@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.4

package/tests/cases/unit/transport-errors.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test } from 'bun:test'
+import { CliError, ExitCode } from '@contember/cli-common'
+import { inspect } from 'node:util'
+import { classifyHttpStatus, toHttpTransportError, toTransportError } from '../../../src/lib/errors/TransportError.js'
+
+const context = {
+	service: 'Test API',
+	codePrefix: 'TEST_API',
+	url: 'https://user:password@example.com/path?token=secret#fragment',
+}
+
+describe('classifyHttpStatus', () => {
+	const cases = [
+		{ status: 400, kind: 'input', codeSuffix: 'BAD_REQUEST', exitCode: ExitCode.InputError },
+		{ status: 401, kind: 'forbidden', codeSuffix: 'UNAUTHORIZED', exitCode: ExitCode.Forbidden },
+		{ status: 403, kind: 'forbidden', codeSuffix: 'FORBIDDEN', exitCode: ExitCode.Forbidden },
+		{ status: 404, kind: 'not-found', codeSuffix: 'NOT_FOUND', exitCode: ExitCode.NotFound },
+		{ status: 408, kind: 'transient', codeSuffix: 'TIMEOUT', exitCode: ExitCode.Transient },
+		{ status: 409, kind: 'conflict', codeSuffix: 'CONFLICT', exitCode: ExitCode.Conflict },
+		{ status: 425, kind: 'transient', codeSuffix: 'TOO_EARLY', exitCode: ExitCode.Transient },
+		{ status: 429, kind: 'transient', codeSuffix: 'RATE_LIMITED', exitCode: ExitCode.Transient },
+		{ status: 500, kind: 'transient', codeSuffix: 'SERVER_ERROR', exitCode: ExitCode.Transient },
+	]
+
+	for (const expected of cases) {
+		test(`classifies ${expected.status}`, () => {
+			expect(classifyHttpStatus(expected.status)).toEqual({
+				kind: expected.kind,
+				codeSuffix: expected.codeSuffix,
+				exitCode: expected.exitCode,
+			})
+		})
+	}
+})
+
+describe('transport errors', () => {
+	test('creates a safe HTTP error and preserves Retry-After', () => {
+		const error = toHttpTransportError({ status: 429, retryAfter: '30' }, context)
+
+		expect(error.code).toBe('TEST_API_RATE_LIMITED')
+		expect(error.retryable).toBe(true)
+		expect(error.details).toEqual({ status: 429, retryAfter: '30', url: 'https://example.com/path' })
+		expect(JSON.stringify(error.details)).not.toContain('password')
+		expect(JSON.stringify(error.details)).not.toContain('secret')
+	})
+
+	test('drops an invalid Retry-After value', () => {
+		const error = toHttpTransportError({ status: 429, retryAfter: 'secret-response-value' }, context)
+
+		expect(error.details).toEqual({ status: 429, url: 'https://example.com/path' })
+	})
+
+	test('does not retain a raw HTTP cause', () => {
+		const cause = new Error('response included secret-http-cause')
+		const error = toHttpTransportError({ status: 500 }, context, cause)
+
+		expect(error.cause).not.toBe(cause)
+		expect(inspect(error, { depth: null })).not.toContain('secret-http-cause')
+	})
+
+	test('normalizes a rejected fetch as transient', () => {
+		const cause = new TypeError('fetch failed with private context')
+		const error = toTransportError(cause, context)
+
+		expect(error.code).toBe('TEST_API_UNREACHABLE')
+		expect(error.exitCode).toBe(ExitCode.Transient)
+		expect(error.retryable).toBe(true)
+		expect(error.message).not.toContain(cause.message)
+		expect(error.cause).not.toBe(cause)
+		expect(inspect(error, { depth: null })).not.toContain('private context')
+	})
+
+	test('keeps an existing CliError unchanged', () => {
+		const original = new CliError('known failure', { code: 'KNOWN', exitCode: ExitCode.Conflict })
+
+		expect(toTransportError(original, context)).toBe(original)
+	})
+})

