@skyhook-io/radar-app 1.15.0 → 1.16.0

package/src/api/diagnose.test.ts

@@ -1,5 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { createRun, subscribeRun, type DiagnoseStreamEvent } from "./diagnose";
+import {
+  addTurn,
+  createRun,
+  DiagnoseError,
+  subscribeRun,
+  type DiagnoseStreamEvent,
+} from "./diagnose";
 
 type SSEListener = (event: { data: string; lastEventId: string }) => void;
 
@@ -266,3 +272,98 @@ describe("investigation start requests", () => {
     expect(JSON.parse(init.body as string).issueId).toBe("issue-1");
   });
 });
+
+describe("refused requests", () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  const target = { kind: "Pod", group: "", namespace: "prod", name: "api-0" };
+
+  const refuse = (status: number, body: string) =>
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(new Response(body, { status })),
+    );
+
+  const startError = async () => {
+    try {
+      await createRun(target);
+    } catch (e) {
+      return e as DiagnoseError;
+    }
+    throw new Error("createRun resolved");
+  };
+
+  it("shows the sentence a host sends in detail, not its code", async () => {
+    refuse(
+      402,
+      JSON.stringify({
+        error: "ai_quota_exhausted",
+        detail: "Your organization has used this month's investigations.",
+        reason: "allowance_used_free",
+        action: "upgrade",
+      }),
+    );
+    const e = await startError();
+    expect(e).toBeInstanceOf(DiagnoseError);
+    expect(e.status).toBe(402);
+    expect(e.message).toBe(
+      "Your organization has used this month's investigations.",
+    );
+    expect(e.code).toBe("ai_quota_exhausted");
+    expect(e.reason).toBe("allowance_used_free");
+    expect(e.action).toBe("upgrade");
+  });
+
+  it("applies the same reading to follow-up turns", async () => {
+    refuse(
+      402,
+      JSON.stringify({ error: "ai_quota_exhausted", detail: "Limit reached." }),
+    );
+    await expect(addTurn("run-1", { question: "why?" })).rejects.toMatchObject({
+      status: 402,
+      message: "Limit reached.",
+      code: "ai_quota_exhausted",
+    });
+  });
+
+  it("reads a code sent beside a sentence repeated in error", async () => {
+    const sentence = "This investigation has reached its follow-up limit.";
+    refuse(
+      409,
+      JSON.stringify({
+        error: sentence,
+        detail: sentence,
+        code: "investigation_turn_limit",
+      }),
+    );
+    await expect(addTurn("run-1", { question: "why?" })).rejects.toMatchObject({
+      status: 409,
+      message: sentence,
+      code: "investigation_turn_limit",
+    });
+  });
+
+  it("never reports the sentence as the code", async () => {
+    const sentence = "Busy.";
+    refuse(409, JSON.stringify({ error: sentence, detail: sentence }));
+    expect((await startError()).code).toBeUndefined();
+  });
+
+  it("shows error when it is the only sentence", async () => {
+    refuse(409, JSON.stringify({ error: "Too many investigations running." }));
+    const e = await startError();
+    expect(e.message).toBe("Too many investigations running.");
+    expect(e.code).toBeUndefined();
+    expect(e.reason).toBeUndefined();
+    expect(e.action).toBeUndefined();
+  });
+
+  it.each([
+    ["an empty detail", JSON.stringify({ error: "Busy.", detail: "" }), "Busy."],
+    ["a non-JSON body", "upstream timeout", "request failed (502)"],
+    ["no message at all", JSON.stringify({ error: "  " }), "request failed (502)"],
+  ])("falls back past %s", async (_name, body, message) => {
+    refuse(502, body);
+    expect((await startError()).message).toBe(message);
+  });
+});

package/src/api/diagnose.ts

@@ -260,22 +260,53 @@ export async function fetchAgents(
   return res.json();
 }
 
