@skyhook-io/k8s-ui 1.6.0 → 1.6.2

package/src/utils/gitops-owner.test.ts

@@ -1,136 +1,95 @@
 import { describe, it, expect } from 'vitest'
-import { detectGitOpsOwner } from './gitops-owner'
 
-const FLUX_HELM_NAME = 'helm.toolkit.fluxcd.io/name'
-const FLUX_HELM_NS = 'helm.toolkit.fluxcd.io/namespace'
-const FLUX_KUSTOMIZE_NAME = 'kustomize.toolkit.fluxcd.io/name'
-const FLUX_KUSTOMIZE_NS = 'kustomize.toolkit.fluxcd.io/namespace'
-const ARGO_TRACKING_ID = 'argocd.argoproj.io/tracking-id'
-const ARGO_INSTANCE = 'argocd.argoproj.io/instance'
-const HELM_INSTANCE = 'app.kubernetes.io/instance'
+import type { Relationships } from '../types/core'
 
-function resource(labels: Record<string, string> = {}, annotations: Record<string, string> = {}) {
-  return { metadata: { labels, annotations } }
-}
+import { gitOpsOwnerFromRelationships } from './gitops-owner'
 
-describe('detectGitOpsOwner', () => {
-  it('returns null for non-objects', () => {
-    expect(detectGitOpsOwner(null)).toBeNull()
-    expect(detectGitOpsOwner(undefined)).toBeNull()
-    expect(detectGitOpsOwner('string')).toBeNull()
+describe('gitOpsOwnerFromRelationships', () => {
+  it('returns null when relationships is undefined', () => {
+    expect(gitOpsOwnerFromRelationships(undefined)).toBeNull()
   })
 
-  it('returns null when no GitOps labels/annotations present', () => {
-    expect(detectGitOpsOwner(resource({ app: 'foo' }))).toBeNull()
+  it('returns null when managedBy is absent', () => {
+    expect(gitOpsOwnerFromRelationships({})).toBeNull()
   })
 
-  describe('Flux HelmRelease labels', () => {
-    it('extracts name + namespace', () => {
-      const got = detectGitOpsOwner(resource({
-        [FLUX_HELM_NAME]: 'podinfo',
-        [FLUX_HELM_NS]: 'flux-system',
-      }))
-      expect(got).toEqual({ tool: 'fluxcd', kind: 'helmreleases', namespace: 'flux-system', name: 'podinfo' })
-    })
-
-    it('wins over Flux Kustomize labels when both are present (most-direct owner)', () => {
-      const got = detectGitOpsOwner(resource({
-        [FLUX_HELM_NAME]: 'podinfo',
-        [FLUX_HELM_NS]: 'flux-system',
-        [FLUX_KUSTOMIZE_NAME]: 'parent',
-        [FLUX_KUSTOMIZE_NS]: 'flux-system',
-      }))
-      expect(got?.kind).toBe('helmreleases')
-      expect(got?.name).toBe('podinfo')
-    })
-
-    it('requires both name and namespace', () => {
-      expect(detectGitOpsOwner(resource({ [FLUX_HELM_NAME]: 'podinfo' }))).toBeNull()
-      expect(detectGitOpsOwner(resource({ [FLUX_HELM_NS]: 'flux-system' }))).toBeNull()
-    })
+  it('returns null when managedBy is empty', () => {
+    expect(gitOpsOwnerFromRelationships({ managedBy: [] })).toBeNull()
   })
 
-  describe('Flux Kustomize labels', () => {
-    it('extracts name + namespace', () => {
-      const got = detectGitOpsOwner(resource({
-        [FLUX_KUSTOMIZE_NAME]: 'infra',
-        [FLUX_KUSTOMIZE_NS]: 'flux-system',
-      }))
-      expect(got).toEqual({ tool: 'fluxcd', kind: 'kustomizations', namespace: 'flux-system', name: 'infra' })
+  it('maps an ArgoCD Application ref', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'storefront' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'argocd',
+      kind: 'applications',
+      namespace: 'argocd',
+      name: 'storefront',
     })
   })
 
