@rancher/shell 3.0.12-rc.2 → 3.0.12-rc.3

package/plugins/dashboard-store/actions.js

@@ -660,12 +660,8 @@ export default {
     return getters.all(type);
   },
 
-  // opt:
-  //  filter: Filter by fields, e.g. {field: value, anotherField: anotherValue} (default: none)
-  //  limit: Number of records to return per page (default: 1000)
-  //  sortBy: Sort by field
-  //  sortOrder: asc or desc
-  //  url: Use this specific URL instead of looking up the URL for the type/id.  This should only be used for bootstrapping schemas on startup.
+  // opt: @ActionFindArgs
+  // @returns @ActionFindResponse
   //  @TODO depaginate: If the response is paginated, retrieve all the pages. (default: true)
   async find(ctx, { type, id, opt }) {
     if (!id) {
@@ -697,11 +693,23 @@ export default {
       }
     }
 
+    const havePage = getters.havePage(type);
+
     opt = opt || {};
     opt.url = getters.urlFor(type, id, opt);
 
     const res = await dispatch('request', { opt, type });
 
+    if (!havePage && getters.havePage(type)) {
+      // There may be a super edge case where list --> detail (whilst loading) --> list navigation causes the list's rows to disappear
+      // Somehow the `findPage` from the list page returns before the `find`. The `find` then clears the page state in the cache.
+      // If this has happened silently return (we don't care about result)
+      // https://github.com/rancher/dashboard/issues/17524
+      console.warn(`Prevented \`find\` action from polluting cache for type "${ type }" (currently represents a page).`); // eslint-disable-line no-console
+
+      return;
+    }
+
     if (!opt.transient) {
       await dispatch('load', { data: res, invalidatePageCache: opt.invalidatePageCache });
     }
@@ -830,19 +838,33 @@ export default {
   /**
    * Remove all cached entries for a resource and stop watches
    */
-  forgetType({ commit, dispatch, state }, type, compareWatches) {
-    // Stop all known watches
-    state.started
-      .filter((entry) => compareWatches ? compareWatches(entry) : entry.type === type)
-      .forEach((entry) => dispatch('unwatch', entry));
-
-    // Stop all known back-off watch processes for this type
-    dispatch('resetWatchBackOff', {
-      type, compareWatches, resetStarted: false
-    });
+  forgetType({ commit, dispatch, state }, payload) {
+    let type = payload;
+    let config = {};
+
+    if ( typeof payload === 'object' && payload !== null && payload.type ) {
+      type = payload.type;
+      config = payload;
+    }
+
+    const { compareWatches, unwatch = true, forget = true } = config;
 
-    // Remove entries from store
-    commit('forgetType', type);
+    if (unwatch) {
+      // Stop all known watches
+      state.started
+        .filter((entry) => compareWatches ? compareWatches(entry) : entry.type === type)
+        .forEach((entry) => dispatch('unwatch', entry));
+
+      // Stop all known back-off watch processes for this type
+      dispatch('resetWatchBackOff', {
+        type, compareWatches, resetStarted: false
+      });
+    }
+
+    if (forget) {
+      // Remove entries from store
+      commit('forgetType', type);
+    }
   },
 
   promptRemove({ commit, state }, resources ) {

package/plugins/dashboard-store/resource-class.js

@@ -946,12 +946,15 @@ export default class Resource {
     // where mostly likely extension CRD model is extending from resource-class
     const isResourceDetailDrawerCompatibleWithRancherSystem = semver.satisfies(parsedRancherVersion, '>= 2.13.0');
 
+    // If the resource can't show an edit or a yaml we don't want to show the configuration drawer
+    const showConfigEnabled = isResourceDetailDrawerCompatibleWithRancherSystem && this.disableResourceDetailDrawer !== true && (this.canCustomEdit || this.canYaml);
+
     const all = [
       {
         action:  'showConfiguration',
         label:   this.t('action.showConfiguration'),
         icon:    'icon icon-document',
-        enabled: isResourceDetailDrawerCompatibleWithRancherSystem && this.disableResourceDetailDrawer !== true && (this.canCustomEdit || this.canYaml), // If the resource can't show an edit or a yaml we don't want to show the configuration drawer
+        enabled: showConfigEnabled,
       },
       { divider: true },
       {
@@ -964,7 +967,7 @@ export default class Resource {
         action:  this.canEditYaml ? 'goToEditYaml' : 'goToViewYaml',
         label:   this.t(this.canEditYaml ? 'action.editYaml' : 'action.viewYaml'),
         icon:    'icon icon-file',
-        enabled: this.canYaml,
+        enabled: this.canYaml && (this.canEditYaml || !showConfigEnabled), // Hide "View YAML" when "Show Configuration" is available since it already includes YAML viewing
       },
       {
         action:  (this.canCustomEdit ? 'goToClone' : 'cloneYaml'),

