@skyhook-io/radar-app 1.16.3 → 1.17.1

package/src/api/actions.errorCode.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import { ApiError } from './client'
+import { cnpgActionErrorCode } from './cnpg'
+import { actionCompleted, actionOutcomeLocked } from './actions'
+
+describe('cnpgActionErrorCode', () => {
+  it('keeps the server code when there is one', () => {
+    expect(cnpgActionErrorCode(new ApiError('changed', 409, { code: 'changed' }))).toBe('changed')
+  })
+  it('treats a lost connection or an apiserver timeout as an unknown outcome', () => {
+    expect(cnpgActionErrorCode(new TypeError('Failed to fetch'))).toBe('outcome_unknown')
+    expect(cnpgActionErrorCode(new ApiError('timeout', 504))).toBe('outcome_unknown')
+    expect(cnpgActionErrorCode(new ApiError('internal', 500))).toBe('outcome_unknown')
+  })
+  it('treats an uncoded 503 as unknown: a proxy may have forwarded the write before the upstream reset', () => {
+    const reset = new ApiError('upstream connect error or disconnect/reset before headers', 503)
+    expect(cnpgActionErrorCode(reset)).toBe('outcome_unknown')
+    expect(actionOutcomeLocked(reset)).toBe(true)
+  })
+  it('treats refusals before any write as known failures', () => {
+    expect(cnpgActionErrorCode(new ApiError('webhook down', 503, { code: 'operator_webhook_unavailable' }))).toBe('operator_webhook_unavailable')
+    expect(actionOutcomeLocked(new ApiError('webhook down', 503, { code: 'operator_webhook_unavailable' }))).toBe(false)
+    expect(actionOutcomeLocked(new ApiError('Not connected to cluster', 503, { error: 'Not connected to cluster', code: 'unavailable' }))).toBe(false)
+    expect(cnpgActionErrorCode(new ApiError('forbidden', 403))).toBeUndefined()
+    expect(cnpgActionErrorCode(null)).toBeUndefined()
+  })
+})
+
+describe('partial outcomes', () => {
+  const partial = new ApiError('stopped', 403, { code: 'partial', completed: ['deleted PVC pg-2', 'deleted PVC pg-2-wal'] })
+  it('locks confirm and lists what already happened, whatever the status', () => {
+    expect(cnpgActionErrorCode(partial)).toBe('partial')
+    expect(actionOutcomeLocked(partial)).toBe(true)
+    expect(actionCompleted(partial)).toEqual(['deleted PVC pg-2', 'deleted PVC pg-2-wal'])
+  })
+  it('leaves known refusals unlocked', () => {
+    expect(actionOutcomeLocked(new ApiError('changed', 409, { code: 'changed' }))).toBe(false)
+    expect(actionCompleted(new ApiError('changed', 409, { code: 'changed' }))).toEqual([])
+  })
+})