-async function errorText(res: Response): Promise<string> {
+/**
+ * Why a host refused an investigation, and what would unblock it. Hosts that
+ * meter investigations send these beside the sentence to show, so an embedding
+ * app can offer the matching action. Radar's own backend never sends them.
+ */
+export interface DiagnoseRefusal {
+  /** Machine-readable code, e.g. "ai_quota_exhausted". */
+  code?: string;
+  reason?: string;
+  action?: string;
+}
+
+// The sentence to show is `detail` when a host sends one, else `error`. A
+// host's machine-readable code is `code`, or `error` when that is not the
+// sentence itself.
+async function diagnoseError(res: Response): Promise<DiagnoseError> {
+  let body: Record<string, unknown> | null = null;
   try {
-    const d = await res.json();
-    if (d && typeof d.error === "string") return d.error;
+    const d: unknown = await res.json();
+    if (d && typeof d === "object") body = d as Record<string, unknown>;
   } catch {
     /* ignore */
   }
-  return `request failed (${res.status})`;
+  const str = (v: unknown) =>
+    typeof v === "string" && v.trim() !== "" ? v : undefined;
+  const detail = str(body?.detail);
+  const error = str(body?.error);
+  const message = detail ?? error ?? `request failed (${res.status})`;
+  return new DiagnoseError(res.status, message, {
+    code: str(body?.code) ?? (detail && error !== detail ? error : undefined),
+    reason: str(body?.reason),
+    action: str(body?.action),
+  });
 }
 
 // DiagnoseError carries the HTTP status so callers can special-case (e.g. 409 cap).
 export class DiagnoseError extends Error {
   status: number;
-  constructor(status: number, message: string) {
+  code?: string;
+  reason?: string;
+  action?: string;
+  constructor(status: number, message: string, refusal?: DiagnoseRefusal) {
     super(message);
     this.status = status;
+    this.code = refusal?.code;
+    this.reason = refusal?.reason;
+    this.action = refusal?.action;
   }
 }
 
@@ -313,7 +344,7 @@ export async function createRun(
     headers: { "Content-Type": "application/json", ...getAuthHeaders() },
     body: JSON.stringify({ ...target, ...opts }),
   });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  if (!res.ok) throw await diagnoseError(res);
   return res.json();
 }
 
@@ -332,7 +363,7 @@ export async function listRuns(signal?: AbortSignal): Promise<RunsResponse> {
     headers: getAuthHeaders(),
     signal,
   });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  if (!res.ok) throw await diagnoseError(res);
   const d = await res.json();
   return { runs: d.runs ?? [], historyDegraded: !!d.historyDegraded };
 }
@@ -348,7 +379,7 @@ export async function getRun(
     headers: getAuthHeaders(),
     signal,
   });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  if (!res.ok) throw await diagnoseError(res);
   return res.json();
 }
 
@@ -360,7 +391,7 @@ export async function recordConsent(surface: string): Promise<void> {
     headers: { "Content-Type": "application/json", ...getAuthHeaders() },
     body: JSON.stringify({ surface }),
   });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  if (!res.ok) throw await diagnoseError(res);
 }
 
 // clearHistory wipes the persisted investigation history (finished runs); live
@@ -371,7 +402,7 @@ export async function clearHistory(): Promise<void> {
     credentials: getCredentialsMode(),
     headers: getAuthHeaders(),
   });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  if (!res.ok) throw await diagnoseError(res);
 }
 
 // addTurn appends a follow-up (question) or an apply turn (apply + confirmed fix).
@@ -391,7 +422,7 @@ export async function addTurn(
     headers: { "Content-Type": "application/json", ...getAuthHeaders() },
     body: JSON.stringify(body),
   });
-  if (!res.ok) throw new DiagnoseError(res.status, await errorText(res));
+  if (!res.ok) throw await diagnoseError(res);
 }
 
 // stopRun cancels a run's in-flight agent.

package/src/api/drain-plan.test.ts

@@ -1,9 +1,7 @@
 import { describe, expect, it } from "vitest";
 import {
   describeDrainResult,
-  DrainPlanUnsupportedError,
   drainPlanBody,
-  drainPlanFetchError,
   drainPlanPath,
 } from "./client";
 
