feat(secrets-ui): RCL + authz policies + metadata-only secrets list

2026-07-15 17:10:40 -04:00
parent 7f1db1b214
commit d7f8ca455b
7 changed files with 294 additions and 16 deletions
@@ -1,7 +0,0 @@
-namespace ZB.MOM.WW.Secrets.Ui.Tests;
-
-public class PlaceholderTests
-{
-    [Fact]
-    public void Builds() => Assert.True(true);
-}
@@ -0,0 +1,120 @@
+using Bunit;
+using Bunit.TestDoubles;
+using Microsoft.Extensions.DependencyInjection;
+using ZB.MOM.WW.Secrets.Abstractions;
+using ZB.MOM.WW.Secrets.Ui;
+
+namespace ZB.MOM.WW.Secrets.Ui.Tests;
+
+public class SecretsListTests : TestContext
+{
+    private static readonly SecretMetadata SecretOne = new()
+    {
+        Name = new SecretName("db/primary"),
+        Description = "Primary database connection",
+        ContentType = SecretContentType.ConnectionString,
+        KekId = "kek-a",
+        Revision = 3,
+        CreatedUtc = new DateTimeOffset(2026, 7, 1, 0, 0, 0, TimeSpan.Zero),
+        UpdatedUtc = new DateTimeOffset(2026, 7, 10, 12, 0, 0, TimeSpan.Zero),
+        UpdatedBy = "alice",
+    };
+
+    private static readonly SecretMetadata SecretTwo = new()
+    {
+        Name = new SecretName("api/token"),
+        Description = "External API token",
+        ContentType = SecretContentType.Text,
+        KekId = "kek-b",
+        Revision = 1,
+        CreatedUtc = new DateTimeOffset(2026, 7, 2, 0, 0, 0, TimeSpan.Zero),
+        UpdatedUtc = new DateTimeOffset(2026, 7, 11, 8, 30, 0, TimeSpan.Zero),
+        UpdatedBy = "bob",
+    };
+
+    private void RegisterStore(params SecretMetadata[] rows)
+        => Services.AddSingleton<ISecretStore>(new FakeSecretStore(rows));
+
+    [Fact]
+    public void Renders_Metadata_ForEachSecret()
+    {
+        RegisterStore(SecretOne, SecretTwo);
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("alice");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        var cut = RenderComponent<SecretsList>();
+        var markup = cut.Markup;
+
+        Assert.Contains("db/primary", markup);
+        Assert.Contains("Primary database connection", markup);
+        Assert.Contains(nameof(SecretContentType.ConnectionString), markup);
+
+        Assert.Contains("api/token", markup);
+        Assert.Contains("External API token", markup);
+        Assert.Contains(nameof(SecretContentType.Text), markup);
+    }
+
+    [Fact]
+    public void RevealButton_Hidden_WithoutRevealPolicy()
+    {
+        RegisterStore(SecretOne, SecretTwo);
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("alice");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        var cut = RenderComponent<SecretsList>();
+
+        Assert.Empty(cut.FindAll("button.reveal-secret"));
+        Assert.DoesNotContain("Reveal", cut.Markup);
+    }
+
+    [Fact]
+    public void RevealButton_Shown_WithRevealPolicy()
+    {
+        RegisterStore(SecretOne, SecretTwo);
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("carol");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy, SecretsAuthorization.RevealPolicy);
+
+        var cut = RenderComponent<SecretsList>();
+
+        // One reveal affordance per secret row.
+        Assert.Equal(2, cut.FindAll("button.reveal-secret").Count);
+    }
+
+    [Fact]
+    public void EmptyList_ShowsEmptyState()
+    {
+        RegisterStore();
+        var auth = this.AddTestAuthorization();
+        auth.SetAuthorized("alice");
+        auth.SetPolicies(SecretsAuthorization.ManagePolicy);
+
+        var cut = RenderComponent<SecretsList>();
+
+        Assert.Contains("No secrets", cut.Markup);
+    }
+
+    /// <summary>Minimal hand-written <see cref="ISecretStore"/> whose only real behavior is <see cref="ListAsync"/>.</summary>
+    private sealed class FakeSecretStore(IReadOnlyList<SecretMetadata> rows) : ISecretStore
+    {
+        public Task<IReadOnlyList<SecretMetadata>> ListAsync(bool includeDeleted, CancellationToken ct)
+            => Task.FromResult(rows);
+
+        public Task<StoredSecret?> GetAsync(SecretName name, CancellationToken ct)
+            => throw new NotSupportedException();
+
+        public Task UpsertAsync(StoredSecret row, CancellationToken ct)
+            => throw new NotSupportedException();
+
+        public Task<bool> DeleteAsync(SecretName name, string? actor, CancellationToken ct)
+            => throw new NotSupportedException();
+
+        public Task<IReadOnlyList<SecretManifestEntry>> GetManifestAsync(CancellationToken ct)
+            => throw new NotSupportedException();
+
+        public Task ApplyReplicatedAsync(StoredSecret row, CancellationToken ct)
+            => throw new NotSupportedException();
+    }
+}