-  describe('Argo tracking-id annotation', () => {
-    it('parses the namespaced form (<ns>_<name>:...)', () => {
-      const got = detectGitOpsOwner(resource({}, {
-        [ARGO_TRACKING_ID]: 'argocd_my-app:apps/Deployment:default/web',
-      }))
-      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'my-app' })
-    })
-
-    it('parses the legacy single-name form (no underscore)', () => {
-      const got = detectGitOpsOwner(resource({}, {
-        [ARGO_TRACKING_ID]: 'my-app:apps/Deployment:default/web',
-      }))
-      // Empty namespace is the contract — caller defaults / routes accordingly.
-      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: '', name: 'my-app' })
-    })
-
-    it('returns null on a malformed tracking-id (no colon)', () => {
-      const got = detectGitOpsOwner(resource({}, { [ARGO_TRACKING_ID]: 'just-garbage-no-colon' }))
-      // Falls through to label scan; with no labels present, returns null.
-      expect(got).toBeNull()
-    })
-
-    it('returns null on tracking-id with empty name after underscore', () => {
-      const got = detectGitOpsOwner(resource({}, { [ARGO_TRACKING_ID]: 'my-ns_:apps/Deployment:default/web' }))
-      expect(got).toBeNull()
+  it('maps a Flux Kustomization ref', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'Kustomization', group: 'kustomize.toolkit.fluxcd.io', namespace: 'flux-system', name: 'prod-apps' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'fluxcd',
+      kind: 'kustomizations',
+      namespace: 'flux-system',
+      name: 'prod-apps',
     })
+  })
 
-    it('wins over the bare instance label (most authoritative)', () => {
-      const got = detectGitOpsOwner(resource(
-        { [ARGO_INSTANCE]: 'wrong-app' },
-        { [ARGO_TRACKING_ID]: 'argocd_right-app:apps/Deployment:default/web' },
-      ))
-      expect(got?.name).toBe('right-app')
-      expect(got?.namespace).toBe('argocd')
+  it('maps a Flux HelmRelease ref', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'HelmRelease', group: 'helm.toolkit.fluxcd.io', namespace: 'flux-system', name: 'cert-manager' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'fluxcd',
+      kind: 'helmreleases',
+      namespace: 'flux-system',
+      name: 'cert-manager',
     })
   })
 
-  describe('Argo instance label fallback', () => {
-    it('extracts name from argocd-specific instance label', () => {
-      const got = detectGitOpsOwner(resource({ [ARGO_INSTANCE]: 'guestbook' }))
-      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: '', name: 'guestbook' })
-    })
+  it('disambiguates Flux HelmRelease from native Helm via API group', () => {
+    // A native Helm release would not carry the helm.toolkit.fluxcd.io group;
+    // server-side SynthesizeManagedBy only assigns that group for Flux.
+    const rel: Relationships = {
+      managedBy: [{ kind: 'HelmRelease', group: 'helm.sh', namespace: 'default', name: 'native-helm' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toBeNull()
+  })
 
-    it('does NOT fall back to standard k8s instance label', () => {
-      // app.kubernetes.io/instance is stamped by virtually every Helm chart.
-      // Treating it as an Argo signal produced a false "Managed by <release>"
-      // chip on plain Helm-installed resources, so detection now requires an
-      // Argo-specific signal (tracking-id annotation or argocd.argoproj.io/instance).
-      expect(detectGitOpsOwner(resource({ [HELM_INSTANCE]: 'guestbook-healthy' }))).toBeNull()
-    })
+  it('returns null for native K8s owners (no GitOps chip)', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'Deployment', namespace: 'prod', name: 'web' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toBeNull()
+  })
 
-    it('argocd-specific label still wins when both labels present', () => {
-      const got = detectGitOpsOwner(resource({
-        [ARGO_INSTANCE]: 'argo-pick',
-        [HELM_INSTANCE]: 'helm-pick',
-      }))
-      expect(got?.name).toBe('argo-pick')
-    })
+  it('returns null for an unrecognized manager kind', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'CustomController', group: 'example.com', namespace: 'prod', name: 'thing' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toBeNull()
   })
 
