@skyhook-io/k8s-ui 1.18.0 → 1.18.1

package/src/utils/read-actions.ts

@@ -0,0 +1,56 @@
+// What resolves each read code, mirroring Radar's pkg/readreason. A test
+// checks this table against pkg/readreason/testdata/actions.json.
+export type ReadAction =
+  | 'retry'
+  | 'wait'
+  | 'check_target'
+  | 'change_request'
+  | 'user_access'
+  | 'radar_config'
+  | 'none'
+
+export const READ_ACTIONS: Record<string, ReadAction> = {
+  cluster_connecting: 'retry',
+  cluster_disconnected: 'radar_config',
+  connection_changed: 'check_target',
+  filter_eval_failed: 'change_request',
+  findings_scan_incomplete: 'change_request',
+  kind_not_watchable: 'change_request',
+  kind_not_searchable: 'change_request',
+  kind_sync_pending: 'retry',
+  kind_sync_timed_out: 'wait',
+  kind_unknown: 'change_request',
+  list_too_large: 'change_request',
+  namespace_not_found: 'change_request',
+  namespace_required: 'change_request',
+  object_not_found: 'none',
+  outside_namespace_pin: 'radar_config',
+  radar_credentials_rejected: 'radar_config',
+  radar_forbidden: 'radar_config',
+  radar_kind_not_collected: 'radar_config',
+  radar_namespace_not_collected: 'radar_config',
+  read_error: 'retry',
+  user_forbidden: 'user_access',
+  user_namespace_not_visible: 'change_request',
+  user_no_namespace_access: 'user_access',
+  user_permission_check_failed: 'retry',
+}
+
+// Spellings Radar releases sent before the shared vocabulary, for codes that
+// kept their meaning: a newer UI reading an older Radar reads them as the code
+// they became.
+const LEGACY_READ_CODES: Record<string, string> = {
+  kind_sync_failed: 'kind_sync_timed_out',
+  rbac_denied: 'user_forbidden',
+}
+
+/** The current spelling of a read code, translating one an older Radar sent. */
+export function canonicalReadCode(code: unknown): unknown {
+  return typeof code === 'string' ? (LEGACY_READ_CODES[code] ?? code) : code
+}
+
+/** The action for a code; an unknown code (from a newer Radar) is treated as needing a change. */
+export function readActionFor(code: unknown): ReadAction | undefined {
+  const current = canonicalReadCode(code)
+  return typeof current === 'string' ? (READ_ACTIONS[current] ?? 'change_request') : undefined
+}

package/src/utils/resource-coverage.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, it } from 'vitest'
+import type { ResourceReadCoverage } from '../types/resource-coverage'
+import { boundedCountLabel, isEmptyCount, isLowerBound, resourceCountHint, resourceCountLabel, resourceCoverageNotice, resourceEmptyMessage, resourceNarrowedNotice } from './resource-coverage'
+
+const partial: ResourceReadCoverage = {
+  status: 'partial', scope: { type: 'all_namespaces' },
+  read: { type: 'namespaces', namespaces: { count: 1000 } },
+  gaps: [{ code: 'radar_namespace_not_collected' }],
+}
+const complete: ResourceReadCoverage = { status: 'complete', gaps: [], scope: { type: 'all_namespaces' }, read: { type: 'all_namespaces' } }
+const collected: ResourceReadCoverage = {
+  status: 'complete', gaps: [], narrowedBy: ['namespace_collection'],
+  scope: { type: 'namespaces', namespaces: { names: ['alpha', 'beta', 'gamma', 'ns-04', 'ns-05', 'ns-06', 'ns-07', 'ns-08', 'ns-09', 'ns-10', 'ns-11', 'ns-12'], count: 12 } },
