procesio-cli 0.1.1__py3-none-any.whl

procesio_cli/tools/procesio/tests/test_form_chains.py

@@ -0,0 +1,217 @@
+"""form-set-element-chains: rewrite ordered event chains from names, in one save.
+
+The action exists because a MAP_FORM_DATA row or condition pointing at a wrong path is saved
+without an error and then silently does nothing, so every name is resolved (and every unknown one
+refused) before the single PUT."""
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from tools.procesio import errors, main
+from tools.procesio.client import ProcesioClient
+from tools.procesio.dto.form.fieldpath import FIELDS_NS
+from tools.procesio.tests.conftest import FakeResp, FakeSession
+
+ROOT = "root-1"
+
+
+def _builder(session):
+    return lambda prof: ProcesioClient(
+        profile={"type": "apikey", "key": "N", "value": "V"}, name="t", session=session)
+
+
+def _form():
+    return {
+        "id": "F1", "name": "F", "type": 0, "status": 1, "state": True,
+        "data": {
+            "dataModel": {"id": ROOT},
+            "variables": [{"name": "form", "id": ROOT}, {"name": "isPF", "id": "var-pf"}],
+            "elements": [
+                {"id": "btn", "type": "button", "configs": [
+                    {"id": "c-btn-name", "key": "name", "value": "validate"},
+                    {"id": "c-btn-vis", "key": "visible", "value": True},
+                    {"id": "c-btn-click", "key": "onClickEvents", "value": {"debounce": 0, "events": [
+                        {"id": "ev-js1", "type": "CLICK", "action": "RUN_JAVASCRIPT",
+                         "config": {"code": "a()"}},
+                        {"id": "ev-map", "type": "CLICK", "action": "MAP_FORM_DATA",
+                         "config": {"mapping": []}},
+                        {"id": "ev-js2", "type": "CLICK", "action": "RUN_JAVASCRIPT",
+                         "config": {"code": "b()"}},
+                    ]}},
+                ]},
+                {"id": "inp", "type": "input", "configs": [
+                    {"id": "c-inp-name", "key": "name", "value": "Input2"},
+                    {"id": "c-inp-val", "key": "value", "value": ""},
+                    {"id": "c-inp-dis", "key": "disabled", "value": False},
+                ]},
+                {"id": "flag", "type": "number-input", "configs": [
+                    {"id": "c-flag-name", "key": "name", "value": "flag"},
+                    {"id": "c-flag-val", "key": "value", "value": ""},
+                    {"id": "c-flag-input", "key": "onInputEvents",
+                     "value": {"debounce": 0, "events": []}},
+                ]},
+                {"id": "step2", "type": "step", "configs": [
+                    {"id": "c-step-name", "key": "name", "value": "step-two"},
+                    {"id": "c-step-vis", "key": "visible", "value": False},
+                ]},
+            ]},
+    }
+
+
+def _run(plan, *extra, queue=None):
+    sess = FakeSession(queue=queue or [FakeResp(200, _form()), FakeResp(200, {})])
+    out = main.dispatch("form-set-element-chains",
+                        ["--id", "F1", "--plan", json.dumps(plan), *extra],
+                        client_builder=_builder(sess))
+    return out, sess
+
+
+def _put_events(sess, element_id, key):
+    put = sess.calls[-1]
+    assert put["method"] == "PUT" and put["url"].endswith("/api/FormTemplate")
+    el = next(e for e in put["json"]["Data"]["elements"] if e["id"] == element_id)
+    return next(c for c in el["configs"] if c["key"] == key)["value"]["events"]
+
+
+def _path(element_id, config_id):
+    return f"{ROOT}.{FIELDS_NS}.{element_id}.{config_id}"
+
+
+def test_keeps_verbatim_builds_map_from_names_and_drops_the_rest():
+    plan = {"chains": [{"element": "validate", "on": "click", "events": [
+        {"keep": "ev-js1"},
+        {"map": {"set": {"Input2.disabled": True, "step-two.visible": True, "@isPF": False},
