too much for one commit

tests/EntKube.Provisioning.Tests/Features/AddAppSecretHandlerTests.cs

@@ -0,0 +1,88 @@
+using EntKube.Provisioning.Domain;
+using EntKube.Provisioning.Features.Apps.AddAppSecret;
+using EntKube.Provisioning.Infrastructure;
+using EntKube.SharedKernel.Domain;
+using FluentAssertions;
+
+namespace EntKube.Provisioning.Tests.Features;
+
+public class AddAppSecretHandlerTests
+{
+    private readonly AddAppSecretHandler handler;
+    private readonly InMemoryAppRepository repository;
+
+    public AddAppSecretHandlerTests()
+    {
+        repository = new InMemoryAppRepository();
+        handler = new AddAppSecretHandler(repository);
+    }
+
+    [Fact]
+    public async Task HandleAsync_WithValidRequest_AddsSecretToEnvironment()
+    {
+        // Arrange — An app deployed to dev needs a database connection string.
+        // The actual secret value lives in the vault — we just store the reference.
+
+        App app = App.Create(Guid.NewGuid(), Guid.NewGuid(), "API", "api", AppType.Deployment);
+        Guid environmentId = Guid.NewGuid();
+        app.AddEnvironment(environmentId, Guid.NewGuid(), "api-dev");
+        await repository.AddAsync(app);
+
+        AddAppSecretRequest request = new(
+            AppId: app.Id,
+            EnvironmentId: environmentId,
+            Name: "DATABASE_URL",
+            VaultKey: "database-connection-string");
+
+        // Act
+
+        Result result = await handler.HandleAsync(request);
+
+        // Assert
+
+        result.IsSuccess.Should().BeTrue();
+
+        App? updated = await repository.GetByIdAsync(app.Id);
+        AppEnvironment env = updated!.Environments[0];
+        env.Secrets.Should().HaveCount(1);
+        env.Secrets[0].Name.Should().Be("DATABASE_URL");
+        env.Secrets[0].VaultKey.Should().Be("database-connection-string");
+    }
+
+    [Fact]
+    public async Task HandleAsync_NonExistentApp_ReturnsFailure()
+    {
+        // Arrange & Act
+
+        AddAppSecretRequest request = new(Guid.NewGuid(), Guid.NewGuid(), "KEY", "vault-key");
+        Result result = await handler.HandleAsync(request);
+
+        // Assert
+
+        result.IsFailure.Should().BeTrue();
+        result.Error.Should().Contain("not found");
+    }
+
+    [Fact]
+    public async Task HandleAsync_DuplicateSecretName_ReturnsFailure()
+    {
+        // Arrange — A secret with this name already exists.
+
+        App app = App.Create(Guid.NewGuid(), Guid.NewGuid(), "API", "api", AppType.Deployment);
+        Guid environmentId = Guid.NewGuid();
+        AppEnvironment env = app.AddEnvironment(environmentId, Guid.NewGuid(), "api-dev");
+        env.AddSecret("DATABASE_URL", "db-conn");
+        await repository.AddAsync(app);
+
+        AddAppSecretRequest request = new(app.Id, environmentId, "DATABASE_URL", "other-key");
+
+        // Act
+
+        Result result = await handler.HandleAsync(request);
+
+        // Assert
+
+        result.IsFailure.Should().BeTrue();
+        result.Error.Should().Contain("already exists");
+    }
+}