fix: fix invalid redacting for sibling branches with coercions

Author: ccharly

src/structs/types.ts

@@ -45,6 +45,14 @@ function withSensitiveEntries<Type, Schema extends ObjectSchema>(
   return new Struct({
     ...base,
     *entries(value: unknown, context: Context) {
+      // `run` initialises `branch` before coercion runs, so `value` here may
+      // be a freshly-created coerced copy (e.g. `object()`'s `{ ...value }`)
+      // while `context.branch[last]` still holds the original reference that
+      // ends up in failure branches. Using the branch reference ensures the
+      // `===` check inside `withRedactedBranch` matches when coercion is active.
+      // Falls back to `value` if branch is somehow empty (entries called outside
+      // of `run`).
+      const parentInBranch = context.branch[context.branch.length - 1] ?? value;
       for (const entry of base.entries(value, context)) {
         const [fieldKey, fieldValue, fieldStruct] = entry;
         // The entries tuple types the third element as `Struct<any> |
@@ -54,7 +62,11 @@ function withSensitiveEntries<Type, Schema extends ObjectSchema>(
         yield [
           fieldKey,
           fieldValue,
-          withRedactedBranch(fieldStruct as AnyStruct, value, sensitiveKeys),
+          withRedactedBranch(
+            fieldStruct as AnyStruct,
+            parentInBranch,
+            sensitiveKeys,
+          ),
         ];
       }
     },

test/validation/sensitive/invalid-sibling-coerced.ts

@@ -0,0 +1,23 @@
+import { literal, object, sensitive, string } from '../../../src';
+
+// Validates that sibling-field branch redaction works when coercion is active
+// (create / mask / validate with coerce). `run` builds `branch` before calling
+// the struct coercer, so the parent reference in `branch` can differ from the
+// coerced `value` received by `entries`. The fix reads from `context.branch`.
+export const Struct = object({
+  secret: sensitive(string()),
+  tag: literal('ok'),
+});
+
+export const create = true;
+export const data = { secret: 'raw-secret', tag: 'bad' };
+
+export const failures = [
+  {
+    value: 'bad',
+    type: 'literal',
+    refinement: undefined,
+    path: ['tag'],
+    branch: [{ secret: '***', tag: 'bad' }, 'bad'],
+  },
+];

test/validation/sensitive/invalid-sibling-exactoptional.ts

@@ -1,4 +1,10 @@
-import { exactOptional, literal, object, sensitive, string } from '../../../src';
+import {
+  exactOptional,
+  literal,
+  object,
+  sensitive,
+  string,
+} from '../../../src';
 
 export const Struct = object({
   secret: exactOptional(sensitive(string())),