@@ -24,14 +22,6 @@ describe("drain plan request", () => {
       force: true,
     });
   });
-
-  it("reads a plain-text 404 as an unsupported endpoint, not as a missing node", () => {
-    expect(drainPlanFetchError(404, null)).toBeInstanceOf(DrainPlanUnsupportedError);
-    const nodeGone = drainPlanFetchError(404, { error: 'nodes "worker-1" not found' });
-    expect(nodeGone).not.toBeInstanceOf(DrainPlanUnsupportedError);
-    expect(nodeGone.message).toBe('nodes "worker-1" not found');
-    expect(drainPlanFetchError(503, null).message).toBe("HTTP 503");
-  });
 });
 
 describe("describeDrainResult", () => {

package/src/api/httpErrors.test.ts

@@ -0,0 +1,95 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ApiError, fetchJSON } from './client'
+import { CHI_UNKNOWN_ROUTE_BODY, httpStatusMessage, isUnknownRouteResponse, nonJsonErrorMessage, readErrorResponse } from './httpErrors'
+
+const TEXT = 'text/plain; charset=utf-8'
+
+function response(status: number, body: string, contentType: string | null, statusText = ''): Response {
+  const headers = new Headers()
+  if (contentType) headers.set('Content-Type', contentType)
+  return new Response(body, { status, statusText, headers })
+}
+
+describe('isUnknownRouteResponse', () => {
+  it("matches only chi's own unknown-route 404", () => {
+    expect(isUnknownRouteResponse(404, TEXT, CHI_UNKNOWN_ROUTE_BODY)).toBe(true)
+  })
+
+  it("rejects a handler's JSON 404", () => {
+    expect(isUnknownRouteResponse(404, 'application/json', '{"error":"pods \\"web\\" not found"}')).toBe(false)
+  })
+
+  it("rejects Radar Hub's plain-text cluster lookup 404", () => {
+    expect(isUnknownRouteResponse(404, TEXT, 'not found\n')).toBe(false)
+  })
+
+  it('rejects the same body under another status or content type', () => {
+    expect(isUnknownRouteResponse(405, TEXT, CHI_UNKNOWN_ROUTE_BODY)).toBe(false)
+    expect(isUnknownRouteResponse(500, TEXT, CHI_UNKNOWN_ROUTE_BODY)).toBe(false)
+    expect(isUnknownRouteResponse(404, 'text/html', CHI_UNKNOWN_ROUTE_BODY)).toBe(false)
+    expect(isUnknownRouteResponse(404, null, CHI_UNKNOWN_ROUTE_BODY)).toBe(false)
+    expect(isUnknownRouteResponse(404, TEXT, '<html>404 page not found</html>')).toBe(false)
+  })
+})
+
+describe('readErrorResponse', () => {
+  it('returns a JSON envelope as-is', async () => {
+    const { body, unknownRoute } = await readErrorResponse(response(404, '{"error":"gone","code":7}', 'application/json'))
+    expect(body).toEqual({ error: 'gone', code: 7 })
+    expect(unknownRoute).toBe(false)
+  })
+
+  it('names the status instead of "Unknown error" for a non-JSON body', async () => {
+    const chi = await readErrorResponse(response(404, CHI_UNKNOWN_ROUTE_BODY, TEXT))
+    expect(chi).toEqual({ body: { error: 'HTTP 404 (Not Found)' }, unknownRoute: true })
+    const gateway = await readErrorResponse(response(502, '<html>Bad gateway</html>', 'text/html'))
+    expect(gateway).toEqual({ body: { error: 'HTTP 502 (Bad Gateway)' }, unknownRoute: false })
+  })
+
+  it("keeps a short plain-text reason such as Radar Hub's", async () => {
+    const offline = await readErrorResponse(response(503, 'cluster "prod" not connected\n', TEXT))
+    expect(offline.body.error).toBe('cluster "prod" not connected (HTTP 503)')
+    // Hub's bare "not found" only repeats the status.
+    const hub = await readErrorResponse(response(404, 'not found\n', TEXT))
+    expect(hub.body.error).toBe('HTTP 404 (Not Found)')
+    const long = await readErrorResponse(response(500, 'x'.repeat(500), TEXT))
+    expect(long.body.error).toBe('HTTP 500 (Internal Server Error)')
+  })
+})
+
+describe('nonJsonErrorMessage', () => {
+  it('reads a body the caller already consumed', () => {
+    expect(nonJsonErrorMessage(response(502, '', TEXT), 'upstream connect error\n')).toBe(
+      'upstream connect error (HTTP 502)',
+    )
+    expect(nonJsonErrorMessage(response(404, '', TEXT), CHI_UNKNOWN_ROUTE_BODY)).toBe('HTTP 404 (Not Found)')
+    expect(nonJsonErrorMessage(response(502, '', 'text/html'), '<html>bad</html>')).toBe('HTTP 502 (Bad Gateway)')
+  })
+})
+
+describe('httpStatusMessage', () => {
+  it('prefers the response status text and falls back to the table', () => {
+    expect(httpStatusMessage(404, 'Nope')).toBe('HTTP 404 (Nope)')
+    expect(httpStatusMessage(404, '')).toBe('HTTP 404 (Not Found)')
+    expect(httpStatusMessage(418)).toBe('HTTP 418')
+  })
+})
+
+describe('fetchJSON error fallback', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  it('reports the status and flags an unknown route', async () => {
+    vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(response(404, CHI_UNKNOWN_ROUTE_BODY, TEXT))))
+    const error = await fetchJSON('/policy/resource/pods/default/web').catch((e: unknown) => e)
+    expect(error).toBeInstanceOf(ApiError)
+    expect((error as ApiError).message).toBe('HTTP 404 (Not Found)')
+    expect((error as ApiError).unknownRoute).toBe(true)
+  })
+
+  it("keeps a handler's own message and does not flag it", async () => {
+    vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(response(404, '{"error":"pods \\"web\\" not found"}', 'application/json'))))
+    const error = (await fetchJSON('/pods/default/web/environment').catch((e: unknown) => e)) as ApiError
+    expect(error.message).toBe('pods "web" not found')
+    expect(error.unknownRoute).toBe(false)
+  })
+})

