fix(management): elide DatabaseConnection ConnectionString from List/Get (arch-review C3)

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
2026-07-10 05:15:55 -04:00
parent ecf8ac1b7d
commit d4d1732a9e
4 changed files with 83 additions and 6 deletions
@@ -218,4 +218,59 @@ public class SecretProjectionTests : TestKit, IDisposable
            Arg.Is<object>(o => !ManagementActor.SerializeResult(o).Contains("newsecret")),
            Arg.Any<CancellationToken>());
    }
+
+    // ========================================================================
+    // Task 9 — DatabaseConnection ConnectionString elision
+    // ========================================================================
+
+    private IExternalSystemRepository AddDatabaseConnectionRepo(DatabaseConnectionDefinition def)
+    {
+        var repo = Substitute.For<IExternalSystemRepository>();
+        repo.GetDatabaseConnectionByIdAsync(def.Id, Arg.Any<CancellationToken>()).Returns(def);
+        repo.GetAllDatabaseConnectionsAsync(Arg.Any<CancellationToken>())
+            .Returns(new List<DatabaseConnectionDefinition> { def });
+        _services.AddScoped(_ => repo);
+        return repo;
+    }
+
+    [Fact]
+    public void GetDatabaseConnection_ResponseOmitsConnectionString()
+    {
+        AddDatabaseConnectionRepo(new DatabaseConnectionDefinition("db", "Server=db;Password=sql-secret") { Id = 1 });
+
+        var actor = CreateActor();
+        actor.Tell(Envelope(new GetDatabaseConnectionCommand(1), "Viewer"));
+
+        var resp = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
+        Assert.DoesNotContain("sql-secret", resp.JsonData);
+        Assert.Contains("hasConnectionString", resp.JsonData);
+    }
+
+    [Fact]
+    public void ListDatabaseConnections_ResponseOmitsConnectionString()
+    {
+        AddDatabaseConnectionRepo(new DatabaseConnectionDefinition("db", "Server=db;Password=sql-secret") { Id = 1 });
+
+        var actor = CreateActor();
+        actor.Tell(Envelope(new ListDatabaseConnectionsCommand(), "Viewer"));
+
+        var resp = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
+        Assert.DoesNotContain("sql-secret", resp.JsonData);
+        Assert.Contains("hasConnectionString", resp.JsonData);
+    }
+
+    [Fact]
+    public async Task UpdateDatabaseConnection_NullConnectionString_PreservesStoredSecret()
+    {
+        var stored = new DatabaseConnectionDefinition("db", "Server=db;Password=sql-secret") { Id = 1 };
+        var repo = AddDatabaseConnectionRepo(stored);
+
+        var actor = CreateActor();
+        actor.Tell(Envelope(new UpdateDatabaseConnectionDefCommand(1, "db-renamed", null), "Designer"));
+        ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
+
+        await repo.Received(1).UpdateDatabaseConnectionAsync(
+            Arg.Is<DatabaseConnectionDefinition>(d => d.ConnectionString == "Server=db;Password=sql-secret"),
+            Arg.Any<CancellationToken>());
+    }
 }