package/src/api/actions.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest'
+import { capabilityReason, actionErrorCode, actionOutcomeLocked, actionDialogResult } from './actions'
+import { ApiError } from './client'
+import { RadarFeatureUnsupportedError } from './radarFeatures'
+
+describe('capabilityReason', () => {
+  it('says nothing for an allowed action, and the server reason when there is one', () => {
+    expect(capabilityReason({ allowed: true, permission: 'allowed' })).toBeUndefined()
+    expect(capabilityReason({ allowed: false, permission: 'allowed', reason: 'The Cluster is hibernated' })).toBe('The Cluster is hibernated')
+  })
+  it('names the missing grant when the reason is absent', () => {
+    expect(capabilityReason({ allowed: false, permission: 'denied', grant: { verb: 'create', group: 'postgresql.cnpg.io', resource: 'backups', namespace: 'db' } })).toBe(
+      'Your account may not do this (create backups (postgresql.cnpg.io) in namespace db)',
+    )
+    expect(capabilityReason({ allowed: false, permission: 'unknown' })).toBe('Not available')
+  })
+})
+
+it('does not call a pre-request feature refusal an unknown write outcome', () => {
+  const error = new RadarFeatureUnsupportedError('cnpgWorkspace', {})
+  expect(actionErrorCode(error)).toBeUndefined()
+  expect(actionOutcomeLocked(error)).toBe(false)
+  expect(actionDialogResult(error)?.state).toBe('error')
+})
+
+describe('actionDialogResult', () => {
+  it.each([
+    [new ApiError('Review changed', 409, { code: 'changed' }), 'error'],
+    [new ApiError('upstream connect error or disconnect/reset before headers', 503), 'unknown'],
+    [new ApiError('The operator webhook did not answer', 503, { code: 'operator_webhook_unavailable' }), 'error'],
+    [new ApiError('Gateway timeout', 504), 'unknown'],
+    [new Error('Connection lost'), 'unknown'],
+    [new ApiError('Write result missing', 500, { code: 'outcome_unknown' }), 'unknown'],
+    [new ApiError('One volume removed', 409, { code: 'partial', completed: ['delete volume'] }), 'partial'],
+  ] as const)('keeps the result classification for %s', (error, state) => {
+    expect(actionDialogResult(error)?.state).toBe(state)
+    expect(actionDialogResult(error)?.message).toBe(error.message)
+  })
+
+  it('selects the heading belonging to the result and retains no empty result', () => {
+    const titles = { error: 'Review could not be loaded', unknown: 'The Cluster may have changed', partial: 'Earlier writes partially completed' }
+    expect(actionDialogResult(new ApiError('Refused', 409), titles)?.title).toBe(titles.error)
+    expect(actionDialogResult(new Error('Connection lost'), titles)?.title).toBe(titles.unknown)
+    expect(actionDialogResult(new ApiError('Partial', 409, { code: 'partial' }), titles)?.title).toBe(titles.partial)
+    expect(actionDialogResult(new ApiError('Partial', 409, { code: 'partial' }), { unknown: 'May have changed' })?.title).toBeUndefined()
+    expect(actionDialogResult(null)).toBeUndefined()
+  })
+})

package/src/api/actions.ts

@@ -0,0 +1,79 @@
+// The client half of the reviewed-action contract shared by workspace
+// integrations. A capability says
+// whether an action is offered and why not; a request carries the context,
+// object UID and facts the user confirmed, and the server refuses it with a
+// stable code when any of them no longer holds.
+
+import { formatGrant, type Grant, type ActionConfirmResult } from '@skyhook-io/k8s-ui'
+import { ApiError } from './client'
+import { isRadarFeatureUnsupported } from './radarFeatures'
+
+export interface ActionCapability {
+  allowed: boolean
+  reason?: string
+  reasonCode?: string
+  /** `unknown`: the permission check itself failed; the apiserver decides on submit. */
+  permission: 'allowed' | 'denied' | 'unknown'
+  grant?: Grant
+}
+
+export interface ActionRequest<Facts extends object = object, Params extends object = object> {
+  reviewedContext: string
+  uid: string
+  facts: Facts
+  params?: Params
+}
+
+/**
+ * Refusals every action family shares. An integration adds its own codes by
+ * widening the type parameter of actionErrorCode.
+ */
+export type ActionErrorCode = 'context_changed' | 'changed' | 'blocked' | 'partial' | 'unavailable' | 'outcome_unknown'
+
+// A request that timed out or lost its connection may have been applied by the
+// apiserver anyway. A 503 without a code is just as uncertain: an Envoy-based
+// ingress (Istio, Contour, Gateway API implementations) answers 503 when the
+// upstream connection reset after it forwarded the request. Radar's own
+// refusals before any write carry the code `unavailable`.
+const AMBIGUOUS_STATUSES = new Set([500, 502, 503, 504])
+
+export function actionErrorCode<C extends string = ActionErrorCode>(err: unknown): C | ActionErrorCode | undefined {
+  if (!err || isRadarFeatureUnsupported(err)) return undefined
+  if (!(err instanceof ApiError)) return 'outcome_unknown'
+  const code = err.data?.code
+  if (typeof code === 'string') return code as C
+  return AMBIGUOUS_STATUSES.has(err.status) ? 'outcome_unknown' : undefined
+}
+
+/**
+ * Confirm stays locked when the last attempt may have taken effect (unknown)
+ * or partly did (partial): repeating it would act on a target that moved.
+ */
+export function actionOutcomeLocked(err: unknown): boolean {
+  const code = actionErrorCode(err)
+  return code === 'outcome_unknown' || code === 'partial'
+}
+
+export function actionDialogResult(
+  error: Error | null | undefined,
+  titles: { error?: string; unknown?: string; partial?: string } = {},
+): ActionConfirmResult | undefined {
+  if (!error) return undefined
+  const code = actionErrorCode(error)
+  const state = code === 'outcome_unknown' ? 'unknown' : code === 'partial' ? 'partial' : 'error'
+  return { state, message: error.message, title: state === 'error' ? titles.error : state === 'partial' ? titles.partial : titles.unknown }
+}
+
+/** The mutations a `partial` refusal reports as already done. */
+export function actionCompleted(err: unknown): string[] {
+  if (!(err instanceof ApiError) || err.data?.code !== 'partial') return []
+  const done = err.data.completed
+  return Array.isArray(done) ? done.filter((d): d is string => typeof d === 'string') : []
+}
+
+/** Why an action is not offered, or undefined when it is. */
+export function capabilityReason(cap: ActionCapability): string | undefined {
+  if (cap.allowed) return undefined
+  if (cap.reason) return cap.reason
+  return cap.permission === 'denied' ? `Your account may not do this (${formatGrant(cap.grant) ?? 'permission denied'})` : 'Not available'
+}