-  describe('Flux labels beat Argo annotations', () => {
-    it('Flux HelmRelease wins over Argo tracking-id', () => {
-      const got = detectGitOpsOwner(resource(
-        {
-          [FLUX_HELM_NAME]: 'podinfo',
-          [FLUX_HELM_NS]: 'flux-system',
-        },
-        { [ARGO_TRACKING_ID]: 'argocd_some-app:apps/Deployment:default/web' },
-      ))
-      expect(got?.tool).toBe('fluxcd')
-      expect(got?.kind).toBe('helmreleases')
+  it('only considers the first managedBy entry', () => {
+    // The server emits the topmost meaningful manager first; if there are
+    // multiple, downstream chips intentionally only render the primary.
+    const rel: Relationships = {
+      managedBy: [
+        { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'primary' },
+        { kind: 'Kustomization', group: 'kustomize.toolkit.fluxcd.io', namespace: 'flux-system', name: 'secondary' },
+      ],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'argocd',
+      kind: 'applications',
+      namespace: 'argocd',
+      name: 'primary',
     })
   })
 })

package/src/utils/gitops-owner.ts

@@ -1,13 +1,12 @@
-// Detect whether a Kubernetes resource is managed by a GitOps controller
-// (ArgoCD or FluxCD) and return a navigable ref to its owning GitOps CR so the
-// drawer can render a "Managed by <app>" affordance.
+// Map a resource's server-side `Relationships.managedBy` to a navigable
+// GitOps owner ref, used by the drawer to render the "Managed by <app>" chip.
 //
-// Precedence (most-specific wins):
-//   1. Flux HelmRelease labels
-//   2. Flux Kustomize labels
-//   3. Argo tracking-id annotation
-//   4. Argo-specific instance label
-//   5. Standard k8s instance label (best-effort; false positives possible)
+// The detection (label/annotation parsing, Argo tracking-id decoding, Flux
+// label inspection, Helm release annotation, owner-chain walk) lives server-
+// side in pkg/topology.SynthesizeManagedBy. This file is now a thin mapper
+// from the structured ref into the discriminated union the chip + router need.
+
+import type { Relationships, ResourceRef } from '../types/core'
 
 // GitOpsOwnerRef is a discriminated union — the tool determines which kind is
 // valid. Modeling it this way prevents callers (and consumers of the returned
@@ -20,73 +19,37 @@ export type GitOpsOwnerRef =
 // Vocabulary mirrors `pkg/gitops/tree.Tool` so the wire labels match end-to-end.
 export type GitOpsOwnerTool = GitOpsOwnerRef['tool']
 
