Complete runtime resilience and audit controls

test/Integration.hs

@@ -11,7 +11,12 @@ import           Data.List (sort)
 import           Data.Text (Text)
 import qualified Data.Text.Encoding as TE
 import           Database.PostgreSQL.Simple (Only (..))
-import           Nuthatch.Config (Config (..), loadConfig)
+import           Nuthatch.Config
+  ( Config (..)
+  , loadConfig
+  , revealSecret
+  , secret
+  )
 import           Nuthatch.Db
   ( Db
   , configurePoolLimit
@@ -356,7 +361,9 @@ verifyStorage config store = do
   missing <- getObjectBytes store (ObjectKey "shared/missing")
   assertEqual "typed not-found error" (Left S3NotFound) missing
   deniedStore <- newS3 config
-    { cfgS3SecretKey = cfgS3SecretKey config <> "-invalid" }
+    { cfgS3SecretKey =
+        secret (revealSecret (cfgS3SecretKey config) <> "-invalid")
+    }
   denied <- listObjects deniedStore "" Nothing Nothing 1
   case denied of
     Left (S3ServiceError code) ->