V6.1 continue beating on the backup

tests/ui/test_runtime_settings_store.py

@@ -8,6 +8,7 @@ import pytest
 
 from transcription.config import Settings
 from transcription.errors import AppError
+from transcription.ui import runtime_settings_store
 from transcription.ui.runtime_settings_store import HIDDEN_SETTINGS_CATEGORIES
 from transcription.ui.runtime_settings_store import RUNTIME_SETTINGS_CATALOG
 from transcription.ui.runtime_settings_store import SETTINGS_UI_EXCLUDED_FIELDS
@@ -35,6 +36,12 @@ def test_hidden_settings_categories_list_secret_and_high_risk_env_keys():
     assert "DATABASE__PASSWORD" in hidden_keys
     assert "DATABASE__DRIVER" in hidden_keys
     assert "DATABASE__HOST" in hidden_keys
+    assert "POSTGRES_DB" in hidden_keys
+    assert "POSTGRES_USER" in hidden_keys
+    assert "POSTGRES_PASSWORD" in hidden_keys
+    assert "CLOUDFLARE_TUNNEL_TOKEN" in hidden_keys
+    assert "BACKUP_DIR" in hidden_keys
+    assert "SYNOLOGY_BACKUP_DIR" in hidden_keys
 
 
 def test_runtime_settings_snapshot_includes_catalog_fields(tmp_path: Path):
@@ -98,3 +105,31 @@ def test_runtime_settings_uses_override_env_file(tmp_path: Path, monkeypatch):
 
     assert snapshot.env_file_path == target
     assert "PORT=9001" in target.read_text(encoding="utf-8")
+
+
+def test_save_runtime_settings_surfaces_unreadable_target(tmp_path: Path, monkeypatch):
+    settings = _settings_for_runtime_editing(tmp_path)
+    env_path = tmp_path / ".env"
+
+    def _raise_read_error(_self, encoding="utf-8"):
+        _ = encoding
+        raise OSError("denied")
+
+    monkeypatch.setattr(Path, "read_text", _raise_read_error)
+    with pytest.raises(AppError) as exc:
+        save_runtime_settings(settings=settings, updates={"port": "9001"}, env_file_path=env_path)
+    assert exc.value.message == "Runtime settings file is unreadable."
+
+
+def test_save_runtime_settings_surfaces_unwritable_target(tmp_path: Path, monkeypatch):
+    settings = _settings_for_runtime_editing(tmp_path)
+    env_path = tmp_path / ".env"
+
+    def _raise_write_error(*args, **kwargs):
+        _ = args, kwargs
+        raise OSError("denied")
+
+    monkeypatch.setattr(runtime_settings_store, "_write_env_lines_atomic", _raise_write_error)
+    with pytest.raises(AppError) as exc:
+        save_runtime_settings(settings=settings, updates={"port": "9001"}, env_file_path=env_path)
+    assert exc.value.message == "Runtime settings file is not writable."