+                 "when": [{"field": "flag", "op": "EQUALS", "value": "1"},
+                          {"variable": "isPF", "op": "is_true"}]}},
+        {"js": "c()"},
+    ]}]}
+    out, sess = _run(plan)
+    events = _put_events(sess, "btn", "onClickEvents")
+    assert [e["action"] for e in events] == ["RUN_JAVASCRIPT", "MAP_FORM_DATA", "RUN_JAVASCRIPT"]
+    assert events[0] == {"id": "ev-js1", "type": "CLICK", "action": "RUN_JAVASCRIPT",
+                         "config": {"code": "a()"}}
+    cfg = events[1]["config"]
+    assert cfg["mapping"] == [
+        {"id": 0, "left": _path("inp", "c-inp-dis"), "right": "true"},
+        {"id": 1, "left": _path("step2", "c-step-vis"), "right": "true"},
+        {"id": 2, "left": "var-pf", "right": "false"},
+    ]
+    assert cfg["areConditionsConfigured"] is True
+    c0, c1 = cfg["conditions"]
+    # a field operand addresses the element's VALUE config; the first condition links with AND
+    assert c0["leftOperator"]["value"] == _path("flag", "c-flag-val")
+    assert (c0["operator"], c0["rightOperator"]["value"], c0["logicOperator"]) == ("EQUALS", "1", 1)
+    assert c0["operandsAsListOptional"] is True
+    assert c1["leftOperator"]["value"] == "var-pf"
+    assert (c1["operator"], c1["logicOperator"], c1["operandsAsListOptional"]) == ("IS_TRUE", 0, False)
+    assert events[1]["type"] == "CLICK" and events[2]["config"] == {"code": "c()"}
+    report = out["chains"][0]
+    assert report["kept"] == ["ev-js1"] and report["dropped"] == ["ev-map", "ev-js2"]
+    assert report["events"][1]["set"] == {"Input2.disabled": "true", "step-two.visible": "true",
+                                          "@isPF": "false"}
+
+
+def test_unconditional_map_carries_no_conditions_key_and_any_means_or():
+    plan = {"chains": [{"element": "flag", "on": "input", "events": [
+        {"map": {"set": {"step-two.visible": True}}},
+        {"map": {"set": {"Input2.disabled": False}, "match": "any",
+                 "when": [{"field": "Input2.disabled", "op": "IS_TRUE"},
+                          {"field": "flag", "op": "IS_EMPTY"}]}},
+    ]}]}
+    _, sess = _run(plan)
+    events = _put_events(sess, "flag", "onInputEvents")
+    assert events[0]["type"] == "INPUT"
+    assert set(events[0]["config"]) == {"mapping"}
+    conds = events[1]["config"]["conditions"]
+    assert conds[0]["leftOperator"]["value"] == _path("inp", "c-inp-dis")
+    assert [c["logicOperator"] for c in conds] == [2, 0]
+    # the designer's flag follows the operator: IS_TRUE false, IS_EMPTY true - on a field too
+    assert [c["operandsAsListOptional"] for c in conds] == [False, True]
+
+
+def test_several_elements_land_in_one_put():
+    plan = {"chains": [
+        {"element": "validate", "on": "click", "events": [{"keep": "ev-js2"}]},
+        {"element": "flag", "on": "input", "events": [{"js": "go()"}]},
+    ]}
+    out, sess = _run(plan)
+    assert [c["method"] for c in sess.calls] == ["GET", "PUT"]
+    assert [e["id"] for e in _put_events(sess, "btn", "onClickEvents")] == ["ev-js2"]
+    assert _put_events(sess, "flag", "onInputEvents")[0]["config"]["code"] == "go()"
+    assert out["updated"] is True and out["elements"] == 4
+
+
+def test_dry_run_reports_names_and_does_not_write():
+    plan = {"chains": [{"element": "validate", "on": "click", "events": [
+        {"map": {"set": {"step-two.visible": True},
+                 "when": [{"field": "flag", "op": "EQUALS", "value": 1}]}}]}]}
+    out, sess = _run(plan, "--dry-run", queue=[FakeResp(200, _form())])
+    assert out["dry_run"] is True
+    assert [c["method"] for c in sess.calls] == ["GET"]
+    assert out["chains"][0]["events"][0]["when"] == ["flag.value EQUALS '1'"]
+
+
+@pytest.mark.parametrize("event, needle", [
+    ({"map": {"set": {"Input2.visibility": True}}}, "no 'visibility' config"),