package/src/api/apiResources.navigation.test.tsx

@@ -0,0 +1,232 @@
+// @vitest-environment jsdom
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import {
+  customResourceDefinitionRef,
+  kindToPluralWithGroup,
+  knownKindForPluralWithGroup,
+  resetNavigationMap,
+} from "@skyhook-io/k8s-ui/utils/navigation";
+import { useAPIResources } from "./apiResources";
+import { MetadataSection } from "@skyhook-io/k8s-ui/components/ui/drawer-components";
+
+beforeEach(() => vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true));
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+  resetNavigationMap();
+});
+
+it.each(["unwatched", "syncing", "denied", "deferred", "unsupported", "synced", undefined])(
+  "bounds definition polling for inventory state %s",
+  async (state) => {
+    vi.useFakeTimers();
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    const root = createRoot(document.createElement("div"));
+    const fetch = vi.fn(() => Promise.resolve(Response.json([{
+      group: "apiextensions.k8s.io", version: "v1", kind: "CustomResourceDefinition",
+      name: "customresourcedefinitions", namespaced: false, isCrd: false, verbs: ["get", "list", "watch"],
+      ...(state ? { observation: { state } } : {}),
+    }])));
+    vi.stubGlobal("fetch", fetch);
+    function Probe() {
+      useAPIResources();
+      return null;
+    }
+    try {
+      await act(async () => root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>));
+      await act(async () => { await vi.advanceTimersByTimeAsync(120_001); });
+      const calls = fetch.mock.calls.length;
+      if (state === "unwatched" || state === "syncing") expect(calls).toBeGreaterThan(1);
+      else expect(calls).toBe(1);
+      await act(async () => { await vi.advanceTimersByTimeAsync(60_000); });
+      expect(fetch).toHaveBeenCalledTimes(calls);
+    } finally {
+      await act(async () => root.unmount());
+      client.clear();
+    }
+  },
+);
+
+it("refreshes definitions until their inventory syncs, without relying on topology", async () => {
+  vi.useFakeTimers();
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const root = createRoot(document.createElement("div"));
+  let synced = false;
+  const fetch = vi.fn(() => Promise.resolve(Response.json([
+    {
+      group: "apiextensions.k8s.io", version: "v1", kind: "CustomResourceDefinition",
+      name: "customresourcedefinitions", namespaced: false, isCrd: false, verbs: ["get", "list", "watch"],
+      observation: { state: synced ? "synced" : "syncing" },
+    },
+    {
+      group: "plants.example.io", version: "v1", kind: "Cactus", name: "cacti",
+      namespaced: true, isCrd: true, verbs: ["get"],
+      ...(synced ? { definitionName: "cacti.plants.example.io" } : {}),
+    },
+  ])));
+  vi.stubGlobal("fetch", fetch);
+  function Probe() {
+    useAPIResources();
+    return null;
+  }
+  try {
+    await act(async () => {
+      root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>);
+    });
+    await act(async () => { await vi.advanceTimersByTimeAsync(0); });
+    expect(fetch).toHaveBeenCalledTimes(1);
+    expect(customResourceDefinitionRef("plants.example.io/v1", "Cactus")).toBeNull();
+    synced = true;
+    await act(async () => { await vi.advanceTimersByTimeAsync(3000); });
+    await act(async () => { await vi.advanceTimersByTimeAsync(1); });
+    expect(fetch).toHaveBeenCalledTimes(2);
+    expect(customResourceDefinitionRef("plants.example.io/v1", "Cactus")?.name).toBe("cacti.plants.example.io");
+    await act(async () => { await vi.advanceTimersByTimeAsync(6000); });
+    expect(fetch).toHaveBeenCalledTimes(2);
+  } finally {
+    await act(async () => root.unmount());
+    client.clear();
+  }
+});
+
+it("renders a definition link when discovery arrives after the instance", async () => {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const element = document.createElement("div");
+  const root = createRoot(element);
+  const resource = {
+    group: "plants.example.io", version: "v1", kind: "Cactus", name: "cacti",
+    namespaced: true, isCrd: true, verbs: ["get"], definitionName: "cacti.plants.example.io",
+  };
+  let finishDiscovery!: (response: Response) => void;
