11ac168839
Two end-to-end journeys via `pic` against a real server: * `group_secret_is_injected_then_app_value_overrides` — a group-owned secret is injected into a descendant app's script through `secrets::get` (decrypted under the group AAD), then an app-owned secret of the same name shadows it (decrypted under the app AAD). Drives the resolver + both owner-AAD open paths against Postgres. * `group_secret_value_is_masked_from_app_devs` — the §5.3 boundary: an app dev (editor on the app, no group role) is denied the secret VALUE (403) yet still sees it EXISTS, masked, in `config/effective` (status set, owner group, no value); a group_admin reads the value. Proves an app runs with config its own devs cannot read. Also updates the existing app-secrets `ls` journey for the new `env` column (group secrets are env-scoped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
114 lines
3.5 KiB
Rust
114 lines
3.5 KiB
Rust
//! `pic secrets` smoke tests. Covers set→ls→rm round trip and the
|
|
//! "value must come from stdin" contract.
|
|
|
|
use predicates::prelude::*;
|
|
|
|
use crate::common;
|
|
use crate::common::cleanup::AppGuard;
|
|
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn set_ls_rm_round_trip() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let slug = common::unique_slug("sec-rt");
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &slug])
|
|
.assert()
|
|
.success();
|
|
let _guard = AppGuard::new(&env.url, &env.token, &slug);
|
|
|
|
// Set — value via stdin (the only valid channel).
|
|
common::pic_as(&env)
|
|
.args(["secrets", "set", "--app", &slug, "api_key"])
|
|
.write_stdin("xyzzy")
|
|
.assert()
|
|
.success()
|
|
.stdout(predicate::str::contains("Set secret api_key"));
|
|
|
|
// Ls — name appears, value never leaves the server.
|
|
let out = common::pic_as(&env)
|
|
.args(["secrets", "ls", "--app", &slug])
|
|
.output()
|
|
.expect("secrets ls");
|
|
let stdout = String::from_utf8(out.stdout).unwrap();
|
|
let header = stdout.lines().next().expect("header");
|
|
assert_eq!(common::cells(header), vec!["name", "env", "updated_at"]);
|
|
assert!(
|
|
stdout.lines().skip(1).any(|l| l.starts_with("api_key")),
|
|
"api_key missing from ls: {stdout}"
|
|
);
|
|
|
|
// Rm — name dropped.
|
|
common::pic_as(&env)
|
|
.args(["secrets", "rm", "--app", &slug, "api_key"])
|
|
.assert()
|
|
.success()
|
|
.stdout(predicate::str::contains("Deleted secret api_key"));
|
|
|
|
let out = common::pic_as(&env)
|
|
.args(["secrets", "ls", "--app", &slug])
|
|
.output()
|
|
.expect("secrets ls after rm");
|
|
let stdout = String::from_utf8(out.stdout).unwrap();
|
|
assert_eq!(stdout.lines().count(), 1, "no rows after rm: {stdout}");
|
|
}
|
|
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn set_empty_stdin_errors() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let slug = common::unique_slug("sec-empty");
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &slug])
|
|
.assert()
|
|
.success();
|
|
let _guard = AppGuard::new(&env.url, &env.token, &slug);
|
|
|
|
common::pic_as(&env)
|
|
.args(["secrets", "set", "--app", &slug, "anything"])
|
|
.write_stdin("")
|
|
.assert()
|
|
.failure()
|
|
.stderr(predicate::str::contains(
|
|
"empty stdin — secret value must not be empty",
|
|
));
|
|
}
|
|
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn set_with_json_flag_round_trips_object() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let slug = common::unique_slug("sec-json");
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &slug])
|
|
.assert()
|
|
.success();
|
|
let _guard = AppGuard::new(&env.url, &env.token, &slug);
|
|
|
|
common::pic_as(&env)
|
|
.args(["secrets", "set", "--app", &slug, "cfg", "--json"])
|
|
.write_stdin(r#"{"endpoint":"https://example.com","retries":3}"#)
|
|
.assert()
|
|
.success();
|
|
|
|
// Ls confirms the name landed.
|
|
let out = common::pic_as(&env)
|
|
.args(["secrets", "ls", "--app", &slug])
|
|
.output()
|
|
.expect("ls");
|
|
let stdout = String::from_utf8(out.stdout).unwrap();
|
|
assert!(
|
|
stdout.lines().skip(1).any(|l| l.starts_with("cfg")),
|
|
"cfg missing: {stdout}"
|
|
);
|
|
}
|