package/plugins/steve/__tests__/subscribe.spec.ts

@@ -14,7 +14,8 @@ describe('steve: subscribe', () => {
         schemaFor:       () => null,
         inError:         () => false,
         watchStarted:    () => false,
-        listenerManager: state.listenerManager
+        listenerManager: state.listenerManager,
+        typeRegistered:  () => true,
       };
       const rootGetters = {
         'type-map/isSpoofed': () => false,
@@ -343,7 +344,7 @@ describe('steve: subscribe', () => {
 
         // call watch
         actions.watch({
-          state, dispatch, getters, rootGetters
+          state, dispatch, getters, rootGetters, commit
         }, {
           ...obj,
           revision,
@@ -488,6 +489,7 @@ describe('steve: subscribe', () => {
         const state = {
           started:         [],
           inError:         {},
+          queue:           [],
           listenerManager: new SteveWatchEventListenerManager()
         };
         const _getters = {
@@ -498,7 +500,8 @@ describe('steve: subscribe', () => {
           watchStarted:    (...args) => getters.watchStarted(state)(...args),
           backOffId:       (...args) => getters.backOffId()(...args),
           canBackoff:      () => true,
-          listenerManager: state.listenerManager
+          listenerManager: state.listenerManager,
+          typeRegistered:  () => true,
         };
         const commit = (type, ...args) => mutations[type](state, ...args);
 

package/plugins/steve/steve-pagination-utils.ts

@@ -258,6 +258,11 @@ class StevePaginationUtils extends NamespaceProjectFilters {
       { field: 'spec.displayName' },
       { field: `status.provider` },
       { field: `status.connected` },
+      { field: `status.info.machineProvider` },
+      { field: `status.driver` },
+      { field: `status.provider` },
+      { field: `status.info.kubernetesVersion` },
+      { field: `spec.fleetWorkspaceName` },
     ],
     [SECRET]: [
       { field: `metadata.annotations[${ UI_PROJECT_SECRET_COPY }]` },
@@ -265,7 +270,10 @@ class StevePaginationUtils extends NamespaceProjectFilters {
     [NAMESPACE]: [
     ],
     [CAPI.MACHINE]: [
-      { field: 'spec.clusterName' }
+      { field: 'spec.clusterName' },
+    ],
+    [CAPI.MACHINE_DEPLOYMENT]: [
+      { field: 'spec.clusterName' },
     ],
     [EVENT]: [
       { field: '_type' },
@@ -770,8 +778,8 @@ export const PAGINATION_SETTINGS_STORE_DEFAULTS: PaginationSettingsStores = {
       enableAll:  false,
       enableSome: {
         enabled: [
-          { resource: CAPI.RANCHER_CLUSTER, context: ['side-bar'] },
-          { resource: MANAGEMENT.CLUSTER, context: ['side-bar'] },
+          { resource: CAPI.RANCHER_CLUSTER, context: ['side-bar', 'home', 'cluster-management'] },
+          { resource: MANAGEMENT.CLUSTER, context: ['side-bar', 'home', 'cluster-management'] },
           { resource: CATALOG.APP, context: ['branding'] },
           SECRET
         ],

package/plugins/steve/subscribe.js

@@ -469,8 +469,10 @@ const sharedActions = {
     const worker = (this.$workers || {})[getters.storeName];
 
     if (worker) {
+      const storeName = getters.storeName;
+
       worker.postMessage({ destroyWorker: true }); // we're only passing the boolean here because the key needs to be something truthy to ensure it's passed on the object.
-      cleanupTasks.push(waitFor(() => !this.$workers[getters.storeName], 'Worker is destroyed'));
+      cleanupTasks.push(waitFor(() => !this.$workers?.[storeName], 'Worker to be destroyed', 30000, 10, true));
     }
 
