Hide physical keepass paths in token and approval UX

internal/api/server_test.go

@@ -396,6 +396,58 @@ func TestVaultServiceFindsBrowserLoginsRechecksChildPoliciesAfterPrompt(t *testi
 	}
 }
 
+func TestVaultServiceApprovalRequestsUseLogicalRootPathForPhysicalVault(t *testing.T) {
+	t.Parallel()
+
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{
+				ID:       "codex-nextcloud",
+				Title:    "Nextcloud (codex)",
+				Username: "jjulian",
+				Password: "secret-1",
+				URL:      "https://nextcloud.example.invalid",
+				Path:     []string{"keepass", "Joe", "codex"},
+			},
+			testAPITokenEntry(t),
+		},
+		Groups: [][]string{
+			{"keepass"},
+			{"keepass", "Joe"},
+			{"keepass", "Joe", "codex"},
+		},
+	}
+	client, _, service, cleanup := newTestHarnessForModel(t, model)
+	defer cleanup()
+	service.approvals = apiapproval.NewBroker(time.Minute)
+
+	respCh := make(chan *keepassgov1.ListEntriesResponse, 1)
+	errCh := make(chan error, 1)
+	go func() {
+		resp, err := client.ListEntries(tokenContext(defaultTestTokenSecret), &keepassgov1.ListEntriesRequest{
+			Path: []string{"Joe", "codex"},
+		})
+		respCh <- resp
+		errCh <- err
+	}()
+
+	pending := waitForServerPendingApproval(t, service, 1)[0]
+	if got := pending.Resource.Path; !slices.Equal(got, []string{"Root", "Joe", "codex"}) {
+		t.Fatalf("pending.Resource.Path = %v, want [Root Joe codex]", got)
+	}
+	if _, _, err := service.ResolveApproval(pending.ID, apiapproval.OutcomeAllowOnce); err != nil {
+		t.Fatalf("ResolveApproval(allow once) error = %v", err)
+	}
+
+	if err := <-errCh; err != nil {
+		t.Fatalf("ListEntries() error = %v", err)
+	}
+	resp := <-respCh
+	if len(resp.GetEntries()) != 1 || resp.GetEntries()[0].GetId() != "codex-nextcloud" {
+		t.Fatalf("ListEntries().Entries = %#v, want codex-nextcloud after approval", resp.GetEntries())
+	}
+}
+
 func TestVaultServiceDoesNotMatchSpecificBrowserEntryToParentDomain(t *testing.T) {
 	t.Parallel()