package/tests/cases/unit/workspace-update-api.test.ts

@@ -0,0 +1,152 @@
+import { describe, expect, test } from 'bun:test'
+import { CliError } from '@contember/cli-common'
+import {
+	DockerComposeAccess,
+	PackageUpdateWorkspace,
+	PackageUpdateWorkspaceResolver,
+	WorkspaceUpdateApiCommand,
+} from '../../../src/commands/workspace/WorkspaceUpdateApiCommand.js'
+import { createTestOutput } from '../../../../cli-common/tests/lib/testOutput.js'
+
+const defaultUpdatedDependencies = [
+	{ name: '@contember/schema' },
+	{ name: '@contember/schema-definition' },
+	{ name: '@contember/cli' },
+]
+
+const createPackageWorkspace = (
+	onWrite: () => void,
+	updatedDependencies: readonly { name: string }[] = defaultUpdatedDependencies,
+): PackageUpdateWorkspace => ({
+	findDefinedDependencies: packageName => [{
+		name: packageName,
+		version: '2.1.0',
+		isDev: false,
+		pckg: { dir: '/workspace', isRoot: true },
+	}],
+	updateEverywhere: async () => {
+		onWrite()
+		return updatedDependencies
+	},
+})
+
+describe('WorkspaceUpdateApiCommand', () => {
+	test('validates every input before package or docker-compose writes', async () => {
+		let packageWrites = 0
+		let dockerWrites = 0
+		const packageWorkspace = createPackageWorkspace(() => packageWrites++)
+		const resolver: PackageUpdateWorkspaceResolver = { resolve: async () => packageWorkspace }
+		const dockerCompose: DockerComposeAccess = {
+			tryReadMainDockerComposeConfig: async () => ({ services: { engine: 'malformed-service' } }),
+			updateMainDockerComposeConfig: async () => {
+				dockerWrites++
+			},
+		}
+		const command = new WorkspaceUpdateApiCommand(resolver, dockerCompose)
+		const { output } = createTestOutput()
+
+		const promise = command.run(['2.2.0'], output)
+		await expect(promise).rejects.toBeInstanceOf(CliError)
+		await expect(promise).rejects.toMatchObject({ code: 'INVALID_WORKSPACE_UPDATE' })
+		expect(packageWrites).toBe(0)
+		expect(dockerWrites).toBe(0)
+	})
+
+	test('updates known images and preserves services without images', async () => {
+		let packageWrites = 0
+		let writtenCompose: unknown
+		const packageWorkspace = createPackageWorkspace(() => packageWrites++)
+		const resolver: PackageUpdateWorkspaceResolver = { resolve: async () => packageWorkspace }
+		const dockerCompose: DockerComposeAccess = {
+			tryReadMainDockerComposeConfig: async () => ({
+				services: {
+					engine: { image: 'contember/engine-ee:2.1.0', environment: { MODE: 'test' } },
+					custom: { build: '.' },
+				},
+			}),
+			updateMainDockerComposeConfig: async updater => {
+				writtenCompose = updater({})
+			},
+		}
+		const command = new WorkspaceUpdateApiCommand(resolver, dockerCompose)
+		const { output, stdout, stderr } = createTestOutput()
+
+		await command.run(['2.2.0'], output)
+
+		expect(packageWrites).toBe(1)