     if ( socket ) {
@@ -553,17 +555,32 @@ const sharedActions = {
    * @param {STEVE_WATCH_PARAMS} params
    */
   watch({
-    state, dispatch, getters, rootGetters
+    state, dispatch, getters, rootGetters, commit
   }, params) {
     state.debugSocket && console.info(`Watch Request [${ getters.storeName }]`, JSON.stringify(params)); // eslint-disable-line no-console
     let {
       // eslint-disable-next-line prefer-const
-      type, selector, id, revision, namespace, stop, force, mode, standardWatch = true
+      type, selector, id, revision, namespace, stop, force, mode, standardWatch = true, registerType = false
     } = params;
 
     namespace = acceptOrRejectSocketMessage.subscribeNamespace(namespace);
     type = getters.normalizeType(type);
 
+    if ( !getters.typeRegistered(type) ) {
+      if (registerType) {
+        commit('registerType', type);
+      } else if (mode !== STEVE_WATCH_MODE.RESOURCE_CHANGES) {
+        // - If we continue and open up a watch whenever we receive a `resource.` notification we go to queueChanges (bar resource.changes mode).
+        // - queueChanges ignores any change that's for a type that hasn't been registered
+        // - So here we're just exiting early, avoiding the watch --> queueChanges --> ignore loop
+        //
+        // Interestingly this is hit quite a few times (on cluster create screens there's token, cluster, project, projectRoleTemplateBinding, etc)
+        state.debugSocket && console.info('Will not Watch (type is not registered)', JSON.stringify(params)); // eslint-disable-line no-console
+
+        return;
+      }
+    }
+
     if (rootGetters['type-map/isSpoofed'](type)) {
       state.debugSocket && console.info('Will not Watch (type is spoofed)', JSON.stringify(params)); // eslint-disable-line no-console
 
@@ -620,6 +637,9 @@ const sharedActions = {
         if (debounceMs) {
           msg.debounceMs = debounceMs;
         }
+
+        // Anything in the queue will pollute the result set, so clear (and print to console so we know it's working)
+        commit('clearFromQueue', { type, log: true });
       }
     }
 
@@ -1556,10 +1576,20 @@ const defaultMutations = {
     state.socketListenerManager = new SteveWatchEventListenerManager(state.config.namespace);
   },
 
-  clearFromQueue(state, type) {
+  clearFromQueue(state, args) {
+    const safeArgs = typeof args === 'object' ? args : { type: args };
+    const { type, log } = safeArgs;
+
     // Remove anything in the queue that is a resource update for the given type
     state.queue = state.queue.filter((item) => {
-      return item.body?.type !== type;
+      const keep = item.body?.type !== type;
+
+      if (!keep && log) {
+        // eslint-disable-next-line no-console
+        console.info(`Clearing queued item of type \`${ type }\` from queue`, item);
+      }
+
+      return keep;
     });
   },
 };

package/rancher-components/Form/LabeledInput/LabeledInput.test.ts

@@ -1,4 +1,4 @@
-import { defineComponent, nextTick } from 'vue';
+import { defineComponent, nextTick, provide, ref } from 'vue';
 import { mount, flushPromises } from '@vue/test-utils';
 import { useForm } from 'vee-validate';
 import { LabeledInput } from './index';
@@ -195,21 +195,27 @@ describe('component: LabeledInput', () => {
 
     it('with name prop: form-level validation schema error is shown when the form validates', async() => {
       const errorMessage = 'Username is required';
+      const showAllErrors = ref(false);
       let triggerFormValidation!: () => Promise<unknown>;
 
       const TestWrapper = defineComponent({
         components: { LabeledInput },
         setup() {
+          provide('vee-show-all-errors', showAllErrors);
+
           const { validate } = useForm({
             validationSchema: { username: (v: string) => (!v ? errorMessage : true) },
-            initialValues:    { username: '' }
+            initialValues:    { username: '' },
           });
 
