fix(secrets-ui): preserve metadata on rotate + audit unexpected mutation/reveal failures

2026-07-15 17:31:34 -04:00
parent 0ab276dac0
commit 294f53b49a
8 changed files with 306 additions and 37 deletions
@@ -85,6 +85,35 @@ public class RevealButtonTests : TestContext
        Assert.Equal("api/missing", evt.Target);
    }

+    [Fact]
+    public void RevealButton_DecryptFault_AuditsFailure_ShowsError_NoValue()
+    {
+        var (store, audit, cipher) = RegisterServices();
+        var name = new SecretName("api/token");
+        store.Seed(Row(name, PlainValue));
+        cipher.FailDecrypt = true;
+
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("carol");
+        auth.SetPolicies(SecretsAuthorization.RevealPolicy);
+
+        var cut = RenderComponent<RevealButton>(p => p.Add(c => c.Name, name));
+
+        // The click must not throw into the Blazor event pipeline.
+        cut.Find("button.reveal-secret").Click();
+
+        // No value shown, an error surfaced, and a Failure reveal audit recorded (no value leak).
+        Assert.DoesNotContain(PlainValue, cut.Markup);
+        Assert.NotEmpty(cut.FindAll("[data-testid=reveal-error]"));
+        Assert.Single(audit.Events);
+        AuditEvent evt = audit.Events[0];
+        Assert.Equal("secret.reveal", evt.Action);
+        Assert.Equal(AuditOutcome.Failure, evt.Outcome);
+        Assert.Equal("api/token", evt.Target);
+        Assert.Equal("carol", evt.Actor);
+        AssertNoValueLeak(evt);
+    }
+
    private static void AssertNoValueLeak(AuditEvent evt)
    {
        foreach (string? field in new[] { evt.Action, evt.Actor, evt.Category, evt.Target, evt.DetailsJson, evt.ToString() })