+		expect(writtenCompose).toEqual({
+			services: {
+				engine: { image: 'contember/engine:2.2.0', environment: { MODE: 'test' } },
+				custom: { build: '.' },
+			},
+		})
+		expect(stdout.text).toBe('')
+		expect(stderr.lines).toStrictEqual([
+			'Updating docker-compose',
+			'docker-compose service engine updated',
+			'API versions updated',
+			'Restart server to apply changes',
+		])
+	})
+
+	test('returns updated package and service names as JSON', async () => {
+		const packageWorkspace = createPackageWorkspace(() => {}, [
+			{ name: '@contember/schema' },
+			{ name: '@contember/schema' },
+			{ name: '@contember/cli' },
+		])
+		const resolver: PackageUpdateWorkspaceResolver = { resolve: async () => packageWorkspace }
+		const dockerCompose: DockerComposeAccess = {
+			tryReadMainDockerComposeConfig: async () => ({
+				services: {
+					engine: { image: 'contember/engine:2.1.0' },
+					custom: { build: '.' },
+				},
+			}),
+			updateMainDockerComposeConfig: async () => {},
+		}
+		const { output, stdout, stderr } = createTestOutput()
+
+		await new WorkspaceUpdateApiCommand(resolver, dockerCompose).run(['2.2.0', '--json'], output)
+
+		expect(JSON.parse(stdout.text)).toStrictEqual({
+			version: '2.2.0',
+			updatedPackages: ['@contember/schema', '@contember/cli'],
+			updatedServices: ['engine'],
+		})
+		expect(stderr.text).toBe('')
+	})
+
+	test('returns stable scalar lines in quiet mode', async () => {
+		const packageWorkspace = createPackageWorkspace(() => {}, [{ name: '@contember/schema' }])
+		const resolver: PackageUpdateWorkspaceResolver = { resolve: async () => packageWorkspace }
+		const dockerCompose: DockerComposeAccess = {
+			tryReadMainDockerComposeConfig: async () => ({ services: { engine: { image: 'contember/engine:2.1.0' } } }),
+			updateMainDockerComposeConfig: async () => {},
+		}
+		const { output, stdout, stderr } = createTestOutput()
+
+		await new WorkspaceUpdateApiCommand(resolver, dockerCompose).run(['2.2.0', '--quiet'], output)
+
+		expect(stdout.lines).toStrictEqual(['2.2.0', '@contember/schema', 'engine'])
+		expect(stderr.text).toBe('')
+	})
+
+	test('reports an empty update plan without inventing changed names', async () => {
+		const packageWorkspace = createPackageWorkspace(() => {}, [])
+		const resolver: PackageUpdateWorkspaceResolver = { resolve: async () => packageWorkspace }
+		const dockerCompose: DockerComposeAccess = {
+			tryReadMainDockerComposeConfig: async () => ({ services: { custom: { build: '.' } } }),
+			updateMainDockerComposeConfig: async () => {},
+		}
+		const { output, stdout } = createTestOutput()
+
+		await new WorkspaceUpdateApiCommand(resolver, dockerCompose).run(['2.2.0', '--json'], output)
+
+		expect(JSON.parse(stdout.text)).toStrictEqual({
+			version: '2.2.0',
+			updatedPackages: [],
+			updatedServices: [],
+		})
+	})
+})