-          triggerFormValidation = validate;
+          triggerFormValidation = async() => {
+            await validate();
+            showAllErrors.value = true;
+          };
 
           return {};
         },
-        template: '<LabeledInput name="username" value="" />'
+        template: '<LabeledInput name="username" value="" />',
       });
 
       const wrapper = mount(TestWrapper, { global: { mocks: { $store: { getters: { 'i18n/t': jest.fn() } } } } });

package/rancher-components/Form/LabeledInput/LabeledInput.vue

@@ -1,6 +1,5 @@
 <script lang="ts">
-import { defineComponent, inject, computed, watch } from 'vue';
-import { useField } from 'vee-validate';
+import { defineComponent, inject, computed, toRef } from 'vue';
 import TextAreaAutoGrow from '@components/Form/TextArea/TextAreaAutoGrow.vue';
 import LabeledTooltip from '@components/LabeledTooltip/LabeledTooltip.vue';
 import { escapeHtml, generateRandomAlphaString } from '@shell/utils/string';
@@ -9,6 +8,7 @@ import { isValidCron } from 'cron-validator';
 import { debounce } from 'lodash';
 import { useLabeledFormElement, labeledFormElementProps } from '@shell/composables/useLabeledFormElement';
 import { useCompactInput } from '@shell/composables/useCompactInput';
+import { useVeeValidateField } from '@shell/composables/useVeeValidateField';
 
 interface NonReactiveProps {
   onInput: (event: Event) => void | ((event: Event) => void);
@@ -142,56 +142,11 @@ export default defineComponent({
 
     const onInput = inject('onInput', provideProps.onInput);
 
-    // Stable fallback name so useField is always called unconditionally.
-    // When no name prop is given the field won't match any form-schema path.
-    const standaloneFieldId = `__field__${ generateRandomAlphaString(12) }`;
-    const veeFieldName = computed(() => props.name || standaloneFieldId);
-
-    // Pass existing rules to vee-validate so field-level validation still runs
-    const veeValidator = (value: unknown): boolean | string => {
-      // Return true when name is absent to avoid duplicating
-      // useLabeledFormElement validation
-      if (!props.name) {
-        return true;
-      }
-      for (const rule of props.rules as Array<(v: unknown) => string | undefined>) {
-        const msg = rule(value);
-
-        if (msg) {
-          return msg;
-        }
-      }
-
-      return true;
-    };
-
-    const {
-      errorMessage: veeError,
-      handleBlur:   veeHandleBlur,
-      validate:     veeValidate,
-      value:        veeValue,
-    } = useField<string | number | Record<string, unknown>>(
-      veeFieldName,
-      veeValidator,
-      {
-        initialValue:          props.value as string | number,
-        validateOnValueUpdate: true,
-      }
-    );
-
-    // Keep vee-validate's internal value in sync with the controlled prop value.
-    watch(() => props.value, (v) => {
-      if (veeValue.value !== v) {
-        veeValue.value = v as string | number;
-      }
-    });
-
-    const effectiveValidationMessage = computed(() => {
-      if (props.name && veeError.value) {
-        return veeError.value;
-      }
-
-      return validationMessage.value;
+    const { effectiveValidationMessage, veeHandleBlur, veeValidate } = useVeeValidateField({
+      name:  toRef(props, 'name'),
+      rules: toRef(props, 'rules'),
+      value: toRef(props, 'value'),
+      validationMessage,
     });
 
     const effectiveStatus = computed(() => props.status);

package/rancher-components/RcButton/RcButton.test.ts

@@ -1,4 +1,4 @@
-import { mount } from '@vue/test-utils';
+import { mount, RouterLinkStub } from '@vue/test-utils';
 import RcButton from './RcButton.vue';
 
 describe('rcButton.vue', () => {
@@ -138,4 +138,40 @@ describe('rcButton.vue', () => {
       expect(button.classes()).toContain('variant-ghost');
     });
   });
+
+  describe('to prop', () => {
+    it('renders as a <button> when no "to" prop is provided', () => {
+      const wrapper = mount(RcButton);
+
+      expect(wrapper.find('button').exists()).toBe(true);
+      expect(wrapper.findComponent(RouterLinkStub).exists()).toBe(false);
+    });
+
+    it('renders as a RouterLink when "to" prop is provided', () => {
+      const to = { name: 'some-route' };
+      const wrapper = mount(RcButton, {
+        props:  { to },
+        global: { stubs: { RouterLink: RouterLinkStub } },
+      });
+
+      const link = wrapper.findComponent(RouterLinkStub);
+
+      expect(link.exists()).toBe(true);
+      expect(wrapper.find('button').exists()).toBe(false);
+      expect(link.props('to')).toStrictEqual(to);
+    });
+
+    it('applies button classes when rendered as a RouterLink', () => {
+      const wrapper = mount(RcButton, {
+        props:  { to: '/foo', variant: 'secondary' },
+        global: { stubs: { RouterLink: RouterLinkStub } },
+      });
+
+      const link = wrapper.findComponent(RouterLinkStub);
+
+      expect(link.classes()).toContain('rc-button');
+      expect(link.classes()).toContain('btn');
+      expect(link.classes()).toContain('variant-secondary');
+    });
+  });
 });