package/src/api/httpErrors.ts

@@ -0,0 +1,101 @@
+// Error-body handling shared by every fetch site. Kept free of client.ts
+// imports so the pure helpers can be tested and reused without the hooks.
+
+const STATUS_TEXT: Record<number, string> = {
+  400: 'Bad Request',
+  401: 'Unauthorized',
+  403: 'Forbidden',
+  404: 'Not Found',
+  405: 'Method Not Allowed',
+  408: 'Request Timeout',
+  409: 'Conflict',
+  413: 'Payload Too Large',
+  429: 'Too Many Requests',
+  500: 'Internal Server Error',
+  502: 'Bad Gateway',
+  503: 'Service Unavailable',
+  504: 'Gateway Timeout',
+}
+
+/**
+ * "HTTP 404 (Not Found)". The table backs up `statusText`, which HTTP/2
+ * responses leave empty.
+ */
+export function httpStatusMessage(status: number, statusText?: string): string {
+  const text = statusText || STATUS_TEXT[status]
+  return text ? `HTTP ${status} (${text})` : `HTTP ${status}`
+}
+
+/** What chi's default NotFound handler writes for a route the router doesn't have. */
+export const CHI_UNKNOWN_ROUTE_BODY = '404 page not found\n'
+
+/**
+ * True only for chi's own unknown-route response. Radar's handlers answer a
+ * missing resource with a JSON envelope, and Radar Hub's proxy answers a
+ * cluster lookup failure with a plain-text "not found", so neither matches.
+ * That exactness is what lets a caller read this as "the connected Radar
+ * predates this endpoint" rather than "something is missing".
+ */
+export function isUnknownRouteResponse(status: number, contentType: string | null, body: string): boolean {
+  return (
+    status === 404 &&
+    (contentType ?? '').toLowerCase().startsWith('text/plain') &&
+    body === CHI_UNKNOWN_ROUTE_BODY
+  )
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- error envelopes carry handler-specific fields
+export type ErrorBody = { error?: string; [key: string]: any }
+
+export interface ErrorResponse {
+  body: ErrorBody
+  unknownRoute: boolean
+}
+
+const MAX_PLAIN_TEXT_REASON = 200
+
+/**
+ * Reads a failed response once. A JSON object body is returned as-is; anything
+ * else becomes `{ error: <message> }` (see nonJsonErrorMessage) so callers
+ * never surface a contentless "Unknown error".
+ */
+export async function readErrorResponse(response: Response): Promise<ErrorResponse> {
+  const text = await response.text().catch(() => '')
+  const contentType = response.headers.get('content-type')
+  const unknownRoute = isUnknownRouteResponse(response.status, contentType, text)
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(text)
+  } catch {
+    parsed = undefined
+  }
+  if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+    return { body: parsed as ErrorBody, unknownRoute }
+  }
+  return { body: { error: nonJsonErrorMessage(response, text) }, unknownRoute }
+}
+
+/**
+ * The message for a failed response whose body is not a JSON object, for
+ * callers that already read the body as text. A short plain-text reason, such
+ * as Radar Hub's `cluster "x" not connected`, leads and the status trails it
+ * ("cluster "x" not connected (HTTP 503)"), so it reads like Radar's own
+ * errors. Without one (an HTML page, chi's unknown-route body, an empty body)
+ * the status is the message: "HTTP 502 (Bad Gateway)".
+ */
+export function nonJsonErrorMessage(response: Response, text: string): string {
+  const status = httpStatusMessage(response.status, response.statusText)
+  const contentType = response.headers.get('content-type')
+  const reason = text.trim()
+  const showReason =
+    !isUnknownRouteResponse(response.status, contentType, text) &&
+    (contentType ?? '').toLowerCase().startsWith('text/plain') &&
+    reason.length > 0 &&
+    reason.length <= MAX_PLAIN_TEXT_REASON &&
+    !status.toLowerCase().includes(reason.toLowerCase())
+  return showReason ? `${reason} (HTTP ${response.status})` : status
+}
+
+export async function readErrorBody(response: Response): Promise<ErrorBody> {
+  return (await readErrorResponse(response)).body
+}

