---
id: w6/m4/t006
title: Integration test - full workspace teardown
worker: worker6
status: done
estimate: 45m
depends_on: [w6/m4/t005]
---

## Objective

Prove end to end that deleting a workspace tears down everything it owns: a managed Postgres database, a managed KeyValue store, and OpenBao secrets — extending the existing workspace lifecycle e2e test.

## Context

- `w6/m1` shipped `workspaces_e2e_test` (create/rename/delete, plan-limit refusals, FGA grant/revoke, App-CR teardown, non-admin 403) against real Postgres + real OpenFGA — this task extends that same test, not a new harness.
- Needs a real (or test-container) OpenBao instance for the secrets purge assertion, consistent with however `w6/m1`'s e2e test already sets up its dependencies.

## Steps

1. Extend the e2e test: after creating a workspace, provision a managed Postgres database, a managed KeyValue store, and at least one env var/secret for it.
2. Delete the workspace.
3. Assert: the `Database` CR is gone, the `KeyValue` CR is gone, and the OpenBao secret tree for that tenant is gone.
4. Assert `ownerId` scoping also works pre-delete: `ListPostgres`/`ListKeyValues` with the workspace's `ownerId` return the created resources.

## Files

- The existing `workspaces_e2e_test` file (or equivalent) from `w6/m1`.

## Acceptance criteria

- [ ] Test provisions a Database, KeyValue, and secret under a test workspace
- [ ] Test asserts all three are gone after workspace delete
- [ ] Test asserts `ownerId` list-filter correctness pre-delete
- [ ] Test passes against real Postgres + real OpenFGA + real (or test-container) OpenBao

## Out of scope

- New test infrastructure/harness — reuse what `w6/m1` already stood up.