-const ARGO_TRACKING_ID_ANNOTATION = 'argocd.argoproj.io/tracking-id'
-const ARGO_INSTANCE_LABEL = 'argocd.argoproj.io/instance'
-// app.kubernetes.io/instance is intentionally NOT a fallback signal here.
-// It's the standard k8s recommended label and stamped by virtually every
-// Helm chart in existence, not just Argo. Treating it as an Argo ownership
-// hint produced false positives on plain Helm-installed resources, which
-// surfaced as a misleading "Managed by <release>" chip on ordinary workload
-// drawers. Argo installs that rely on this default can still be detected
-// via the tracking-id annotation; the `argocd.argoproj.io/instance` label
-// (above) covers Argo deployments that explicitly set their own label key.
-
-const FLUX_KUSTOMIZE_NAME = 'kustomize.toolkit.fluxcd.io/name'
-const FLUX_KUSTOMIZE_NS = 'kustomize.toolkit.fluxcd.io/namespace'
-const FLUX_HELM_NAME = 'helm.toolkit.fluxcd.io/name'
-const FLUX_HELM_NS = 'helm.toolkit.fluxcd.io/namespace'
-
-export function detectGitOpsOwner(resource: unknown): GitOpsOwnerRef | null {
-  if (!resource || typeof resource !== 'object') return null
-  const meta = (resource as { metadata?: { labels?: Record<string, string>; annotations?: Record<string, string> } }).metadata
-  const labels = meta?.labels ?? {}
-  const annotations = meta?.annotations ?? {}
-
-  const helmName = labels[FLUX_HELM_NAME]
-  const helmNs = labels[FLUX_HELM_NS]
-  if (helmName && helmNs) {
-    return { tool: 'fluxcd', kind: 'helmreleases', namespace: helmNs, name: helmName }
-  }
-  const kustName = labels[FLUX_KUSTOMIZE_NAME]
-  const kustNs = labels[FLUX_KUSTOMIZE_NS]
-  if (kustName && kustNs) {
-    return { tool: 'fluxcd', kind: 'kustomizations', namespace: kustNs, name: kustName }
-  }
+// API groups for GitOps manager kinds. Used to disambiguate Flux HelmRelease
+// from a future native-Helm kind, etc.
+const ARGO_APPLICATION_GROUP = 'argoproj.io'
+const FLUX_KUSTOMIZE_GROUP = 'kustomize.toolkit.fluxcd.io'
+const FLUX_HELM_GROUP = 'helm.toolkit.fluxcd.io'
 
-  const trackingID = annotations[ARGO_TRACKING_ID_ANNOTATION]
-  if (trackingID) {
-    const parsed = parseArgoTrackingID(trackingID)
-    if (parsed) {
-      return { tool: 'argocd', kind: 'applications', namespace: parsed.namespace, name: parsed.name }
-    }
-  }
-
-  const instance = labels[ARGO_INSTANCE_LABEL]
-  if (instance) {
-    // App namespace unknown without tracking-id; emit empty so the consumer can
-    // either skip the link or default to a well-known namespace.
-    return { tool: 'argocd', kind: 'applications', namespace: '', name: instance }
-  }
-
-  return null
+// gitOpsOwnerFromRelationships reads relationships.managedBy[0] and maps it to
+// a GitOpsOwnerRef when the manager is a GitOps controller. Returns null when
+// the manager is a native K8s owner (Deployment, ReplicaSet, etc.), a plain
+// Helm release, or when no manager is reported.
+//
+// Old radar binaries (pre-T2) emit no managedBy field; this returns null in
+// that case and the drawer silently skips the chip — natural pressure to
+// upgrade rather than carry a label-parsing fallback in the client.
+export function gitOpsOwnerFromRelationships(
+  rel: Relationships | undefined | null,
+): GitOpsOwnerRef | null {
+  const refs = rel?.managedBy
+  if (!refs || refs.length === 0) return null
+  return refToGitOpsOwner(refs[0])
 }
 
-// Argo CD writes its tracking-id in one of two forms depending on whether
-// installationID / namespaced-install is configured:
-//   "<appName>:<group>/<kind>:<resourceNs>/<resourceName>"                   default
-//   "<appNamespace>_<appName>:<group>/<kind>:<resourceNs>/<resourceName>"    namespaced install
-// We accept both. The legacy single-name form yields an empty namespace so the
-// caller can route to a "find this app" search instead of guessing.
-function parseArgoTrackingID(value: string): { namespace: string; name: string } | null {
-  const firstColon = value.indexOf(':')
-  if (firstColon < 0) return null
-  const head = value.slice(0, firstColon)
-  const sep = head.indexOf('_')
-  if (sep < 0) {
-    return head ? { namespace: '', name: head } : null
+function refToGitOpsOwner(ref: ResourceRef): GitOpsOwnerRef | null {
+  switch (true) {
+    case ref.kind === 'Application' && ref.group === ARGO_APPLICATION_GROUP:
+      return { tool: 'argocd', kind: 'applications', namespace: ref.namespace, name: ref.name }
+    case ref.kind === 'Kustomization' && ref.group === FLUX_KUSTOMIZE_GROUP:
+      return { tool: 'fluxcd', kind: 'kustomizations', namespace: ref.namespace, name: ref.name }
+    case ref.kind === 'HelmRelease' && ref.group === FLUX_HELM_GROUP:
+      return { tool: 'fluxcd', kind: 'helmreleases', namespace: ref.namespace, name: ref.name }
+    default:
+      return null
   }
-  const namespace = head.slice(0, sep)
-  const name = head.slice(sep + 1)
-  if (!name) return null
-  return { namespace, name }
 }

