@skyhook-io/k8s-ui 1.14.3 → 1.14.4

package/src/components/resources/resource-utils-eso.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { getSecretStoreProviderType, getSecretStoreProviderKey } from './resource-utils-eso'
+import { getSecretStoreProviderType, getSecretStoreProviderKey, getExternalSecretStoreKey } from './resource-utils-eso'
 
 // The provider label answers "which backend holds these secrets?", so it has to
 // track the upstream `spec.provider` field names rather than plausible ones.
@@ -54,3 +54,28 @@ describe('getSecretStoreProviderKey', () => {
     expect(key('ParameterStore')).toBe('aws')
   })
 })
+
+describe('getExternalSecretStoreKey', () => {
+  // A ClusterSecretStore is referenceable from any namespace, so keying it by
+  // namespace would miss every ExternalSecret outside the store's own.
+  it('keys a ClusterSecretStore by name alone', () => {
+    expect(getExternalSecretStoreKey({
+      metadata: { namespace: 'prod' },
+      spec: { secretStoreRef: { name: 'vault-global', kind: 'ClusterSecretStore' } },
+    })).toBe('vault-global')
+  })
+
+  it('scopes a SecretStore to the ExternalSecret namespace', () => {
+    expect(getExternalSecretStoreKey({
+      metadata: { namespace: 'prod' },
+      spec: { secretStoreRef: { name: 'aws', kind: 'SecretStore' } },
+    })).toBe('prod/aws')
+  })
+
+  it('treats an omitted kind as a SecretStore, as the CRD defaults it', () => {
+    expect(getExternalSecretStoreKey({
+      metadata: { namespace: 'prod' },
+      spec: { secretStoreRef: { name: 'aws' } },
+    })).toBe('prod/aws')
+  })
+})

package/src/components/resources/resource-utils-eso.ts

@@ -235,6 +235,19 @@ export function getExternalSecretStore(resource: any): { name: string; kind: str
   }
 }
 
+/**
+ * Key for looking this ExternalSecret's store up in a provider map.
+ *
+ * A ClusterSecretStore is cluster-scoped and referenceable from any namespace,
+ * so it keys by name alone; a SecretStore only resolves within the
+ * ExternalSecret's own namespace.
+ */
+export function getExternalSecretStoreKey(resource: any): string {
+  const store = getExternalSecretStore(resource)
+  if (store.kind === 'ClusterSecretStore') return store.name
+  return `${resource?.metadata?.namespace ?? ''}/${store.name}`
+}
+
 export function getExternalSecretRefreshInterval(resource: any): string {
   return resource.spec?.refreshInterval || '-'
 }

package/src/components/resources/resource-utils-knative.ts

@@ -62,14 +62,14 @@ export function getRevisionStatus(resource: any): StatusBadge {
   if (ready?.status === 'True' && active?.status === 'False') {
     const reason = active.reason || ''
     if (reason === 'NoTraffic') {
-      return { text: 'Scaled to Zero', color: 'bg-blue-500/20 text-blue-400', level: 'healthy' }
+      return { text: 'Scaled to Zero', color: 'status-blue', level: 'healthy' }
     }
-    return { text: reason || 'Inactive', color: 'bg-yellow-500/20 text-yellow-400', level: 'degraded' }
+    return { text: reason || 'Inactive', color: 'status-amber', level: 'degraded' }
   }
 
   // Check for activating: Active condition is Unknown (scaling up)
   if (ready?.status === 'True' && active?.status === 'Unknown') {
-    return { text: 'Activating', color: 'bg-blue-500/20 text-blue-400', level: 'healthy' }
+    return { text: 'Activating', color: 'status-blue', level: 'healthy' }
   }
 
   return getKnativeConditionStatus(resource)

