Add resource secret epoch metadata

crates/geth/tests/bootstrap.rs

@@ -609,6 +609,64 @@ fn document_create_and_status_use_local_store() {
     );
 }
 
+#[test]
+fn secret_create_rotate_and_status_track_resource_epochs() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+
+    let first = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::SecretCreate {
+            resource: "resource:cas:local".to_owned(),
+        },
+    )
+    .expect("create secret");
+    match first {
+        geth_control::ControlResponse::SecretCreated { secret } => {
+            assert_eq!(secret.resource.to_string(), "resource:cas:local");
+            assert_eq!(secret.epoch, 1);
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let second = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::SecretRotate {
+            resource: "resource:cas:local".to_owned(),
+        },
+    )
+    .expect("rotate secret");
+    match second {
+        geth_control::ControlResponse::SecretCreated { secret } => {
+            assert_eq!(secret.resource.to_string(), "resource:cas:local");
+            assert_eq!(secret.epoch, 2);
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let status = geth_node::handle_request(&node, geth_control::ControlRequest::SecretStatus)
+        .expect("secret status");
+    match status {
+        geth_control::ControlResponse::SecretStatus { secrets } => {
+            assert_eq!(secrets.len(), 2);
+            assert_eq!(secrets[0].epoch, 1);
+            assert_eq!(secrets[1].epoch, 2);
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    assert!(
+        geth_node::handle_request(
+            &node,
+            geth_control::ControlRequest::SecretCreate {
+                resource: "resource:missing".to_owned(),
+            },
+        )
+        .is_err()
+    );
+}
+
 #[test]
 fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
     let home = tempfile::tempdir().expect("tempdir");