package/src/api/policy.ts

@@ -7,7 +7,17 @@ import type {
   VeleroStoredBackupsResponse,
   VeleroRunMessagesResponse,
 } from '@skyhook-io/k8s-ui'
-import { fetchJSON } from './client'
+import { fetchJSON, useRadarFeature } from './client'
+import { hasPolicyReports, useAPIResources } from './apiResources'
+import { isRadarFeatureUnsupported } from './radarFeatures'
+
+const POLICY_NOT_INSTALLED: PolicyResourceResponse = {
+  evaluated: false,
+  status: 'not_installed',
+  liveUpdates: false,
+  counts: { pass: 0, fail: 0, warn: 0, error: 0, skip: 0 },
+  findings: [],
+}
 
 // /api/policy/resource/{kind}/{namespace}/{name}
 //
@@ -15,11 +25,15 @@ import { fetchJSON } from './client'
 // a short stale window keeps drawer navigation instant without going stale in a
 // way an operator would notice.
 export function usePolicyResource(kind: string, namespace: string, name: string, enabled = true) {
-  return useQuery<PolicyResourceResponse>({
-    queryKey: ['policy', 'resource', kind, namespace, name],
+  const { guard, gatedKey } = useRadarFeature('policyResource')
+  const { data: apiResources, isPending: discoveryPending } = useAPIResources()
+  const query = useQuery<PolicyResourceResponse>({
+    queryKey: ['policy', 'resource', kind, namespace, name, ...gatedKey],
     queryFn: () =>
-      fetchJSON<PolicyResourceResponse>(
-        `/policy/resource/${encodeURIComponent(kind)}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`,
+      guard(() =>
+        fetchJSON<PolicyResourceResponse>(
+          `/policy/resource/${encodeURIComponent(kind)}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`,
+        ),
       ),
     enabled: enabled && !!kind && !!namespace && !!name,
     staleTime: 15000,
@@ -27,6 +41,20 @@ export function usePolicyResource(kind: string, namespace: string, name: string,
     // would just repeat the denial on every drawer open.
     retry: false,
   })
+  // A Radar too old for policy results, on a cluster with no policy engine,
+  // gets the answer a current Radar would give: not installed. Prompting an
+  // upgrade there would promise a section that stays empty. Derived at render
+  // so it follows discovery whenever /api-resources answers; until it does the
+  // section stays loading rather than flashing a note it may withdraw.
+  if (isRadarFeatureUnsupported(query.error)) {
+    if (apiResources === undefined && discoveryPending) {
+      return { ...query, error: null, isError: false, isLoading: true, isPending: true, status: 'pending' as const }
+    }
+    if (apiResources !== undefined && !hasPolicyReports(apiResources)) {
+      return { ...query, data: POLICY_NOT_INSTALLED, error: null, isError: false, isSuccess: true, status: 'success' as const }
+    }
+  }
+  return query
 }
 
 // /api/policy/policies/{policy}