feat: harden release signing and coverage gate

tests/config-store.test.mjs

@@ -165,3 +165,91 @@ test("profile, review and operation lookups return safe empty values", async (t)
   await store.deleteInventoryReviewDecision("missing", "workload");
   await store.deleteDeploymentProfile("missing/repo", "profile");
 });
+
+test("session credentials preserve, replace and clear safely when OS encryption is unavailable", async (t) => {
+  const { store } = await storeFixture(t);
+  assert.deepEqual(store.setToken(" session-token "), { persistent: false, preserved: false });
+  assert.equal(store.getToken(), "session-token");
+  assert.deepEqual(store.setToken("", { preserveExisting: true }), { persistent: false, preserved: true });
+  assert.equal(store.getToken(), "session-token");
+  assert.deepEqual(store.setToken("replacement"), { persistent: false, preserved: false });
+  assert.equal(store.getToken(), "replacement");
+  assert.deepEqual(store.setToken(""), { persistent: true, preserved: false });
+  assert.equal(store.getToken(), "");
+  assert.throws(() => store.encryptSecret("password"), (error) => error.code === "SECURE_STORAGE_UNAVAILABLE");
+  assert.equal(store.encryptSecret(""), null);
+  assert.equal(store.decryptSecret(null), "");
+  assert.equal(store.decryptSecret("not-base64-encrypted-data"), "");
+});
+
+test("setup, Gitea updates and generic patches retain normalized public state", async (t) => {
+  const { store } = await storeFixture(t);
+  const completed = await store.completeSetup({
+    baseUrl: "https://gitea.test", token: "token", user: { login: "jens" },
+    workspaceRoots: [" C:/Projects ", "C:/Projects", ""]
+  });
+  assert.equal(completed.state.setupComplete, true);
+  assert.equal(completed.state.gitea.hasToken, true);
+  assert.deepEqual(completed.state.workspaceRoots, ["C:/Projects"]);
+  const update = await store.updateGitea({ baseUrl: "https://new.test", token: "", user: null });
+  assert.equal(update.preserved, true);
+  assert.equal(store.data.gitea.user.login, "jens");
+  const patched = await store.patch({ appearance: "light", workspaceRoots: ["D:/Code", "D:/Code"] });
+  assert.equal(patched.appearance, "light");
+  assert.deepEqual(patched.workspaceRoots, ["D:/Code"]);
+  assert.equal("encryptedToken" in patched.gitea, false);
+});
+
+test("server saves reject absent credentials before mutating configuration", async (t) => {
+  const { store } = await storeFixture(t);
+  await assert.rejects(
+    store.saveServer({ host: "unraid", username: "root", authType: "password", basePath: "/mnt/apps" }),
+    /password is required/i
+  );
+  await assert.rejects(
+    store.saveServer({ host: "unraid", username: "root", authType: "privateKey", basePath: "/mnt/apps", privateKeyPath: "" }),
+    /select a private key/i
+  );
+  assert.deepEqual(store.data.servers, []);
+});
+
+test("deployment profile normalization covers safe defaults and every optional Unraid control", async (t) => {
+  const { store } = await storeFixture(t);
+  const actions = store.normalizeDeploymentProfile({ environment: "qa", statusUrl: "https://app.test/status" });
+  assert.equal(actions.provider, "gitea-actions");
+  assert.equal(actions.name, "qa");
+  assert.equal(actions.branch, "main");
+  assert.equal(actions.workflowFile, "deploy.yml");
+  assert.equal(actions.rollbackWorkflowFile, "");
+  assert.equal(actions.confirmationRequired, true);
+
+  const unraid = store.normalizeDeploymentProfile({
+    id: "all-options", name: " Server ", environment: "production", provider: "ssh-unraid", branch: "release",
+    serverId: " server ", remoteFolder: "apps/App", deploymentMode: "monitor-only", generatedCompose: true,
+    composeFiles: [], composeServices: ["WEB", "Worker"], composeProject: "App.prod", composeWorkingDir: "/mnt/apps/App",
+    containerName: "Visible.App", cloneUrl: "https://gitea.test/Owner/App.git", alignRemote: true,
+    hostPort: -2, containerPort: 70000, webUiUrl: "http://[IP]:[PORT:3000]/", iconMode: "upload",
+    iconFilePath: "C:/icon.png", dockerShell: "/bin/bash", preservePaths: [], adoptedFromServer: true,
+    serverSourceOfTruth: true, manageDockerMan: true, forceRecreate: true, removeOrphans: true,
+    workloadIdentity: { workloadId: "one" }, serverGitAccess: { configured: true, deployKeyId: "invalid", keyFingerprint: "", hostFingerprint: "", configuredAt: "now" },
+    provenance: { remoteFolder: "server" }, detectedMetadata: { source: "docker" }, serverIconReference: " icon ",
+    deploymentPolicy: { frozen: true, freezeReason: " maintenance ", requireNote: true, maintenanceWindows: [{ days: [0, 0, 6, 7, "bad"], start: "01:00", end: "02:00" }] }
+  });
+  assert.equal(unraid.name, "Server");
+  assert.equal(unraid.serverId, "server");
+  assert.equal(unraid.composeFile, "docker-compose.yml");
+  assert.deepEqual(unraid.composeServices, ["web", "worker"]);
+  assert.equal(unraid.hostPort, 1);
+  assert.equal(unraid.containerPort, 65535);
+  assert.equal(unraid.iconMode, "upload");
+  assert.equal(unraid.dockerShell, "/bin/bash");
+  assert.equal(unraid.serverGitAccess.deployKeyId, null);
+  assert.equal(unraid.serverGitAccess.keyFingerprint, null);
+  assert.deepEqual(unraid.deploymentPolicy.maintenanceWindows[0].days, [0, 6]);
+  assert.equal(unraid.serverIconReference, "icon");
+
+  assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", composeService: "app", composeServices: ["bad service"] }), /Compose services/);
+  assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", composeProject: "bad project!" }), /Compose project/);
+  assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", composeWorkingDir: "relative" }), /working directory/);
+  assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", containerName: "bad name" }), /Container name/);
+});