@skyhook-io/radar-app 1.16.2 → 1.17.0

package/src/contexts/CapabilitiesContext.tsx

@@ -114,6 +114,10 @@ export function useCanHelmWrite(): boolean {
   return useContext(CapabilitiesContext).helmWrite
 }
 
+export function useIsAuthEnabled(): boolean {
+  return useContext(CapabilitiesContext).authEnabled === true
+}
+
 export function useCanNodeWrite(): boolean {
   return useContext(CapabilitiesContext).nodeWrite
 }
@@ -158,7 +162,11 @@ export function useNamespacedCapabilities(namespace: string | undefined) {
     canExec: nsCaps?.exec ?? globalCaps.exec,
     canViewLogs: nsCaps?.logs ?? globalCaps.logs,
     canPortForward: nsCaps?.portForward ?? globalCaps.portForward,
+    canHelmWrite: nsCaps?.helmWrite ?? globalCaps.helmWrite,
     workloadWrites: nsCaps?.workloadWrites ?? globalCaps.workloadWrites,
     workloadWritesPending: Boolean(namespace && isPending),
-  }), [globalCaps.exec, globalCaps.logs, globalCaps.portForward, globalCaps.workloadWrites, isPending, namespace, nsCaps])
+    // A failed refetch keeps the last successful namespace answer; with none,
+    // the global value is not an answer for this namespace.
+    helmWriteUnknown: Boolean(namespace && !nsCaps && (isPending || error)),
+  }), [globalCaps.exec, globalCaps.logs, globalCaps.portForward, globalCaps.helmWrite, globalCaps.workloadWrites, error, isPending, namespace, nsCaps])
 }

package/src/hooks/useGitOpsWriteGuard.test.tsx

@@ -0,0 +1,457 @@
+// @vitest-environment jsdom
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { SetImageDialog, canConfirmGitOpsWrite, setImageSelectionKey, type WorkloadImageInventory } from '@skyhook-io/k8s-ui'
+import { afterEach, expect, it, vi } from 'vitest'
+import { useGitOpsWriteGuard, type GitOpsWriteGuardState } from './useGitOpsWriteGuard'
+
+const mocks = vi.hoisted(() => ({
+  applications: { data: undefined as unknown[] | undefined, isPending: true, isError: false },
+  inherited: { data: undefined as unknown, isPending: false, isError: false },
+  target: { data: undefined as unknown, relationships: undefined as unknown, isLoading: false, isError: false },
+  evidence: vi.fn(),
+  evidenceUnsupported: false,
+}))
+vi.mock('../api/client', () => ({
+  useResource: (kind: string) => (kind === 'deployments' ? mocks.target : { data: undefined, isLoading: false, isError: false }),
+  useResourceWithRelationships: () => mocks.inherited,
+  useResources: () => mocks.applications,
+  useRadarFeature: () => ({
+    guard: async (fn: () => unknown) => {
+      if (!mocks.evidenceUnsupported) return fn()
+      const { RadarFeatureUnsupportedError } = await import('../api/radarFeatures')
+      throw new RadarFeatureUnsupportedError('gitopsWriteEvidence', { currentVersion: 'v1.16.0' })
+    },
+    gatedKey: mocks.evidenceUnsupported ? ['radar-feature-unsupported'] : [],
+  }),
+  fetchGitOpsWriteEvidence: (...args: unknown[]) => mocks.evidence(...args),
+}))
+
+afterEach(() => {
+  mocks.evidenceUnsupported = false
+  mocks.applications.data = undefined
+  mocks.applications.isPending = true
+  mocks.applications.isError = false
+  mocks.inherited = { data: undefined, isPending: false, isError: false }
+  mocks.target = { data: undefined, relationships: undefined, isLoading: false, isError: false }
+  mocks.evidence.mockReset()
+})
+
+it.each(['resolved', 'failed', 'empty', 'ambiguous'])('waits for Argo Application namespace lookup before handling %s ownership', async (outcome) => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  const root = createRoot(document.createElement('div'))
+  let state: GitOpsWriteGuardState
+  const onLoad = vi.fn(async (): Promise<WorkloadImageInventory> => ({
+    target: { kind: 'Deployment', group: 'apps', resource: 'deployments', namespace: 'prod', name: 'web' },
+    containers: [{ type: 'container', name: 'app', image: 'app:old' }],
+    behavior: { type: 'rolling' },
+  }))
+  mocks.evidence.mockResolvedValue({ uid: 'deployment', resourceVersion: '1', owner: { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }, policy: null, paths: [] })
+  function Harness() {
+    state = useGitOpsWriteGuard({
+      target: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'web' },
+      resource: {},
+      relationships: { managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: '', name: 'web' }] },
