@skyhook-io/k8s-ui 1.12.0 → 1.13.0

package/src/components/resources/renderers/LookupFailureNote.test.tsx

@@ -0,0 +1,60 @@
+import { describe, expect, it } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { LookupFailureNote } from './LookupFailureNote'
+
+function err(message: string, status?: number): Error {
+  return Object.assign(new Error(message), status === undefined ? {} : { status })
+}
+
+describe('LookupFailureNote', () => {
+  it('says nothing when every lookup came back', () => {
+    expect(renderToString(<LookupFailureNote errors={[]} what="x" />)).toBe('')
+    expect(renderToString(<LookupFailureNote errors={[null, undefined]} what="x" />)).toBe('')
+  })
+
+  // Being unable to see something is expected and not actionable; a fault is
+  // neither. The two must not read alike.
+  it('renders a permission answer as a calm note, not a red error', () => {
+    const html = renderToString(
+      <LookupFailureNote errors={[err('forbidden', 403)]} what="which clusters use this store" />,
+    )
+    expect(html).toContain('permission')
+    expect(html).not.toContain('text-red-400')
+  })
+
+  it('keeps a genuine fault loud, with the reason', () => {
+    const html = renderToString(
+      <LookupFailureNote errors={[err('Failed to fetch')]} what="what replicates here" />,
+    )
+    expect(html).toContain('text-red-400')
+    expect(html).toContain('Failed to fetch')
+  })
+
+  // A fault is actionable and a permission answer is not, so the actionable one
+  // is the one worth showing when both happened.
+  it('prefers the fault when a lookup was both forbidden and broken', () => {
+    const html = renderToString(
+      <LookupFailureNote errors={[err('forbidden', 403), err('boom', 500)]} what="x" />,
+    )
+    expect(html).toContain('boom')
+    expect(html).toContain('text-red-400')
+  })
+
+  // The case that loses counts: rows are on screen, so the failure means the
+  // list is short — not that nothing was found.
+  it('says the list is incomplete rather than unchecked when rows are showing', () => {
+    const html = renderToString(
+      <LookupFailureNote errors={[err('boom', 500)]} what="x" incomplete />,
+    )
+    expect(html).toContain('This may be incomplete')
+    expect(html).toContain('boom')
+  })
+
+  it('does the same for a partial permission answer', () => {
+    const html = renderToString(
+      <LookupFailureNote errors={[err('forbidden', 403)]} what="x" incomplete />,
+    )
+    expect(html).toContain('may be incomplete')
+    expect(html).not.toContain('text-red-400')
+  })
+})

package/src/components/resources/renderers/LookupFailureNote.tsx

@@ -0,0 +1,42 @@
+import { isForbiddenError } from '../../../types/fetch-error'
+
+interface LookupFailureNoteProps {
+  /** Nulls are ignored, so callers can pass `[a.error, b.error]` from their hooks. */
+  errors: unknown[]
+  /** Tail of a sentence: "which clusters use this store". */
+  what: string
+  /** Rows are already on screen, so the failure shortened the list rather than
+   *  emptying it. */
+  incomplete?: boolean
+}
+
+/**
+ * A reverse lookup that did not come back, told apart from one that found
+ * nothing. Same split as RBACErrorSection and sharing its predicate: a denial is
+ * expected and reads calm, a fault stays loud.
+ */
+export function LookupFailureNote({ errors, what, incomplete }: LookupFailureNoteProps) {
+  const real = errors.filter(Boolean)
+  if (real.length === 0) return null
+
+  // A fault outranks a denial: only one of the two is actionable.
+  const fault = real.find((e) => !isForbiddenError(e))
+  if (!fault) {
+    return (
+      <div className="text-xs text-theme-text-tertiary">
+        {incomplete
+          ? `This may be incomplete: you don’t have permission to check ${what}.`
+          : `You don’t have permission to check ${what}.`}
+      </div>
+    )
+  }
+
+  const message = fault instanceof Error ? fault.message : String(fault)
+  return (
+    <div className="text-xs text-red-400">
+      {incomplete
+        ? `This may be incomplete — could not check ${what}: ${message}`
+        : `Could not check ${what}: ${message}`}
+    </div>
+  )
+}