+  read: { type: 'namespaces', namespaces: { names: ['alpha', 'beta', 'gamma', 'ns-04', 'ns-05', 'ns-06', 'ns-07', 'ns-08', 'ns-09', 'ns-10', 'ns-11', 'ns-12'], count: 12 } },
+}
+
+describe('partial coverage notice', () => {
+  it('counts a namespace set too large to name', () => {
+    expect(resourceCoverageNotice(partial)).toContain('Radar read 1,000 namespaces;')
+  })
+  it('previews a named set', () => {
+    expect(resourceCoverageNotice({ ...partial, read: { type: 'namespaces', namespaces: { names: ['alpha', 'beta', 'gamma', 'delta'], count: 4 } } })).toContain('alpha, beta, gamma and 1 more')
+  })
+  it('explains loading and collector denial without calling either absence', () => {
+    expect(resourceCoverageNotice({ ...partial, gaps: [{ code: 'kind_sync_pending' }] })).toContain('still loading')
+    expect(resourceCoverageNotice({ ...partial, gaps: [{ code: 'radar_forbidden' }] })).toContain("Radar's collector could not read")
+    expect(resourceCoverageNotice(partial)).toContain("Radar doesn't collect this kind")
+    expect(resourceCoverageNotice({ ...partial, gaps: [{ code: 'radar_namespace_not_collected' }, { code: 'kind_sync_pending' }] })).toContain('still loading')
+  })
+  it('names small gaps and reserves "requested" for unnamed explicit scope', () => {
+    expect(resourceCoverageNotice(partial)).toBe("Partial results. Radar read 1,000 namespaces; Radar doesn't collect this kind in some namespaces.")
+    const named = { ...partial, scope: { type: 'namespaces' as const, namespaces: { names: ['alpha', 'zeta'], count: 2 } }, read: { type: 'namespaces' as const, namespaces: { names: ['alpha'], count: 1 } }, gaps: [{ code: 'radar_namespace_not_collected', namespaces: { names: ['zeta'], count: 1 } }] }
+    expect(resourceCoverageNotice(named, 'Pods')).toBe("Partial results. Radar read alpha; Radar doesn't collect Pods in zeta.")
+    expect(resourceCoverageNotice({ ...named, gaps: [{ code: 'radar_namespace_not_collected', namespaces: { count: 1 } }] })).toContain('some requested namespaces')
+    expect(resourceCoverageNotice({ ...named, narrowedBy: ['user_access'] })).not.toContain('requested')
+  })
+
+  it('does not warn on a complete or unknown answer', () => {
+    expect(resourceCoverageNotice(complete)).toBeUndefined()
+    expect(resourceCoverageNotice(collected)).toBeUndefined()
+    expect(resourceCoverageNotice({ status: 'unknown' })).toBeUndefined()
+    expect(resourceCoverageNotice(undefined)).toBeUndefined()
+  })
+})
+
+describe('narrowed coverage note', () => {
+  it('names the namespaces Radar collects, bounded', () => {
+    expect(resourceNarrowedNotice(collected)).toBe('Radar collects this kind only in 12 namespaces: alpha, beta, gamma and 9 more.')
+    expect(resourceNarrowedNotice({ ...collected, scope: { type: 'namespaces', namespaces: { names: ['alpha'], count: 1 } } })).toBe('Radar collects this kind only in 1 namespace: alpha.')
+  })
+  it('is shown only for collection, which the namespace picker does not show', () => {
+    for (const narrowing of ['user_access', 'namespace_pin']) {
+      expect(resourceNarrowedNotice({ ...collected, narrowedBy: [narrowing] })).toBeUndefined()
+    }
+    expect(resourceNarrowedNotice({ ...collected, narrowedBy: ['user_access', 'namespace_collection'] })).toBe('Radar collects this kind only in 12 of your namespaces: alpha, beta, gamma and 9 more.')
