@red-hat-developer-hub/e2e-test-utils 2.1.13 → 2.1.15

package/dist/secrets/tests/bitwarden.test.js

@@ -0,0 +1,418 @@
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect, playwright/no-conditional-in-test -- node:test fixtures model CLI and environment keys */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { BitwardenClient } from "../bitwarden.js";
+const selectors = [
+    {
+        prefix: "global/",
+        optional: false,
+        destination: {
+            kind: "environment",
+            stripPrefix: "global/",
+            requirePrefix: "VAULT_",
+            keyTransform: "legacy-env",
+        },
+    },
+    {
+        prefix: "workspaces/backstage/",
+        optional: true,
+        destination: {
+            kind: "environment",
+            stripPrefix: "workspaces/backstage/",
+            requirePrefix: "VAULT_",
+            keyTransform: "legacy-env",
+        },
+    },
+];
+function result(stdout = "", status = 0) {
+    return { status, stdout, stderr: status === 0 ? "" : "synthetic failure" };
+}
+test("requires an unlocked BW_SESSION before any Bitwarden command", async () => {
+    let called = false;
+    const runner = async () => {
+        called = true;
+        return result();
+    };
+    await assert.rejects(() => new BitwardenClient({
+        env: { PATH: "/bin" },
+        runner,
+    }).read("rhdh-plugin-export-overlays", selectors), /BW_SESSION.*unlocked/i);
+    assert.equal(called, false);
+});
+test("rejects the denied AWS collection before any Bitwarden command", async () => {
+    let called = false;
+    const runner = async () => {
+        called = true;
+        return result();
+    };
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-aws-credentials", [selectors[0]]), /rhdh-aws-credentials.*Bitwarden/i);
+    assert.equal(called, false);
+});
+test("syncs and reads only exact-prefix items from the selected collection", async () => {
+    const calls = [];
+    const runner = async (_command, args, options) => {
+        calls.push({ args, env: options?.env });
+        if (args[0] === "--version")
+            return result("2026.5.0\n");
+        if (args[0] === "status")
+            return result(JSON.stringify({ status: "unlocked" }));
+        if (args[0] === "sync")
+            return result();
+        if (args[0] === "list" && args[1] === "collections") {
+            return result(JSON.stringify([
+                {
+                    id: "other-collection",
+                    name: "Other",
+                    organizationId: "other-org",
+                },
+                {
+                    id: "collection-id",
+                    name: "Rhdh Plugin Export Overlays Ci Secrets",
+                    organizationId: "org-id",
+                },
+            ]));
+        }
+        if (args[0] === "list" && args[1] === "items") {
+            assert.deepEqual(args.slice(0, 4), [
+                "list",
+                "items",
+                "--collectionid",
+                "collection-id",
+            ]);
+            return result(JSON.stringify(args.at(-1) === "global/"
+                ? [{ id: "global-id" }, { id: "false-positive" }]
+                : [{ id: "workspace-id" }]));
+        }
+        if (args[0] === "get" && args[1] === "item" && args[2] === "global-id") {
+            return result(JSON.stringify({
+                id: "global-id",
+                name: "global/VAULT_GITHUB_TOKEN",
+                notes: "synthetic-token",
+                type: 2,
+                collectionIds: ["collection-id"],
+                organizationId: "org-id",
+            }));
+        }
+        if (args[0] === "get" &&
+            args[1] === "item" &&
+            args[2] === "false-positive") {
+            return result(JSON.stringify({
+                id: "false-positive",
+                name: "global-other/VAULT_NOT_SELECTED",
+                notes: "not-selected",
+                type: 2,
+                collectionIds: ["collection-id"],
+                organizationId: "org-id",
+            }));
+        }
+        if (args[0] === "get" && args[1] === "item" && args[2] === "workspace-id") {
+            return result(JSON.stringify({
+                id: "workspace-id",
+                name: "workspaces/backstage/VAULT_GH_USER_ID",
+                notes: "synthetic-user",
+                type: 2,
+                collectionIds: ["collection-id"],
+                organizationId: "org-id",
+            }));
+        }
+        throw new Error(`Unexpected command: ${args.join(" ")}`);
+    };