package/src/utils/helm-status.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest'
+import { isHelmReleaseActionable } from './badge-colors'
+
+// Pin the membership set so adding a new Helm status becomes a
+// deliberate decision here.
+
+describe('isHelmReleaseActionable', () => {
+  it('returns true for `failed`', () => {
+    expect(isHelmReleaseActionable('failed')).toBe(true)
+  })
+
+  it('is case-insensitive (matches Helm SDK serialisation variants)', () => {
+    expect(isHelmReleaseActionable('FAILED')).toBe(true)
+    expect(isHelmReleaseActionable('Failed')).toBe(true)
+  })
+
+  it('returns FALSE for the pending-* in-flight statuses', () => {
+    // These are Helm's NORMAL in-flight states during every
+    // routine install/upgrade/rollback. If we treated them as
+    // actionable, every routine install would briefly attach an
+    // alarming chevron + tooltip to its own row. Until we have
+    // release age available client-side to distinguish
+    // "transient" from "stuck > N min", we give up the
+    // stuck-controller signpost rather than alarm the common case.
+    expect(isHelmReleaseActionable('pending-install')).toBe(false)
+    expect(isHelmReleaseActionable('pending-upgrade')).toBe(false)
+    expect(isHelmReleaseActionable('pending-rollback')).toBe(false)
+  })
+
+  it('returns false for the success / normal statuses', () => {
+    expect(isHelmReleaseActionable('deployed')).toBe(false)
+    expect(isHelmReleaseActionable('superseded')).toBe(false)
+    expect(isHelmReleaseActionable('uninstalled')).toBe(false)
+  })
+
+  it('returns false for `uninstalling` (in-progress, not stuck)', () => {
+    expect(isHelmReleaseActionable('uninstalling')).toBe(false)
+  })
+
+  it('returns false for null / undefined / empty', () => {
+    expect(isHelmReleaseActionable(null)).toBe(false)
+    expect(isHelmReleaseActionable(undefined)).toBe(false)
+    expect(isHelmReleaseActionable('')).toBe(false)
+  })
+
+  it('returns false for unknown strings (defensive)', () => {
+    expect(isHelmReleaseActionable('mystery-status')).toBe(false)
+    expect(isHelmReleaseActionable('error')).toBe(false) // Helm uses 'failed', not 'error'
+  })
+})

package/src/utils/index.ts

@@ -16,3 +16,4 @@ export * from './view-transition'
 export * from './validators'
 export * from './gitops-owner'
 export * from './gitops-route'
+export * from './rbac-badges'