package/src/components/topology/TopologyGraph.tsx

@@ -245,6 +245,23 @@ interface TopologyGraphProps {
   children?: ReactNode
 }
 
+// A pod group's children normally carry the health the server computed. Without
+// it, the phase is honest for every state except Running: a crash-looping pod
+// sits at Phase=Running with its container restarting, so that one case says
+// unknown rather than repeating the bug this fallback exists behind.
+export function phaseOnlyHealth(phase: string | undefined): HealthStatus {
+  switch (phase) {
+    case 'Failed':
+      return 'unhealthy'
+    case 'Pending':
+      return 'degraded'
+    case 'Succeeded':
+      return 'neutral'
+    default:
+      return 'unknown'
+  }
+}
+
 export function TopologyGraph({
   topology,
   viewMode,
@@ -430,7 +447,7 @@ export function TopologyGraph({
         // the kubelet's Waiting->Running oscillation, which the phase alone
         // hides — a crash-looping pod sits at Phase=Running. Deriving it here
         // again would rebuild that logic in a second place and get it wrong.
-        status: pod.status ?? 'unknown',
+        status: pod.status ?? phaseOnlyHealth(pod.phase),
         data: {
           ...podGroupNode.data,
           namespace: pod.namespace,

package/src/components/topology/pod-phase-fallback.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest'
+import { phaseOnlyHealth } from './TopologyGraph'
+
+// Only reached when the server sent no per-pod status — an older Radar behind a
+// newer embedding host. The point of the fallback is that it must not repeat the
+// bug it stands in for.
+describe('phaseOnlyHealth', () => {
+  it('does not call a Running pod healthy', () => {
+    // A crash-looping pod sits at Phase=Running with its container restarting,
+    // so Running is the one phase that hides a fault.
+    expect(phaseOnlyHealth('Running')).toBe('unknown')
+  })
+
+  it('reads the phases that are honest on their own', () => {
+    expect(phaseOnlyHealth('Failed')).toBe('unhealthy')
+    expect(phaseOnlyHealth('Pending')).toBe('degraded')
+    expect(phaseOnlyHealth('Succeeded')).toBe('neutral')
+  })
+
+  it('says nothing for a phase it does not recognise', () => {
+    expect(phaseOnlyHealth(undefined)).toBe('unknown')
+    expect(phaseOnlyHealth('SomeFuturePhase')).toBe('unknown')
+  })
+})

package/src/theme/components.css

@@ -228,6 +228,35 @@
     border-color: transparent;
   }
 
+  /* Colour-named accents carry no health meaning — they exist so an
+     informational badge can pick a hue without borrowing a status semantic.
+     A categorical badge (an admission verb, a policy action, a configured
+     mode) belongs here; only evidence about a resource's condition belongs on
+     .status-healthy / -degraded / -unhealthy. */
+  .status-green {
+    background-color: light-dark(rgba(34, 197, 94, 0.15), rgba(34, 197, 94, 0.2));
+    color: light-dark(#15803d, #4ade80);
+    border-color: transparent;
+  }
+
+  .status-red {
+    background-color: light-dark(rgba(239, 68, 68, 0.15), rgba(239, 68, 68, 0.2));
+    color: light-dark(#b91c1c, #f87171);
+    border-color: transparent;
+  }
+
+  .status-amber {
+    background-color: light-dark(rgba(234, 179, 8, 0.15), rgba(234, 179, 8, 0.2));
+    color: light-dark(#a16207, #facc15);
+    border-color: transparent;
+  }
+
+  .status-blue {
+    background-color: light-dark(rgba(59, 130, 246, 0.15), rgba(59, 130, 246, 0.2));
+    color: light-dark(#2563eb, #60a5fa);
+    border-color: transparent;
+  }
+
   .status-cyan {
     background-color: light-dark(rgba(6, 182, 212, 0.15), rgba(6, 182, 212, 0.2));
     color: light-dark(#0891b2, #22d3ee);

package/src/utils/badge-colors.ts

@@ -74,7 +74,7 @@ export const NODEPOOL_MODE_BADGE: Record<string, string> = {
 
 // Translucent gray badge for "inactive / unknown / pending / unset / disabled" states.
 // The de-facto fallback in renderers when no severity or category applies.
-export const BADGE_INACTIVE = 'bg-gray-500/20 text-gray-400'
+export const BADGE_INACTIVE = 'status-unknown'
 