+    const secrets = await new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session", PATH: "/bin" },
+        runner,
+    }).read("rhdh-plugin-export-overlays", selectors);
+    assert.deepEqual(secrets, [
+        {
+            id: "global-id",
+            name: "global/VAULT_GITHUB_TOKEN",
+            value: "synthetic-token",
+            selector: selectors[0],
+        },
+        {
+            id: "workspace-id",
+            name: "workspaces/backstage/VAULT_GH_USER_ID",
+            value: "synthetic-user",
+            selector: selectors[1],
+        },
+    ]);
+    assert.equal(calls[0]?.args[0], "--version");
+    assert.equal(calls.every((call) => call.env?.BW_SESSION === "synthetic-session"), true);
+});
+test("rejects duplicate exact item names before returning secrets", async () => {
+    const runner = async (_command, args) => {
+        if (args[0] === "--version")
+            return result("2026.5.0");
+        if (args[0] === "status")
+            return result(JSON.stringify({ status: "unlocked" }));
+        if (args[0] === "sync")
+            return result();
+        if (args[1] === "collections") {
+            return result(JSON.stringify([
+                {
+                    id: "collection-id",
+                    name: "Rhdh Qe Ci Secrets",
+                    organizationId: "org-id",
+                },
+            ]));
+        }
+        if (args[1] === "items") {
+            return result(JSON.stringify([{ id: "one" }, { id: "two" }]));
+        }
+        return result(JSON.stringify({
+            id: args[2],
+            name: "global/VAULT_DUPLICATE",
+            notes: "synthetic",
+            type: 2,
+            collectionIds: ["collection-id"],
+            organizationId: "org-id",
+        }));
+    };
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [selectors[0]]), /duplicate.*item name/i);
+});
+test("rejects non-note items and items assigned to multiple collections", async () => {
+    const runner = async (_command, args) => {
+        if (args[0] === "--version")
+            return result("2026.5.0");
+        if (args[0] === "status")
+            return result(JSON.stringify({ status: "unlocked" }));
+        if (args[0] === "sync")
+            return result();
+        if (args[1] === "collections") {
+            return result(JSON.stringify([
+                {
+                    id: "collection-id",
+                    name: "Rhdh Qe Ci Secrets",
+                    organizationId: "org-id",
+                },
+            ]));
+        }
+        if (args[1] === "items")
+            return result(JSON.stringify([{ id: "item-id" }]));
+        return result(JSON.stringify({
+            id: "item-id",
+            name: "global/VAULT_TOKEN",
+            notes: "synthetic",
+            type: 1,
+            collectionIds: ["collection-id", "other-id"],
+            organizationId: "org-id",
+        }));
+    };
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [selectors[0]]), /secure note.*selected collection/i);
+});
+test("fails required selectors and permits empty optional selectors", async () => {
+    const runner = async (_command, args) => {
+        if (args[0] === "--version")
+            return result("2026.5.0");
+        if (args[0] === "status")
+            return result(JSON.stringify({ status: "unlocked" }));
+        if (args[0] === "sync")
+            return result();
+        if (args[1] === "collections") {
+            return result(JSON.stringify([
+                {
+                    id: "collection-id",
+                    name: "Rhdh Qe Ci Secrets",
+                    organizationId: "org-id",
+                },
+            ]));
+        }
+        return result("[]");
+    };
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [selectors[0]]), /required prefix.*global\//i);
+    const secrets = await new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [selectors[1]]);
+    assert.deepEqual(secrets, []);
+});
+function attachmentSelector() {
+    return selectors[0];
+}
+function attachmentRunner(item, attachmentResult = result("synthetic-attachment"), calls = []) {
+    return async (_command, args) => {
+        calls.push(args);
+        if (args[0] === "--version")
+            return result("2026.5.0\n");
+        if (args[0] === "status")
+            return result(JSON.stringify({ status: "unlocked" }));
+        if (args[0] === "sync")
+            return result();
+        if (args[0] === "list" && args[1] === "collections") {
+            return result(JSON.stringify([
+                {
+                    id: "collection-id",
