Hide physical keepass paths in token and approval UX

internal/appui/main_test.go

@@ -9355,6 +9355,49 @@ func TestUIAPIPolicyTargetActionsUseCurrentContext(t *testing.T) {
 	}
 }
 
+func TestUIEditAPIPolicyRuleHidesPhysicalKeepassRoot(t *testing.T) {
+	t.Parallel()
+
+	token := apitokens.Token{
+		ID:   "token-1",
+		Name: "Crew Browser",
+		Policies: []apitokens.PolicyRule{{
+			Effect:    apitokens.EffectAllow,
+			Operation: apitokens.OperationListEntries,
+			Resource: apitokens.Resource{
+				Kind: apitokens.ResourceGroup,
+				Path: []string{"keepass", "Crew", "bashertarr"},
+			},
+		}},
+	}
+	u := newUIWithModel("desktop", vault.Model{
+		Entries: []vault.Entry{
+			token.Entry(apitokens.EntryPath),
+		},
+	})
+	u.showAPITokensSection()
+	u.state.SelectedEntryID = "token-1"
+
+	if err := u.editAPIPolicyRuleAction(0); err != nil {
+		t.Fatalf("editAPIPolicyRuleAction() error = %v", err)
+	}
+	if got := u.apiPolicyPath.Text(); got != "Root / Crew / bashertarr" {
+		t.Fatalf("apiPolicyPath.Text() = %q, want %q", got, "Root / Crew / bashertarr")
+	}
+}
+
+func TestUIAuditAndApprovalFormattingHidePhysicalKeepassRoot(t *testing.T) {
+	t.Parallel()
+
+	resource := apitokens.Resource{Kind: apitokens.ResourceGroup, Path: []string{"keepass", "Crew", "bashertarr"}}
+	if got := formatAuditResource(resource); got != "Root / Crew / bashertarr" {
+		t.Fatalf("formatAuditResource() = %q, want %q", got, "Root / Crew / bashertarr")
+	}
+	if got := approvalResourceText(apiapproval.Request{Resource: resource}); got != "Root / Crew / bashertarr" {
+		t.Fatalf("approvalResourceText() = %q, want %q", got, "Root / Crew / bashertarr")
+	}
+}
+
 func TestUIVisibleBreadcrumbsCompressesAggressivelyOnPhone(t *testing.T) {
 	t.Parallel()