 // Best practices category colors
 export const BP_CATEGORY_BADGE: Record<string, string> = {

package/src/utils/index.ts

@@ -7,6 +7,7 @@ export * from './navigation'
 export * from './context-name'
 export * from './animation'
 export * from './resource-hierarchy'
+export * from './log-export'
 export * from './log-format'
 export * from './download'
 export * from './clipboard'

package/src/utils/log-export.test.ts

@@ -0,0 +1,225 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  LOG_EXPORT_FORMATS,
+  previewLogExport,
+  serializeLogEntries,
+  type ExportableLogEntry,
+  type LogExportFormat,
+} from './log-export'
+
+const ESC = '\u001b'
+
+const entry = (over: Partial<ExportableLogEntry> = {}): ExportableLogEntry => ({
+  timestamp: '2024-01-20T10:30:00.123456789Z',
+  content: 'connection refused',
+  container: 'app',
+  pod: 'api-7d9f',
+  ...over,
+})
+
+const opts = (over: Partial<{ format: LogExportFormat; showTimestamps: boolean; showPodName: boolean }> = {}) => ({
+  format: 'txt' as LogExportFormat,
+  showTimestamps: true,
+  showPodName: true,
+  ...over,
+})
+
+describe('serializeLogEntries — text', () => {
+  it('emits the raw RFC3339 timestamp rather than any display format', () => {
+    const { content } = serializeLogEntries([entry()], opts({ showPodName: false }))
+    expect(content).toBe('2024-01-20T10:30:00.123456789Z connection refused')
+  })
+
+  it('omits timestamps when the viewer has them hidden', () => {
+    const { content } = serializeLogEntries([entry()], opts({ showTimestamps: false, showPodName: false }))
+    expect(content).toBe('connection refused')
+  })
+
+  it('attributes pod and container when pod names are shown', () => {
+    const { content } = serializeLogEntries([entry()], opts({ showTimestamps: false }))
+    expect(content).toBe('[api-7d9f/app] connection refused')
+  })
+
+  it('falls back to the pod alone when no container is known', () => {
+    const { content } = serializeLogEntries([entry({ container: undefined })], opts({ showTimestamps: false }))
+    expect(content).toBe('[api-7d9f] connection refused')
+  })
+
+  it('drops pod attribution for entries with no pod, even when the toggle is on', () => {
+    const { content } = serializeLogEntries([entry({ pod: undefined })], opts({ showTimestamps: false }))
+    expect(content).toBe('connection refused')
+  })
+
+  it('skips an empty timestamp instead of emitting a leading space', () => {
+    const { content } = serializeLogEntries([entry({ timestamp: '' })], opts({ showPodName: false }))
+    expect(content).toBe('connection refused')
+  })
+
+  it('strips ANSI escapes', () => {
+    const { content } = serializeLogEntries(
+      [entry({ content: `${ESC}[31mconnection refused${ESC}[0m` })],
+      opts({ showTimestamps: false, showPodName: false }),
+    )
+    expect(content).toBe('connection refused')
+  })
+
+  it('preserves raw JSON content rather than any collapsed rendering', () => {
+    const json = '{"level":"error","msg":"connection refused","stack":"a\\nb"}'
+    const { content } = serializeLogEntries([entry({ content: json })], opts({ showTimestamps: false, showPodName: false }))
+    expect(content).toBe(json)
+  })
+
+  it('joins entries with newlines and returns empty for no entries', () => {
+    const { content } = serializeLogEntries(
+      [entry({ content: 'first' }), entry({ content: 'second' })],
+      opts({ showTimestamps: false, showPodName: false }),
+    )
+    expect(content).toBe('first\nsecond')
+    expect(serializeLogEntries([], opts()).content).toBe('')
+  })
+})
+
+describe('serializeLogEntries — structured formats', () => {
+  it('keeps the timestamp field in JSON even when the display toggle is off', () => {
+    const { content, mime, extension } = serializeLogEntries(
+      [entry()],
+      opts({ format: 'json', showTimestamps: false }),
+    )
+    expect(JSON.parse(content)).toEqual([{
+      timestamp: '2024-01-20T10:30:00.123456789Z',
+      pod: 'api-7d9f',
+      container: 'app',
+      content: 'connection refused',
+    }])
+    expect(mime).toBe('application/json;charset=utf-8')
+    expect(extension).toBe('json')
+  })
+
+  it('keeps the pod key in JSON even when pod attribution is off, since the display toggle is not a schema', () => {
+    const { content } = serializeLogEntries([entry()], opts({ format: 'json', showPodName: false }))
+    expect(Object.keys(JSON.parse(content)[0])).toEqual(['timestamp', 'pod', 'container', 'content'])
+  })
+
+  it('omits the pod key only for entries that genuinely have no pod', () => {
+    const { content } = serializeLogEntries([entry({ pod: undefined })], opts({ format: 'json' }))
+    expect(Object.keys(JSON.parse(content)[0])).toEqual(['timestamp', 'container', 'content'])
+  })
+
+  it('strips ANSI from structured content too', () => {