+                    name: "Rhdh Qe Ci Secrets",
+                    organizationId: "org-id",
+                },
+            ]));
+        }
+        if (args[0] === "list" && args[1] === "items") {
+            return result(JSON.stringify([{ id: item.id }]));
+        }
+        if (args[0] === "get" && args[1] === "item") {
+            return result(JSON.stringify(item));
+        }
+        if (args[0] === "get" && args[1] === "attachment") {
+            return attachmentResult;
+        }
+        throw new Error(`Unexpected command: ${args.join(" ")}`);
+    };
+}
+test("reads one attachment through the raw Bitwarden command", async () => {
+    const calls = [];
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT_PEM",
+        notes: null,
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }],
+    }, result("synthetic-attachment"), calls);
+    const [secret] = await new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]);
+    assert.equal(secret?.value, "synthetic-attachment");
+    assert.deepEqual(calls.at(-1), [
+        "get",
+        "attachment",
+        "VAULT_CERT_PEM",
+        "--itemid",
+        "item-id",
+        "--raw",
+    ]);
+});
+test("preserves multiline attachment contents", async () => {
+    const contents = "-----BEGIN CERTIFICATE-----\nline\n-----END CERTIFICATE-----\n";
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT_PEM",
+        notes: "",
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }],
+    }, result(contents));
+    const [secret] = await new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]);
+    assert.equal(secret?.value, contents);
+});
+test("rejects items with multiple attachments", async () => {
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT_PEM",
+        notes: null,
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [
+            { id: "attachment-id", fileName: "VAULT_CERT_PEM" },
+            { id: "other-attachment-id", fileName: "other" },
+        ],
+    });
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]), /exactly one attachment/i);
+});
+test("rejects invalid attachment metadata", async () => {
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT_PEM",
+        notes: null,
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [{ id: "attachment-id" }],
+    });
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]), /invalid attachment metadata/i);
+});
+test("rejects an attachment filename that does not match the sanitized item basename", async () => {
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT key",
+        notes: null,
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [{ id: "attachment-id", fileName: "VAULT_CERT-key" }],
+    });
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]), /attachment filename.*basename/i);
+});
+test("rejects a non-empty note combined with an attachment", async () => {
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT_PEM",
+        notes: "synthetic-note",
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }],
+    });
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]), /notes.*attachment/i);
+});
+test("rejects non-string note metadata on attachment-backed items", async () => {
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT_PEM",
+        notes: 42,
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }],
+    });
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]), (error) => {
+        assert(error instanceof Error);
+        assert.equal(error.message, "Bitwarden item notes must be null or empty when an attachment is present for global/");
+        assert.doesNotMatch(error.message, /synthetic-attachment/);
+        return true;
+    });
+});
+test("does not expose attachment command output when the command fails", async () => {
+    const attachmentPayload = "synthetic-private-attachment";
+    const runner = attachmentRunner({
+        id: "item-id",
+        name: "global/VAULT_CERT_PEM",
+        notes: null,
+        type: 2,
+        collectionIds: ["collection-id"],
+        organizationId: "org-id",
+        attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }],
+    }, { status: 1, stdout: attachmentPayload, stderr: attachmentPayload });
+    await assert.rejects(() => new BitwardenClient({
+        env: { BW_SESSION: "synthetic-session" },
+        runner,
+    }).read("rhdh-qe", [attachmentSelector()]), (error) => {
+        assert(error instanceof Error);
+        assert.match(error.message, /attachment read failed/i);
+        assert.doesNotMatch(error.message, /synthetic-private-attachment/);
+        return true;
+    });
+});