+  let fail = false;
+  vi.stubGlobal("fetch", vi.fn(() => fail
+    ? Promise.resolve(new Response("{}", { status: 500 }))
+    : new Promise<Response>((resolve) => { finishDiscovery = resolve; })));
+  function Probe() {
+    useAPIResources();
+    return <MetadataSection data={{ apiVersion: "plants.example.io/v1", kind: "Cactus", metadata: { name: "live" } }} />;
+  }
+  try {
+    await act(async () => root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>));
+    expect(element.textContent).not.toContain("cacti.plants.example.io");
+    await act(async () => { finishDiscovery(Response.json([resource])); });
+    await vi.waitFor(async () => {
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)); });
+      expect(element.textContent).toContain("cacti.plants.example.io");
+    });
+    fail = true;
+    await act(async () => { await client.invalidateQueries({ queryKey: ["api-resources"] }); });
+    await vi.waitFor(async () => {
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)); });
+      expect(element.textContent).not.toContain("cacti.plants.example.io");
+    });
+  } finally {
+    await act(async () => root.unmount());
+    client.clear();
+  }
+});
+
+it("clears confirmed definitions after a failed refresh and cancels discovery from an old cluster", async () => {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  const root = createRoot(document.createElement("div"));
+  const resource = {
+    group: "plants.example.io",
+    version: "v1",
+    kind: "Cactus",
+    name: "cacti",
+    namespaced: true,
+    isCrd: true,
+    verbs: ["get"],
+    definitionName: "cacti.plants.example.io",
+  };
+  let fail = false;
+  let hold = false;
+  let pendingSignal: AbortSignal | undefined;
+  vi.stubGlobal(
+    "fetch",
+    vi.fn((_input: unknown, init?: RequestInit) => {
+      if (hold) {
+        pendingSignal = init?.signal as AbortSignal;
+        return new Promise<Response>(() => {});
+      }
+      return Promise.resolve(
+        fail ? new Response("{}", { status: 500 }) : Response.json([resource]),
+      );
+    }),
+  );
+  function Probe() {
+    useAPIResources();
+    return null;
+  }
+  const settle = async () => {
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+  };
+  try {
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={client}>
+          <Probe />
+        </QueryClientProvider>,
+      );
+    });
+    await vi.waitFor(async () => {
+      await settle();
+      expect(
+        customResourceDefinitionRef("plants.example.io/v1", "Cactus")?.name,
+      ).toBe(resource.definitionName);
+    });
+    expect(
+      knownKindForPluralWithGroup("helmreleases", "helm.toolkit.fluxcd.io"),
+    ).toBe("HelmRelease");
+    expect(
+      customResourceDefinitionRef("helm.toolkit.fluxcd.io/v2", "HelmRelease"),
+    ).toBeNull();
+    fail = true;
+    await act(async () => {
+      await client.invalidateQueries({ queryKey: ["api-resources"] });
+    });
+    await vi.waitFor(async () => {
+      await settle();
+      expect(
+        customResourceDefinitionRef("plants.example.io/v1", "Cactus"),
+      ).toBeNull();
+    });
+    expect(
+      knownKindForPluralWithGroup("helmreleases", "helm.toolkit.fluxcd.io"),
+    ).toBe("HelmRelease");
+    expect(kindToPluralWithGroup("Cactus", "plants.example.io")).toBe("cacti");
+    fail = false;
+    await act(async () => {
+      await client.invalidateQueries({ queryKey: ["api-resources"] });
+    });
+    await vi.waitFor(async () => {
+      await settle();
+      expect(
+        customResourceDefinitionRef("plants.example.io/v1", "Cactus")?.name,
+      ).toBe(resource.definitionName);
+    });
+    hold = true;
+    await act(async () => {
+      void client.invalidateQueries({ queryKey: ["api-resources"] });
+    });
+    expect(pendingSignal?.aborted).toBe(false);
+    resetNavigationMap();
+    await act(async () => {
+      client.removeQueries();
+    });
+    expect(pendingSignal?.aborted).toBe(true);
+    expect(
+      customResourceDefinitionRef("plants.example.io/v1", "Cactus"),
+    ).toBeNull();
+  } finally {
+    await act(async () => root.unmount());
+    client.clear();
+  }
+});