+      writes: [{ scope: 'spec', paths: ['spec.replicas'] }],
+    })
+    return outcome !== 'resolved' ? <SetImageDialog open workloadLabel="Deployment" workloadName="web" workloadResource="deployments" ownership={state.guard ? { guard: state.guard } : undefined} onLoad={onLoad} onClose={() => {}} onConfirm={async () => {}} /> : null
+  }
+  const render = () => root.render(<QueryClientProvider client={queryClient}><Harness /></QueryClientProvider>)
+  try {
+    await act(async () => render())
+    expect(state!.guard?.pending).toBe(true)
+    expect(mocks.evidence).not.toHaveBeenCalled()
+    mocks.applications.isPending = false
+    if (outcome === 'resolved') mocks.applications.data = [{ metadata: { name: 'web', namespace: 'argocd' } }]
+    else if (outcome === 'failed') mocks.applications.isError = true
+    else mocks.applications.data = outcome === 'empty' ? [] : ['argocd-a', 'argocd-b'].map((namespace) => ({ metadata: { name: 'web', namespace } }))
+    await act(async () => render())
+    if (outcome === 'resolved') {
+      await act(async () => vi.waitFor(() => expect(mocks.evidence).toHaveBeenCalledTimes(1)))
+      expect(mocks.evidence.mock.calls[0][0].owner.namespace).toBe('argocd')
+    } else {
+      // The server resolves the namespace; the browser sends the name alone.
+      await act(async () => vi.waitFor(() => expect(mocks.evidence).toHaveBeenCalledTimes(1)))
+      expect(mocks.evidence.mock.calls[0][0].owner.namespace).toBe('')
+      await act(async () => vi.waitFor(() => expect(state!.guard?.pending).toBe(false)))
+      expect(state!.ownership.lookupError).toBe(false)
+      expect(state!.guard?.pending).toBe(false)
+      expect(state!.guard?.requiresAck).toBe(true)
+      expect(state!.guard?.level).toBe('may-revert')
+      expect(canConfirmGitOpsWrite(state!.guard, true)).toBe(true)
+      expect(document.body.textContent).not.toContain('Management ownership unavailable')
+      expect(document.body.textContent).toContain('Argo CD')
+    }
+  } finally {
+    await act(async () => root.unmount())
+    queryClient.clear()
+  }
+})
+
+async function renderGuard(options: Parameters<typeof useGitOpsWriteGuard>[0]) {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  const root = createRoot(document.createElement('div'))
+  const ref: { state?: GitOpsWriteGuardState } = {}
+  function Harness() {
+    ref.state = useGitOpsWriteGuard(options)
+    return null
+  }
+  await act(async () => root.render(<QueryClientProvider client={queryClient}><Harness /></QueryClientProvider>))
+  return {
+    ref,
+    queryClient,
+    rerender: () => act(async () => root.render(<QueryClientProvider client={queryClient}><Harness /></QueryClientProvider>)),
+    cleanup: async () => {
+      await act(async () => root.unmount())
+      queryClient.clear()
+    },
+  }
+}
+
+const deployment = { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'web' }
+const replicas = [{ scope: 'spec' as const, paths: ['spec.replicas'] }]
+
+it('reads missing relationships as unknown ownership, not as unmanaged', async () => {
+  const h = await renderGuard({ target: deployment, resource: {}, relationshipsUnavailable: true, writes: replicas })
+  try {
+    expect(mocks.evidence).not.toHaveBeenCalled()
+    expect(h.ref.state!.guard?.pending).toBe(false)
+    expect(h.ref.state!.guard?.level).toBe('may-revert')
+    expect(h.ref.state!.guard?.requiresAck).toBe(true)
+    expect(h.ref.state!.guard?.ownershipError).toContain("hasn't mapped this resource's owners")
+    expect(canConfirmGitOpsWrite(h.ref.state!.guard, false)).toBe(false)
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('asks for an acknowledgment when the server saw a manager the browser could not resolve', async () => {
+  const h = await renderGuard({ target: deployment, resource: {}, relationships: {}, declaredManager: 'Argo CD', writes: replicas })
+  try {
+    expect(h.ref.state!.guard?.requiresAck).toBe(true)
+    expect(h.ref.state!.guard?.ownershipError).toContain('Argo CD')
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('ignores the declared manager once an owner resolves', async () => {
+  mocks.evidence.mockResolvedValue({ uid: 'u', resourceVersion: '1', owner: { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }, policy: null, paths: [] })
