KeysFunc: apply top-level marks to result

cty/function/stdlib/collection.go

@@ -564,7 +564,10 @@ var KeysFunc = function.New(&function.Spec{
 		}
 	},
 	Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
-		// Since map keys cannot be marked, we don't need to preserve the deeply-nested marks.
+		// We must unmark the value before we can use ElementIterator on it, and
+		// then re-apply the same marks (possibly none) when we return. Since we
+		// don't mark map keys, we can throw away any nested marks, which would
+		// only apply to values.
 		m, marks := args[0].Unmark()
 		m, _ = m.UnmarkDeep()
 		var keys []cty.Value

cty/function/stdlib/collection_test.go

@@ -1328,48 +1328,6 @@ func TestZipMap(t *testing.T) {
 	}
 }
 
-func TestKeys(t *testing.T) {
-	tests := []struct {
-		Collection cty.Value
-		Want       cty.Value
-		Err        bool
-	}{
-		{
-			cty.MapVal(map[string]cty.Value{"hello": cty.StringVal("world")}),
-			cty.ListVal([]cty.Value{cty.StringVal("hello")}),
-			false,
-		},
-		{ // The map itself is not marked, just an inner element.
-			cty.MapVal(map[string]cty.Value{"hello": cty.StringVal("world").Mark("a")}),
-			cty.ListVal([]cty.Value{cty.StringVal("hello")}),
-			false,
-		},
-		{ // The entire map is marked, and we refuse to risk returning sensitive keys.
-			cty.MapVal(map[string]cty.Value{"hello": cty.StringVal("world")}).Mark("a"),
-			cty.NilVal,
-			false,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(fmt.Sprintf("Keys(%#v)", test.Collection), func(t *testing.T) {
-			got, err := Keys(test.Collection)
-			if test.Err {
-				if err == nil {
-					t.Fatal("succeeded; want error")
-				}
-				return
-			} else if err != nil {
-				t.Fatalf("unexpected error: %s", err)
-			}
-
-			if !got.RawEquals(test.Want) {
-				t.Errorf("wrong result\ngot:  %#v\nwant: %#v", got, test.Want)
-			}
-		})
-	}
-}
-
 func TestKeys(t *testing.T) {
 	tests := []struct {
 		Collection cty.Value