From db19ca872969d92f6d878a26ddb6c75b7c0c15c7 Mon Sep 17 00:00:00 2001
From: All Asmaul Husnain <2263081025@uttarauniversity.edu.bd>
Date: Sat, 24 Oct 2026 14:56:28 +0600
Subject: [PATCH] test: cover secret owner isolation across all operations

---
 tests/test_secrets.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/test_secrets.py b/tests/test_secrets.py
index dd6ce5e..c0511f8 100644
--- a/tests/test_secrets.py
+++ b/tests/test_secrets.py
@@ -50,10 +50,32 @@ def test_secret_lifecycle_and_user_isolation() -> None:
         assert listed.headers["cache-control"] == "no-store"
         assert [item["id"] for item in listed.json()] == [secret_id]
 
+        # A different user must not discover, read, modify, or delete this secret.
+        other_listed = client.get("/secrets", headers=other_headers)
+        assert other_listed.status_code == 200
+        assert other_listed.headers["cache-control"] == "no-store"
+        assert other_listed.json() == []
+
         other_access = client.get(f"/secrets/{secret_id}", headers=other_headers)
         assert other_access.status_code == 404
         assert other_access.headers["cache-control"] == "no-store"
 
+        other_update = client.patch(
+            f"/secrets/{secret_id}",
+            headers=other_headers,
+            json={"name": "stolen", "value": "stolen-secret"},
+        )
+        assert other_update.status_code == 404
+        assert other_update.headers["cache-control"] == "no-store"
+
+        other_delete = client.delete(f"/secrets/{secret_id}", headers=other_headers)
+        assert other_delete.status_code == 404
+        assert other_delete.headers["cache-control"] == "no-store"
+
+        still_owned = client.get(f"/secrets/{secret_id}", headers=owner_headers)
+        assert still_owned.status_code == 200
+        assert still_owned.json()["value"] == "initial-secret"
+
         updated = client.patch(
             f"/secrets/{secret_id}",
             headers=owner_headers,