+    const { content } = serializeLogEntries(
+      [entry({ content: `${ESC}[31mboom${ESC}[0m` })],
+      opts({ format: 'json' }),
+    )
+    expect(JSON.parse(content)[0].content).toBe('boom')
+  })
+
+  it('writes a CSV header matching the columns it emits', () => {
+    const { content, mime } = serializeLogEntries([entry()], opts({ format: 'csv' }))
+    expect(content.split('\n')).toEqual([
+      'timestamp,pod,container,content',
+      '"2024-01-20T10:30:00.123456789Z","api-7d9f","app","connection refused"',
+    ])
+    expect(mime).toBe('text/csv;charset=utf-8')
+  })
+
+  it('keeps the CSV pod column when pod attribution is off but the data has pods', () => {
+    const { content } = serializeLogEntries([entry()], opts({ format: 'csv', showPodName: false }))
+    expect(content.split('\n')[0]).toBe('timestamp,pod,container,content')
+  })
+
+  it('drops the CSV pod column only when no entry has a pod', () => {
+    const { content } = serializeLogEntries([entry({ pod: undefined })], opts({ format: 'csv' }))
+    expect(content.split('\n')).toEqual([
+      'timestamp,container,content',
+      '"2024-01-20T10:30:00.123456789Z","app","connection refused"',
+    ])
+  })
+
+  it('keeps the column count aligned when only some entries carry a pod', () => {
+    const { content } = serializeLogEntries(
+      [entry({ pod: undefined }), entry()],
+      opts({ format: 'csv' }),
+    )
+    const [header, ...rows] = content.split('\n')
+    expect(header.split(',').length).toBe(4)
+    for (const row of rows) expect(row.split('","').length).toBe(4)
+  })
+
+  it('neutralizes cells a spreadsheet would evaluate as a formula', () => {
+    const { content } = serializeLogEntries(
+      [entry({ content: '=cmd|\' /c calc\'!A1' }), entry({ content: '+1' }), entry({ content: '-rf /' }), entry({ content: '@SUM(A1)' })],
+      opts({ format: 'csv', showPodName: false }),
+    )
+    const cells = content.split('\n').slice(1).map(r => r.split(',').pop())
+    expect(cells).toEqual([
+      '"\'=cmd|\' /c calc\'!A1"',
+      '"\'+1"',
+      '"\'-rf /"',
+      '"\'@SUM(A1)"',
+    ])
+  })
+
+  it('leaves ordinary content unprefixed', () => {
+    const { content } = serializeLogEntries([entry()], opts({ format: 'csv', showPodName: false }))
+    expect(content).toContain('"connection refused"')
+  })
+
+  it('doubles quotes inside a CSV cell', () => {
+    const { content } = serializeLogEntries(
+      [entry({ content: 'said "hello"', pod: undefined })],
+      opts({ format: 'csv' }),
+    )
+    expect(content.split('\n')[1]).toBe('"2024-01-20T10:30:00.123456789Z","app","said ""hello"""')
+  })
+
+  it('emits a header-only CSV and an empty JSON array for no entries', () => {
+    expect(serializeLogEntries([], opts({ format: 'csv' })).content).toBe('timestamp,container,content')
+    expect(serializeLogEntries([], opts({ format: 'json' })).content).toBe('[]')
+  })
+
+  it('declares a charset so non-ASCII content survives a spreadsheet import', () => {
+    for (const format of LOG_EXPORT_FORMATS) {
+      expect(serializeLogEntries([], opts({ format })).mime).toContain('charset=utf-8')
+    }
+  })
+})
+
+describe('previewLogExport', () => {
+  it('shows the first two lines of a text export', () => {
+    expect(previewLogExport(
+      [entry({ content: 'first' }), entry({ content: 'second' }), entry({ content: 'third' })],
+      opts({ showTimestamps: false, showPodName: false }),
+    )).toEqual(['first', 'second'])
+  })
+
+  it('shows one compact object for JSON, not the pretty-printed array', () => {
+    const [line, ...rest] = previewLogExport([entry()], opts({ format: 'json' }))
+    expect(rest).toEqual([])
+    expect(line).toBe('{"timestamp":"2024-01-20T10:30:00.123456789Z","pod":"api-7d9f","container":"app","content":"connection refused"}')
+  })
+
+  it('shows the CSV header alongside a row so the columns are legible', () => {
+    expect(previewLogExport([entry()], opts({ format: 'csv' }))).toEqual([
+      'timestamp,pod,container,content',
+      '"2024-01-20T10:30:00.123456789Z","api-7d9f","app","connection refused"',
+    ])
+  })
+
+  it('previews exactly what the payload contains', () => {
+    for (const format of ['txt', 'json', 'csv'] as LogExportFormat[]) {
+      const o = opts({ format })
+      const preview = previewLogExport([entry()], o)
+      const { content } = serializeLogEntries([entry()], o)
+      for (const line of preview) {
+        // JSON pretty-prints across lines, so compare on the field values instead.
+        if (format === 'json') expect(JSON.parse(content)[0]).toEqual(JSON.parse(line))
+        else expect(content.split('\n')).toContain(line)
+      }
+    }
+  })
+
+  it('returns nothing when there is nothing to export', () => {
+    expect(previewLogExport([], opts())).toEqual([])
+  })
+})