+  const h = await renderGuard({
+    target: deployment,
+    resource: {},
+    relationships: { managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }] },
+    declaredManager: 'Argo CD',
+    writes: replicas,
+  })
+  try {
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+    expect(h.ref.state!.guard?.ownershipError).toBeNull()
+    expect(h.ref.state!.guard?.owner?.name).toBe('web')
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('treats a refetch of the evidence as pending', async () => {
+  let resolveSecond: (v: unknown) => void = () => {}
+  const evidence = { uid: 'u', resourceVersion: '1', owner: { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }, policy: null, paths: [] }
+  mocks.evidence.mockResolvedValueOnce(evidence).mockImplementationOnce(() => new Promise((resolve) => { resolveSecond = resolve }))
+  const h = await renderGuard({
+    target: deployment,
+    resource: {},
+    relationships: { managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }] },
+    writes: replicas,
+  })
+  try {
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+    await act(async () => { void h.queryClient.invalidateQueries({ queryKey: ['gitops-write-evidence'] }) })
+    await h.rerender()
+    expect(h.ref.state!.guard?.pending).toBe(true)
+    expect(canConfirmGitOpsWrite(h.ref.state!.guard, true)).toBe(false)
+    await act(async () => resolveSecond(evidence))
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('does not keep an exemption after a refetch fails', async () => {
+  const exempt = {
+    uid: 'u',
+    resourceVersion: '1',
+    owner: { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' },
+    policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null, respectIgnoreDifferences: true },
+    paths: [{ path: 'spec.replicas', lastApplied: 'present', ownedBy: [], ownedByGitOps: false, ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }],
+  }
+  mocks.evidence.mockResolvedValueOnce(exempt).mockRejectedValueOnce(new Error('503 cache not ready'))
+  const h = await renderGuard({
+    target: deployment,
+    resource: {},
+    relationships: { managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }] },
+    writes: replicas,
+  })
+  try {
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+    expect(h.ref.state!.guard?.level).toBe('info')
+    await act(async () => { await h.queryClient.invalidateQueries({ queryKey: ['gitops-write-evidence'] }) })
+    await act(async () => vi.waitFor(() => {
+      expect(h.ref.state!.guard?.pending).toBe(false)
+      expect(h.ref.state!.guard?.level).toBe('may-revert')
+    }))
+    expect(h.ref.state!.guard?.requiresAck).toBe(true)
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('asks for an acknowledgment, not a block, on a Radar without write evidence', async () => {
+  mocks.evidenceUnsupported = true
+  const h = await renderGuard({
+    target: deployment,
+    resource: {},
+    relationships: { managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }] },
+    writes: replicas,
+  })
+  try {
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+    expect(mocks.evidence).not.toHaveBeenCalled()
+    const guard = h.ref.state!.guard
+    expect(guard?.level).toBe('may-revert')
+    expect(guard?.perWrite[0].reason).toContain('need a newer Radar')
+    expect(canConfirmGitOpsWrite(guard, false)).toBe(false)
+    expect(canConfirmGitOpsWrite(guard, true)).toBe(true)
+  } finally {
+    await h.cleanup()
+  }
+})
+
+const pod ={ kind: 'Pod', group: '', namespace: 'prod', name: 'web-1-abc' }
+const podRelationships = {
+  owner: { kind: 'ReplicaSet', group: 'apps', namespace: 'prod', name: 'web-1' },
+  deployment: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'web' },
+}
+
+it('reads a parent without relationships as unknown ownership, not as unmanaged', async () => {
+  mocks.inherited = { data: { resource: { metadata: { labels: { 'kustomize.toolkit.fluxcd.io/name': 'apps' } } } }, isPending: false, isError: false }
+  const h = await renderGuard({ target: pod, resource: {}, relationships: podRelationships, writes: replicas })
+  try {
+    expect(mocks.evidence).not.toHaveBeenCalled()
+    expect(h.ref.state!.guard?.level).toBe('may-revert')