package/src/components/resources/renderers/NetworkPolicyDiagram.tsx

@@ -1,8 +1,15 @@
 import { clsx } from 'clsx'
+import { Badge } from '../../ui/Badge'
 import { Tooltip } from '../../ui/Tooltip'
+import {
+  NETWORK_POLICY_PEER_DOTS,
+  NETWORK_POLICY_PEER_STYLES,
+  type NetworkPolicyPeerType,
+} from './network-policy-peer-styles'
 
 interface NetworkPolicyDiagramProps {
   spec: any
+  staged?: boolean
 }
 
 /**
@@ -11,7 +18,7 @@ interface NetworkPolicyDiagramProps {
  * Each rule is a horizontal band. Peers within a rule are OR'd (stacked).
  * Pure CSS/SVG — no ReactFlow needed for this static diagram.
  */
-export function NetworkPolicyDiagram({ spec }: NetworkPolicyDiagramProps) {
+export function NetworkPolicyDiagram({ spec, staged = false }: NetworkPolicyDiagramProps) {
   const podSelector = spec.podSelector || {}
   const matchLabels = podSelector.matchLabels || {}
   const policyTypes: string[] = spec.policyTypes || []
@@ -29,6 +36,13 @@ export function NetworkPolicyDiagram({ spec }: NetworkPolicyDiagramProps) {
 
   return (
     <div className="card-inner-lg space-y-3">
+      {staged && (
+        <div className="flex items-center gap-2 text-[11px] text-theme-text-tertiary">
+          <Badge severity="warning" size="sm">Staged preview</Badge>
+          <span>Dashed paths are evaluated but not enforced</span>
+        </div>
+      )}
+
       {/* Ingress flows */}
       {hasIngress && (
         <div className="space-y-2">
@@ -43,6 +57,7 @@ export function NetworkPolicyDiagram({ spec }: NetworkPolicyDiagramProps) {
               ports={[]}
               direction="ingress"
               denied
+              staged={staged}
             />
           ) : (
             ingress?.map((rule, i) => (
@@ -52,6 +67,7 @@ export function NetworkPolicyDiagram({ spec }: NetworkPolicyDiagramProps) {
                 target={targetLabel}
                 ports={extractPorts(rule.ports)}
                 direction="ingress"
+                staged={staged}
               />
             ))
           )}
@@ -72,6 +88,7 @@ export function NetworkPolicyDiagram({ spec }: NetworkPolicyDiagramProps) {
               ports={[]}
               direction="egress"
               denied
+              staged={staged}
             />
           ) : (
             egress?.map((rule, i) => (
@@ -81,6 +98,7 @@ export function NetworkPolicyDiagram({ spec }: NetworkPolicyDiagramProps) {
                 target={targetLabel}
                 ports={extractPorts(rule.ports)}
                 direction="egress"
+                staged={staged}
               />
             ))
           )}
@@ -97,7 +115,7 @@ export function NetworkPolicyDiagram({ spec }: NetworkPolicyDiagramProps) {
 interface PeerInfo {
   label: string
   sublabel?: string
-  type: 'pod' | 'namespace' | 'cidr' | 'all' | 'deny' | 'combined'
+  type: NetworkPolicyPeerType
 }
 
 function extractPeers(peers: any[] | undefined): PeerInfo[] {
@@ -155,37 +173,20 @@ function formatSelector(selector: any): string {
   return Object.entries(labels).map(([k, v]) => `${k}=${v}`).join(', ')
 }
 
