test(cli): cover ssl-enforcement get and update (CLI-2270) (#6444)

## TL;DR
adds live e2e coverage for `ssl-enforcement get` and `update`, covering
the ssl-enforcement command family

## whats introduced?
- `ssl-enforcement get`: reads the target project's posture and proves
the json payload carries `currentConfig.database` and
`appliedSuccessfully`
- `ssl-enforcement update`: captures the current posture, toggles it,
proves the flip in its own output and through get, then restores the
captured posture in the same test


## ref:
- closes: CLI-2270

Author: 7ttp

apps/cli/src/legacy/commands/postgres-config/delete/delete.live.test.ts

@@ -1,7 +1,7 @@
 import { expect } from "vitest";
 
 import {
-  postgresConfigLiveFlags,
+  experimentalProjectLiveFlags,
   removePostgresConfigLiveOverride,
   requireLiveSuccess,
   test,
@@ -12,7 +12,7 @@ import {
 // assertion cannot be satisfied by the pre-seed state. Teardown removes the
 // seeded key only when the test did not already prove it gone.
 test("removes the test-seeded override and get proves it is gone", async ({ cli, project }) => {
-  const flags = postgresConfigLiveFlags(project);
+  const flags = experimentalProjectLiveFlags(project);
   let targetError: unknown;
   const cleanupErrors: Array<unknown> = [];
   let cleanupNeeded = true;

apps/cli/src/legacy/commands/postgres-config/get/get.live.test.ts

@@ -1,6 +1,6 @@
 import { expect } from "vitest";
 
-import { postgresConfigLiveFlags, test } from "../../../../../tests/helpers/live.ts";
+import { experimentalProjectLiveFlags, test } from "../../../../../tests/helpers/live.ts";
 
 // A freshly provisioned project can have zero overrides, so the golden path
 // pins the payload shape rather than any key: exit 0 and a JSON object on
@@ -9,7 +9,7 @@ test("reads the current config of the target project", async ({ cli, project })
   const result = await cli([
     "postgres-config",
     "get",
-    ...postgresConfigLiveFlags(project),
+    ...experimentalProjectLiveFlags(project),
     "-o",
     "json",
   ]);

apps/cli/src/legacy/commands/postgres-config/update/update.live.test.ts

@@ -1,7 +1,7 @@
 import { expect } from "vitest";
 
 import {
-  postgresConfigLiveFlags,
+  experimentalProjectLiveFlags,
   removePostgresConfigLiveOverride,
   requireLiveSuccess,
   test,
@@ -11,7 +11,7 @@ import {
 // --no-restart skips the database restart; work_mem is a dynamic parameter, so
 // the override still takes effect.
 test("applies an override with --no-restart and get proves it", async ({ cli, project }) => {
-  const flags = postgresConfigLiveFlags(project);
+  const flags = experimentalProjectLiveFlags(project);
   let targetError: unknown;
   const cleanupErrors: Array<unknown> = [];
   try {

apps/cli/src/legacy/commands/ssl-enforcement/get/get.live.test.ts

@@ -0,0 +1,19 @@
+import { expect } from "vitest";
+
+import { experimentalProjectLiveFlags, test } from "../../../../../tests/helpers/live.ts";
+
+test("reads the SSL enforcement posture of the target project", async ({ cli, project }) => {
+  const result = await cli([
+    "ssl-enforcement",
+    "get",
+    ...experimentalProjectLiveFlags(project),
+    "-o",
+    "json",
+  ]);
+  expect(result.exitCode, result.stderr).toBe(0);
+  expect(result.stdout, result.stderr).not.toBe("");
+  expect(JSON.parse(result.stdout), result.stdout).toMatchObject({
+    currentConfig: { database: expect.any(Boolean) },
+    appliedSuccessfully: expect.any(Boolean),
+  });
+});