+    expect(h.ref.state!.guard?.requiresAck).toBe(true)
+    expect(h.ref.state!.guard?.ownershipError).toContain("hasn't mapped this resource's owners")
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('does not keep an exemption after the parent lookup fails', async () => {
+  const app = { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }
+  mocks.inherited = { data: { resource: {}, relationships: { managedBy: [app] } }, isPending: false, isError: false }
+  mocks.evidence.mockResolvedValue({
+    uid: 'u',
+    resourceVersion: '1',
+    owner: app,
+    policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null, respectIgnoreDifferences: true },
+    paths: [{ path: 'spec.replicas', lastApplied: 'present', ownedBy: [], ownedByGitOps: false, ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }],
+  })
+  const h = await renderGuard({ target: pod, resource: {}, relationships: podRelationships, writes: replicas })
+  try {
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+    expect(h.ref.state!.guard?.level).toBe('info')
+    // React Query keeps the parent's data after a failed refetch.
+    mocks.inherited = { ...mocks.inherited, isError: true }
+    await h.rerender()
+    expect(h.ref.state!.guard?.pending).toBe(false)
+    expect(h.ref.state!.guard?.level).toBe('may-revert')
+    expect(h.ref.state!.guard?.requiresAck).toBe(true)
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('does not keep an exemption after the target lookup fails', async () => {
+  const app = { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' }
+  mocks.target = { data: {}, relationships: { managedBy: [app] }, isLoading: false, isError: false }
+  mocks.evidence.mockResolvedValue({
+    uid: 'u',
+    resourceVersion: '1',
+    owner: app,
+    policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null, respectIgnoreDifferences: true },
+    paths: [{ path: 'spec.replicas', lastApplied: 'present', ownedBy: [], ownedByGitOps: false, ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }],
+  })
+  const h = await renderGuard({ target: deployment, writes: replicas })
+  try {
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+    expect(h.ref.state!.guard?.level).toBe('info')
+    // React Query keeps the target's data after a failed refetch.
+    mocks.target = { ...mocks.target, isError: true }
+    await h.rerender()
+    expect(h.ref.state!.guard?.pending).toBe(false)
+    expect(h.ref.state!.guard?.level).toBe('may-revert')
+    expect(canConfirmGitOpsWrite(h.ref.state!.guard, false)).toBe(false)
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('asks for an acknowledgment, not a block, when the parent cannot be read', async () => {
+  mocks.inherited = { data: undefined, isPending: false, isError: true }
+  const h = await renderGuard({ target: pod, resource: {}, relationships: podRelationships, writes: replicas })
+  try {
+    expect(mocks.evidence).not.toHaveBeenCalled()
+    expect(h.ref.state!.guard?.level).toBe('may-revert')
+    expect(h.ref.state!.guard?.ownershipError).toContain("couldn't read the resource that owns this one")
+    expect(canConfirmGitOpsWrite(h.ref.state!.guard, false)).toBe(false)
+    expect(canConfirmGitOpsWrite(h.ref.state!.guard, true)).toBe(true)
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('lets an ignore rule waive the acknowledgment once the server confirms a name-only Argo match', async () => {
+  mocks.applications.isPending = false
+  mocks.applications.data = [{ metadata: { name: 'web', namespace: 'argocd' } }]
+  const exempt = (ownerTracksTarget: boolean) => ({
+    uid: 'u',
+    resourceVersion: '1',
+    owner: { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' },
+    ownerTracksTarget,
+    policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null, respectIgnoreDifferences: true },
+    paths: [{ path: 'spec.replicas', lastApplied: 'present', ownedBy: [], ownedByGitOps: false, ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }],
+  })
+  for (const [tracks, level] of [[true, 'info'], [false, 'may-revert']] as const) {
+    mocks.evidence.mockResolvedValueOnce(exempt(tracks))
+    const h = await renderGuard({
+      target: deployment,
+      resource: {},
+      // Argo CD 3's tracking id omits the namespace of Applications in its own namespace.
