feat(FN-004): merge fusion/fn-004

apps/api/tests/test_routers/test_secrets.py

@@ -0,0 +1,72 @@
+from typing import Any
+
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker
+
+from app.models.secret import Secret
+
+
+@pytest.mark.asyncio
+async def test_secret_encrypt_decrypt(
+    auth_client: AsyncClient, db_session: async_sessionmaker[Any]
+) -> None:
+    resp = await auth_client.post(
+        "/api/v1/projects",
+        json={"name": "SecretTest", "slug": "secret-test"},
+    )
+    project_id = resp.json()["id"]
+
+    resp = await auth_client.post(
+        "/api/v1/secrets",
+        json={
+            "scope_type": "project",
+            "scope_id": str(project_id),
+            "key": "api_key",
+            "value": "super-secret",
+        },
+    )
+    assert resp.status_code == 201
+    data = resp.json()
+    assert data["value"] == "super-secret"
+    secret_id = data["id"]
+
+    resp = await auth_client.get(f"/api/v1/secrets/{secret_id}")
+    assert resp.status_code == 200
+    assert resp.json()["value"] == "super-secret"
+
+    async with db_session() as session:
+        result = await session.execute(select(Secret).where(Secret.id == secret_id))
+        secret = result.scalar_one()
+        assert secret.encrypted_value != "super-secret"
+
+    resp = await auth_client.put(
+        f"/api/v1/secrets/{secret_id}",
+        json={"value": "new-secret"},
+    )
+    assert resp.status_code == 200
+    assert resp.json()["value"] == "new-secret"
+
+    resp = await auth_client.delete(f"/api/v1/secrets/{secret_id}")
+    assert resp.status_code == 204
+
+
+@pytest.mark.asyncio
+async def test_secret_ownership_enforced(auth_client: AsyncClient) -> None:
+    resp = await auth_client.post("/api/v1/projects", json={"name": "P1", "slug": "p1"})
+    p1 = resp.json()["id"]
+
+    resp = await auth_client.post("/api/v1/projects", json={"name": "P2", "slug": "p2"})
+    p2 = resp.json()["id"]
+
+    resp = await auth_client.post(
+        "/api/v1/secrets",
+        json={"scope_type": "project", "scope_id": str(p1), "key": "k1", "value": "v1"},
+    )
+
+    resp = await auth_client.get("/api/v1/secrets", params={"scope_id": str(p2)})
+    assert resp.status_code == 200
+    secrets = resp.json()
+    for s in secrets:
+        assert s["scope_id"] != str(p1) or s["scope_type"] != "project"