package/rancher-components/RcButton/RcButton.vue

@@ -7,10 +7,15 @@
  *
  * <rc-button variant="primary" @click="doAction">Perform an Action</rc-button>
  */
-import { computed, ref } from 'vue';
+import { computed, ref, resolveComponent } from 'vue';
+import type { RouteLocationRaw } from 'vue-router';
 import {
-  ButtonVariantProps, ButtonSizeProps, ButtonVariantNewProps, ButtonSizeNewProps, ButtonSize,
-  IconProps
+  ButtonVariantProps,
+  ButtonSizeProps,
+  ButtonVariantNewProps,
+  ButtonSizeNewProps,
+  ButtonSize,
+  IconProps,
 } from './types';
 import RcIcon from '@components/RcIcon/RcIcon.vue';
 
@@ -33,7 +38,22 @@ const buttonSizesNew: { size: ButtonSize, className: string }[] = [
   { size: 'large', className: 'btn-large' },
 ];
 
-const props = withDefaults(defineProps<ButtonVariantProps & ButtonSizeProps & ButtonVariantNewProps & ButtonSizeNewProps & IconProps>(), { size: 'medium' });
+const props = withDefaults(
+  defineProps<
+        ButtonVariantProps &
+        ButtonSizeProps &
+        ButtonVariantNewProps &
+        ButtonSizeNewProps &
+        IconProps & { to?: RouteLocationRaw }
+    >(),
+  {
+    size: 'medium',
+    to:   undefined,
+  }
+);
+
+const tag = computed(() => (props.to ? resolveComponent('RouterLink') : 'button'));
+const role = computed(() => (props.to ? 'link' : 'button'));
 
 const activeVariantClassName = computed(() => {
   if (props.variant === 'multiAction' || props.multiAction) {
@@ -94,9 +114,11 @@ defineExpose({ focus });
 </script>
 
 <template>
-  <button
+  <component
+    :is="tag"
     ref="RcFocusTarget"
-    role="button"
+    :role="role"
+    :to="to"
     :class="{ ...buttonClass }"
   >
     <slot
@@ -124,15 +146,23 @@ defineExpose({ focus });
         size="inherit"
       />
     </slot>
-  </button>
+  </component>
 </template>
 
 <style lang="scss" scoped>
-button {
+.rc-button {
   display: inline-flex;
   align-items: center;
   justify-content: center;
 
+  // Override global .btn > .icon:not(:only-child) { margin-right: 6px } from _button.scss.
+  // RcButton uses flex gap for spacing instead. The :not(:only-child) clause matches the global
+  // selector so we win on specificity regardless of stylesheet load order; :deep() is needed to
+  // target slotted content.
+  & > :deep(.icon:not(:only-child)) {
+    margin-right: 0;
+  }
+
   // Much of the styling in here came from _button.scss. Because we're making changes from role to variant and we don't want to impact existing use cases we're pulling in some of these styles. We should in the long run deprecate that file.
   // Variant styles
   &.variant-primary {

package/rancher-components/RcDropdown/RcDropdownTrigger.vue

@@ -35,18 +35,20 @@ defineExpose({ focus });
     @keydown.enter.space="handleKeydown"
     @click="showMenu(true)"
   >
-    <template #before>
-      <slot name="before">
-        <!-- Empty Content -->
-      </slot>
+    <template
+      v-if="$slots.before"
+      #before
+    >
+      <slot name="before" />
     </template>
     <slot name="default">
       <!--Empty slot content-->
     </slot>
-    <template #after>
-      <slot name="after">
-        <!-- Empty Content -->
-      </slot>
+    <template
+      v-if="$slots.after"
+      #after
+    >
+      <slot name="after" />
     </template>
   </RcButton>
 </template>

package/store/__tests__/catalog.test.ts

@@ -1,7 +1,7 @@
 import { CATALOG } from '@shell/config/types';
 import { CATALOG as CATALOG_ANNOTATIONS } from '@shell/config/labels-annotations';
 import {
-  state, getters, actions, mutations, filterAndArrangeCharts
+  state, getters, actions, mutations, filterAndArrangeCharts, isRancherRepo, compatibleVersionsFor, getPermittedOSs
 } from '../catalog';
 import { createStore } from 'vuex';
 