+      relationships: { managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: '', name: 'web' }] },
+      writes: replicas,
+    })
+    try {
+      await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+      expect(h.ref.state!.guard?.level).toBe(level)
+    } finally {
+      await h.cleanup()
+    }
+  }
+})
+
+it("takes the Application the server confirmed when the browser can't list Applications", async () => {
+  mocks.applications.isPending = false
+  mocks.applications.data = []
+  mocks.evidence.mockResolvedValueOnce({
+    uid: 'u',
+    resourceVersion: '1',
+    owner: { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'web' },
+    ownerTracksTarget: true,
+    policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null, respectIgnoreDifferences: true },
+    paths: [{ path: 'spec.replicas', lastApplied: 'present', ownedBy: [], ownedByGitOps: false, ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }],
+  })
+  const h = await renderGuard({
+    target: deployment,
+    resource: {},
+    relationships: { managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: '', name: 'web' }] },
+    writes: replicas,
+  })
+  try {
+    await act(async () => vi.waitFor(() => expect(h.ref.state!.guard?.pending).toBe(false)))
+    expect(mocks.evidence.mock.calls[0][0].owner.namespace).toBe('')
+    expect(h.ref.state!.guard?.owner?.namespace).toBe('argocd')
+    expect(h.ref.state!.guard?.level).toBe('info')
+    expect(h.ref.state!.ownership.ownerVerified).toBe(true)
+  } finally {
+    await h.cleanup()
+  }
+})
+
+it('reports the listed and changed containers so the host can judge exactly those', async () => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+  const root = createRoot(document.createElement('div'))
+  const onSelectionChange = vi.fn()
+  const guard = { owner: null, helmRelease: null, pending: false, level: 'none', perWrite: [], summary: '', syncPolicy: null, requiresAck: false, ownershipError: null } as never
+  const onLoad = vi.fn(async (): Promise<WorkloadImageInventory> => ({
+    target: { kind: 'Deployment', group: 'apps', resource: 'deployments', namespace: 'prod', name: 'web' },
+    containers: [{ type: 'container', name: 'app', image: 'app:old' }, { type: 'initContainer', name: 'migrate', image: 'migrate:old' }],
+    behavior: { type: 'rolling' },
+  }))
+  try {
+    await act(async () => root.render(<SetImageDialog open workloadLabel="Deployment" workloadName="web" workloadResource="deployments" ownership={{ guard, onSelectionChange }} onLoad={onLoad} onClose={() => {}} onConfirm={async () => {}} />))
+    await act(async () => vi.waitFor(() => expect(onSelectionChange).toHaveBeenLastCalledWith({
+      containers: [{ type: 'container', name: 'app' }, { type: 'initContainer', name: 'migrate' }],
+      changed: [],
+    })))
+  } finally {
+    await act(async () => root.unmount())
+  }
+})
+
+it('keeps Update disabled until the host has judged the containers being changed', async () => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+  const host = document.createElement('div')
+  document.body.appendChild(host)
+  const root = createRoot(host)
+  const unmanaged = { owner: null, helmRelease: null, pending: false, level: 'none', perWrite: [], summary: '', syncPolicy: null, requiresAck: false, ownershipError: null } as never
+  const onLoad = vi.fn(async (): Promise<WorkloadImageInventory> => ({
+    target: { kind: 'Deployment', group: 'apps', resource: 'deployments', namespace: 'prod', name: 'web' },
+    containers: [{ type: 'container', name: 'app', image: 'app:old' }],
+    behavior: { type: 'rolling' },
+  }))
+  const changed = setImageSelectionKey({ containers: [{ type: 'container', name: 'app' }], changed: [{ type: 'container', name: 'app' }] })
+  const render = (selectionKey: string) =>