-// Color coding for peer types
-const PEER_STYLES = {
-  pod: 'border-emerald-500/30 bg-emerald-500/8',
-  namespace: 'border-sky-500/30 bg-sky-500/8',
-  cidr: 'border-amber-500/30 bg-amber-500/8',
-  combined: 'border-emerald-500/30 bg-emerald-500/8',
-  all: 'border-theme-border bg-theme-elevated/50',
-  deny: 'border-red-500/30 bg-red-500/8',
-} as const
-
-const PEER_DOT = {
-  pod: 'bg-emerald-500',
-  namespace: 'bg-sky-500',
-  cidr: 'bg-amber-500',
-  combined: 'bg-emerald-500',
-  all: 'bg-theme-text-tertiary',
-  deny: 'bg-red-500',
-} as const
-
 function FlowRow({
   sources,
   target,
   ports,
   direction,
   denied = false,
+  staged = false,
 }: {
   sources: PeerInfo[]
   target: string
   ports: string[]
   direction: 'ingress' | 'egress'
   denied?: boolean
+  staged?: boolean
 }) {
   const isIngress = direction === 'ingress'
 
@@ -200,11 +201,11 @@ function FlowRow({
             <div
               className={clsx(
                 'rounded-md border px-2 py-1.5 min-w-0 overflow-hidden',
-                PEER_STYLES[peer.type],
+                NETWORK_POLICY_PEER_STYLES[peer.type],
               )}
             >
               <div className="flex items-center gap-1.5 min-w-0">
-                <span className={clsx('w-1.5 h-1.5 rounded-full shrink-0', PEER_DOT[peer.type])} />
+                <span className={clsx('w-1.5 h-1.5 rounded-full shrink-0', NETWORK_POLICY_PEER_DOTS[peer.type])} />
                 <span className={clsx('text-[11px] font-medium truncate min-w-0', denied && 'line-through text-red-400')}>
                   {peer.label}
                 </span>
@@ -245,14 +246,14 @@ function FlowRow({
           x1="2" y1="10" x2="32" y2="10"
           stroke={denied ? '#ef4444' : direction === 'ingress' ? '#3b82f6' : '#a855f7'}
           strokeWidth="1.5"
-          strokeDasharray={denied ? '3 2' : undefined}
+          strokeDasharray={staged ? '4 3' : denied ? '3 2' : undefined}
           markerEnd={`url(#arrow-${direction}-${denied ? 'denied' : 'ok'})`}
         />
       </svg>
       {ports.length > 0 && (
-        <div className="flex flex-wrap justify-center gap-0.5 mt-0.5">
+        <div className="flex flex-col items-center gap-0.5 mt-0.5">
           {ports.map((p, i) => (
-            <span key={i} className="text-[8px] text-theme-text-tertiary font-mono leading-none">{p}</span>
+            <span key={i} className="whitespace-nowrap text-[8px] text-theme-text-tertiary font-mono leading-none">{p}</span>
           ))}
         </div>
       )}

package/src/components/resources/renderers/NetworkPolicyRenderer.tsx

@@ -5,9 +5,10 @@ import { NetworkPolicyDiagram } from './NetworkPolicyDiagram'
 
 interface NetworkPolicyRendererProps {
   data: any
+  staged?: boolean
 }
 
-export function NetworkPolicyRenderer({ data }: NetworkPolicyRendererProps) {
+export function NetworkPolicyRenderer({ data, staged = false }: NetworkPolicyRendererProps) {
   const spec = data.spec || {}
   const podSelector = spec.podSelector || {}
   const policyTypes: string[] = spec.policyTypes || []
@@ -23,7 +24,7 @@ export function NetworkPolicyRenderer({ data }: NetworkPolicyRendererProps) {
     <>
       {hasDiagramContent && (
         <Section title="Policy Flow" icon={GitFork} defaultExpanded>
-          <NetworkPolicyDiagram spec={spec} />
+          <NetworkPolicyDiagram spec={spec} staged={staged} />
         </Section>
       )}
 
