feat: add auth admin mutations

tests/wf_cli/test_auth_admin.py

@@ -1,11 +1,17 @@
 from __future__ import annotations
 
+import json
+
 from typer.testing import CliRunner
 
 from wf_cli.app import app
 
 
 class FakeAdmin:
+    def __init__(self) -> None:
+        self._saved: dict[str, dict] = {}
+        self._deleted: list[str] = []
+
     async def list_auth_records(self):
         return {
             "auth_records": [
@@ -27,9 +33,28 @@ class FakeAdmin:
             "payload_keys": ["token"],
         }
 
+    async def save_auth_record(self, *, auth_ref, scheme, payload, metadata=None):
+        self._saved[auth_ref] = {
+            "auth_ref": auth_ref,
+            "scheme": scheme,
+            "payload": payload,
+            "metadata": metadata,
+        }
+        return {
+            "id": auth_ref,
+            "scheme": scheme,
+            "metadata": metadata or {},
+            "payload_keys": sorted(str(key) for key in payload),
+        }
+
+    async def delete_auth_record(self, auth_ref):
+        self._deleted.append(auth_ref)
+        return {"deleted": True, "id": auth_ref}
+
 
 class FakeContext:
-    admin = FakeAdmin()
+    def __init__(self) -> None:
+        self.admin = FakeAdmin()
     verbose = False
 
 
@@ -58,3 +83,95 @@ def test_wf_admin_auth_inspect(monkeypatch) -> None:
     assert "github.work" in result.stdout
     assert "payload_keys" in result.stdout
     assert "secret" not in result.stdout
+
+
+def test_wf_admin_auth_save(monkeypatch) -> None:
+    fake_ctx = FakeContext()
+    monkeypatch.setattr(
+        "wf_cli.commands.auth_admin.load_cli_context_from_typer",
+        lambda ctx: fake_ctx,
+    )
+
+    result = CliRunner().invoke(
+        app,
+        [
+            "admin",
+            "auth",
+            "save",
+            "drive.work",
+            "--scheme",
+            "bearer",
+            "--payload",
+            '{"token":"secret"}',
+        ],
+    )
+
+    assert result.exit_code == 0
+    payload = json.loads(result.stdout)
+    assert payload["id"] == "drive.work"
+    assert payload["payload_keys"] == ["token"]
+    assert "secret" not in result.stdout
+    assert fake_ctx.admin._saved["drive.work"] == {
+        "auth_ref": "drive.work",
+        "scheme": "bearer",
+        "payload": {"token": "secret"},
+        "metadata": None,
+    }
+
+
+def test_wf_admin_auth_save_reads_payload_file(tmp_path, monkeypatch) -> None:
+    fake_ctx = FakeContext()
+    payload_file = tmp_path / "auth.json"
+    payload_file.write_text('{"token":"secret"}', encoding="utf-8")
+    monkeypatch.setattr(
+        "wf_cli.commands.auth_admin.load_cli_context_from_typer",
+        lambda ctx: fake_ctx,
+    )
+
+    result = CliRunner().invoke(
+        app,
+        [
+            "admin",
+            "auth",
+            "save",
+            "drive.work",
+            "--scheme",
+            "bearer",
+            "--payload-file",
+            str(payload_file),
+        ],
+    )
+
+    assert result.exit_code == 0
+    assert fake_ctx.admin._saved["drive.work"]["payload"] == {"token": "secret"}
+
+
+def test_wf_admin_auth_delete_requires_confirm(monkeypatch) -> None:
+    fake_ctx = FakeContext()
+    monkeypatch.setattr(
+        "wf_cli.commands.auth_admin.load_cli_context_from_typer",
+        lambda ctx: fake_ctx,
+    )
+
+    result = CliRunner().invoke(app, ["admin", "auth", "delete", "drive.work"])
+
+    assert result.exit_code != 0
+    assert "confirm" in (result.stdout + result.output).lower()
+    assert fake_ctx.admin._deleted == []
+
+
+def test_wf_admin_auth_delete(monkeypatch) -> None:
+    fake_ctx = FakeContext()
+    monkeypatch.setattr(
+        "wf_cli.commands.auth_admin.load_cli_context_from_typer",
+        lambda ctx: fake_ctx,
+    )
+
+    result = CliRunner().invoke(
+        app,
+        ["admin", "auth", "delete", "drive.work", "--confirm"],
+    )
+
+    assert result.exit_code == 0
+    assert json.loads(result.stdout) == {"deleted": True, "id": "drive.work"}
+    assert fake_ctx.admin._deleted == ["drive.work"]