feat: complete Epic 1 production foundation

apps/admin-api/tests/config_startup.rs

@@ -1,12 +1,20 @@
 use std::process::Command;
 
+use crank_registry::{MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresRegistry};
+use crank_runtime::SecretCrypto;
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+
+const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
+const REGISTERED_MASTER_KEY: &str = "registered-master-key-CANARY_SECRET_VALUE-00000000";
+const WRONG_MASTER_KEY: &str = "wrong-master-key-CANARY_SECRET_VALUE-0000000000000";
+
 fn run_with(entries: &[(&str, &str)]) -> String {
     let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
     for field in crank_config::field_registry() {
         command.env_remove(field.env_name);
     }
     command.envs([
-        ("CRANK_MASTER_KEY", "master"),
+        ("CRANK_MASTER_KEY", TEST_MASTER_KEY),
         ("CRANK_SESSION_SECRET", "session"),
         ("CRANK_PASSWORD_PEPPER", "pepper"),
         ("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
@@ -69,3 +77,92 @@ async fn fresh_database_startup_is_read_only() {
     .unwrap();
     assert!(!present);
 }
+
+#[tokio::test]
+async fn master_key_mismatch_blocks_startup_with_safe_diagnostic() {
+    let database_url = crank_test_support::postgres_schema_url("admin_master_key_mismatch").await;
+    let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
+        .arg("apply")
+        .env("CRANK_DATABASE_URL", &database_url)
+        .output()
+        .expect("migration command executes");
+    assert!(
+        applied.status.success(),
+        "{}",
+        String::from_utf8_lossy(&applied.stderr)
+    );
+    let registry = PostgresRegistry::connect(&database_url).await.unwrap();
+    let crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
+    registry
+        .verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
+            epoch: 1,
+            fingerprint: crypto.master_key_fingerprint(),
+            cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
+            observed_at: &OffsetDateTime::parse("2026-08-21T00:00:00Z", &Rfc3339).unwrap(),
+        })
+        .await
+        .unwrap();
+
+    let stderr = run_with(&[
+        ("CRANK_DATABASE_URL", &database_url),
+        ("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
+    ]);
+    assert!(stderr.contains("master_key_identity_mismatch"), "{stderr}");
+    assert!(!stderr.contains("registered-master-key"));
+    assert!(!stderr.contains("wrong-master-key"));
+}
+
+#[tokio::test]
+async fn populated_database_without_identity_rejects_wrong_first_key() {
+    let database_url =
+        crank_test_support::postgres_schema_url("admin_master_key_first_registration_wrong").await;
+    let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
+        .arg("apply")
+        .env("CRANK_DATABASE_URL", &database_url)
+        .output()
+        .expect("migration command executes");
+    assert!(
+        applied.status.success(),
+        "{}",
+        String::from_utf8_lossy(&applied.stderr)
+    );
+    let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
+    let old_crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
+    let ciphertext = old_crypto
+        .encrypt(&serde_json::json!({"token": "CANARY_SECRET_VALUE"}))
+        .unwrap();
+    sqlx::query(
+        "insert into secrets (
+            id, workspace_id, name, kind, status, current_version, created_at, updated_at
+         ) values (
+            'legacy_secret', 'ws_default', 'legacy secret', 'token', 'active', 1, now(), now()
+         )",
+    )
+    .execute(&pool)
+    .await
+    .unwrap();
+    sqlx::query(
+        "insert into secret_versions (
+            secret_id, version, ciphertext, key_version, master_key_epoch, created_at, created_by
+         ) values (
+            'legacy_secret', 1, $1, $2, 1, now(), null
+         )",
+    )
+    .bind(ciphertext)
+    .bind(old_crypto.key_version())
+    .execute(&pool)
+    .await
+    .unwrap();
+
+    let stderr = run_with(&[
+        ("CRANK_DATABASE_URL", &database_url),
+        ("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
+    ]);
+    assert!(stderr.contains("startup_failed"), "{stderr}");
+    assert!(!stderr.contains("CANARY_SECRET_VALUE"));
+    let identities: i64 = sqlx::query_scalar("select count(*) from master_key_identities")
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+    assert_eq!(identities, 0);
+}