@@ -125,7 +126,9 @@ function IngressEgressRuleCard({
       )}
 
       {peers.length === 0 && ports.length === 0 && (
-        <div className="text-xs text-theme-text-tertiary">Allow all</div>
+        <div className="text-xs text-theme-text-tertiary">
+          {direction === 'from' ? 'All sources' : 'All destinations'}
+        </div>
       )}
     </div>
   )

package/src/components/resources/renderers/PolicyCoverageSection.test.tsx

@@ -0,0 +1,348 @@
+import { describe, expect, it } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { PolicyCoverageSection } from './PolicyCoverageSection'
+import type { PolicyCoverageResponse, PolicyCoverageRule, PolicyCoverageSubject } from '../../../types/policy'
+
+const vpol = (spec: any = {}) => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'ValidatingPolicy', spec })
+const mpol = () => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'MutatingPolicy', spec: {} })
+const legacy = (spec: any) => ({ apiVersion: 'kyverno.io/v1', kind: 'ClusterPolicy', spec })
+
+const counts = (c: Partial<PolicyCoverageResponse['counts']> = {}) =>
+  ({ pass: 0, fail: 0, warn: 0, error: 0, skip: 0, ...c })
+
+const subject = (name: string, result: string, namespace = 'app'): PolicyCoverageSubject =>
+  ({ kind: 'Pod', namespace, name, result })
+
+const rule = (r: Partial<PolicyCoverageRule> = {}): PolicyCoverageRule =>
+  ({ rule: 'check', counts: counts(), subjects: [], total: 0, ...r })
+
+const coverage = (o: Partial<PolicyCoverageResponse> = {}): PolicyCoverageResponse => ({
+  evaluated: true,
+  status: 'ready',
+  liveUpdates: true,
+  policy: 'p',
+  counts: counts(),
+  scopeNamespaces: 1,
+  withheldNamespaces: 0,
+  examined: 0,
+  rules: [],
+  ...o,
+})
+
+const render = (data: PolicyCoverageResponse, resource: any = vpol(), extra = {}) =>
+  renderToString(<PolicyCoverageSection resource={resource} data={data} {...extra} />)
+
+/**
+ * The wording is the feature here, so these assert on what the section actually
+ * renders. Kyverno reports the same `result: fail` for every family and does not
+ * mean the same thing by it, and several of the sentences claim more than the
+ * data behind them if they are built from the wrong number.
+ */
+describe('what the section says a policy did', () => {
+  it('states the consequence of enforcing without claiming what exists is blocked', () => {
+    const html = render(
+      coverage({ examined: 7, subjects: 7, subjectsFailing: 7, counts: counts({ fail: 7 }),
+        rules: [rule({ counts: counts({ fail: 7 }), subjects: [subject('a', 'fail')], total: 7 })] }),
+      vpol({ validationActions: ['Deny'] }),
+    )
+    expect(html).toContain('already exist')
+    expect(html).toContain('will be rejected')
+    expect(html).not.toMatch(/would be blocked|blocks these/)
+  })
+
+  it('frames an audit policy as a dry run, not a current block', () => {
+    const html = render(
+      coverage({ examined: 3, subjects: 3, subjectsFailing: 3, counts: counts({ fail: 3 }),
+        rules: [rule({ counts: counts({ fail: 3 }), subjects: [subject('a', 'fail')], total: 3 })] }),
+      vpol({ validationActions: ['Audit'] }),
+    )
+    expect(html).toContain('Nothing is rejected today')
+  })
+
+  // A mutating policy's fail carries "mutation is not applied" — nothing
+  // violated anything, so calling it a failure misreports compliance.
+  it('does not call an unapplied mutation a failure', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      mpol(),
+    )
+    expect(html).toContain('not mutated')
+    expect(html).not.toContain('Fail')
+  })
+
+  // The subject of a generate result is the trigger, never the object produced.
+  it('calls a generate rule’s pass a trigger, not a generated object', () => {
+    const html = render(
+      coverage({ examined: 1, subjects: 1, counts: counts({ pass: 1 }),
+        rules: [rule({ rule: 'gen', counts: counts({ pass: 1 }), subjects: [subject('cm', 'pass')], total: 1 })] }),
+      legacy({ rules: [{ name: 'gen', generate: {} }] }),