+    root.render(<SetImageDialog open workloadLabel="Deployment" workloadName="web" workloadResource="deployments" ownership={{ guard: unmanaged, onSelectionChange: () => {}, selectionKey }} onLoad={onLoad} onClose={() => {}} onConfirm={async () => {}} />)
+  const update = () => [...document.querySelectorAll('button')].find((b) => /^Update \d+ image/.test(b.textContent ?? '')) as HTMLButtonElement | undefined
+  try {
+    await act(async () => render(''))
+    const input = await vi.waitFor(() => {
+      const el = document.querySelector('input[aria-label^="New image"]') as HTMLInputElement | null
+      expect(el).not.toBeNull()
+      return el!
+    })
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')!.set!.call(input, 'app:new')
+      input.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+    // The guard on screen was judged before the edit.
+    expect(update()?.disabled).toBe(true)
+    await act(async () => render(changed))
+    expect(update()?.disabled).toBe(false)
+  } finally {
+    await act(async () => root.unmount())
+    host.remove()
+  }
+})
+
+it("doesn't hold Update for a host that reports the selection without judging it", async () => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+  const host = document.createElement('div')
+  document.body.appendChild(host)
+  const root = createRoot(host)
+  const unmanaged = { owner: null, helmRelease: null, pending: false, level: 'none', perWrite: [], summary: '', syncPolicy: null, requiresAck: false, ownershipError: null } as never
+  const onLoad = vi.fn(async (): Promise<WorkloadImageInventory> => ({
+    target: { kind: 'Deployment', group: 'apps', resource: 'deployments', namespace: 'prod', name: 'web' },
+    containers: [{ type: 'container', name: 'app', image: 'app:old' }],
+    behavior: { type: 'rolling' },
+  }))
+  try {
+    await act(async () => root.render(<SetImageDialog open workloadLabel="Deployment" workloadName="web" workloadResource="deployments" ownership={{ guard: unmanaged, onSelectionChange: () => {} }} onLoad={onLoad} onClose={() => {}} onConfirm={async () => {}} />))
+    const input = await vi.waitFor(() => {
+      const el = document.querySelector('input[aria-label^="New image"]') as HTMLInputElement | null
+      expect(el).not.toBeNull()
+      return el!
+    })
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')!.set!.call(input, 'app:new')
+      input.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+    const update = [...document.querySelectorAll('button')].find((b) => /^Update \d+ image/.test(b.textContent ?? '')) as HTMLButtonElement | undefined
+    expect(update?.disabled).toBe(false)
+  } finally {
+    await act(async () => root.unmount())
+    host.remove()
+  }
+})

package/src/hooks/useGitOpsWriteGuard.ts

@@ -0,0 +1,193 @@
+import { useMemo } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import {
+  evaluateGitOpsWriteGuard,
+  gitOpsWriteEvidencePaths,
+  type GitOpsWrite,
+  type GitOpsWriteEvidence,
+  type GitOpsWriteGuard,
+  type GitOpsWriteTarget,
+} from '@skyhook-io/k8s-ui'
+import type { Relationships } from '../types'
+import { fetchGitOpsWriteEvidence, useResource, useRadarFeature } from '../api/client'
+import { getApiBase } from '../api/config'
+import { kindToPluralWithGroup } from '../utils/navigation'
+import { gitOpsOwnerKindRef, useResolvedGitOpsOwner, type ResolvedGitOpsOwner } from './useResolvedGitOpsOwner'
+
+export interface GitOpsWriteGuardState {
+  /** Undefined only while disabled. */
+  guard: GitOpsWriteGuard | undefined
+  ownership: ResolvedGitOpsOwner
+  evidence: GitOpsWriteEvidence | undefined
+}
+
+// Evaluates the GitOps write guard for a write to `target`: resolves the
+// owner (or takes one the host already resolved), asks the server for the
+// field-level evidence the browser can't see, and classifies the writes.
