "selected_value"
+        return "test-secret-value"
+
+    def fake_spawn(command, env, secret):
+        assert command == ["probe"]
+        assert secret == "test-secret-value"
+        assert env["SELECTED_VALUE"] == "test-secret-value"
+        assert "PRIMARY" not in env
+        return 0
+
+    monkeypatch.setattr("secrets_engine.exec_delivery._fetch_value", fake_fetch)
+    monkeypatch.setattr("secrets_engine.exec_delivery._spawn", fake_spawn)
+    assert (
+        exec_with_secret(
+            object(), entry, "selected_value", ["probe"], mode="exec-env"
+        )
+        == 0
+    )
+
+
+def test_exec_rejects_undeclared_field_before_fetch(monkeypatch):
+    entry = validate_entry(VALID)
+    monkeypatch.setattr(
+        "secrets_engine.exec_delivery._fetch_value",
+        lambda *_args, **_kwargs: pytest.fail("must not fetch undeclared field"),
+    )
+    with pytest.raises(DeliveryError):
+        exec_with_secret(object(), entry, "other_field", ["probe"], mode="exec-env")