+    )
+    expect(html).toContain('triggered generation')
+    expect(html).not.toContain('Generated')
+  })
+
+  it('withholds the consequence when the policy’s rules disagree on blocking', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      legacy({ rules: [
+        { name: 'a', validate: { failureAction: 'Enforce' } },
+        { name: 'b', validate: { failureAction: 'Audit' } },
+      ] }),
+    )
+    expect(html).not.toContain('will be rejected')
+    expect(html).not.toContain('already exist')
+  })
+})
+
+describe('counts describe the cluster, lists describe the view', () => {
+  it('separates checks from resources when one resource was checked twice', () => {
+    const html = render(coverage({
+      examined: 2, subjects: 1, counts: counts({ pass: 1, fail: 1 }),
+      rules: [rule({ counts: counts({ fail: 1 }), subjects: [subject('only-one', 'fail')], total: 1 })],
+    }))
+    expect(html).toContain('2 checks on 1 resource')
+    expect(html).not.toContain('2 resources examined')
+  })
+
+  it('says resources when each was checked once', () => {
+    const html = render(coverage({
+      examined: 34, subjects: 34, counts: counts({ pass: 34 }),
+      rules: [rule({ counts: counts({ pass: 34 }), subjects: [subject('a', 'pass')], total: 34 })],
+    }))
+    expect(html).toContain('34 resources examined')
+  })
+
+  it('claims "all" passing only when nothing is outside the view', () => {
+    const all = render(coverage({
+      examined: 3, subjects: 3, counts: counts({ pass: 3 }),
+      rules: [rule({ counts: counts({ pass: 3 }), subjects: [subject('a', 'pass')], total: 3 })],
+    }))
+    expect(all).toContain('All 3 resources passing')
+
+    const filtered = render(coverage({
+      examined: 34, subjects: 34, counts: counts({ pass: 34 }),
+      rules: [rule({ counts: counts({ pass: 34 }), subjects: [subject('a', 'pass')], total: 34, hiddenByFilter: 27 })],
+    }))
+    expect(filtered).toContain('7 resources passing in view')
+    expect(filtered).not.toContain('All 34')
+    expect(filtered).toContain('27 hidden by your namespace filter')
+  })
+
+  // Only non-passing subjects are listed, so a hidden pass leaves nothing to
+  // claim — "All 0 resources passing" is not a statement worth making.
+  it('makes no passing claim when the filter hid the only subject', () => {
+    const html = render(coverage({
+      examined: 1, subjects: 1, counts: counts({ pass: 1 }),
+      rules: [rule({ counts: counts({ pass: 1 }), subjects: [], total: 1, hiddenByFilter: 1 })],
+    }))
+    expect(html).not.toContain('All 0')
+    expect(html).toContain('1 hidden by your namespace filter')
+  })
+
+  // The counts exclude what a family or a namespace held back, so "All" would be
+  // quantifying over a set the page itself goes on to say was short.
+  it('does not claim all passed when a report family was withheld', () => {
+    const html = render(coverage({
+      examined: 5, subjects: 5, counts: counts({ pass: 5 }),
+      withheldByFamily: 2, unreadableFamilies: ['openreports.io'],
+      rules: [rule({ counts: counts({ pass: 5 }), subjects: [], total: 5 })],
+    }))
+    expect(html).toContain('5 resources passing')
+    expect(html).not.toContain('All 5 resources passing')
+  })
+
+  it('keeps the plain claim when nothing was held back', () => {
+    const html = render(coverage({
+      examined: 5, subjects: 5, counts: counts({ pass: 5 }),
+      rules: [rule({ counts: counts({ pass: 5 }), subjects: [], total: 5 })],
+    }))
+    expect(html).toContain('All 5 resources passing')
+  })
+
+  it('names the hidden rows that were failing', () => {
+    const html = render(coverage({
+      examined: 1, subjects: 1, counts: counts({ fail: 1 }),
+      rules: [rule({ counts: counts({ fail: 1 }), subjects: [], total: 1, hiddenByFilter: 1, hiddenNotable: 1 })],
+    }))
+    expect(html).toContain('1 of them failing')
+  })
+
+  // Kyverno files engine errors under a rule of their own. Calling those hidden