+    ({"map": {"set": {"Nope.visible": True}}}, "not an element"),
+    ({"map": {"set": {"@nope": True}}}, "not a form variable"),
+    ({"map": {"set": {"Input2.disabled": True},
+              "when": [{"field": "flag", "op": "ROUGHLY"}]}}, "is not one of"),
+    ({"map": {"set": {"Input2.disabled": True}, "match": "some",
+              "when": [{"field": "flag", "op": "IS_TRUE"}]}}, "match must be"),
+    ({"keep": "ev-missing"}, "no event 'ev-missing'"),
+    ({"js": "  "}, "empty JavaScript"),
+    ({"teleport": 1}, "unknown event kind"),
+])
+def test_unresolvable_plans_are_refused_before_any_write(event, needle):
+    plan = {"chains": [{"element": "validate", "on": "click", "events": [event]}]}
+    sess = FakeSession(queue=[FakeResp(200, _form())])
+    with pytest.raises(errors.UsageError) as e:
+        main.dispatch("form-set-element-chains", ["--id", "F1", "--plan", json.dumps(plan)],
+                      client_builder=_builder(sess))
+    assert needle in str(e.value)
+    assert all(c["method"] == "GET" for c in sess.calls)
+
+
+def test_same_element_trigger_twice_is_refused():
+    plan = {"chains": [
+        {"element": "validate", "on": "click", "events": [{"keep": "ev-js1"}]},
+        {"element": "btn", "on": "click", "events": [{"keep": "ev-js2"}]},
+    ]}
+    sess = FakeSession(queue=[FakeResp(200, _form())])
+    with pytest.raises(errors.UsageError, match="appears twice"):
+        main.dispatch("form-set-element-chains", ["--id", "F1", "--plan", json.dumps(plan)],
+                      client_builder=_builder(sess))
+
+
+def test_js_file_resolves_relative_to_the_plan_file(tmp_path):
+    (tmp_path / "go.js").write_text("go();\n", encoding="utf-8")
+    plan_file = tmp_path / "plan.json"
+    plan_file.write_text(json.dumps({"chains": [
+        {"element": "flag", "on": "input", "events": [{"js_file": "go.js"}]}]}), encoding="utf-8")
+    sess = FakeSession(queue=[FakeResp(200, _form()), FakeResp(200, {})])
+    main.dispatch("form-set-element-chains", ["--id", "F1", "--plan-file", str(plan_file)],
+                  client_builder=_builder(sess))
+    assert _put_events(sess, "flag", "onInputEvents")[0]["config"]["code"] == "go();\n"
+
+
+def test_is_true_on_a_string_default_variable_is_reported_but_not_refused():
+    form = _form()
+    form["data"]["variables"].append({"name": "isPJ", "id": "var-pj", "defaultValue": "False"})
+    plan = {"chains": [{"element": "validate", "on": "click", "events": [
+        {"map": {"set": {"step-two.visible": True},
+                 "when": [{"variable": "isPJ", "op": "IS_TRUE"}]}}]}]}
+    sess = FakeSession(queue=[FakeResp(200, form)])
+    out = main.dispatch("form-set-element-chains",
+                        ["--id", "F1", "--plan", json.dumps(plan), "--dry-run"],
+                        client_builder=_builder(sess))
+    assert len(out["warnings"]) == 1 and "isPJ IS_TRUE" in out["warnings"][0]
+    # a variable without a string default raises nothing
+    plan["chains"][0]["events"][0]["map"]["when"] = [{"variable": "isPF", "op": "IS_TRUE"}]
+    sess = FakeSession(queue=[FakeResp(200, _form())])
+    out = main.dispatch("form-set-element-chains",
+                        ["--id", "F1", "--plan", json.dumps(plan), "--dry-run"],
+                        client_builder=_builder(sess))
+    assert "warnings" not in out

procesio_cli/tools/procesio/tests/test_form_code_actions.py

@@ -0,0 +1,188 @@
+"""form-get-code / form-set-code: surgical read-modify-write of Data.code.
+
+The invariant worth guarding is that restyling a form NEVER rewrites its content:
+the PUT body must carry the element tree, theme and data model through untouched,
+with `Data.code` the only changed field. A desired-state rebuild would silently
+drop hand-authored elements, which is exactly what these actions exist to avoid.
