From 5865c40d77379cceb08b76b07916e0c40f5b717a Mon Sep 17 00:00:00 2001
From: Brian Majewski <brian.majewski@gmail.com>
Date: Fri, 5 Jun 2026 09:52:51 -0700
Subject: [PATCH] test: coverage for store protections self-heal (hook on
 push/rekey, no-op, gitignore content)

---
 test/secrets.bats | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/test/secrets.bats b/test/secrets.bats
index ad77ac2..03c8138 100644
--- a/test/secrets.bats
+++ b/test/secrets.bats
@@ -1552,3 +1552,48 @@ gradle_project() {
   [ "$(cat .env)" = "SECRET_KEY=abc123" ]
   [ "$(cat .env.staging)" = "DB_HOST=staging.db.example.com" ]
 }
+
+@test "push reinstalls missing pre-commit hook" {
+  init_with_remote
+  rm "$SECRETS_DIR/.git/hooks/pre-commit"
+  create_project_dir
+
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  [ -x "$SECRETS_DIR/.git/hooks/pre-commit" ]
+}
+
+@test "rekey reinstalls missing pre-commit hook" {
+  init_with_remote
+  create_project_dir
+  "$SECRETS_BIN" push >/dev/null 2>&1
+  rm "$SECRETS_DIR/.git/hooks/pre-commit"
+
+  run "$SECRETS_BIN" rekey
+  [ "$status" -eq 0 ]
+  [ -x "$SECRETS_DIR/.git/hooks/pre-commit" ]
+}
+
+@test "store protections heal is a silent no-op when nothing is missing" {
+  init_with_remote
+  create_project_dir
+
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"Restored store .gitignore"* ]]
+  [[ "$output" != *"Reinstalled pre-commit hook"* ]]
+}
+
+@test "restored store .gitignore carries the full block/allow globs" {
+  init_with_remote
+  rm "$SECRETS_DIR/.gitignore"
+  create_project_dir
+  "$SECRETS_BIN" push >/dev/null 2>&1
+
+  grep -q "^key.txt$" "$SECRETS_DIR/.gitignore"
+  grep -qF '**/.env' "$SECRETS_DIR/.gitignore"
+  grep -qF '**/.dev.vars' "$SECRETS_DIR/.gitignore"
+  grep -qF '!**/.env.age' "$SECRETS_DIR/.gitignore"
+  grep -qF '!**/.env.*.age' "$SECRETS_DIR/.gitignore"
+  grep -qF '!**/.dev.vars.age' "$SECRETS_DIR/.gitignore"
+}