apps/cli/src/legacy/commands/ssl-enforcement/update/update.live.test.ts

@@ -0,0 +1,115 @@
+import { Schema } from "effect";
+import { expect } from "vitest";
+
+import {
+  experimentalProjectLiveFlags,
+  type LiveFixtures,
+  requireLiveSuccess,
+  test,
+  throwWithCleanup,
+} from "../../../../../tests/helpers/live.ts";
+
+type LiveCli = LiveFixtures["cli"];
+
+// Bound the polled gets and the restore so one hung subprocess cannot exhaust
+// the live testTimeout and leave the shared project with a flipped posture.
+const POLL_ATTEMPT_EXIT_TIMEOUT_MS = 20_000;
+const RESTORE_EXIT_TIMEOUT_MS = 60_000;
+
+const SslEnforcementPosture = Schema.Struct({
+  currentConfig: Schema.Struct({ database: Schema.Boolean }),
+  appliedSuccessfully: Schema.Boolean,
+});
+
+function enforcementFlag(enforce: boolean): string {
+  return enforce ? "--enable-db-ssl-enforcement" : "--disable-db-ssl-enforcement";
+}
+
+async function readPosture(
+  cli: LiveCli,
+  flags: ReadonlyArray<string>,
+  label: string,
+  exitTimeoutMs?: number,
+): Promise<typeof SslEnforcementPosture.Type> {
+  const result = await cli(["ssl-enforcement", "get", ...flags, "-o", "json"], { exitTimeoutMs });
+  requireLiveSuccess(result, label);
+  expect(result.stdout, result.stderr).not.toBe("");
+  const payload: unknown = JSON.parse(result.stdout);
+  if (!Schema.is(SslEnforcementPosture)(payload)) {
+    throw new Error(`${label}: unexpected ssl-enforcement get payload\n${result.stdout}`);
+  }
+  return payload;
+}
+
+// get reports `appliedSuccessfully: false` while a requested posture has not
+// propagated yet (see ../get/SIDE_EFFECTS.md), so proving a toggle or a restore
+// means polling get until the requested value is reported as applied.
+function expectApplied(
+  cli: LiveCli,
+  flags: ReadonlyArray<string>,
+  enforce: boolean,
+  label: string,
+): Promise<void> {
+  return expect
+    .poll(() => readPosture(cli, flags, label, POLL_ATTEMPT_EXIT_TIMEOUT_MS), {
+      interval: 2_000,
+      timeout: 60_000,
+      message: label,
+    })
+    .toEqual({ currentConfig: { database: enforce }, appliedSuccessfully: true });
+}
+
+test("toggles enforcement, get proves it, and restores the captured posture", async ({
+  cli,
+  project,
+}) => {
+  const flags = experimentalProjectLiveFlags(project);
+  const posture = (
+    await readPosture(cli, flags, "ssl-enforcement get capture for ssl-enforcement update")
+  ).currentConfig.database;
+  let targetError: unknown;
+  const cleanupErrors: Array<unknown> = [];
+  try {
+    const updated = await cli([
+      "ssl-enforcement",
+      "update",
+      enforcementFlag(!posture),
+      ...flags,
+      "-o",
+      "json",
+    ]);
+    expect(updated.exitCode, updated.stderr).toBe(0);
+    expect(updated.stdout, updated.stderr).not.toBe("");
+    expect(JSON.parse(updated.stdout), updated.stdout).toMatchObject({
+      currentConfig: { database: !posture },
+    });
+
+    await expectApplied(
+      cli,
+      flags,
+      !posture,
+      "ssl-enforcement get proof for ssl-enforcement update",
+    );
+  } catch (error) {
+    targetError = error;
+  } finally {
+    try {
+      const restored = await cli(
+        ["ssl-enforcement", "update", enforcementFlag(posture), ...flags],
+        {
+          exitTimeoutMs: RESTORE_EXIT_TIMEOUT_MS,
+        },
+      );
+      requireLiveSuccess(restored, "ssl-enforcement update restore of the captured posture");
+      await expectApplied(
+        cli,
+        flags,
+        posture,
+        "ssl-enforcement get proof of the restored posture for ssl-enforcement update",
+      );
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+  }
+  throwWithCleanup(targetError, cleanupErrors);
+});

apps/cli/tests/helpers/live.ts

@@ -145,9 +145,9 @@ export async function removeStorageLiveObject(
   }
 }
 
-/** Flags every postgres-config live test passes: the family is
- * experimental-gated and addresses the shared project by ref. */
-export function postgresConfigLiveFlags(project: LiveProject): ReadonlyArray<string> {
+/** Flags for experimental-gated live tests that address the shared project by
+ * ref rather than linking it (contrast `storageLiveFlags`). */
+export function experimentalProjectLiveFlags(project: LiveProject): ReadonlyArray<string> {
   return ["--project-ref", project.ref, "--experimental"];
 }
 
@@ -166,7 +166,7 @@ export async function removePostgresConfigLiveOverride(
     "delete",
     "--config",
     key,
-    ...postgresConfigLiveFlags(project),
+    ...experimentalProjectLiveFlags(project),
     "--no-restart",
   ]);
   requireLiveSuccess(removed, `postgres-config delete cleanup for ${key}`);