diff --git a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/AssemblyMarker.cs b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/AssemblyMarker.cs
deleted file mode 100644
index 4c5bad5..0000000
--- a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/AssemblyMarker.cs
+++ /dev/null
@@ -1,9 +0,0 @@
-namespace ZB.MOM.WW.Secrets.Ui;
-
-///
-/// Internal marker giving the assembly a compilable input while the Blazor
-/// components are scaffolded. Replace with real components as they are added.
-///
-internal static class AssemblyMarker
-{
-}
diff --git a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/Components/SecretsList.razor b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/Components/SecretsList.razor
new file mode 100644
index 0000000..a7b2511
--- /dev/null
+++ b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/Components/SecretsList.razor
@@ -0,0 +1,84 @@
+@namespace ZB.MOM.WW.Secrets.Ui
+@implements IDisposable
+@inject ISecretStore Store
+@* Components/SecretsList.razor — metadata-only listing of secrets. Never renders a value or ciphertext. *@
+
+
+ @if (_secrets is null)
+ {
+ Loading…
+ }
+ else
+ {
+
+
+
+
+ Name
+ Description
+ Content type
+ KEK
+ Revision
+ Updated (UTC)
+ Updated by
+
+
+
+ @if (_secrets.Count == 0)
+ {
+
+ No secrets.
+
+ }
+ else
+ {
+ @foreach (SecretMetadata secret in _secrets)
+ {
+
+ @secret.Name.Value
+ @secret.Description
+ @secret.ContentType
+ @secret.KekId
+ @secret.Revision
+ @secret.UpdatedUtc.UtcDateTime.ToString("u")
+ @secret.UpdatedBy
+
+
+ @* Placeholder — actual reveal wiring is a later task. Gated so it
+ renders only for principals holding the reveal policy. *@
+
+ Reveal
+
+
+
+
+ }
+ }
+
+
+
+
+@code {
+ private readonly CancellationTokenSource _cts = new();
+ private IReadOnlyList? _secrets;
+
+ /// Secrets
+Manage stored secrets. Values are never shown here — reveal is a separate, more privileged action.
+
+
+/// Authorization policies and the roles that back them for the secrets-management UI.
+///
+///
+/// Two policies gate the UI, layered by privilege:
+///
+/// -
+///
+/// metadata (the list
+/// page, create/rename/delete affordances). Satisfied by
+///
+/// -
+///
+///
+///
+///
+/// Both policies require an authenticated user. The requirements are expressed as role checks
+/// against the canonical IGroupRoleMapper / Security:Ldap:GroupToRole
+/// configuration) exactly as it does for every other ZB.MOM.WW role. The role-name
+/// constants are deliberately minimal and can be overridden by the host by registering its own
+/// policies under the same policy names instead of calling
+public static class SecretsAuthorization
+{
+ /// Policy name for administering secret metadata (the list page and management actions).
+ public const string ManagePolicy = "secrets:manage";
+
+ /// Policy name for revealing a secret's plaintext value — strictly more privileged than
+ public const string RevealPolicy = "secrets:reveal";
+
+ /// Role that grants secret metadata management (satisfies
+ public const string ManageRole = "secrets-manager";
+
+ /// Role that grants secret value reveal (satisfies both
+ public const string RevealRole = "secrets-reveal";
+
+ /// Administrator role that satisfies every secrets policy.
+ public const string AdminRole = "administrator";
+
+ ///
+ /// Registers the
+ /// The same
+ /// null .(new FakeSecretStore(rows));
+
+ [Fact]
+ public void Renders_Metadata_ForEachSecret()
+ {
+ RegisterStore(SecretOne, SecretTwo);
+ var auth = this.AddTestAuthorization();
+ auth.SetAuthorized("alice");
+ auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+ var cut = RenderComponent();
+ var markup = cut.Markup;
+
+ Assert.Contains("db/primary", markup);
+ Assert.Contains("Primary database connection", markup);
+ Assert.Contains(nameof(SecretContentType.ConnectionString), markup);
+
+ Assert.Contains("api/token", markup);
+ Assert.Contains("External API token", markup);
+ Assert.Contains(nameof(SecretContentType.Text), markup);
+ }
+
+ [Fact]
+ public void RevealButton_Hidden_WithoutRevealPolicy()
+ {
+ RegisterStore(SecretOne, SecretTwo);
+ var auth = this.AddTestAuthorization();
+ auth.SetAuthorized("alice");
+ auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+ var cut = RenderComponent();
+
+ Assert.Empty(cut.FindAll("button.reveal-secret"));
+ Assert.DoesNotContain("Reveal", cut.Markup);
+ }
+
+ [Fact]
+ public void RevealButton_Shown_WithRevealPolicy()
+ {
+ RegisterStore(SecretOne, SecretTwo);
+ var auth = this.AddTestAuthorization();
+ auth.SetAuthorized("carol");
+ auth.SetPolicies(SecretsAuthorization.ManagePolicy, SecretsAuthorization.RevealPolicy);
+
+ var cut = RenderComponent();
+
+ // One reveal affordance per secret row.
+ Assert.Equal(2, cut.FindAll("button.reveal-secret").Count);
+ }
+
+ [Fact]
+ public void EmptyList_ShowsEmptyState()
+ {
+ RegisterStore();
+ var auth = this.AddTestAuthorization();
+ auth.SetAuthorized("alice");
+ auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+ var cut = RenderComponent();
+
+ Assert.Contains("No secrets", cut.Markup);
+ }
+
+ /// Minimal hand-written
+ private sealed class FakeSecretStore(IReadOnlyList rows) : ISecretStore
+ {
+ public Task> ListAsync(bool includeDeleted, CancellationToken ct)
+ => Task.FromResult(rows);
+
+ public Task GetAsync(SecretName name, CancellationToken ct)
+ => throw new NotSupportedException();
+
+ public Task UpsertAsync(StoredSecret row, CancellationToken ct)
+ => throw new NotSupportedException();
+
+ public Task DeleteAsync(SecretName name, string? actor, CancellationToken ct)
+ => throw new NotSupportedException();
+
+ public Task> GetManifestAsync(CancellationToken ct)
+ => throw new NotSupportedException();
+
+ public Task ApplyReplicatedAsync(StoredSecret row, CancellationToken ct)
+ => throw new NotSupportedException();
+ }
+}