From bd42aa59348bac381e1783356cef28bb09710353 Mon Sep 17 00:00:00 2001
From: mptyl <mp@tylconsulting.it>
Date: Fri, 14 Aug 2026 18:05:28 +0200
Subject: [PATCH] test: verify read-only workspace secret flow

---
 backend/test/config.test.ts              | 4 ++--
 backend/test/workspaces-schema.test.ts   | 2 +-
 scripts/verify-workspace-install-docs.sh | 5 +++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/backend/test/config.test.ts b/backend/test/config.test.ts
index 52f4488d..284ca5f7 100644
--- a/backend/test/config.test.ts
+++ b/backend/test/config.test.ts
@@ -34,9 +34,9 @@ test("loadConfig keeps local development defaults", () => {
     workspaceRegistry: {
       root: "/data/workspace-registry",
       branch: "main",
-      maxImportBytes: 10 * 1024 * 1024,
-      maxImportEntries: 32,
     },
+    workspaceSecretStoreRoot: "/data/workspace-secrets",
+    workspaceSecretRuntimeRoot: "/tmp/thothii-workspace-secrets",
     internalQdrantUrl: "http://qdrant:6333",
     internalEmbeddingUrl: "http://embedding:11434",
     internalEmbeddingModel: "qwen3-embedding:0.6b",
diff --git a/backend/test/workspaces-schema.test.ts b/backend/test/workspaces-schema.test.ts
index 6dff5f87..3e93669e 100644
--- a/backend/test/workspaces-schema.test.ts
+++ b/backend/test/workspaces-schema.test.ts
@@ -238,7 +238,7 @@ test("constructs diagnostic URLs only when the resolved URL remains on the servi
 
   expect(resolveDiagnosticUrl).toBeTypeOf("function");
   expect((resolveDiagnosticUrl as (baseUrl: string, path: string) => URL)("https://service.example/base", "/rpc/ping"))
-    .toMatchObject({ href: "https://service.example/rpc/ping" });
+    .toMatchObject({ href: "https://service.example/base/rpc/ping" });
   expect(() => (resolveDiagnosticUrl as (baseUrl: string, path: string) => URL)(
     "https://service.example/base", "//diagnostic.invalid/rpc",
   )).toThrow(/origin/i);
diff --git a/scripts/verify-workspace-install-docs.sh b/scripts/verify-workspace-install-docs.sh
index 15b8765f..34935cef 100755
--- a/scripts/verify-workspace-install-docs.sh
+++ b/scripts/verify-workspace-install-docs.sh
@@ -1766,8 +1766,13 @@ if not any(mount.get("source") == "workspace-secrets" and mount.get("target") ==
 checked = [
     root / "docs/install/local-workspace-registry.md",
     root / "docs/install/server-workspace-registry.md",
+    root / "docs/install/local.md",
+    root / "docs/install/server.md",
+    root / "docs/install/psd-workspace-setup.md",
     root / "docs/guida-utente.md",
     root / "deploy/workspace-registry.env.example",
+    root / "deploy/env/local.env.example",
+    root / "deploy/env/server.env.example",
     root / "deploy/psd/operator.env.example",
     root / "docs/install/examples/thothii-installation.local.yaml",
     root / "docs/install/examples/thothii-installation.server.yaml",