11ac168839
Two end-to-end journeys via `pic` against a real server: * `group_secret_is_injected_then_app_value_overrides` — a group-owned secret is injected into a descendant app's script through `secrets::get` (decrypted under the group AAD), then an app-owned secret of the same name shadows it (decrypted under the app AAD). Drives the resolver + both owner-AAD open paths against Postgres. * `group_secret_value_is_masked_from_app_devs` — the §5.3 boundary: an app dev (editor on the app, no group role) is denied the secret VALUE (403) yet still sees it EXISTS, masked, in `config/effective` (status set, owner group, no value); a group_admin reads the value. Proves an app runs with config its own devs cannot read. Also updates the existing app-secrets `ls` journey for the new `env` column (group secrets are env-scoped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
42 lines
882 B
Rust
42 lines
882 B
Rust
//! Integration-test binary for the `pic` CLI.
|
|
//!
|
|
//! Every `#[test]` in this binary routes through `common::fixture()`, a
|
|
//! `LazyLock` that spawns picloud once on a private port and reuses it
|
|
//! across all journey modules. Mirrors the dashboard Playwright suite,
|
|
//! which spins backend + Vite up once for 63 specs.
|
|
//!
|
|
//! Gated on `DATABASE_URL`. To run:
|
|
//!
|
|
//! docker compose up -d postgres
|
|
//! DATABASE_URL=postgres://picloud:picloud@127.0.0.1:15432/picloud \
|
|
//! cargo test -p picloud-cli --test cli -- --include-ignored
|
|
|
|
mod common;
|
|
|
|
mod admins;
|
|
mod api_keys;
|
|
mod apply;
|
|
mod apps;
|
|
mod auth;
|
|
mod config;
|
|
mod dead_letters;
|
|
mod email_queue;
|
|
mod enabled;
|
|
mod env_overlay;
|
|
mod group_secrets;
|
|
mod groups;
|
|
mod init;
|
|
mod invoke;
|
|
mod logs;
|
|
mod output;
|
|
mod plan;
|
|
mod prune;
|
|
mod pull;
|
|
mod roles;
|
|
mod routes;
|
|
mod scripts;
|
|
mod secrets;
|
|
mod staleness;
|
|
mod triggers;
|
|
mod vars;
|