+//
+// `relationships`/`resource` may be omitted; the target is then fetched.
+export function useGitOpsWriteGuard({
+  target,
+  writes,
+  relationships,
+  resource,
+  ownership: resolved,
+  relationshipsUnavailable = false,
+  declaredManager,
+  evidencePaths: requestedPaths,
+  enabled = true,
+}: {
+  target: GitOpsWriteTarget
+  writes: GitOpsWrite[]
+  /** Paths to ask the server about, when wider than the writes being judged
+   *  (every container a dialog lists, while judging the ones being changed). */
+  evidencePaths?: string[]
+  relationships?: Relationships
+  resource?: unknown
+  /** Pass when the host already resolved ownership for this target. */
+  ownership?: ResolvedGitOpsOwner
+  /** The host read the target but the server sent no relationships (its
+   *  topology isn't built yet), so ownership is unknown rather than absent. */
+  relationshipsUnavailable?: boolean
+  /** A manager the server detected on its own (e.g. "Argo CD"). When the
+   *  browser can't resolve an owner, ownership is unknown rather than absent. */
+  declaredManager?: string | null
+  enabled?: boolean
+}): GitOpsWriteGuardState {
+  const needsTarget = enabled && !resolved && relationships === undefined
+  const targetQuery = useResource<any>(
+    needsTarget ? kindToPluralWithGroup(target.kind, target.group) : '',
+    target.namespace,
+    target.name,
+    target.group || undefined,
+    // Keyed by API base: a host can point one QueryClient at several clusters
+    // (Radar Hub's fleet Diagnose panel), and the shared resource keys aren't.
+    { enabled: needsTarget, cacheScope: getApiBase() },
+  )
+  const ownRelationships = relationships ?? targetQuery.relationships
+  const ownResolution = useResolvedGitOpsOwner({
+    kind: kindToPluralWithGroup(target.kind, target.group),
+    group: target.group || undefined,
+    namespace: target.namespace,
+    name: target.name,
+    relationships: ownRelationships,
+    resource: resource ?? targetQuery.data,
+    enabled: enabled && !resolved,
+    cacheScope: getApiBase(),
+  })
+  const ownership = resolved ?? ownResolution
+
+  const targetLookupPending = needsTarget && targetQuery.isLoading
+  const targetLookupFailed = needsTarget && targetQuery.isError
+  const lookupPending = targetLookupPending || ownership.lookupPending
+  const managed = Boolean(ownership.owner || ownership.helmOwner)
+
+  const writesKey = JSON.stringify(writes)
+  const requestedPathsKey = requestedPaths ? JSON.stringify(requestedPaths) : ''
+  const paths = useMemo(
+    () => (requestedPathsKey ? (JSON.parse(requestedPathsKey) as string[]) : gitOpsWriteEvidencePaths(JSON.parse(writesKey))),
+    [requestedPathsKey, writesKey],
+  )
+  const ownerRef = useMemo(() => {
+    if (ownership.owner) {
+      return { ...gitOpsOwnerKindRef(ownership.owner), namespace: ownership.owner.namespace, name: ownership.owner.name }
+    }
+    if (ownership.helmOwner) {
+      return { kind: 'HelmRelease', group: '', namespace: ownership.helmOwner.namespace, name: ownership.helmOwner.name }
+    }
+    return null
+  }, [ownership.owner, ownership.helmOwner])
+  // An Argo owner without a namespace is still asked about: the server finds
+  // the Application whose status lists the object.