package/src/utils/log-export.ts

@@ -0,0 +1,149 @@
+/**
+ * Serialization for the log viewer's export popover.
+ *
+ * Copy and download share this module so the two can never disagree about what
+ * a line looks like — the popover's preview is rendered from the same functions
+ * that produce the payload.
+ */
+
+import { stripAnsi } from './log-format'
+
+export type LogExportFormat = 'txt' | 'json' | 'csv'
+
+export interface ExportableLogEntry {
+  timestamp: string
+  content: string
+  container?: string
+  pod?: string
+}
+
+export interface LogExportOptions {
+  format: LogExportFormat
+  /**
+   * Mirrors the viewer's timestamp toggle, and applies to `txt` only. JSON and
+   * CSV always carry the timestamp: there it is a named field a reader can
+   * ignore, not the visual noise the toggle exists to suppress.
+   */
+  showTimestamps: boolean
+  /**
+   * Mirrors the viewer's pod attribution, and — like `showTimestamps` — applies
+   * to `txt` only. JSON and CSV carry `pod` whenever the entry has one: a
+   * display preference must not silently strip the column that makes a
+   * multi-pod export attributable.
+   */
+  showPodName: boolean
+}
+
+export interface LogExportPayload {
+  content: string
+  mime: string
+  extension: LogExportFormat
+}
+
+// Charset is explicit: log content is arbitrary UTF-8, and Excel on Windows
+// falls back to a legacy code page without it.
+const MIME: Record<LogExportFormat, string> = {
+  txt: 'text/plain;charset=utf-8',
+  json: 'application/json;charset=utf-8',
+  csv: 'text/csv;charset=utf-8',
+}
+
+/** Display order for the format picker. */
+export const LOG_EXPORT_FORMATS: readonly LogExportFormat[] = ['txt', 'json', 'csv']
+
+export const LOG_EXPORT_FORMAT_LABELS: Record<LogExportFormat, string> = {
+  txt: 'Text',
+  json: 'JSON',
+  csv: 'CSV',
+}
+
+/**
+ * One entry as the viewer would read it back: timestamps raw rather than in the
+ * display format, since an exported line is correlated against other systems
+ * long after the screen that produced it is gone.
+ */
+function textLine(entry: ExportableLogEntry, { showTimestamps, showPodName }: LogExportOptions): string {
+  const parts: string[] = []
+  if (showTimestamps && entry.timestamp) parts.push(entry.timestamp)
+  if (showPodName && entry.pod) parts.push(entry.container ? `[${entry.pod}/${entry.container}]` : `[${entry.pod}]`)
+  parts.push(stripAnsi(entry.content))
+  return parts.join(' ')
+}
+
+function jsonEntry(entry: ExportableLogEntry): Record<string, string> {
+  return {
+    timestamp: entry.timestamp,
+    ...(entry.pod ? { pod: entry.pod } : {}),
+    ...(entry.container ? { container: entry.container } : {}),
+    content: stripAnsi(entry.content),
+  }
+}
+
+/** Columns follow the data, not a display toggle, so a row can never carry a field the header doesn't name. */
+function csvColumns(entries: readonly ExportableLogEntry[]): string[] {
+  return entries.some(e => e.pod)
+    ? ['timestamp', 'pod', 'container', 'content']
+    : ['timestamp', 'container', 'content']
+}
+
+// A cell opening with one of these is a formula to Excel and Sheets, and quoting
+// does not stop it — the quotes are stripped before evaluation. Log content is
+// whatever a pod chose to print, so the leading apostrophe (which spreadsheets