+"""
+from __future__ import annotations
+
+import pytest
+
+from tools.procesio import main
+from tools.procesio.client import ProcesioClient
+from tools.procesio.dto.form import code_cipher
+from tools.procesio.errors import NotPersisted, UsageError
+from tools.procesio.tests.conftest import FakeResp, FakeSession
+
+APIKEY = {"type": "apikey", "key": "N", "value": "V"}
+KEY = "test-passphrase"
+
+
+def _call(action, argv, session):
+    return main.dispatch(
+        action, argv,
+        client_builder=lambda prof: ProcesioClient(profile=APIKEY, name="t", session=session))
+
+
+@pytest.fixture(autouse=True)
+def _stub_key(monkeypatch):
+    monkeypatch.setattr("tools.procesio.handlers.form_code._code_key", lambda *_a, **_k: KEY)
+
+
+def _form(code: str = "") -> dict:
+    return {
+        "id": "F1", "name": "Some form", "isPrivate": False, "type": 1, "status": 1,
+        "state": True, "assignees": [], "customUrl": None,
+        "data": {"code": code, "elements": [{"id": "e1", "type": "input"}],
+                 "theme": [{"label": "Colors"}], "dataModel": {"id": "dm"},
+                 "browserTitle": "T"},
+    }
+
+
+def test_get_code_decrypts_and_writes_files(tmp_path):
+    blob = code_cipher.encrypt_code("var a=1;", ".x{color:red}", KEY)
+    s = FakeSession(queue=[FakeResp(200, _form(blob))])
+    css_out, js_out = tmp_path / "a.css", tmp_path / "a.js"
+    out = _call("form-get-code",
+                ["--id", "F1", "--css-out", str(css_out), "--js-out", str(js_out)], s)
+    assert out["css"] == ".x{color:red}" and out["javascript"] == "var a=1;"
+    assert css_out.read_text(encoding="utf-8") == ".x{color:red}"
+    assert js_out.read_text(encoding="utf-8") == "var a=1;"
+
+
+def test_get_code_on_empty_blob_is_not_an_error():
+    s = FakeSession(queue=[FakeResp(200, _form(""))])
+    out = _call("form-get-code", ["--id", "F1"], s)
+    assert out["css"] == "" and out["javascript"] == ""
+
+
+def test_null_css_and_js_are_treated_as_absent_not_as_an_error():
+    """A form that never used "Switch to code" carries {"JAVASCRIPT":null,"CSS":null} —
+    the designer's initial state, not a corrupt blob. Seen on a real 134-element form."""
+    import json as _json
+    from tools.procesio.dto.form import code_cipher as cc
+    nulls = _json.dumps({"JAVASCRIPT": None, "CSS": None}, separators=(",", ":"))
+    salt = b"\x00" * 8
+    k, iv = cc._evp_bytes_to_key(KEY.encode(), salt)
+    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+    import base64 as _b64
+    data = nulls.encode()
+    pad = 16 - (len(data) % 16)
+    enc = Cipher(algorithms.AES(k), modes.CBC(iv)).encryptor()
+    blob = _b64.b64encode(b"Salted__" + salt + enc.update(data + bytes([pad]) * pad)
+                          + enc.finalize()).decode()
+
+    s = FakeSession(queue=[FakeResp(200, _form(blob))])
+    out = _call("form-get-code", ["--id", "F1"], s)
+    assert out["css"] == "" and out["javascript"] == ""
+
+    # ...and setting only CSS over it must not blow up on the null JS side.
+    s = FakeSession(queue=[FakeResp(200, _form(blob)), FakeResp(200, {})])
+    out = _call("form-set-code", ["--id", "F1", "--css", ".x{}"], s)
+    assert out["updated"] is True and out["javascript_bytes"] == 0
+    assert cc.decrypt_code(s.calls[1]["json"]["Data"]["code"], KEY) == {
+        "JAVASCRIPT": "", "CSS": ".x{}"}
+
+
+def test_set_code_puts_full_dto_and_changes_only_code():
+    original = _form(code_cipher.encrypt_code("old();", ".old{}", KEY))
+    s = FakeSession(queue=[FakeResp(200, original), FakeResp(200, {})])
+    out = _call("form-set-code", ["--id", "F1", "--css", ".new{}", "--javascript", "neu();"], s)
+
+    assert s.calls[0]["method"] == "GET"
+    put = s.calls[1]
+    assert put["method"] == "PUT" and put["url"].endswith("/api/FormTemplate")
+    body = put["json"]
+    # PascalCase envelope, mapped from the camelCase GET.
+    assert body["Id"] == "F1" and body["Name"] == "Some form" and body["State"] is True
+    # Everything except `code` survives byte-identical.
+    assert body["Data"]["elements"] == original["data"]["elements"]
+    assert body["Data"]["theme"] == original["data"]["theme"]
+    assert body["Data"]["dataModel"] == original["data"]["dataModel"]
+    assert code_cipher.decrypt_code(body["Data"]["code"], KEY) == {
+        "JAVASCRIPT": "neu();", "CSS": ".new{}"}
+    # The overwritten code comes back, so the change is recoverable from the output.
