fix(secrets-ui): preserve metadata on rotate + audit unexpected mutation/reveal failures

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Ui.Tests/ConfirmDeleteModalTests.cs

@@ -80,6 +80,44 @@ public class ConfirmDeleteModalTests : TestContext
         Assert.Empty(audit.Events);
     }
 
+    [Fact]
+    public void ConfirmDeleteModal_StoreFault_AuditsFailure_ShowsError_DoesNotThrow()
+    {
+        var store = new RecordingSecretStore
+        {
+            DeleteFault = new MasterKeyUnavailableException("KEK unavailable."),
+        };
+        var audit = new CapturingAuditWriter();
+        Services.AddSingleton<ISecretStore>(store);
+        Services.AddSingleton<IAuditWriter>(audit);
+
+        var name = new SecretName("db/primary");
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("carol");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        bool deleted = false;
+        var cut = RenderComponent<ConfirmDeleteModal>(p => p
+            .Add(c => c.Visible, true)
+            .Add(c => c.Name, name)
+            .Add(c => c.OnDeleted, () => deleted = true));
+
+        // The click must not throw into the Blazor event pipeline.
+        cut.Find("[data-testid=confirm-delete]").Click();
+
+        // OnDeleted not raised; a Failure audit recorded; an error surfaced.
+        Assert.False(deleted);
+        Assert.Single(audit.Events);
+        AuditEvent evt = audit.Events[0];
+        Assert.Equal("secret.delete", evt.Action);
+        Assert.Equal(AuditOutcome.Failure, evt.Outcome);
+        Assert.Equal("Secrets", evt.Category);
+        Assert.Equal("db/primary", evt.Target);
+        Assert.Equal("carol", evt.Actor);
+
+        Assert.NotEmpty(cut.FindAll("[data-testid=delete-error]"));
+    }
+
     [Fact]
     public void ConfirmDeleteModal_NotVisible_RendersNothing()
     {

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Ui.Tests/Fakes/RecordingSecretStore.cs

@@ -20,6 +20,12 @@ public sealed class RecordingSecretStore : ISecretStore
     /// <summary>Delete calls (name + recorded actor), in call order.</summary>
     public IReadOnlyList<(SecretName Name, string? Actor)> Deletes => _deletes.ToArray();
 
+    /// <summary>When set, <see cref="UpsertAsync"/> throws this to drive the mutation-failure path.</summary>
+    public Exception? UpsertFault { get; set; }
+
+    /// <summary>When set, <see cref="DeleteAsync"/> throws this to drive the mutation-failure path.</summary>
+    public Exception? DeleteFault { get; set; }
+
     /// <summary>Seeds a row so <see cref="GetAsync"/> and <see cref="ListAsync"/> can return it.</summary>
     /// <param name="row">The row to seed.</param>
     public void Seed(StoredSecret row) => _rows[row.Name.Value] = row;
@@ -31,6 +37,11 @@ public sealed class RecordingSecretStore : ISecretStore
     /// <inheritdoc />
     public Task UpsertAsync(StoredSecret row, CancellationToken ct)
     {
+        if (UpsertFault is not null)
+        {
+            throw UpsertFault;
+        }
+
         _rows[row.Name.Value] = row;
         _upserts.Enqueue(row);
         return Task.CompletedTask;
@@ -39,6 +50,11 @@ public sealed class RecordingSecretStore : ISecretStore
     /// <inheritdoc />
     public Task<bool> DeleteAsync(SecretName name, string? actor, CancellationToken ct)
     {
+        if (DeleteFault is not null)
+        {
+            throw DeleteFault;
+        }
+
         _deletes.Enqueue((name, actor));
         return Task.FromResult(_rows.TryRemove(name.Value, out _));
     }

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Ui.Tests/RevealButtonTests.cs

@@ -85,6 +85,35 @@ public class RevealButtonTests : TestContext
         Assert.Equal("api/missing", evt.Target);
     }
 
