fix(secrets-ui): preserve metadata on rotate + audit unexpected mutation/reveal failures

2026-07-15 17:31:34 -04:00
parent 0ab276dac0
commit 294f53b49a
8 changed files with 306 additions and 37 deletions
@@ -99,6 +99,78 @@ public class SecretEditorTests : TestContext
        AssertNoValueLeak(audit.Events[0], "rotated-value");
    }

+    [Fact]
+    public void SecretEditor_Rotate_PreservesDescriptionAndContentType()
+    {
+        var (store, _, cipher) = RegisterServices();
+        var name = new SecretName("db/primary");
+
+        // Seed an existing Json secret with a description; rotating must NOT blank either.
+        StoredSecret existing = cipher.Encrypt(name, "old-value", SecretContentType.Json) with
+        {
+            Description = "db creds",
+            Revision = 1,
+            CreatedUtc = DateTimeOffset.UnixEpoch,
+            UpdatedUtc = DateTimeOffset.UnixEpoch,
+        };
+        store.Seed(existing);
+
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("dave");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        var cut = RenderComponent<SecretEditor>(p => p
+            .Add(c => c.ExistingName, name)
+            .Add(c => c.OnSaved, () => { }));
+
+        // The editor pre-filled the existing metadata (no plaintext read).
+        Assert.Equal("db creds", cut.Find("[data-testid=secret-description]").GetAttribute("value"));
+
+        // The operator supplies ONLY a new value.
+        cut.Find("[data-testid=secret-value]").Change("rotated-value");
+        cut.Find("[data-testid=editor-submit]").Click();
+
+        Assert.Single(store.Upserts);
+        StoredSecret row = store.Upserts[0];
+        Assert.Equal("db/primary", row.Name.Value);
+        Assert.Equal("rotated-value", cipher.Decrypt(row));
+        // Metadata preserved — content type not reset to Text, description not blanked.
+        Assert.Equal(SecretContentType.Json, row.ContentType);
+        Assert.Equal("db creds", row.Description);
+    }
+
+    [Fact]
+    public void SecretEditor_Add_StoreFault_AuditsFailure_ShowsError_DoesNotThrow()
+    {
+        var (store, audit, _) = RegisterServices();
+        store.UpsertFault = new MasterKeyUnavailableException("KEK unavailable.");
+
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("carol");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        var cut = RenderComponent<SecretEditor>(p => p
+            .Add(c => c.OnSaved, () => { }));
+
+        cut.Find("[data-testid=secret-name]").Change("app/thing");
+        cut.Find("[data-testid=secret-value]").Change(EnteredValue);
+
+        // The click must not throw into the Blazor event pipeline.
+        cut.Find("[data-testid=editor-submit]").Click();
+
+        // Nothing persisted, a Failure audit recorded, an error surfaced, and no value leak.
+        Assert.Empty(store.Upserts);
+        Assert.Single(audit.Events);
+        AuditEvent evt = audit.Events[0];
+        Assert.Equal("secret.add", evt.Action);
+        Assert.Equal(AuditOutcome.Failure, evt.Outcome);
+        Assert.Equal("app/thing", evt.Target);
+        Assert.Equal("carol", evt.Actor);
+        AssertNoValueLeak(evt);
+
+        Assert.NotEmpty(cut.FindAll("[data-testid=editor-error]"));
+    }
+
    private static void AssertNoValueLeak(AuditEvent evt, string value = EnteredValue)
    {
        foreach (string? field in new[] { evt.Action, evt.Actor, evt.Category, evt.Target, evt.DetailsJson, evt.ToString() })