+    assert out["previous"] == {"css": ".old{}", "javascript": "old();"}
+    assert out["updated"] is True
+
+
+def test_set_code_preserves_the_side_not_passed():
+    s = FakeSession(queue=[
+        FakeResp(200, _form(code_cipher.encrypt_code("keep();", ".keep{}", KEY))),
+        FakeResp(200, {})])
+    _call("form-set-code", ["--id", "F1", "--css", ".only-css{}"], s)
+    assert code_cipher.decrypt_code(s.calls[1]["json"]["Data"]["code"], KEY) == {
+        "JAVASCRIPT": "keep();", "CSS": ".only-css{}"}
+
+
+def test_set_code_dry_run_sends_no_write():
+    s = FakeSession(queue=[FakeResp(200, _form(""))])
+    out = _call("form-set-code", ["--id", "F1", "--css", ".x{}", "--dry-run"], s)
+    assert out["dry_run"] is True and len(s.calls) == 1
+    assert all(c["method"] == "GET" for c in s.calls)
+
+
+def test_set_code_reads_from_files(tmp_path):
+    css = tmp_path / "f.css"
+    css.write_text(".from-file{}", encoding="utf-8")
+    s = FakeSession(queue=[FakeResp(200, _form("")), FakeResp(200, {})])
+    _call("form-set-code", ["--id", "F1", "--css-file", str(css)], s)
+    assert code_cipher.decrypt_code(s.calls[1]["json"]["Data"]["code"], KEY)["CSS"] == ".from-file{}"
+
+
+def test_set_code_requires_something_to_set():
+    s = FakeSession(queue=[])
+    with pytest.raises(UsageError):
+        _call("form-set-code", ["--id", "F1"], s)
+
+
+def test_inline_and_file_for_the_same_side_is_rejected(tmp_path):
+    f = tmp_path / "f.css"
+    f.write_text("x", encoding="utf-8")
+    with pytest.raises(UsageError):
+        _call("form-set-code",
+              ["--id", "F1", "--css", ".a{}", "--css-file", str(f)], FakeSession(queue=[]))
+
+
+def test_wrong_key_fails_loudly_rather_than_overwriting():
+    s = FakeSession(queue=[FakeResp(200, _form(code_cipher.encrypt_code("j", "c", "OTHER-KEY")))])
+    with pytest.raises(UsageError, match="does not match"):
+        _call("form-set-code", ["--id", "F1", "--css", ".x{}"], s)
+    assert all(c["method"] == "GET" for c in s.calls)
+
+
+def test_put_keys_track_the_form_builder_top_level_shape():
+    """The surgical PUT rebuilds the FormTemplate DTO from _PUT_KEYS (all the surgical
+    handlers share this one list). If the form BUILDER ever grows a new top-level field,
+    a surgical write would silently drop it — so lock the two together: the builder's
+    top-level keys, minus Data, must be exactly _PUT_KEYS."""
+    import itertools
+    import json as _json
+
+    from tools.procesio.dto.form import builder as fb
+    from tools.procesio.handlers.form_code import _PUT_KEYS
+
+    cnt = itertools.count(1)
+    ctx = {"new_id": lambda: f"00000000-0000-0000-0000-{next(cnt):012d}"}
+    cfg = _json.loads((fb.DIR / "fixtures" / "reg.config.json").read_text(encoding="utf-8"))
+    dto = fb.build(cfg, ctx)
+    assert set(dto) - {"Data"} == set(_PUT_KEYS)
+
+
+def test_set_code_reads_back_and_reports_verified():
+    sent = code_cipher.encrypt_code("new();", ".new{}", KEY)
+    s = FakeSession(queue=[FakeResp(200, _form("")), FakeResp(200, {}), FakeResp(200, _form(sent))])
+    out = _call("form-set-code", ["--id", "F1", "--css", ".new{}", "--javascript", "new();"], s)
+    assert out["updated"] is True and out["verified"] is True
+
+
+def test_set_code_fails_when_the_server_keeps_the_previous_code():
+    # PROCESIO has answered 2xx while dropping the form's Data, leaving the old code in place
+    old = code_cipher.encrypt_code("old();", ".old{}", KEY)
+    big_js = "new();"
+    s = FakeSession(queue=[FakeResp(200, _form(old)), FakeResp(200, {}), FakeResp(200, _form(old))])
+    with pytest.raises(NotPersisted) as e:
+        _call("form-set-code", ["--id", "F1", "--javascript", big_js], s)
+    assert e.value.details["kept_previous"] is True
+    assert "PREVIOUS code" in str(e.value)

procesio_cli/tools/procesio/tests/test_form_code_keys.py

@@ -0,0 +1,92 @@
+"""form-code-key per environment: one key per installation, never borrowed.