package/src/api/apiResources.ts

@@ -1,8 +1,12 @@
+import { useEffect } from "react";
+import { initNavigationMap } from "@skyhook-io/k8s-ui/utils/navigation";
 import { useQuery } from "@tanstack/react-query";
 import type { APIResource } from "../types";
 import { apiUrl, getAuthHeaders, getCredentialsMode } from "./config";
 import { readErrorBody } from "./httpErrors";
 
+const definitionPollDeadlines = new WeakMap<object, number>();
+
 // Re-export pure functions from package
 export {
   categorizeResources,
@@ -15,8 +19,9 @@ export {
 } from "@skyhook-io/k8s-ui";
 export type { ResourceCategory } from "@skyhook-io/k8s-ui";
 
-async function fetchJSON<T>(path: string): Promise<T> {
+async function fetchJSON<T>(path: string, signal?: AbortSignal): Promise<T> {
   const response = await fetch(apiUrl(path), {
+    signal,
     credentials: getCredentialsMode(),
     headers: getAuthHeaders(),
   });
@@ -27,13 +32,51 @@ async function fetchJSON<T>(path: string): Promise<T> {
   return response.json();
 }
 
+// Known GitOps navigation identities, not installation or CRD-existence evidence.
+export const GITOPS_KINDS: APIResource[] = [
+  { name: 'applications', kind: 'Application', group: 'argoproj.io', version: 'v1alpha1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'applicationsets', kind: 'ApplicationSet', group: 'argoproj.io', version: 'v1alpha1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'appprojects', kind: 'AppProject', group: 'argoproj.io', version: 'v1alpha1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'kustomizations', kind: 'Kustomization', group: 'kustomize.toolkit.fluxcd.io', version: 'v1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'helmreleases', kind: 'HelmRelease', group: 'helm.toolkit.fluxcd.io', version: 'v2', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'gitrepositories', kind: 'GitRepository', group: 'source.toolkit.fluxcd.io', version: 'v1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'ocirepositories', kind: 'OCIRepository', group: 'source.toolkit.fluxcd.io', version: 'v1beta2', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'helmrepositories', kind: 'HelmRepository', group: 'source.toolkit.fluxcd.io', version: 'v1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'alerts', kind: 'Alert', group: 'notification.toolkit.fluxcd.io', version: 'v1beta3', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+]
+
+
 // Fetch all API resources from the cluster
 export function useAPIResources() {
-  return useQuery<APIResource[]>({
+  const result = useQuery<APIResource[]>({
     queryKey: ["api-resources"],
-    queryFn: () => fetchJSON("/api-resources"),
+    queryFn: ({ signal }) => fetchJSON("/api-resources", signal),
     staleTime: 5 * 60 * 1000, // 5 minutes - resources don't change often
+    refetchInterval: (query) => {
+      const state = query.state.data?.find(resource =>
+        resource.group === "apiextensions.k8s.io" && resource.name === "customresourcedefinitions")?.observation?.state;
+      if (state !== "unwatched" && state !== "syncing") {
+        definitionPollDeadlines.delete(query);
+        return false;
+      }
+      let deadline = definitionPollDeadlines.get(query);
+      if (deadline === undefined) {
+        deadline = Date.now() + 2 * 60 * 1000;
+        definitionPollDeadlines.set(query, deadline);
+      }
+      return Date.now() < deadline ? 3000 : false;
+    },
   });
+  useEffect(() => {
+    // Route identities survive a failed refresh; permission-dependent links do not.
+    const actual = result.isError
+      ? (result.data ?? []).map(resource => ({ ...resource, definitionName: undefined }))
+      : result.data ?? [];
+    const knownOnly = GITOPS_KINDS.filter(known => !actual.some(resource =>
+      resource.group === known.group && (resource.kind === known.kind || resource.name === known.name)));
+    initNavigationMap([...actual, ...knownOnly]);
+  }, [result.data, result.isError]);
+  return result;
 }
 
