11ac168839
Two end-to-end journeys via `pic` against a real server: * `group_secret_is_injected_then_app_value_overrides` — a group-owned secret is injected into a descendant app's script through `secrets::get` (decrypted under the group AAD), then an app-owned secret of the same name shadows it (decrypted under the app AAD). Drives the resolver + both owner-AAD open paths against Postgres. * `group_secret_value_is_masked_from_app_devs` — the §5.3 boundary: an app dev (editor on the app, no group role) is denied the secret VALUE (403) yet still sees it EXISTS, masked, in `config/effective` (status set, owner group, no value); a group_admin reads the value. Proves an app runs with config its own devs cannot read. Also updates the existing app-secrets `ls` journey for the new `env` column (group secrets are env-scoped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
6 lines
324 B
Plaintext
6 lines
324 B
Plaintext
// Phase-3 group-secrets journey fixture: returns the resolved `stripe-key`
|
|
// secret verbatim so the test can assert runtime injection across the group
|
|
// chain (inherited group value) vs an app-owned proximity override. The
|
|
// value is decrypted under the resolved owner's AAD before injection.
|
|
secrets::get("stripe-key")
|