+
+The platform encrypts a form's Data.code with a key that is the same on every workspace
+of an installation and not guaranteed to match on another. A blob written with the
+wrong installation's key is one the renderer cannot open, so the form goes blank. These
+pin the lookup: the environment's own key first, the legacy bare key only for the
+default environment, and otherwise an error that names the secret to store.
+"""
+from __future__ import annotations
+
+import pytest
+
+from tools.procesio import form_code_keys
+from tools.procesio.dto.form import builder as fb
+from tools.procesio.dto.form import code_cipher
+from tools.procesio.errors import UsageError
+from tools.procesio.handlers import form_code
+
+
+@pytest.fixture
+def store(monkeypatch):
+    """A fake Credential Manager for the procesio tool, with Internal-PROD as default."""
+    secrets: dict[str, str] = {}
+    monkeypatch.setattr("tools._lib.creds.get_optional",
+                        lambda tool, name: secrets.get(name) if tool == "procesio" else None)
+    monkeypatch.setattr("tools.procesio.environments.get_default", lambda: "Internal-PROD")
+    known = {"internal-prod": "Internal-PROD", "internal-qa": "Internal-QA"}
+    monkeypatch.setattr("tools.procesio.environments.canonical_name",
+                        lambda name: known.get(str(name).lower()))
+    return secrets
+
+
+class _Client:
+    def __init__(self, env_name):
+        self.env = {"name": env_name}
+
+
+def test_secret_name_carries_the_environment():
+    assert form_code_keys.secret_name("Internal-QA") == "form-code-key@Internal-QA"
+
+
+def test_the_default_environment_still_reads_the_legacy_key(store):
+    store["form-code-key"] = "L"
+    assert form_code_keys.key_for(None) == "L"
+    assert form_code_keys.key_for("Internal-PROD") == "L"
+    assert form_code_keys.key_for("internal-prod") == "L"     # names are canonicalised
+
+
+def test_an_environment_key_wins_over_the_legacy_one(store):
+    store["form-code-key"] = "L"
+    store["form-code-key@Internal-PROD"] = "P"
+    assert form_code_keys.key_for("Internal-PROD") == "P"
+
+
+def test_another_environment_uses_its_own_key(store):
+    store["form-code-key"] = "L"
+    store["form-code-key@Internal-QA"] = "Q"
+    assert form_code_keys.key_for("Internal-QA") == "Q"
+
+
+def test_another_environment_never_borrows_the_default_key(store):
+    """The one rule that keeps a form from going blank: no silent fallback."""
+    store["form-code-key"] = "L"
+    with pytest.raises(UsageError) as e:
+        form_code_keys.key_for("Internal-QA")
+    message = str(e.value)
+    assert "set-credential.py procesio form-code-key@Internal-QA" in message
+    assert "never used for another installation" in message
+
+
+def test_form_get_and_set_code_use_the_clients_environment(store):
+    store["form-code-key"] = "L"
+    store["form-code-key@Internal-QA"] = "Q"
+    assert form_code._code_key(_Client("Internal-QA")) == "Q"
+    assert form_code._code_key(_Client("Internal-PROD")) == "L"
+
+
+def test_form_create_encrypts_with_the_environments_key(store):
+    store["form-code-key@Internal-QA"] = "Q"
+    blob = fb._build_code({"css": "a{color:red}"}, {"form_code_env": "Internal-QA"})
+    assert code_cipher.decrypt_code(blob, "Q")["CSS"] == "a{color:red}"
+
+
+def test_form_create_refuses_to_encrypt_with_another_installations_key(store):
+    store["form-code-key"] = "L"
+    with pytest.raises(UsageError):
+        fb._build_code({"css": "a{}"}, {"form_code_env": "Internal-QA"})
+
+
+def test_the_form_context_records_the_environment():
+    ctx = fb._prepare_ctx(_Client("Internal-QA"), {"name": "F", "elements": []})
+    assert ctx == {"form_code_env": "Internal-QA"}