package/tests/tenantConfigApplier.test.ts

@@ -1,87 +1,324 @@
 import { describe, expect, test } from 'bun:test'
-import { TenantConfigApplier } from '../src/lib/tenant/TenantConfigApplier.js'
-import type { RemoteIdentityProvider, TenantClient } from '../src/lib/tenant/TenantClient.js'
+import { createTestOutput } from '../../cli-common/tests/lib/testOutput.js'
+import { TenantConfigApplier, TenantConfigApplierClients } from '../src/lib/tenant/TenantConfigApplier.js'
+import type { RemoteAuthPolicy, RemoteIdentityProvider } from '../src/lib/tenant/clients/index.js'
+import type { TenantGlobalConfig } from '../src/lib/tenant/tenantConfig.js'
 
-const createClientMock = (existingIdps: RemoteIdentityProvider[] = []) => {
+const createPolicy = (policy: Pick<RemoteAuthPolicy, 'id' | 'scope' | 'project' | 'roles'>): RemoteAuthPolicy => ({
+	mfaRequired: null,
+	tokenExpiration: null,
+	idleTimeout: null,
+	mfaGraceDuration: null,
+	rememberMeAllowed: null,
+	...policy,
+})
+
+const createClientsMock = (existingIdps: RemoteIdentityProvider[] = [], existingPolicies: RemoteAuthPolicy[] = []) => {
 	const calls: string[] = []
-	const client = {
-		configure: async () => {
-			calls.push('configure')
-		},
-		listIdentityProviders: async () => existingIdps,
-		addIdp: async (slug: string) => {
-			calls.push(`addIdp:${slug}`)
-		},
-		updateIdp: async (slug: string) => {
-			calls.push(`updateIdp:${slug}`)
+	const configured: TenantGlobalConfig[] = []
+	const clients: TenantConfigApplierClients = {
+		project: {
+			configure: async (config: TenantGlobalConfig) => {
+				calls.push('configure')
+				configured.push(config)
+			},
+			listIdentityProviders: async () => existingIdps,
+			addIdp: async (slug: string) => {
+				calls.push(`addIdp:${slug}`)
+			},
+			updateIdp: async (slug: string) => {
+				calls.push(`updateIdp:${slug}`)
+			},
+			enableIdp: async (slug: string) => {
+				calls.push(`enableIdp:${slug}`)
+			},
+			disableIdp: async (slug: string) => {
+				calls.push(`disableIdp:${slug}`)
+			},
 		},
-		enableIdp: async (slug: string) => {
-			calls.push(`enableIdp:${slug}`)
-		},
-		disableIdp: async (slug: string) => {
-			calls.push(`disableIdp:${slug}`)
-		},
-		addMailTemplate: async (template: { type: string }) => {
-			calls.push(`addMailTemplate:${template.type}`)
+		policy: {
+			addMailTemplate: async (template: { type: string }) => {
+				calls.push(`addMailTemplate:${template.type}`)
+			},
+			listAuthPolicies: async () => existingPolicies,
+			createAuthPolicy: async (policy: { roles: readonly string[] }) => {
+				calls.push(`createAuthPolicy:${[...policy.roles].sort().join('+')}`)
+				return 'new-policy-id'
+			},
+			updateAuthPolicy: async (id: string) => {
+				calls.push(`updateAuthPolicy:${id}`)
+			},
 		},
 	}
-	return { client: client as unknown as TenantClient, calls }
+	return { clients, calls, configured }
+}
+
+const createApplier = () => {
+	const testOutput = createTestOutput()
+	return { applier: new TenantConfigApplier(testOutput.output), ...testOutput }
 }
 
 describe('TenantConfigApplier', () => {
 	test('sends configure when global config is present', async () => {
-		const { client, calls } = createClientMock()
-		await new TenantConfigApplier().apply(client, { config: { password: { minLength: 8 } } })
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, { config: { password: { minLength: 8 } } })
+		expect(calls).toEqual(['configure'])
+		expect(actions).toEqual([{ action: 'configure', target: null }])
+	})
+
+	// The applier does not model config sections; new ones (here: panel) must reach `configure` verbatim.
+	test('forwards the management panel access lists verbatim', async () => {
+		const { clients, configured } = createClientsMock()
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			config: { panel: { globalRoles: ['super_admin', 'ops'], projectRoles: [] } },
+		})
+		expect(configured).toEqual([{ panel: { globalRoles: ['super_admin', 'ops'], projectRoles: [] } }])
+	})
+
+	test('skips a schema-level no-op and continues with later actions', async () => {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			config: { password: { minLength: null }, captcha: { secret: null } },
+			identityProviders: { google: { type: 'oidc', configuration: {} } },
+			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+		})
+		expect(calls).toEqual(['addIdp:google', 'addMailTemplate:RESET_PASSWORD_REQUEST'])
+		expect(actions).toEqual([
+			{ action: 'addIdp', target: 'google' },
+			{ action: 'addMailTemplate', target: 'RESET_PASSWORD_REQUEST' },
+		])
+	})
+
+	test('a dry run omits no-op configure but keeps the rest of the plan', async () => {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			config: { captcha: { secret: null, protect: { signUp: null } } },
+			identityProviders: { google: { type: 'oidc', configuration: {} } },
+		}, { dryRun: true })
+		expect(calls).toEqual([])
+		expect(actions).toEqual([{ action: 'addIdp', target: 'google' }])
+	})
+
+	test('keeps explicit null clears that map to nullable database columns', async () => {
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, { config: { password: { pattern: null } } })
 		expect(calls).toEqual(['configure'])
+		expect(actions).toEqual([{ action: 'configure', target: null }])
 	})
 