+// consume on import) is the difference between a CSV and an execution vector.
+const SPREADSHEET_FORMULA_START = /^[=+\-@\t\r]/
+
+function csvCell(value: string): string {
+  const escaped = (SPREADSHEET_FORMULA_START.test(value) ? `'${value}` : value).replace(/"/g, '""')
+  return `"${escaped}"`
+}
+
+function csvRow(entry: ExportableLogEntry, columns: readonly string[]): string {
+  const cells = [
+    entry.timestamp,
+    ...(columns.includes('pod') ? [entry.pod ?? ''] : []),
+    entry.container ?? '',
+    stripAnsi(entry.content),
+  ]
+  return cells.map(csvCell).join(',')
+}
+
+export function serializeLogEntries(
+  entries: readonly ExportableLogEntry[],
+  opts: LogExportOptions,
+): LogExportPayload {
+  const base = { mime: MIME[opts.format], extension: opts.format }
+  switch (opts.format) {
+    case 'json':
+      return { ...base, content: JSON.stringify(entries.map(jsonEntry), null, 2) }
+    case 'csv': {
+      const columns = csvColumns(entries)
+      return { ...base, content: [columns.join(','), ...entries.map(e => csvRow(e, columns))].join('\n') }
+    }
+    default:
+      return { ...base, content: entries.map(e => textLine(e, opts)).join('\n') }
+  }
+}
+
+/**
+ * Up to two representative lines for the popover's preview box. This is the only
+ * thing telling the user which fields their export carries, so it renders the
+ * shape of the real output rather than a description of it: for CSV that means
+ * the header alongside a row, and for JSON a single compact entry rather than
+ * the pretty-printed array the payload actually uses.
+ */
+export function previewLogExport(
+  entries: readonly ExportableLogEntry[],
+  opts: LogExportOptions,
+): string[] {
+  if (entries.length === 0) return []
+  switch (opts.format) {
+    case 'json':
+      return [JSON.stringify(jsonEntry(entries[0]))]
+    case 'csv': {
+      const columns = csvColumns(entries)
+      return [columns.join(','), csvRow(entries[0], columns)]
+    }
+    default:
+      return entries.slice(0, 2).map(e => textLine(e, opts))
+  }
+}

package/src/utils/navigation.test.ts

@@ -326,3 +326,13 @@ describe('lane identity helpers', () => {
     expect(parseLaneId('bogus')).toBeNull()
   })
 })
+
+describe('pluralToKind on absent input', () => {
+  // A saved investigation can carry an empty kind. This runs over every row of
+  // the run list, so throwing here took the whole investigations panel down and
+  // made every other run unopenable — one bad row, no panel.
+  test('returns the empty string instead of throwing', () => {
+    expect(() => pluralToKind('')).not.toThrow()
+    expect(pluralToKind('')).toBe('')
+  })
+})

package/src/utils/navigation.ts

@@ -147,6 +147,10 @@ export function kindToPluralWithGroup(kind: string, group: string): string {
  * singular PascalCase form for internal logic (health checks, badge colors, hierarchy matching).
  */
 export function pluralToKind(plural: string): string {
+  // A saved investigation can carry an empty kind, and this runs over every
+  // row of the run list — indexing [0] of "" threw and took the whole panel
+  // down with it, making every other run unopenable.
+  if (!plural) return plural
   const lower = plural.toLowerCase()
   const pluralToKindMap = getPluralToKind()