package/src/utils/rbac-badges.ts

@@ -0,0 +1,61 @@
+// Theme-aware badge classes for RBAC display (verbs, resources, API groups).
+// Reuses the same light/dark pairs as Badge.tsx's SEVERITY/KIND maps so the
+// RBAC views read with the same contrast as the rest of the app — the
+// inherited `text-*-400` foreground without a light counterpart was washing
+// out on light backgrounds.
+//
+// Centralized here so SA / Pod / RoleBinding renderers and the
+// MyPermissions dialog all stay in sync; previous duplicate copies drifted.
+
+import { BADGE_SEVERITY_COLORS, BADGE_KIND_COLORS } from '../components/ui/Badge'
+import {
+  RBAC_BLAST_READ_VERBS,
+  RBAC_BLAST_WRITE_VERBS,
+  RBAC_BLAST_DELETE_VERBS,
+  RBAC_BLAST_ESCALATION_VERBS,
+} from './rbac-blast-radius'
+
+/** Theme-aware classes for an RBAC verb chip. */
+export function rbacVerbBadgeClass(verb: string): string {
+  if (verb === '*') return BADGE_SEVERITY_COLORS.error
+  if (RBAC_BLAST_ESCALATION_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.error
+  if (RBAC_BLAST_DELETE_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.error
+  if (RBAC_BLAST_WRITE_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.warning
+  if (RBAC_BLAST_READ_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.success
+  return BADGE_SEVERITY_COLORS.info
+}
+
+/** Theme-aware classes for an RBAC resource chip (pods, configmaps, …). */
+export const rbacResourceBadgeClass: string =
+  BADGE_KIND_COLORS.HTTPRoute // purple-100/-700 in light, purple-950/-400 in dark
+
+/**
+ * Theme-aware kind badge for the four RBAC kinds. We can't put these in
+ * Badge.tsx's KIND map without churn there, so reuse the closest existing
+ * palette entry: blue/info for namespaced (Role/RoleBinding), purple for
+ * cluster-scoped (ClusterRole/ClusterRoleBinding).
+ */
+export function rbacKindBadgeClass(kind: string): string {
+  switch (kind) {
+    case 'Role':
+    case 'RoleBinding':
+      return BADGE_KIND_COLORS.Service // blue-100/-700 light, blue-950/-400 dark
+    case 'ClusterRole':
+    case 'ClusterRoleBinding':
+      return BADGE_KIND_COLORS.HelmRelease // purple-100/-700 light, purple-950/-400 dark
+    default:
+      return BADGE_KIND_COLORS.HelmRelease
+  }
+}
+
+/** Theme-aware classes for an API group chip (notification.toolkit.fluxcd.io, …). */
+export const rbacApiGroupBadgeClass: string =
+  'bg-theme-hover/60 text-theme-text-secondary border-theme-border'
+
+/** Theme-aware classes for a resourceName chip (rare — `resourceNames: [...]`). */
+export const rbacResourceNameBadgeClass: string =
+  BADGE_KIND_COLORS.PersistentVolumeClaim // cyan, distinct from resources
+
+/** Theme-aware classes for a non-resource URL chip (/healthz etc). */
+export const rbacNonResourceUrlBadgeClass: string =
+  BADGE_KIND_COLORS.Application // orange, distinct from everything above

