fix(gcp): Correctly handle the fact that GCP returns binary values

Updates to docs and tests help clarify how to get to the value, in the form the user prefers/needs.

Author: detro

plugin/source/gcp/README.md

@@ -39,10 +39,10 @@ Retrieve a specific version of a secret:
 gcp://projects/1234567890/secrets/my-api-key/versions/2
 ```
 
-Using modifiers (e.g., extracting JSON path) safely ignores trailing slashes in the path:
+Using modifiers (e.g., extracting JSON path) safely ignores trailing slashes in the path, but keep in mind that since GCP Secret Manager payloads are returned as Base64 encoded strings, you might need to decode them first before parsing:
 
 ```text
-gcp://projects/my-project-123/secrets/my-json-secret/?jp=$.password
+gcp://projects/my-project-123/secrets/my-json-secret/?b64d&jp=$.password
 ```
 
 ## Configuration
@@ -80,7 +80,7 @@ func main() {
    - Any trailing slash (e.g., when the URI contains query parameters like `/?jp=$.password`) is stripped automatically.
    - If no `/versions/` suffix is present, `/versions/latest` is automatically appended to the request.
 2. **Retrieval**: Uses `gcpClient.AccessSecretVersion` to fetch the payload of the secret.
-3. **Extraction**: Returns the decoded payload data as a string.
+3. **Extraction**: Because GCP Secret Manager payloads are strictly binary (`[]byte`), the source converts and returns the payload data as a **Base64-encoded string**. It is up to the user to decode it using the `?b64d` modifier (or handle it in their application) if plain text or JSON is required.
 4. **Errors**:
     - Returns `ErrSecretSourceGCPInvalidLocation` if the location format is invalid.
     - Returns `ErrCouldNotFetchSecret` if the API call fails for other reasons.

plugin/source/gcp/gcp.go

@@ -2,6 +2,7 @@ package gcp
 
 import (
 	"context"
+	"encoding/base64"
 	"fmt"
 	"regexp"
 
@@ -38,6 +39,11 @@ var (
 //
 // If the version is omitted, a "/versions/latest" suffix is appended.
 //
+// Because GCP Secret Manager payloads are strictly binary (`[]byte`), this source explicitly
+// converts and returns the payload data as a base64-encoded string. It is up to the user
+// to decode it using the `?b64d` modifier (or handle it in their application) if plain text
+// or JSON parsing is required.
+//
 // Expected format of `<PROJECT_ID_OR_NUM>` is documented at: https://google.aip.dev/cloud/2510.
 // Expected format of `<SECRET_NAME>` is documented at: https://cloud.google.com/security/products/secret-manager.
 //
@@ -92,13 +98,13 @@ func (s *SecretSourceGCP) DigUp(ctx context.Context, coord types.SecretCoord) (s
 		return "", fmt.Errorf("%w (%q): %w", types.ErrCouldNotFetchSecret, coord.Location, err)
 	}
 
-	// Extract and return payload, or error if missing
+	// Extract and return payload encoded in base64, or error if missing
 	if res.Payload == nil || res.Payload.Data == nil {
 		return "", fmt.Errorf(
 			"%w (%q): secret contains no data",
 			types.ErrSecretNotFound,
 			coord.Location,
 		)
 	}
-	return string(res.Payload.Data), nil
+	return base64.StdEncoding.EncodeToString(res.Payload.Data), nil
 }

plugin/source/gcp/gcp_test.go

@@ -1,6 +1,7 @@
 package gcp_test
 
 import (
+	"encoding/base64"
 	"fmt"
 	"testing"
 
@@ -53,12 +54,12 @@ func TestSecretSourceGCP_DigUp_Integration(t *testing.T) {
 		{
 			name:     "valid secret latest",
 			coordStr: fmt.Sprintf("gcp://projects/%s/secrets/%s", projectID, secretName),
-			want:     secretValue,
+			want:     base64.StdEncoding.EncodeToString([]byte(secretValue)),
 		},
 		{
 			name:     "valid secret specific version",
 			coordStr: fmt.Sprintf("gcp://projects/%s/secrets/%s/versions/1", projectID, secretName),
-			want:     secretValue,
+			want:     base64.StdEncoding.EncodeToString([]byte(secretValue)),
 		},
 		{
 			name: "valid secret specific latest version",
@@ -67,12 +68,12 @@ func TestSecretSourceGCP_DigUp_Integration(t *testing.T) {
 				projectID,
 				secretName,
 			),
-			want: secretValue,
+			want: base64.StdEncoding.EncodeToString([]byte(secretValue)),
 		},
 		{
 			name: "valid secret via jp modifier",
 			coordStr: fmt.Sprintf(
-				"gcp://projects/%s/secrets/%s/?jp=$.password",
+				"gcp://projects/%s/secrets/%s/?b64d&jp=$.password",
 				projectID,
 				jsonSecretName,
 			),