+  // rows by the family's fail word made the footers claim more failures than the
+  // summary above them had counted.
+  it('does not call a hidden engine error a failure of the rule', () => {
+    const html = render(coverage({
+      examined: 18, subjects: 18, counts: counts({ error: 18 }),
+      rules: [rule({
+        rule: 'evaluation', counts: counts({ error: 18 }), subjects: [], total: 18,
+        hiddenByFilter: 14, hiddenNotable: 14,
+      })],
+    }), mpol())
+    expect(html).toContain('14 of them could not be evaluated')
+    expect(html).not.toContain('14 of them not mutated')
+  })
+
+  it('still uses the family word when the hidden rows really did fail', () => {
+    const html = render(coverage({
+      examined: 4, subjects: 4, counts: counts({ fail: 3, error: 1 }),
+      rules: [rule({
+        counts: counts({ fail: 3, error: 1 }), subjects: [], total: 4,
+        hiddenByFilter: 3, hiddenNotable: 3,
+      })],
+    }), mpol())
+    expect(html).toContain('3 of them not mutated')
+  })
+})
+
+describe('a bounded list is not a dead end', () => {
+  const many = (n: number, result: string) =>
+    Array.from({ length: n }, (_, i) => subject(`s${i}`, result))
+
+  it('offers to load the rest when the cap removed listable rows', () => {
+    const html = render(
+      coverage({ examined: 251, subjects: 251, counts: counts({ fail: 251 }),
+        rules: [rule({ counts: counts({ fail: 251 }), subjects: many(200, 'fail'), total: 251, truncated: true })] }),
+      vpol(), { onLoadMore: () => {} },
+    )
+    expect(html).toContain('only the first 200 are available here')
+    expect(html).toContain('Load the rest')
+    expect(html).toContain('Show 200 of 251')
+  })
+
+  // A rule where everything passes is capped just as readily, and its list
+  // carries the same offer. Only the label is assertable here: the rows and the
+  // control sit behind a disclosure this renderer opens on click, and the repo
+  // tests renderers with renderToString, which cannot open one.
+  it('summarises a capped passing list as a disclosure rather than a total', () => {
+    const html = render(
+      coverage({ examined: 251, subjects: 251, counts: counts({ pass: 251 }),
+        rules: [rule({ counts: counts({ pass: 251 }), subjects: many(199, 'pass'), total: 251, truncated: true })] }),
+      vpol(), { onLoadMore: () => {} },
+    )
+    expect(html).toContain('All 251 resources passing')
+    expect(html).toContain('<button')
+  })
+
+  // Rows the filter withheld are not the cap's doing, and no higher limit
+  // returns them.
+  it('does not blame the cap for what the namespace filter withheld', () => {
+    const html = render(coverage({
+      examined: 1, subjects: 1, counts: counts({ fail: 1 }),
+      rules: [rule({ counts: counts({ fail: 1 }), subjects: [], total: 1, hiddenByFilter: 1, hiddenNotable: 1 })],
+    }), vpol(), { onLoadMore: () => {} })
+    expect(html).not.toContain('Load the rest')
+    expect(html).not.toContain('only the first')
+  })
+
+  it('does not announce a cap that only removed passing rows', () => {
+    const html = render(
+      coverage({ examined: 251, subjects: 251, counts: counts({ pass: 250, fail: 1 }),
+        rules: [rule({ counts: counts({ pass: 250, fail: 1 }), subjects: [subject('bad', 'fail')], total: 251, truncated: true })] }),
+      vpol(), { onLoadMore: () => {} },
+    )
+    expect(html).not.toContain('only the first 1 are available')
+  })
+})
+
+describe('an engine error is not a verdict', () => {
+  const allErrors = coverage({
+    examined: 1, subjects: 1, subjectsFailing: 0, counts: counts({ error: 1 }),
+    rules: [rule({ rule: 'evaluation', counts: counts({ error: 1 }), subjects: [subject('a', 'error')], total: 1 })],
+  })
+
+  it('does not promise rejection for rules that never ran', () => {
+    const html = render(allErrors, vpol({ validationActions: ['Deny'] }))
+    expect(html).not.toContain('will be rejected')
+    expect(html).toContain('could not be evaluated')
+  })
+
