Fall back to default value when provider isn't configured for the active profile

[balintant]

Fnox's inheritance makes it easy to standardise environments, but it forces us to redefine every variable when we want the default configuration to use local values.

Expected:
For the configuration below, I'd expect fnox to fall back to the default value when the referenced provider isn't configured for the active profile — or at least offer an opt-in for this (perhaps a "disabled" provider option?):

[secrets]
# falling back to the default value
DB_HOST = { provider = "ps", value = "DB_HOST", default = "127.0.0.1" }
DB_PORT = { provider = "ps", value = "DB_PORT", default = "5432" }
DB_USER = { provider = "ps", value = "DB_USER", default = "local_user" }
# some variables are not needed for local development
DB_PASS = { provider = "ps", value = "DB_PASS", if_missing = "ignore" }

[profiles.test.providers]
ps = { type = "aws-ps", region = "", prefix = "/my-app/test/env/" }

[profiles.staging.providers]
ps = { type = "aws-ps", region = "", prefix = "/my-app/staging/env/" }

Actual:
Instead of falling back, fnox errors as follows:

Error: fnox::provider::not_configured (link)
  × Provider 'ps' not configured in profile 'default'
...

[jdx]

Thanks for the clear report. I opened a draft PR with a fix here: #572

The change keeps providers scoped to the active profile, but allows a secret's explicit default to act as the fallback when provider resolution cannot produce a value, including the Provider 'ps' not configured in profile 'default' case. I added regression coverage for both fnox get and fnox exec using the top-level secret plus profile-only provider pattern from this discussion.

Tests run:

• cargo test -p fnox-core secret_resolver
• mise run build
• PATH="$PWD/target/debug:$PWD/test/bats/bin:$PATH" bats test/secret_resolution_priority.bats

This comment was AI-generated by Codex.

[balintant]

Thanks @jdx, just tested and the solution works perfectly.

Keep up the good work!