 	test('adds a new identity provider', async () => {
-		const { client, calls } = createClientMock([])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 		})
 		expect(calls).toEqual(['addIdp:google'])
+		expect(actions).toEqual([{ action: 'addIdp', target: 'google' }])
 	})
 
 	test('updates an existing identity provider', async () => {
-		const { client, calls } = createClientMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 		})
 		expect(calls).toEqual(['updateIdp:google'])
 	})
 
 	test('disables an enabled provider marked disabled', async () => {
-		const { client, calls } = createClientMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {}, disabled: true } },
 		})
 		expect(calls).toEqual(['updateIdp:google', 'disableIdp:google'])
 	})
 
 	test('re-enables a disabled provider no longer marked disabled', async () => {
-		const { client, calls } = createClientMock([{ slug: 'google', type: 'oidc', disabledAt: '2024-01-01T00:00:00Z' }])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: '2024-01-01T00:00:00Z' }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 		})
 		expect(calls).toEqual(['updateIdp:google', 'enableIdp:google'])
 	})
 
 	test('upserts mail templates', async () => {
-		const { client, calls } = createClientMock()
-		await new TenantConfigApplier().apply(client, {
-			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c', variant: 'cs' }],
 		})
 		expect(calls).toEqual(['addMailTemplate:RESET_PASSWORD_REQUEST'])
+		expect(actions).toEqual([{ action: 'addMailTemplate', target: 'RESET_PASSWORD_REQUEST/cs' }])
+	})
+
+	test('creates an auth policy that does not exist yet', async () => {
+		const { clients, calls } = createClientsMock([], [])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin'], mfaRequired: true }],
+		})
+		expect(calls).toEqual(['createAuthPolicy:admin'])
+		expect(actions).toEqual([{ action: 'createAuthPolicy', target: 'global [admin]' }])
 	})
 