package/dist/secrets/tests/cli.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.integration.test.d.ts.map

package/dist/secrets/tests/cli.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.integration.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/cli.integration.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/cli.integration.test.js

@@ -0,0 +1,70 @@
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test fixture models CLI environment keys */
+import assert from "node:assert/strict";
+import { chmod, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+test("runs the package bin with a fake bw executable and redacted child auth", async () => {
+    const directory = await mkdtemp(path.join(os.tmpdir(), "secrets-cli-test-"));
+    const command = path.join(directory, "bw");
+    const profile = path.join(directory, "profile.json");
+    const entrypoint = path.join(directory, "rhdh-e2e-secrets");
+    await symlink(path.resolve("dist/secrets/cli.js"), entrypoint);
+    await writeFile(command, `#!/usr/bin/env node
+const args = process.argv.slice(2);
+if (args[0] === "--version") process.stdout.write("2026.5.0\\n");
+else if (args[0] === "status") process.stdout.write(JSON.stringify({ status: "unlocked" }));
+else if (args[0] === "sync") {}
+else if (args[0] === "list" && args[1] === "collections") process.stdout.write(JSON.stringify([{ id: "collection-id", name: "Rhdh Qe Ci Secrets", organizationId: "organization-id" }]));
+else if (args[0] === "list" && args[1] === "items") process.stdout.write(JSON.stringify([{ id: "note-item-id" }, { id: "attachment-item-id" }]));
+else if (args[0] === "get" && args[1] === "item" && args[2] === "note-item-id") process.stdout.write(JSON.stringify({ id: "note-item-id", name: "global/VAULT_TOKEN", notes: "synthetic-note-value", type: 2, collectionIds: ["collection-id"], organizationId: "organization-id" }));
+else if (args[0] === "get" && args[1] === "item" && args[2] === "attachment-item-id") process.stdout.write(JSON.stringify({ id: "attachment-item-id", name: "global/VAULT_CERT_PEM", notes: null, type: 2, collectionIds: ["collection-id"], organizationId: "organization-id", attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }] }));
+else if (args[0] === "get" && args[1] === "attachment" && args[2] === "VAULT_CERT_PEM" && args[3] === "--itemid" && args[4] === "attachment-item-id" && args[5] === "--raw") process.stdout.write("synthetic-attachment-value");
+else process.exitCode = 1;
+`);
+    await chmod(command, 0o755);
+    await writeFile(profile, JSON.stringify({
+        schemaVersion: 1,
+        collection: "rhdh-qe",
+        selectors: [
+            {
+                prefix: "global/",
+                destination: {
+                    kind: "environment",
+                    stripPrefix: "global/",
+                    requirePrefix: "VAULT_",
+                    keyTransform: "legacy-env",
+                },
+            },
+        ],
+    }));
+    try {
+        const result = spawnSync(entrypoint, [
+            "exec",
+            "--profile",
+            profile,
+            "--",
+            process.execPath,
+            "-e",
+            "if (process.env.VAULT_TOKEN === 'synthetic-note-value' && process.env.VAULT_CERT_PEM === 'synthetic-attachment-value' && process.env.BW_SESSION === undefined) process.stdout.write('child-ran'); else process.exit(1)",
+        ], {
+            cwd: path.resolve("."),
+            encoding: "utf8",
+            env: {
+                ...process.env,
+                PATH: `${directory}${path.delimiter}${process.env.PATH ?? ""}`,
+                BW_SESSION: "synthetic-session",
+            },
+        });
+        assert.equal(result.status, 0, result.stderr);
+        assert.match(result.stdout, /child-ran/);
+        assert.doesNotMatch(result.stdout, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(result.stderr, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(result.stdout, /synthetic-session/);
+        assert.doesNotMatch(result.stderr, /synthetic-session/);
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+});

package/dist/secrets/tests/cli.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.test.d.ts.map

package/dist/secrets/tests/cli.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/cli.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/cli.test.js

@@ -0,0 +1,42 @@
+/* eslint-disable playwright/expect-expect -- this file uses node:test assertions */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { parseCliArguments } from "../cli.js";
+test("parses the exec profile, repeated workspaces, and command after --", () => {
+    const parsed = parseCliArguments([
+        "exec",
+        "--profile",
+        "e2e-secrets.profile.json",
+        "--workspace",
+        "backstage",
+        "--workspace=extensions",
+        "--",
+        "playwright",
+        "test",
+        "--headed",
+    ]);
+    assert.deepEqual(parsed, {
+        command: "exec",
+        profilePath: "e2e-secrets.profile.json",
+        workspaces: ["backstage", "extensions"],
+        executable: "playwright",
+        args: ["test", "--headed"],
+    });
+});
+test("requires a profile and a command after --", () => {
+    assert.throws(() => parseCliArguments(["exec", "--", "playwright"]), /profile/i);
+    assert.throws(() => parseCliArguments(["exec", "--profile", "profile.json"]), /command.*--/i);
+    assert.throws(() => parseCliArguments(["exec", "--profile", "profile.json", "--", ""]), /command/i);
+});
+test("rejects unknown commands and malformed options", () => {
+    assert.throws(() => parseCliArguments(["rotate"]), /unsupported command/i);
+    assert.throws(() => parseCliArguments(["exec", "--profile", "--", "playwright"]), /requires a value/i);
+    assert.throws(() => parseCliArguments([
+        "exec",
+        "--profile",
+        "profile.json",
+        "--workspace",
+        "--",
+        "playwright",
+    ]), /requires a value/i);
+});

package/dist/secrets/tests/config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/secrets/tests/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/config.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/config.test.js