+  // The policy has to declare Ignore to reach this wording at all: an absent
+  // failurePolicy means Fail per the CRD, so the default is the fail-closed
+  // sentence, not this one.
+  it('agrees in number', () => {
+    const ignores = vpol({ failurePolicy: 'Ignore' })
+    expect(render(allErrors, ignores)).toContain('1 could not be evaluated and is being allowed through unchecked')
+    const two = coverage({
+      examined: 2, subjects: 2, counts: counts({ error: 2 }),
+      rules: [rule({ rule: 'evaluation', counts: counts({ error: 2 }), subjects: [subject('a', 'error')], total: 2 })],
+    })
+    expect(render(two, ignores)).toContain('2 could not be evaluated and are being allowed through unchecked')
+  })
+
+  it('says a fail-closed policy rejects on the error instead', () => {
+    const html = render(allErrors, vpol({ failurePolicy: 'Fail', validationActions: ['Deny'] }))
+    expect(html).toContain('fails closed')
+    expect(html).toContain('that admission is')
+  })
+
+  // `evaluation` is Kyverno's own marker, not a rule the policy declares.
+  it('does not present the engine’s marker as a rule the policy contains', () => {
+    const html = render(allErrors)
+    expect(html).toContain('Engine errors')
+    expect(html).not.toMatch(/>evaluation</)
+  })
+})
+
+describe('absence is only claimed when the whole answer arrived', () => {
+  it('says nothing has been checked when nothing was withheld', () => {
+    expect(render(coverage())).toContain('Nothing has been checked against this policy yet')
+  })
+
+  it('does not claim that when results were withheld', () => {
+    const html = render(coverage({ withheldNamespaces: 2 }))
+    expect(html).not.toContain('Nothing has been checked')
+    expect(html).toContain('No results to show here')
+    expect(html).toContain('2 namespaces are not shown')
+  })
+
+  it('attributes a family the caller cannot read to their permissions', () => {
+    const html = render(coverage({ withheldByFamily: 3, unreadableFamilies: ['openreports.io'] }))
+    expect(html).toContain('openreports.io')
+    expect(html).toContain('3 results were')
+  })
+
+  it('names another engine rather than presenting its findings as this policy’s', () => {
+    const html = render(coverage({
+      examined: 1, subjects: 1, counts: counts({ fail: 1 }), engines: ['kyverno', 'trivy'],
+      rules: [rule({ counts: counts({ fail: 1 }), subjects: [subject('a', 'fail')], total: 1 })],
+    }))
+    expect(html).toContain('trivy')
+  })
+})
+
+/**
+ * An engine error is either rejected or waved through, and which one is the
+ * whole point of the sentence. `spec.failurePolicy` defaults to Fail per the
+ * published CRD and most policies never set it, so reading absent as anything
+ * else states the opposite of what the cluster does.
+ */
+describe('what an engine error costs', () => {
+  const errored = coverage({
+    examined: 2, subjects: 2, counts: counts({ error: 2 }),
+    rules: [rule({ counts: counts({ error: 2 }), subjects: [], total: 2 })],
+  })
+
+  it('treats an unset failurePolicy as fail-closed, like the CRD does', () => {
+    const html = render(errored, vpol({}))
+    expect(html).toContain('rejected for an engine error')
+    expect(html).not.toContain('allowed through unchecked')
+  })
+
+  it('says so plainly when the policy declares Ignore', () => {
+    const html = render(errored, vpol({ failurePolicy: 'Ignore' }))
+    expect(html).toContain('allowed through unchecked')
+  })
+
+  // The legacy family keeps the field somewhere else entirely.
+  it('honours a legacy policy that opted out via webhookConfiguration', () => {
+    const html = render(errored, legacy({ webhookConfiguration: { failurePolicy: 'Ignore' }, rules: [] }))
+    expect(html).toContain('allowed through unchecked')
+    expect(html).not.toContain('fails closed')
+  })
+
+  it('agrees with an explicit Fail', () => {
+    expect(render(errored, vpol({ failurePolicy: 'Fail' }))).toContain('rejected for an engine error')
+  })
+})