package/src/utils/rbac-blast-radius.test.ts

@@ -0,0 +1,137 @@
+import { describe, it, expect } from 'vitest'
+import { detectBlastRadius, rulePermissivenessScore } from './rbac-blast-radius'
+import type { RBACBindingRules, RBACSubjectResponse } from '../types/rbac'
+
+// Skeleton helpers — keep fixtures terse so each test reads as a contract.
+function binding(over: Partial<RBACBindingRules> = {}): RBACBindingRules {
+  return {
+    binding: { kind: 'RoleBinding', namespace: 'default', name: 'b', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } },
+    role: { kind: 'Role', namespace: 'default', name: 'r' },
+    rules: [],
+    ...over,
+  }
+}
+
+function subject(direct: RBACBindingRules[] = [], inherited: { groupName: string; bindings: RBACBindingRules[] }[] = []): RBACSubjectResponse {
+  return {
+    subject: { kind: 'ServiceAccount', namespace: 'default', name: 'app-sa' },
+    direct,
+    inheritedFromGroups: inherited,
+    flat: [],
+    truncated: false,
+  }
+}
+
+describe('detectBlastRadius', () => {
+  // The five documented triggers; each is a security-UX invariant the PR
+  // description and inline comments call load-bearing. If any of these
+  // silently regresses, the Pod blast-radius banner stops alarming on the
+  // exact scenarios it was added for.
+
+  it('flags cluster-admin role-name match', () => {
+    const b = binding({ role: { kind: 'ClusterRole', name: 'cluster-admin', namespace: '' } })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/cluster-admin/)
+  })
+
+  it('flags verb wildcards', () => {
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['pods'], apiGroups: [''] }],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/verb wildcard/)
+  })
+
+  it('flags escalation verbs', () => {
+    const b = binding({
+      rules: [{ verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] }],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/escalate/)
+  })
+
+  it('flags impersonate and bind too', () => {
+    const b1 = binding({ binding: { kind: 'RoleBinding', namespace: 'default', name: 'b1', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } }, rules: [{ verbs: ['impersonate'], resources: ['users'], apiGroups: [''] }] })
+    const b2 = binding({ binding: { kind: 'RoleBinding', namespace: 'default', name: 'b2', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } }, rules: [{ verbs: ['bind'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] }] })
+    const reasons = detectBlastRadius(subject([b1, b2]))
+    expect(reasons).toHaveLength(2)
+    expect(reasons[0].reason).toMatch(/impersonate/)
+    expect(reasons[1].reason).toMatch(/bind/)
+  })
+
+  it('flags cluster-wide "create pods" but NOT namespace-scoped "create pods"', () => {
+    // The cluster-wide form is the lateral-movement vector — a Pod with
+    // namespace-scoped pod-create can only move within its namespace.
+    const cluster = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'cluster-b', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
+      rules: [{ verbs: ['create'], resources: ['pods'], apiGroups: [''] }],
+    })
+    const namespaced = binding({
+      binding: { kind: 'RoleBinding', namespace: 'default', name: 'ns-b', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } },
+      rules: [{ verbs: ['create'], resources: ['pods'], apiGroups: [''] }],
+    })
+    expect(detectBlastRadius(subject([cluster]))).toHaveLength(1)
+    expect(detectBlastRadius(subject([namespaced]))).toHaveLength(0)
+  })
+
+  it('does NOT flag resource-only wildcards', () => {
+    // The `view` ClusterRole grants get/list/watch on `*` resources in
+    // every fluxcd CRD. Flagging this would alarm on every authenticated
+    // SA — calibration call documented in the source.
+    const b = binding({
+      rules: [{ verbs: ['get', 'list', 'watch'], resources: ['*'], apiGroups: ['source.toolkit.fluxcd.io'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
+  it('dedupes by binding identity when multiple risky rules match', () => {
+    const b = binding({
+      rules: [
+        { verbs: ['*'], resources: ['pods'], apiGroups: [''] },
+        { verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] },
+      ],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+  })
+
+  it('includes inherited-from-group bindings, not just direct', () => {
+    const b = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'inherited', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
+      rules: [{ verbs: ['*'], resources: ['secrets'], apiGroups: [''] }],
+    })
+    const reasons = detectBlastRadius(subject([], [{ groupName: 'system:authenticated', bindings: [b] }]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/verb wildcard/)
+  })
+
+  it('returns empty for benign bindings', () => {
+    const b = binding({
+      rules: [{ verbs: ['get', 'list'], resources: ['configmaps'], apiGroups: [''] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+})
+
+describe('rulePermissivenessScore', () => {
+  it('scores wildcards highest', () => {
+    const wildcard = rulePermissivenessScore({ verbs: ['*'], resources: ['*'], apiGroups: ['*'] })
+    const benign = rulePermissivenessScore({ verbs: ['get'], resources: ['configmaps'], apiGroups: [''] })
+    expect(wildcard).toBeGreaterThan(benign)
+  })
+
+  it('boosts cluster-wide "create pods"', () => {
+    const createPods = rulePermissivenessScore({ verbs: ['create'], resources: ['pods'], apiGroups: [''] })
+    const createOthers = rulePermissivenessScore({ verbs: ['create'], resources: ['configmaps'], apiGroups: [''] })
+    expect(createPods).toBeGreaterThan(createOthers)
+  })
+
+  it('scores escalation verbs higher than plain writes', () => {
+    const escalate = rulePermissivenessScore({ verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] })
+    const patch = rulePermissivenessScore({ verbs: ['patch'], resources: ['configmaps'], apiGroups: [''] })
+    expect(escalate).toBeGreaterThan(patch)
+  })
+})