 // The report families the server watches (reportGroups in

package/src/api/client.goneResource.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from "vitest";
+import { ApiError, goneRecheckInterval, refetchOnResourceEvents, resourceEventKey } from "./client";
+
+const notFound = new ApiError('pods "web-1" not found', 404);
+const detail = (namespace: string, name: string, error: unknown) => ({
+  queryKey: ["resource", "pods", namespace, name, undefined],
+  state: { error },
+});
+
+describe("refetchOnResourceEvents", () => {
+  it("refetches a live detail view on any change to its kind", () => {
+    expect(refetchOnResourceEvents(detail("shop", "web-1", null), "pods", new Set())).toBe(true);
+  });
+
+  it("refetches a detail view that failed for a reason other than 404", () => {
+    const failed = detail("shop", "web-1", new ApiError("unavailable", 503));
+    expect(refetchOnResourceEvents(failed, "pods", new Set())).toBe(true);
+  });
+
+  it("leaves a deleted object alone when other objects of its kind change", () => {
+    // The production shape: pods churning next to an open view of a deleted
+    // pod refetched it, 404 every time, for as long as the view stayed open.
+    const named = new Set([resourceEventKey("pods", "shop", "web-2")]);
+    expect(refetchOnResourceEvents(detail("shop", "web-1", notFound), "pods", named)).toBe(false);
+  });
+
+  it("refetches a deleted object as soon as an event names it", () => {
+    // A StatefulSet recreates its pod under the same name.
+    const named = new Set([resourceEventKey("pods", "shop", "web-1")]);
+    expect(refetchOnResourceEvents(detail("shop", "web-1", notFound), "pods", named)).toBe(true);
+  });
+
+  it("matches a cluster-scoped object, whose namespace is empty", () => {
+    const query = { queryKey: ["resource", "nodes", "", "node-a", undefined], state: { error: notFound } };
+    expect(refetchOnResourceEvents(query, "nodes", new Set([resourceEventKey("nodes", "", "node-a")]))).toBe(true);
+  });
+});
+
+describe("goneRecheckInterval", () => {
+  it("re-checks a deleted object once a minute", () => {
+    expect(goneRecheckInterval({ state: { error: notFound } }, undefined)).toBe(60_000);
+    expect(goneRecheckInterval({ state: { error: notFound } }, 5_000)).toBe(60_000);
+  });
+
+  it("keeps the caller's interval otherwise", () => {
+    expect(goneRecheckInterval({ state: { error: null } }, 5_000)).toBe(5_000);
+    expect(goneRecheckInterval({ state: { error: new ApiError("unavailable", 503) } }, undefined)).toBeUndefined();
+  });
+});

