feat(admin): add project metadata config

tests/unit/test_dynamic_manager.py

@@ -0,0 +1,12 @@
+from app.infra.db.dynamic_manager import ProjectConnectionManager
+
+
+def test_normalize_pg_url_preserves_password():
+    manager = ProjectConnectionManager()
+
+    url = manager._normalize_pg_url(
+        "postgresql://tjwater:secret@192.168.1.114:5433/tjwater"
+    )
+
+    assert url == "postgresql+psycopg://tjwater:secret@192.168.1.114:5433/tjwater"
+    assert "***" not in url

tests/unit/test_metadata_repository_dsn_decrypt.py

@@ -23,6 +23,11 @@ class _DummyEncryptor:
         self._raise_invalid_token = raise_invalid_token
         self.encrypted_values = []
 
+    def encrypt(self, value):
+        encrypted = f"encrypted::{value}"
+        self.encrypted_values.append(value)
+        return encrypted
+
     def decrypt(self, _value):
         if self._raise_invalid_token:
             raise InvalidToken()
@@ -117,3 +122,46 @@ def test_encrypted_dsn_decrypts_without_migration(monkeypatch):
 
     assert routing.dsn == "postgresql://u:p%40ss@host/db"
     session.commit.assert_not_awaited()
+
+
+def test_upsert_project_database_config_encrypts_plaintext_dsn(monkeypatch):
+    project_id = uuid4()
+    session = SimpleNamespace(
+        execute=None,
+        add=None,
+        commit=None,
+        refresh=None,
+    )
+    added = []
+    session.execute = AsyncMock(return_value=_DummyResult(None))
+    session.add = lambda item: added.append(item)
+    session.commit = AsyncMock()
+    session.refresh = AsyncMock()
+    encryptor = _DummyEncryptor()
+    repo = MetadataRepository(session)
+
+    monkeypatch.setattr(
+        "app.infra.db.metadb.repositories.metadata_repository.is_database_encryption_configured",
+        lambda: True,
+    )
+    monkeypatch.setattr(
+        "app.infra.db.metadb.repositories.metadata_repository.get_database_encryptor",
+        lambda: encryptor,
+    )
+
+    record = asyncio.run(
+        repo.upsert_project_database_config(
+            project_id,
+            db_role="biz_data",
+            db_type="postgresql",
+            dsn="postgresql://user:secret@localhost/db",
+            pool_min_size=1,
+            pool_max_size=5,
+        )
+    )
+
+    assert encryptor.encrypted_values == ["postgresql://user:secret@localhost/db"]
+    assert record.dsn_encrypted == "encrypted::postgresql://user:secret@localhost/db"
+    assert added == [record]
+    session.commit.assert_awaited_once()
+    session.refresh.assert_awaited_once_with(record)