+  const canFetchEvidence = managed && !lookupPending && !targetLookupFailed && !ownership.lookupError
+
+  const evidenceFeature = useRadarFeature('gitopsWriteEvidence')
+  const evidenceQuery = useQuery({
+    // The API base identifies the cluster when a host switches it (Radar Hub).
+    queryKey: ['gitops-write-evidence', getApiBase(), target.kind, target.group, target.namespace, target.name, paths, ownerRef, ...evidenceFeature.gatedKey],
+    queryFn: () =>
+      evidenceFeature.guard(() =>
+        fetchGitOpsWriteEvidence({
+          kind: target.kind,
+          group: target.group,
+          namespace: target.namespace,
+          name: target.name,
+          paths,
+          owner: ownerRef ?? undefined,
+        }),
+      ),
+    enabled: enabled && canFetchEvidence,
+    staleTime: 0,
+    retry: false,
+  })
+
+  const targetRelationshipsMissing = needsTarget && targetQuery.data != null && targetQuery.relationships == null
+  const unresolvedDeclaredManager = Boolean(declaredManager) && !managed && !lookupPending
+  const unknownOwner = "so it can't tell whether a GitOps tool or Helm manages it."
+  const ownershipError = targetLookupFailed
+    ? `Radar couldn't read this resource, ${unknownOwner}`
+    : ownership.lookupError
+      ? `Radar couldn't read the resource that owns this one, ${unknownOwner}`
+      : relationshipsUnavailable || targetRelationshipsMissing || ownership.relationshipsUnavailable
+        ? `Radar hasn't mapped this resource's owners yet, ${unknownOwner}`
+        : unresolvedDeclaredManager
+          ? `Its labels mark it as managed by ${declaredManager}, but Radar couldn't find the owner to check whether it would revert this change.`
+          : null
+
+  // React Query keeps earlier data after a failed refetch, and while the query
+  // is disabled (an unreadable target or owner); an exemption it carried may no
+  // longer hold.
+  const evidence = evidenceQuery.isError || !canFetchEvidence ? undefined : evidenceQuery.data
+
+  // Argo CD 3's tracking id omits the namespace of Applications in its own
+  // namespace, and the browser's namespace view may hide them; take the
+  // Application the server confirmed.
+  const confirmedOwnership = useMemo<ResolvedGitOpsOwner>(() => {
+    const owner = ownership.owner
+    const namespace = evidence?.ownerTracksTarget ? evidence.owner?.namespace : undefined
+    if (!owner || owner.namespace || !namespace) return ownership
+    return { ...ownership, owner: { ...owner, namespace }, ownerVerified: true }
+  }, [ownership, evidence])
+
+  const guard = useMemo(
+    () =>
+      enabled
+        ? evaluateGitOpsWriteGuard({
+            target,
+            owner: confirmedOwnership.owner,
+            helmRelease: ownership.helmOwner,
+            // A refetch counts as pending: an earlier verdict may no longer hold.
+            ownerPending: lookupPending || (canFetchEvidence && (evidenceQuery.isPending || evidenceQuery.isFetching)),
+            ownershipError,
+            // The Application's status listing the object confirms a name match.
+            ownerMatchedByName: ownership.ownerMatchedByName && !evidence?.ownerTracksTarget,
+            evidence,
+            evidenceError: evidenceQuery.error instanceof Error ? evidenceQuery.error.message : null,
+            writes: JSON.parse(writesKey),
+          })
+        : undefined,
+    // target fields are listed individually so an inline literal doesn't
+    // re-evaluate every render.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [
+      enabled,
+      target.kind,
+      target.group,
+      target.namespace,
+      target.name,
+      confirmedOwnership.owner,
+      ownership.helmOwner,
+      lookupPending,
+      canFetchEvidence,
+      evidenceQuery.isPending,
+      evidenceQuery.isFetching,
+      evidence,
+      evidenceQuery.error,
+      ownershipError,
+      ownership.ownerMatchedByName,
+      writesKey,
+    ],
+  )
+
+  return { guard, ownership: confirmedOwnership, evidence }
+}