Relationships
#3480 Read non-string sensitive resource fields back with their type
Opened by hammz · 10/14/2026
Problem
processSensitiveResourceData stores a non-string sensitive value as JSON text, and read-side resolution returns that text. A sensitive field declared z.number() reads back as the string "5432", and an object reads back as its JSON text. This holds in CEL (data.latest), step outputs and readResource. Since swamp-club#3038, values inside array elements and record values read back with their type through the _swamp.sensitiveFieldJson tag. Top-level and object-nested fields still read back as text, so the two behave differently.
Expected
Every non-string sensitive value reads back as the value written: a number, a boolean or an object.
Notes
This is a behaviour change for existing users. CEL that compares a sensitive number field to a string, or concatenates it, would change, so it needs an upgrade note and probably a release where both work. The _swamp.sensitiveFieldJson mechanism from swamp-club#3038 can be extended to these fields.
Open
No activity in this phase yet.
Sign in to post a ripple.