+    expect(resourceNarrowedNotice(complete)).toBeUndefined()
+    expect(resourceNarrowedNotice({ ...collected, status: 'partial' })).toBeUndefined()
+    expect(resourceNarrowedNotice({ status: 'unknown' })).toBeUndefined()
+  })
+})
+
+describe('empty lists and counts', () => {
+  it('distinguishes complete, partial, unknown and filtered-empty results', () => {
+    expect(resourceEmptyMessage('Pod', complete, false)).toBe('No Pod found in the requested scope')
+    expect(resourceEmptyMessage('Pod', partial, false)).toContain('namespaces Radar could read')
+    expect(resourceEmptyMessage('Pod', partial, true)).toContain('match the current filters')
+  })
+  it('keeps an older Radar\'s empty list as it read before coverage', () => {
+    expect(resourceEmptyMessage('Pod', { status: 'unknown' }, false)).toBe('No Pod found')
+    expect(resourceEmptyMessage('Pod', undefined, false)).toBe('No Pod found')
+  })
+  it('bounds partial counts and never treats a partial zero as absence', () => {
+    expect(resourceCountLabel(23, partial)).toBe('≥23')
+    expect(resourceCountLabel(0, partial)).toBe('–')
+    expect(isEmptyCount(0, partial)).toBe(false)
+  })
+  it('treats a partial or collection-narrowed read as a lower bound for the cluster', () => {
+    expect(isLowerBound(partial)).toBe(true)
+    expect(isLowerBound(collected)).toBe(true)
+    expect(isLowerBound(complete)).toBe(false)
+    expect(isLowerBound({ status: 'unknown' })).toBe(false)
+    expect(isLowerBound(undefined)).toBe(false)
+  })
+  it("never hides a kind whose zero covers only the namespaces Radar collects", () => {
+    expect(isEmptyCount(0, collected)).toBe(false)
+    expect(resourceEmptyMessage('Pod', collected, false)).toBe('No Pod found in the namespaces Radar collects')
+  })
+  it('bounds a collection-narrowed count: Radar did not count the namespaces it does not collect', () => {
+    expect(resourceCountLabel(23, collected)).toBe('≥23')
+    expect(resourceCountLabel(0, collected)).toBe('–')
+    expect(resourceCountHint(collected)).toBe('Radar collects this kind only in some namespaces; more may exist elsewhere.')
+    expect(resourceCountHint(partial)).toBe('Count in the namespaces Radar could read; more may exist outside them.')
+    expect(resourceCountHint(complete)).toBeUndefined()
+  })
+  it('shows complete and unknown counts plainly, and hides their zeros', () => {
+    expect(resourceCountLabel(23, complete)).toBe('23')
+    expect(resourceCountLabel(23, { status: 'unknown' })).toBe('23')
+    expect(resourceCountLabel(0, { status: 'unknown' })).toBe('0')
+    expect(resourceCountLabel(23, undefined)).toBe('23')
+    expect(isEmptyCount(0, complete)).toBe(true)
+    expect(isEmptyCount(0, { status: 'unknown' })).toBe(true)
+    expect(isEmptyCount(0, undefined)).toBe(true)
+    expect(isEmptyCount(3, complete)).toBe(false)
+    expect(isEmptyCount(null, complete)).toBe(false)
+  })
+  it('formats large counts in either case', () => {
+    expect(boundedCountLabel(12345, true)).toBe(`≥${(12345).toLocaleString()}`)
+    expect(boundedCountLabel(12345, false)).toBe((12345).toLocaleString())
+  })
+})
+
+ it('names a small excluded namespace set with its kind', () => {
+  const coverage: ResourceReadCoverage = { status: 'partial', scope: { type: 'all_namespaces' }, read: { type: 'namespaces', namespaces: { count: 1, names: ['read-a'] } }, gaps: [{ code: 'user_forbidden', namespaces: { count: 1, names: ['read-b'] } }] }
+  expect(resourceCoverageNotice(coverage, 'Secrets')).toBe('Partial results. Radar read read-a; your permissions exclude Secrets in read-b.')
+  coverage.gaps[0].namespaces = { count: 3, names: ['b', 'c', 'd'] }
+  expect(resourceCoverageNotice(coverage, 'Secrets')).toContain('Secrets in b, c, d.')