@@ -0,0 +1,105 @@
+/* eslint-disable playwright/expect-expect -- this file uses node:test assertions */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { expandProfile, getCollectionMapping, parseProfile, } from "../config.js";
+const overlayProfile = {
+    schemaVersion: 1,
+    collection: "rhdh-plugin-export-overlays",
+    selectors: [
+        {
+            prefix: "global/",
+            destination: {
+                kind: "environment",
+                stripPrefix: "global/",
+                requirePrefix: "VAULT_",
+                keyTransform: "legacy-env",
+            },
+        },
+        {
+            prefix: "workspaces/${workspace}/",
+            optional: true,
+            destination: {
+                kind: "environment",
+                stripPrefix: "workspaces/${workspace}/",
+                requirePrefix: "VAULT_",
+                keyTransform: "legacy-env",
+            },
+        },
+    ],
+};
+test("maps each approved collection to its exact Bitwarden collection name", () => {
+    assert.deepEqual(getCollectionMapping("rhdh-qe"), {
+        id: "rhdh-qe",
+        bitwardenCollection: "Rhdh Qe Ci Secrets",
+    });
+});
+test("rejects the GSM-only AWS collection before Bitwarden access", () => {
+    assert.throws(() => parseProfile({ ...overlayProfile, collection: "rhdh-aws-credentials" }), /rhdh-aws-credentials.*Bitwarden/i);
+});
+test("expands workspace selectors once for every requested workspace", () => {
+    assert.deepEqual(expandProfile(overlayProfile, ["backstage", "extensions"]).selectors.map((selector) => selector.prefix), ["global/", "workspaces/backstage/", "workspaces/extensions/"]);
+});
+test("allows an optional workspace selector to have no matching items", () => {
+    const expanded = expandProfile(overlayProfile, ["extensions"]);
+    assert.equal(expanded.selectors[1]?.optional, true);
+});
+test("rejects workspace arguments for a profile without a workspace token", () => {
+    assert.throws(() => expandProfile(parseProfile({
+        schemaVersion: 1,
+        collection: "rhdh-qe",
+        selectors: [
+            {
+                prefix: "rhdh/",
+                destination: {
+                    kind: "environment",
+                    stripPrefix: "rhdh/",
+                    keyTransform: "identity",
+                },
+            },
+        ],
+    }), ["backstage"]), /does not accept workspace arguments/);
+});
+test("rejects invalid workspace names and duplicate transformed selectors", () => {
+    assert.throws(() => expandProfile(overlayProfile, ["../secrets"]), /invalid workspace/i);
+    assert.throws(() => parseProfile({
+        schemaVersion: 1,
+        collection: "rhdh-qe",
+        selectors: [
+            {
+                prefix: "rhdh/",
+                destination: {
+                    kind: "environment",
+                    stripPrefix: "rhdh/",
+                    keyTransform: "identity",
+                },
+            },
+            {
+                prefix: "rhdh/",
+                destination: {
+                    kind: "environment",
+                    stripPrefix: "rhdh/",
+                    keyTransform: "identity",
+                },
+            },
+        ],
+    }), /duplicate selector/i);
+});
+test("rejects a strip prefix that cannot apply to the selected item prefix", () => {
+    assert.throws(() => parseProfile({
+        schemaVersion: 1,
+        collection: "rhdh-qe",
+        selectors: [
+            {
+                prefix: "global/",
+                destination: {
+                    kind: "environment",
+                    stripPrefix: "workspaces/",
+                    keyTransform: "identity",
+                },
+            },
+        ],
+    }), /stripPrefix.*prefix/i);
+});
+test("rejects duplicate workspace arguments", () => {
+    assert.throws(() => expandProfile(overlayProfile, ["backstage", "backstage"]), /duplicate workspace/i);
+});

package/dist/secrets/tests/environment.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=environment.test.d.ts.map

package/dist/secrets/tests/environment.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/environment.test.ts"],"names":[],"mappings":""}