+    [Fact]
+    public void RevealButton_DecryptFault_AuditsFailure_ShowsError_NoValue()
+    {
+        var (store, audit, cipher) = RegisterServices();
+        var name = new SecretName("api/token");
+        store.Seed(Row(name, PlainValue));
+        cipher.FailDecrypt = true;
+
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("carol");
+        auth.SetPolicies(SecretsAuthorization.RevealPolicy);
+
+        var cut = RenderComponent<RevealButton>(p => p.Add(c => c.Name, name));
+
+        // The click must not throw into the Blazor event pipeline.
+        cut.Find("button.reveal-secret").Click();
+
+        // No value shown, an error surfaced, and a Failure reveal audit recorded (no value leak).
+        Assert.DoesNotContain(PlainValue, cut.Markup);
+        Assert.NotEmpty(cut.FindAll("[data-testid=reveal-error]"));
+        Assert.Single(audit.Events);
+        AuditEvent evt = audit.Events[0];
+        Assert.Equal("secret.reveal", evt.Action);
+        Assert.Equal(AuditOutcome.Failure, evt.Outcome);
+        Assert.Equal("api/token", evt.Target);
+        Assert.Equal("carol", evt.Actor);
+        AssertNoValueLeak(evt);
+    }
+
     private static void AssertNoValueLeak(AuditEvent evt)
     {
         foreach (string? field in new[] { evt.Action, evt.Actor, evt.Category, evt.Target, evt.DetailsJson, evt.ToString() })

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Ui.Tests/SecretEditorTests.cs

@@ -99,6 +99,78 @@ public class SecretEditorTests : TestContext
         AssertNoValueLeak(audit.Events[0], "rotated-value");
     }
 
+    [Fact]
+    public void SecretEditor_Rotate_PreservesDescriptionAndContentType()
+    {
+        var (store, _, cipher) = RegisterServices();
+        var name = new SecretName("db/primary");
+
+        // Seed an existing Json secret with a description; rotating must NOT blank either.
+        StoredSecret existing = cipher.Encrypt(name, "old-value", SecretContentType.Json) with
+        {
+            Description = "db creds",
+            Revision = 1,
+            CreatedUtc = DateTimeOffset.UnixEpoch,
+            UpdatedUtc = DateTimeOffset.UnixEpoch,
+        };
+        store.Seed(existing);
+
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("dave");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        var cut = RenderComponent<SecretEditor>(p => p
+            .Add(c => c.ExistingName, name)
+            .Add(c => c.OnSaved, () => { }));
+
+        // The editor pre-filled the existing metadata (no plaintext read).
+        Assert.Equal("db creds", cut.Find("[data-testid=secret-description]").GetAttribute("value"));
+
+        // The operator supplies ONLY a new value.
+        cut.Find("[data-testid=secret-value]").Change("rotated-value");
+        cut.Find("[data-testid=editor-submit]").Click();
+
+        Assert.Single(store.Upserts);
+        StoredSecret row = store.Upserts[0];
+        Assert.Equal("db/primary", row.Name.Value);
+        Assert.Equal("rotated-value", cipher.Decrypt(row));
+        // Metadata preserved — content type not reset to Text, description not blanked.
+        Assert.Equal(SecretContentType.Json, row.ContentType);
+        Assert.Equal("db creds", row.Description);
+    }
+
+    [Fact]
+    public void SecretEditor_Add_StoreFault_AuditsFailure_ShowsError_DoesNotThrow()
+    {
+        var (store, audit, _) = RegisterServices();
+        store.UpsertFault = new MasterKeyUnavailableException("KEK unavailable.");
+
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("carol");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        var cut = RenderComponent<SecretEditor>(p => p
+            .Add(c => c.OnSaved, () => { }));
+
+        cut.Find("[data-testid=secret-name]").Change("app/thing");
+        cut.Find("[data-testid=secret-value]").Change(EnteredValue);
+
+        // The click must not throw into the Blazor event pipeline.
+        cut.Find("[data-testid=editor-submit]").Click();
+
+        // Nothing persisted, a Failure audit recorded, an error surfaced, and no value leak.
+        Assert.Empty(store.Upserts);
+        Assert.Single(audit.Events);
+        AuditEvent evt = audit.Events[0];
+        Assert.Equal("secret.add", evt.Action);
+        Assert.Equal(AuditOutcome.Failure, evt.Outcome);
+        Assert.Equal("app/thing", evt.Target);
+        Assert.Equal("carol", evt.Actor);
+        AssertNoValueLeak(evt);
+
+        Assert.NotEmpty(cut.FindAll("[data-testid=editor-error]"));
+    }
+
     private static void AssertNoValueLeak(AuditEvent evt, string value = EnteredValue)
     {
         foreach (string? field in new[] { evt.Action, evt.Actor, evt.Category, evt.Target, evt.DetailsJson, evt.ToString() })