-	test('dry run performs no mutations but still reads state', async () => {
-		const { client, calls } = createClientMock([])
-		await new TenantConfigApplier().apply(client, {
+	test('updates the policy targeting the same scope and roles', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'p1', scope: 'global', project: null, roles: ['admin'] })])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin'], mfaRequired: true }],
+		})
+		expect(calls).toEqual(['updateAuthPolicy:p1'])
+		expect(actions).toEqual([{ action: 'updateAuthPolicy', target: 'global [admin]' }])
+	})
+
+	test('matches roles as a set, not as an ordered list', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'p1', scope: 'global', project: null, roles: ['editor', 'admin'] })])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin', 'editor'] }],
+		})
+		expect(calls).toEqual(['updateAuthPolicy:p1'])
+	})
+
+	test('keeps global and project policies with the same roles apart', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'p1', scope: 'global', project: null, roles: ['admin'] })])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			authPolicies: [{ scope: 'project', project: 'blog', roles: ['admin'] }],
+		})
+		expect(calls).toEqual(['createAuthPolicy:admin'])
+	})
+
+	test('warns about an existing policy the config does not manage', async () => {
+		const { clients } = createClientsMock([], [createPolicy({ id: 'stale', scope: 'global', project: null, roles: ['old_role'] })])
+		const { applier, stderr } = createApplier()
+		const { warnings } = await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin'] }],
+		})
+		expect(warnings).toEqual([{
+			code: 'UNMANAGED_AUTH_POLICY',
+			target: 'global [old_role]',
+			message: 'Auth policy global [old_role] exists but is not in the config; it stays in effect.',
+		}])
+		expect(stderr.lines.filter(it => it.includes('stays in effect'))).toHaveLength(1)
+	})
+
+	// An empty list is the case the warning exists for: the config claims to manage
+	// policies, so a row left over from an earlier apply keeps enforcing unnoticed.
+	test('warns about existing policies when the config lists none', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'stale', scope: 'global', project: null, roles: ['old_role'] })])
+		const { applier, stderr } = createApplier()
+		const { warnings } = await applier.apply(clients, { authPolicies: [] })
+		expect(warnings).toHaveLength(1)
+		expect(warnings[0].code).toBe('UNMANAGED_AUTH_POLICY')
+		expect(stderr.lines).toHaveLength(1)
+		expect(stderr.lines[0]).toContain('old_role')
+		expect(calls).toEqual([])
+	})
+
+	test('stays silent about existing policies when the config does not mention them at all', async () => {
+		const { clients } = createClientsMock([], [createPolicy({ id: 'stale', scope: 'global', project: null, roles: ['old_role'] })])
+		const { applier, stderr } = createApplier()
+		const { warnings } = await applier.apply(clients, {})
+		expect(warnings).toEqual([])
+		expect(stderr.text).toBe('')
+	})
+
+	test('rejects two config entries targeting the same policy before anything is written', async () => {
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		let thrown: unknown
+		try {
+			await applier.apply(clients, {
+				config: { password: { minLength: 8 } },
+				authPolicies: [
+					{ scope: 'global', roles: ['admin', 'editor'], mfaRequired: true },
+					{ scope: 'global', roles: ['editor', 'admin'], mfaRequired: false },
+				],
+			})
+		} catch (e) {
+			thrown = e
+		}
+		expect(thrown).toContain('Duplicate auth policy')
+		// `configure` comes first in apply(), so an empty call list proves the check ran before it.
+		expect(calls).toEqual([])
+	})
+
+	test('rejects duplicate existing policies before anything is written', async () => {
+		const duplicate = { scope: 'global' as const, project: null, roles: ['admin'] }
+		const { clients, calls } = createClientsMock([], [
+			createPolicy({ id: 'p1', ...duplicate }),
+			createPolicy({ id: 'p2', ...duplicate }),
+		])
+		const { applier } = createApplier()
+		let thrown: unknown
+		try {
+			await applier.apply(clients, {
+				config: { password: { minLength: 8 } },
+				authPolicies: [{ scope: 'global', roles: ['admin'] }],
+			})
+		} catch (e) {
+			thrown = e
+		}
+		expect(thrown).toBeInstanceOf(Error)
+		if (thrown instanceof Error) {
+			expect(thrown.message).toContain('Duplicate existing auth policy')
+		}
+		expect(calls).toEqual([])
+	})
+
+	test('dry run performs no mutations but still reads state and returns the plan', async () => {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
 			config: { password: { minLength: 8 } },
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+			authPolicies: [{ scope: 'global', roles: ['admin'] }],
 		}, { dryRun: true })
 		expect(calls).toEqual([])
+		expect(actions).toEqual([
+			{ action: 'configure', target: null },
+			{ action: 'addIdp', target: 'google' },
+			{ action: 'addMailTemplate', target: 'RESET_PASSWORD_REQUEST' },
+			{ action: 'createAuthPolicy', target: 'global [admin]' },
+		])
+	})
+
+	// createTestOutput defaults to a non-TTY stderr, which is what CI looks like — `progress()` would print nothing here
+	test('reports every executed action on stderr even without a TTY, and writes nothing to stdout', async () => {
+		const { clients } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
+		const { applier, stdout, stderr } = createApplier()
+
+		await applier.apply(clients, {
+			config: { password: { minLength: 8 } },
+			identityProviders: { google: { type: 'oidc', configuration: {}, disabled: true } },
+			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+		})
+
+		expect(stderr.lines).toEqual([
+			'configure',
+			'updateIdp: google',
+			'disableIdp: google',
+			'addMailTemplate: RESET_PASSWORD_REQUEST',
+		])
+		expect(stdout.text).toBe('')
+	})
+
+	test('a dry run reports nothing — no action was taken', async () => {
+		const { clients } = createClientsMock([])
+		const { applier, stdout, stderr } = createApplier()
+
+		await applier.apply(clients, { config: { password: { minLength: 8 } } }, { dryRun: true })
+
+		expect(stderr.text).toBe('')
+		expect(stdout.text).toBe('')
 	})
 })