package/src/api/client.helmSource.test.ts

@@ -0,0 +1,39 @@
+import { QueryClient, QueryObserver } from '@tanstack/react-query'
+import { describe, expect, it } from 'vitest'
+import { invalidateHelmAfterSourceChange } from './client'
+
+describe('invalidateHelmAfterSourceChange', () => {
+  it('refreshes OCI inventory and an open release source status query', async () => {
+    const queryClient = new QueryClient()
+    const inventoryKey = ['helm-oci-sources']
+    const statusKey = ['helm-source-status', 'production', 'release']
+    let sourceStatus = {
+      configured: true,
+      available: true,
+      candidates: [{ type: 'oci' as const, reference: 'oci://registry.example.com/charts/example' }],
+    }
+    const observer = new QueryObserver(queryClient, {
+      queryKey: statusKey,
+      queryFn: async () => sourceStatus,
+    })
+    const unsubscribe = observer.subscribe(() => undefined)
+
+    const versionsKey = ['helm-release-versions', 'production', 'release']
+    queryClient.setQueryData(inventoryKey, ['oci://registry.example.com/charts'])
+    queryClient.setQueryData(versionsKey, ['1.0.0'])
+    await observer.refetch()
+
+    sourceStatus = { configured: false, available: false, candidates: [] }
+    await invalidateHelmAfterSourceChange(queryClient)
+
+    expect(queryClient.getQueryState(inventoryKey)?.isInvalidated).toBe(true)
+    expect(queryClient.getQueryState(versionsKey)?.isInvalidated).toBe(true)
+    expect(observer.getCurrentResult().data).toEqual({
+      configured: false,
+      available: false,
+      candidates: [],
+    })
+
+    unsubscribe()
+  })
+})

package/src/api/client.namespaceSwitch.hook.test.tsx

@@ -0,0 +1,54 @@
+// @vitest-environment jsdom
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, expect, it, vi } from "vitest";
+import { useSetActiveNamespace } from "./client";
+
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+});
+
+// The server already reports the requested pick, but the POST never answers.
+async function timedOutSwitch(cacheScoped: boolean) {
+  vi.useFakeTimers();
+  const scope = { actives: ["team-a"], kubeconfigNamespace: "", mode: "namespace", accessibleNamespaces: ["team-a"], deniedNamespaces: [], authoritative: true, canClearNamespace: true, cacheScoped };
+  const calls: string[] = [];
+  vi.stubGlobal("fetch", vi.fn((url: string, init?: RequestInit) => {
+    calls.push(`${init?.method ?? "GET"} ${new URL(url, "http://radar").pathname}`);
+    if (init?.method === "POST") {
+      return new Promise((_, reject) => init.signal?.addEventListener("abort", () => reject(Object.assign(new Error("aborted"), { name: "AbortError" }))));
+    }
+    return Promise.resolve(new Response(JSON.stringify(scope), { status: 200, headers: { "Content-Type": "application/json" } }));
+  }));
+  const client = new QueryClient({ defaultOptions: { mutations: { retry: false } } });
+  client.setQueryData(["namespace-scope"], { ...scope, actives: [] });
+  let mutate!: ReturnType<typeof useSetActiveNamespace>["mutateAsync"];
+  function Probe() {
+    mutate = useSetActiveNamespace().mutateAsync;
+    return null;
+  }
+  const root = createRoot(document.createElement("div"));
+  act(() => root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>));
+  const outcome = mutate({ namespaces: ["team-a"] }).then(() => "applied", (error: Error) => error.message);
+  await vi.advanceTimersByTimeAsync(cacheScoped ? 120_000 : 15_000);
+  const result = { outcome: await outcome, calls };
+  act(() => root.unmount());
+  client.clear();
+  return result;
+}
+
+it("accepts a timed-out view-filter switch the server applied", async () => {
+  const { outcome, calls } = await timedOutSwitch(false);
+  expect(outcome).toBe("applied");
+  expect(calls).toContain("GET /api/cluster/namespace-scope");
+});
+
+it("keeps a timed-out rescope an error even when the scope already names its target", async () => {
+  const { outcome, calls } = await timedOutSwitch(true);
+  expect(outcome).toMatch(/rescope timed out/);
+  expect(calls).not.toContain("GET /api/cluster/namespace-scope");
+});