@@ -509,4 +509,118 @@ describe('catalog', () => {
       });
     });
   });
+
+  describe('isRancherRepo', () => {
+    it('should return true if chart.isRancherRepo is true', () => {
+      const chart = { isRancherRepo: true } as any;
+
+      expect(isRancherRepo(null, chart)).toBe(true);
+    });
+
+    it('should return true if repo.isRancherSource is true', () => {
+      const repo = { isRancherSource: true } as any;
+
+      expect(isRancherRepo(repo, null)).toBe(true);
+    });
+
+    it('should return false if repo is not a rancher source', () => {
+      const repo = { isRancherSource: false } as any;
+
+      expect(isRancherRepo(repo, null)).toBe(false);
+    });
+  });
+
+  describe('compatibleVersionsFor', () => {
+    it('should allow versions if no OS constraint is provided', () => {
+      const chart = { versions: [{ version: '1.0.0' }] } as any;
+      const versions = compatibleVersionsFor(chart, undefined);
+
+      expect(versions).toHaveLength(1);
+    });
+
+    it('should allow windows nodes if permitted-os includes windows', () => {
+      const chart = {
+        versions: [{
+          version:     '1.0.0',
+          annotations: { 'catalog.cattle.io/permits-os': 'linux,windows' }
+        }]
+      } as any;
+      const versions = compatibleVersionsFor(chart, 'windows');
+
+      expect(versions).toHaveLength(1);
+    });
+
+    it('should block windows nodes if permitted-os does not include windows', () => {
+      const chart = {
+        versions: [{
+          version:     '1.0.0',
+          annotations: { 'catalog.cattle.io/permits-os': 'linux' }
+        }]
+      } as any;
+      const versions = compatibleVersionsFor(chart, 'windows');
+
+      expect(versions).toHaveLength(0);
+    });
+
+    it('should fallback to LINUX for rancher repos and block windows nodes', () => {
+      const chart = { isRancherRepo: true, versions: [{ version: '1.0.0' }] } as any;
+      const versions = compatibleVersionsFor(chart, 'windows');
+
+      expect(versions).toHaveLength(0);
+    });
+
+    it('should not fallback to LINUX for non-rancher repos and allow windows nodes', () => {
+      const chart = { isRancherRepo: false, versions: [{ version: '1.0.0' }] } as any;
+      const versions = compatibleVersionsFor(chart, 'windows');
+
+      expect(versions).toHaveLength(1);
+    });
+  });
+
+  describe('getPermittedOSs', () => {
+    it('should return explicitly permitted OSs when the annotation is present on a Rancher repo', () => {
+      const annotations = { [CATALOG_ANNOTATIONS.PERMITTED_OS]: 'linux,windows' };
+      const result = getPermittedOSs(annotations, true);
+
+      expect(result).toHaveLength(2);
+      expect(result).toContain('linux');
+      expect(result).toContain('windows');
+    });
+
+    it('should return explicitly permitted OSs when the annotation is present on a non-Rancher repo', () => {
+      const annotations = { [CATALOG_ANNOTATIONS.PERMITTED_OS]: 'linux' };
+      const result = getPermittedOSs(annotations, false);
+
+      expect(result).toHaveLength(1);
+      expect(result).toContain('linux');
+    });
+
+    it('should fallback to linux if the annotation is missing on a Rancher repo', () => {
+      const annotations = {};
+      const result = getPermittedOSs(annotations, true);
+
+      expect(result).toHaveLength(1);
+      expect(result).toContain('linux');
+    });
+
+    it('should return an empty array (no restrictions) if the annotation is missing on a non-Rancher repo', () => {
+      const annotations = {};
+      const result = getPermittedOSs(annotations, false);
+
+      expect(result).toHaveLength(0);
+    });
+
+    it('should handle undefined annotations safely for Rancher repos', () => {
+      const result = getPermittedOSs(undefined, true);
+
+      expect(result).toHaveLength(1);
+      expect(result).toContain('linux');
+    });
+
+    it('should handle undefined annotations safely for non-Rancher repos', () => {
+      const result = getPermittedOSs(undefined, false);
+
+      expect(result).toHaveLength(0);
+    });
+  });
 });