feat: secure organization Feishu credentials

hub/test/integration/deployment-preflight-cli.test.ts

@@ -13,6 +13,7 @@ import {
   TEST_SECRET_KEY_ID,
 } from "./helpers.js";
 import { ProviderConnectionService } from "../../src/connections/providerConnections.js";
+import { FeishuApplicationConnectionService } from "../../src/connections/feishuApplicationConnections.js";
 
 const execFileAsync = promisify(execFile);
 const TEST_DATABASE_URL = "postgresql://paradigm:paradigm@127.0.0.1:5432/cph_hub_test";
@@ -115,9 +116,12 @@ describe("deployment preflight CLI", () => {
     const result = await runCli(fixture.args);
 
     expect(result.exitCode).toBe(1);
-    expect(result.stderr).toContain("stored provider envelope verification failed");
+    expect(result.stderr).toContain("stored connection envelope verification failed");
+    expect(result.stderr).toContain("provider: secret envelope authentication failed");
+    expect(result.stderr).toContain("Feishu: secret envelope authentication failed");
     expect(result.stderr).toContain("secret envelope authentication failed");
     expect(result.stderr).not.toContain("stored-envelope-secret");
+    expect(result.stderr).not.toContain("stored-feishu-envelope-secret");
   });
 
   it("loads the actual Hub dependency graph and queries PostgreSQL in the runtime probe", async () => {
@@ -282,6 +286,13 @@ describe("deployment preflight CLI", () => {
       baseUrl: "https://provider.example/api",
       authToken: "stored-envelope-secret",
     });
+    await new FeishuApplicationConnectionService(prisma, testSecretEnvelope, async () => {}).rotateCustomerApplication({
+      organizationId: DEFAULT_ORG_ID,
+      actorUserId: "preflight-admin",
+      appId: "cli_preflight",
+      appSecret: "stored-feishu-envelope-secret",
+      botOpenId: "ou_preflight_bot",
+    });
   }
 });