@@ -50,14 +50,24 @@ func isValidDNS1123Label(label string) bool {
5050
5151// getSecretDataCaseInsensitive performs a case-insensitive lookup in secret data.
5252// Returns the value and true if found, empty string and false if not found.
53- func getSecretDataCaseInsensitive (data map [string ][]byte , key string ) (string , bool ) {
54- lowerKey := strings .ToLower (key )
53+ func getSecretDataCaseInsensitive (data map [string ][]byte , key string ) (string , bool , error ) {
54+ // Prefer exact key when present.
55+ if v , ok := data [key ]; ok {
56+ return string (v ), true , nil
57+ }
58+
59+ var matched string
60+ found := false
5561 for k , v := range data {
56- if strings .ToLower (k ) == lowerKey {
57- return string (v ), true
62+ if strings .EqualFold (k , key ) {
63+ if found {
64+ return "" , false , fmt .Errorf ("ambiguous secret data: multiple keys match %q case-insensitively" , key )
65+ }
66+ matched = string (v )
67+ found = true
5868 }
5969 }
60- return "" , false
70+ return matched , found , nil
6171}
6272
6373// isValidDNS1123Subdomain validates a string against DNS-1123 subdomain rules
@@ -372,8 +382,16 @@ func (app *App) AttachLlamaStackClientFromSecret(next func(http.ResponseWriter,
372382 }
373383
374384 // Extract LlamaStack credentials from secret data using case-insensitive key lookups.
375- baseURL , foundBaseURL := getSecretDataCaseInsensitive (foundSecret .Data , "llama_stack_client_base_url" )
376- apiKey , foundAPIKey := getSecretDataCaseInsensitive (foundSecret .Data , "llama_stack_client_api_key" )
385+ baseURL , foundBaseURL , err := getSecretDataCaseInsensitive (foundSecret .Data , "llama_stack_client_base_url" )
386+ if err != nil {
387+ app .badRequestResponse (w , r , fmt .Errorf ("invalid secret %q: %w" , secretName , err ))
388+ return
389+ }
390+ apiKey , foundAPIKey , err := getSecretDataCaseInsensitive (foundSecret .Data , "llama_stack_client_api_key" )
391+ if err != nil {
392+ app .badRequestResponse (w , r , fmt .Errorf ("invalid secret %q: %w" , secretName , err ))
393+ return
394+ }
377395
378396 if ! foundBaseURL || baseURL == "" {
379397 app .badRequestResponse (w , r , fmt .Errorf ("secret %q is missing or has empty value for required key: llama_stack_client_base_url" , secretName ))
0 commit comments