test: add integration tests for group validation and edge cases

- 57: network mismatch rejection on group add
- 58: path traversal and invalid group name validation
- 59: delete --cascade/--ungroup mutual exclusion and --ungroup behavior

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Nomadic Labs

test/integration/cli-tester/tests/group/57-group-add-network-mismatch.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# Test: Adding a service to a group with a different network should fail
+set -euo pipefail
+source /tests/lib.sh
+
+test_init "Group add network mismatch"
+
+GROUP_NAME="test-netmismatch-$$"
+TEST_INSTANCE="test-netmis-node-$$"
+RPC_PORT=$(alloc_port)
+
+# Pre-cleanup
+om group delete "$GROUP_NAME" 2>/dev/null || true
+register_instance "$TEST_INSTANCE"
+
+# ── Create group on shadownet ──
+echo "Creating group '$GROUP_NAME' on shadownet..."
+om group create "$GROUP_NAME" \
+	--network shadownet \
+	--octez-version 24.1 \
+	--service-user tezos
+
+# ── Install a node on a DIFFERENT network ──
+echo "Installing node '$TEST_INSTANCE' on ghostnet..."
+om install-node \
+	--instance "$TEST_INSTANCE" \
+	--network ghostnet \
+	--snapshot \
+	--snapshot-no-check \
+	--snapshot-uri "$SANDBOX_URL/snapshot.rolling" \
+	--rpc-addr "127.0.0.1:$RPC_PORT" \
+	--service-user tezos \
+	--no-enable 2>&1 || true
+
+if ! instance_exists "$TEST_INSTANCE"; then
+	echo "ERROR: Node instance not created"
+	exit 1
+fi
+
+# ── Try to add mismatched service to group ──
+echo "Attempting to add ghostnet node to shadownet group (should fail)..."
+if om group add "$GROUP_NAME" --instance "$TEST_INSTANCE" 2>&1; then
+	echo "ERROR: group add should have failed due to network mismatch"
+	exit 1
+fi
+echo "Correctly rejected: network mismatch"
+
+# ── Cleanup ──
+om group delete "$GROUP_NAME" 2>/dev/null || true
+
+echo "Test passed"

test/integration/cli-tester/tests/group/58-group-name-validation.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Test: Group names with path traversal or invalid characters should be rejected
+set -euo pipefail
+source /tests/lib.sh
+
+test_init "Group name validation"
+
+# ── Path traversal attempts ──
+echo "Testing path traversal in group name..."
+if om group create "../evil" --network shadownet --octez-version 24.1 --service-user tezos 2>&1; then
+	echo "ERROR: Should have rejected '../evil'"
+	om group delete "../evil" 2>/dev/null || true
+	exit 1
+fi
+echo "Correctly rejected: ../evil"
+
+if om group create "foo/bar" --network shadownet --octez-version 24.1 --service-user tezos 2>&1; then
+	echo "ERROR: Should have rejected 'foo/bar'"
+	om group delete "foo/bar" 2>/dev/null || true
+	exit 1
+fi
+echo "Correctly rejected: foo/bar"
+
+# ── Empty name ──
+if om group create "" --network shadownet --octez-version 24.1 --service-user tezos 2>&1; then
+	echo "ERROR: Should have rejected empty name"
+	exit 1
+fi
+echo "Correctly rejected: empty name"
+
+# ── Valid names should work ──
+VALID_NAME="test-valid-name_123-$$"
+om group create "$VALID_NAME" --network shadownet --octez-version 24.1 --service-user tezos
+echo "Accepted valid name: $VALID_NAME"
+
+# Cleanup
+om group delete "$VALID_NAME" 2>/dev/null || true
+
+echo "Test passed"

test/integration/cli-tester/tests/group/59-group-delete-cascade-ungroup.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# Test: Group delete with --cascade and --ungroup flags, and mutual exclusion
+set -euo pipefail
+source /tests/lib.sh
+
+test_init "Group delete cascade and ungroup"
+
+GROUP_NAME="test-cascade-$$"
+TEST_INSTANCE="test-casc-node-$$"
+RPC_PORT=$(alloc_port)
+
+# Pre-cleanup
+om group delete "$GROUP_NAME" 2>/dev/null || true
+register_instance "$TEST_INSTANCE"
+
+# ── Create group and install a service ──
+echo "Creating group '$GROUP_NAME'..."
+om group create "$GROUP_NAME" \
+	--network shadownet \
+	--octez-version 24.1 \
+	--service-user tezos
+
+echo "Installing node '$TEST_INSTANCE'..."
+om install-node \
+	--instance "$TEST_INSTANCE" \
+	--network shadownet \
+	--snapshot \
+	--snapshot-no-check \
+	--snapshot-uri "$SANDBOX_URL/snapshot.rolling" \
+	--rpc-addr "127.0.0.1:$RPC_PORT" \
+	--service-user tezos \
+	--no-enable 2>&1 || true
+
+om group add "$GROUP_NAME" --instance "$TEST_INSTANCE"
+
+# ── Mutual exclusion: --cascade and --ungroup together should fail ──
+echo "Testing --cascade --ungroup mutual exclusion..."
+if om group delete "$GROUP_NAME" --cascade --ungroup 2>&1; then
+	echo "ERROR: Should have rejected --cascade --ungroup together"
+	exit 1
+fi
+echo "Correctly rejected: --cascade --ungroup together"
+
+# ── --ungroup: removes group, keeps service ──
+echo "Deleting group with --ungroup..."
+om group delete "$GROUP_NAME" --ungroup
+
+# Service should still exist but without group
+if ! instance_exists "$TEST_INSTANCE"; then
+	echo "ERROR: Service should survive --ungroup delete"
+	exit 1
+fi
+echo "Service survived --ungroup delete"
+
+# Group should be gone
+OUTPUT=$(om group list 2>&1)
+if echo "$OUTPUT" | grep -q "$GROUP_NAME"; then
+	echo "ERROR: Group still exists after --ungroup delete"
+	exit 1
+fi
+echo "Group removed after --ungroup delete"
+
+echo "Test passed"