+  coverage.gaps[0].namespaces = { count: 4, names: ['b', 'c', 'd', 'e'] }
+  expect(resourceCoverageNotice(coverage, 'Secrets')).toContain('your permissions exclude some namespaces.')
+  coverage.gaps[0].namespaces = { count: 2 }
+  expect(resourceCoverageNotice(coverage, 'Secrets')).toContain('your permissions exclude some namespaces.')
+ })

package/src/utils/resource-coverage.ts

@@ -0,0 +1,117 @@
+import type { ReadNameSet } from '../types/read-coverage'
+import type { ResourceCoverage } from '../types/resource-coverage'
+import { pluralNoun, pluralize } from './pluralize'
+
+// Only a partial answer is qualified. Unknown coverage (an older Radar, or a
+// host that passes none) keeps the presentation that predates coverage: plain
+// counts, empty kinds hidden, and no notice.
+
+// gapPhrases says why the rest of the scope was not read, most actionable first.
+const gapPhrases: [string, (where: string) => string][] = [
+  ['kind_sync_pending', where => `some ${where} are still loading`],
+  ['user_permission_check_failed', where => `access to some ${where} could not be verified`],
+  ['user_forbidden', where => `your permissions exclude some ${where}`],
+  ['user_namespace_not_visible', where => `some ${where} aren't visible to you`],
+  ['outside_namespace_pin', () => 'Radar is pinned to another namespace'],
+  ['radar_credentials_rejected', where => `Kubernetes rejected Radar's credentials for some ${where}`],
+  ['radar_forbidden', where => `Radar's collector could not read some ${where}`],
+  ['kind_sync_timed_out', where => `some ${where} haven't finished loading`],
+  ['radar_namespace_not_collected', where => `Radar doesn't collect this kind in some ${where}`],
+]
+
+/** The first few names of a set and how many more there are; empty when the set is too large to name. */
+function namespacePreview({ names, count }: ReadNameSet): string {
+  if (!names?.length) return ''
+  const extra = count - Math.min(names.length, 3)
+  return `${names.slice(0, 3).join(', ')}${extra > 0 ? ` and ${extra} more` : ''}`
+}
+
+export function resourceCoverageNotice(coverage: ResourceCoverage | undefined, kind = "resources"): string | undefined {
+  if (coverage?.status !== 'partial') return undefined
+  const read = coverage.read
+  if (read?.type !== 'namespaces' || !read.namespaces) return 'Partial results. Radar could not read the whole requested scope.'
+  const { count } = read.namespaces
+  const scope = namespacePreview(read.namespaces) || `${count.toLocaleString()} ${pluralNoun(count, 'namespace')}`
+  // A broad request named no namespaces, so none of them were "requested".
+  const where = coverage.scope.type === 'namespaces' && !coverage.narrowedBy?.length ? 'requested namespaces' : 'namespaces'
+  const codes = new Set(coverage.gaps.map(gap => gap.code))
+  const phrase = gapPhrases.find(([code]) => codes.has(code))
+  const affected = coverage.gaps.filter(gap => gap.code === phrase?.[0]).map(gap => gap.namespaces)
+  const names = [...new Set(affected.flatMap(set => set?.names ?? []))]
+  const canName = affected.length > 0 && names.length > 0 && names.length <= 3 && affected.every(set => set && !set.extent && set.names?.length === set.count)
+  const namedScope = `${kind} in ${names.join(', ')}`
+  const namedPhrases: Record<string, string> = {
+    kind_sync_pending: `${namedScope} are still loading`,
+    user_permission_check_failed: `access to ${namedScope} could not be verified`,
+    user_forbidden: `your permissions exclude ${namedScope}`,
+    user_namespace_not_visible: `${names.join(', ')} ${names.length === 1 ? "isn't" : "aren't"} visible to you`,
+    radar_credentials_rejected: `Kubernetes rejected Radar's credentials for ${namedScope}`,
+    radar_forbidden: `Radar's collector could not read ${namedScope}`,
+    kind_sync_timed_out: `${namedScope} haven't finished loading`,
+    radar_namespace_not_collected: `Radar doesn't collect ${namedScope}`,
+  }
+  const gap = (canName && phrase && namedPhrases[phrase[0]]) || phrase?.[1](where) || `other ${where} were not read`
+  return `Partial results. Radar read ${scope}; ${gap}.`
+}
+
+/**
+ * A complete answer whose scope Radar's own collection narrowed. The other
+ * narrowings (the caller's access and Radar's pin) already show
+ * in the namespace picker, so they get no note.
