diff --git a/src/tests.rs b/src/tests.rs
index 3e8039a..ef520a4 100644
--- a/src/tests.rs
+++ b/src/tests.rs
@@ -15,12 +15,15 @@ use crate::{
 struct TestSystem {
     database: PgTempDB,
     web: Router,
+    config: Arc<Configuration>,
+    store: Arc<IdCoopStore>,
 }
 
 const RSA_KEY_PAIR_PEM: &[u8] = include_bytes!("tests/keypair.pem");
 const RSA_PUBLIC_KEY_PEM: &[u8] = include_bytes!("tests/publickey.crt");
 
-// #[rstest::fixture]
+mod test_cli;
+
 async fn basic_system() -> TestSystem {
     let temp_db = pgtemp::PgTempDBBuilder::new()
         .with_dbname("test_idcoop")
@@ -75,13 +78,17 @@ async fn basic_system() -> TestSystem {
             .expect("failed to decode builtin RSA keypair"),
     };
 
-    let router = make_router(Arc::new(store), Arc::new(config), Arc::new(secrets))
+    let config = Arc::new(config);
+    let store = Arc::new(store);
+    let router = make_router(store.clone(), config.clone(), Arc::new(secrets))
         .await
         .expect("failed to make router");
 
     TestSystem {
         database: temp_db,
         web: router,
+        config,
+        store,
     }
 }
 
diff --git a/src/tests/test_cli.rs b/src/tests/test_cli.rs
new file mode 100644
index 0000000..1413558
--- /dev/null
+++ b/src/tests/test_cli.rs
@@ -0,0 +1,164 @@
+use rstest::rstest;
+
+use crate::cli::{handle_user_command, UserCommand};
+
+use super::basic_system;
+
+#[rstest]
+#[tokio::test]
+async fn test_cli_add_user() {
+    let sys = basic_system().await;
+
+    handle_user_command(
+        UserCommand::Add {
+            username: "jonathan".to_owned(),
+            locked: true,
+        },
+        &sys.config,
+        &sys.store,
+    )
+    .await
+    .unwrap();
+
+    let _: () = sys
+        .store
+        .txn(|mut txn| {
+            Box::pin(async move {
+                let user = txn.lookup_user_by_name("jonathan".to_owned()).await?;
+
+                assert!(user.unwrap().locked);
+                Ok(())
+            })
+        })
+        .await
+        .unwrap();
+}
+
+#[rstest]
+#[tokio::test]
+async fn test_cli_lock_and_unlock_user() {
+    let sys = basic_system().await;
+
+    handle_user_command(
+        UserCommand::Add {
+            username: "jonathan".to_owned(),
+            locked: false,
+        },
+        &sys.config,
+        &sys.store,
+    )
+    .await
+    .unwrap();
+
+    let _: () = sys
+        .store
+        .txn(|mut txn| {
+            Box::pin(async move {
+                let user = txn.lookup_user_by_name("jonathan".to_owned()).await?;
+
+                assert!(!user.unwrap().locked);
+                Ok(())
+            })
+        })
+        .await
+        .unwrap();
+
+    handle_user_command(
+        UserCommand::Lock {
+            username: "jonathan".to_owned(),
+        },
+        &sys.config,
+        &sys.store,
+    )
+    .await
+    .unwrap();
+
+    let _: () = sys
+        .store
+        .txn(|mut txn| {
+            Box::pin(async move {
+                let user = txn.lookup_user_by_name("jonathan".to_owned()).await?;
+
+                assert!(user.unwrap().locked);
+                Ok(())
+            })
+        })
+        .await
+        .unwrap();
+
+    handle_user_command(
+        UserCommand::Unlock {
+            username: "jonathan".to_owned(),
+        },
+        &sys.config,
+        &sys.store,
+    )
+    .await
+    .unwrap();
+
+    let _: () = sys
+        .store
+        .txn(|mut txn| {
+            Box::pin(async move {
+                let user = txn.lookup_user_by_name("jonathan".to_owned()).await?;
+
+                assert!(!user.unwrap().locked);
+                Ok(())
+            })
+        })
+        .await
+        .unwrap();
+}
+
+#[rstest]
+#[tokio::test]
+async fn test_cli_del_user() {
+    let sys = basic_system().await;
+
+    handle_user_command(
+        UserCommand::Add {
+            username: "jonathan".to_owned(),
+            locked: true,
+        },
+        &sys.config,
+        &sys.store,
+    )
+    .await
+    .unwrap();
+
+    let _: () = sys
+        .store
+        .txn(|mut txn| {
+            Box::pin(async move {
+                let user = txn.lookup_user_by_name("jonathan".to_owned()).await?;
+
+                assert!(user.unwrap().locked);
+                Ok(())
+            })
+        })
+        .await
+        .unwrap();
+
+    handle_user_command(
+        UserCommand::Delete {
+            username: "jonathan".to_owned(),
+        },
+        &sys.config,
+        &sys.store,
+    )
+    .await
+    .unwrap();
+
+    let _: () = sys
+        .store
+        .txn(|mut txn| {
+            Box::pin(async move {
+                let user = txn.lookup_user_by_name("jonathan".to_owned()).await?;
+
+                assert!(user.is_none());
+                Ok(())
+            })
+        })
+        .await
+        .unwrap();
+}