+ */
+export function resourceNarrowedNotice(coverage: ResourceCoverage | undefined): string | undefined {
+  if (coverage?.status !== 'complete' || !coverage.narrowedBy?.includes('namespace_collection')) return undefined
+  const namespaces = coverage.scope.namespaces
+  if (!namespaces) return 'Radar collects this kind only in some namespaces.'
+  const preview = namespacePreview(namespaces)
+  // With the caller's access also narrowing it, the scope is the part of their
+  // namespaces Radar collects, not everything Radar collects.
+  const where = coverage.narrowedBy.includes('user_access')
+    ? `${namespaces.count.toLocaleString()} of your namespaces`
+    : pluralize(namespaces.count, 'namespace')
+  return `Radar collects this kind only in ${where}${preview ? `: ${preview}` : ''}.`
+}
+
+export function resourceEmptyMessage(kind: string, coverage: ResourceCoverage | undefined, hasRows: boolean): string {
+  if (hasRows) return `No ${kind} match the current filters`
+  if (coverage?.status === 'complete' && coverage.narrowedBy?.includes('namespace_collection')) return `No ${kind} found in the namespaces Radar collects`
+  if (coverage?.status === 'complete') return `No ${kind} found in the requested scope`
+  if (coverage?.status === 'partial') return `No ${kind} found in the namespaces Radar could read`
+  return `No ${kind} found`
+}
+
+/**
+ * Whether a read's numbers are a lower bound for the cluster: it was partial,
+ * or Radar's collection narrowed it to the namespaces it collects. Views show
+ * cluster totals, which a read of only the collected namespaces can't
+ * establish.
+ */
+export function isLowerBound(coverage: ResourceCoverage | undefined): boolean {
+  return coverage?.status === 'partial' || (coverage?.status === 'complete' && coverage.narrowedBy?.includes('namespace_collection') === true)
+}
+
+/**
+ * A zero that hides its kind as empty. A lower-bound zero proves nothing
+ * about the namespaces Radar couldn't read or doesn't collect.
+ */
+export function isEmptyCount(count: number | null | undefined, coverage: ResourceCoverage | undefined): boolean {
+  return count === 0 && !isLowerBound(coverage)
+}
+
+/** A lower-bound count reads "≥N", and a lower-bound zero is no count at all. */
+export function boundedCountLabel(count: number, lowerBound: boolean): string {
+  if (!lowerBound) return count.toLocaleString()
+  return count === 0 ? '–' : `≥${count.toLocaleString()}`
+}
+
+/** One kind's count: "≥N" when the read is a lower bound for the cluster (see isLowerBound). */
+export function resourceCountLabel(count: number, coverage: ResourceCoverage | undefined): string {
+  return boundedCountLabel(count, isLowerBound(coverage))
+}
+
+/** Why a kind's count is a lower bound, or undefined when it is exact. */
+export function resourceCountHint(coverage: ResourceCoverage | undefined): string | undefined {
+  if (coverage?.status === 'partial') return 'Count in the namespaces Radar could read; more may exist outside them.'
+  if (isLowerBound(coverage)) return 'Radar collects this kind only in some namespaces; more may exist elsewhere.'
+  return undefined
+}