@skyhook-io/radar-app 1.17.0 → 1.17.1

package/src/api/actions.ts

@@ -0,0 +1,79 @@
+// The client half of the reviewed-action contract shared by workspace
+// integrations. A capability says
+// whether an action is offered and why not; a request carries the context,
+// object UID and facts the user confirmed, and the server refuses it with a
+// stable code when any of them no longer holds.
+
+import { formatGrant, type Grant, type ActionConfirmResult } from '@skyhook-io/k8s-ui'
+import { ApiError } from './client'
+import { isRadarFeatureUnsupported } from './radarFeatures'
+
+export interface ActionCapability {
+  allowed: boolean
+  reason?: string
+  reasonCode?: string
+  /** `unknown`: the permission check itself failed; the apiserver decides on submit. */
+  permission: 'allowed' | 'denied' | 'unknown'
+  grant?: Grant
+}
+
+export interface ActionRequest<Facts extends object = object, Params extends object = object> {
+  reviewedContext: string
+  uid: string
+  facts: Facts
+  params?: Params
+}
+
+/**
+ * Refusals every action family shares. An integration adds its own codes by
+ * widening the type parameter of actionErrorCode.
+ */
+export type ActionErrorCode = 'context_changed' | 'changed' | 'blocked' | 'partial' | 'unavailable' | 'outcome_unknown'
+
+// A request that timed out or lost its connection may have been applied by the
+// apiserver anyway. A 503 without a code is just as uncertain: an Envoy-based
+// ingress (Istio, Contour, Gateway API implementations) answers 503 when the
+// upstream connection reset after it forwarded the request. Radar's own
+// refusals before any write carry the code `unavailable`.
+const AMBIGUOUS_STATUSES = new Set([500, 502, 503, 504])
+
+export function actionErrorCode<C extends string = ActionErrorCode>(err: unknown): C | ActionErrorCode | undefined {
+  if (!err || isRadarFeatureUnsupported(err)) return undefined
+  if (!(err instanceof ApiError)) return 'outcome_unknown'
+  const code = err.data?.code
+  if (typeof code === 'string') return code as C
+  return AMBIGUOUS_STATUSES.has(err.status) ? 'outcome_unknown' : undefined
+}
+
+/**
+ * Confirm stays locked when the last attempt may have taken effect (unknown)
+ * or partly did (partial): repeating it would act on a target that moved.
+ */
+export function actionOutcomeLocked(err: unknown): boolean {
+  const code = actionErrorCode(err)
+  return code === 'outcome_unknown' || code === 'partial'
+}
+
+export function actionDialogResult(
+  error: Error | null | undefined,
+  titles: { error?: string; unknown?: string; partial?: string } = {},
+): ActionConfirmResult | undefined {
+  if (!error) return undefined
+  const code = actionErrorCode(error)
+  const state = code === 'outcome_unknown' ? 'unknown' : code === 'partial' ? 'partial' : 'error'
+  return { state, message: error.message, title: state === 'error' ? titles.error : state === 'partial' ? titles.partial : titles.unknown }
+}
+
+/** The mutations a `partial` refusal reports as already done. */
+export function actionCompleted(err: unknown): string[] {
+  if (!(err instanceof ApiError) || err.data?.code !== 'partial') return []
+  const done = err.data.completed
+  return Array.isArray(done) ? done.filter((d): d is string => typeof d === 'string') : []
+}
+
+/** Why an action is not offered, or undefined when it is. */
+export function capabilityReason(cap: ActionCapability): string | undefined {
+  if (cap.allowed) return undefined
+  if (cap.reason) return cap.reason
+  return cap.permission === 'denied' ? `Your account may not do this (${formatGrant(cap.grant) ?? 'permission denied'})` : 'Not available'
+}

package/src/api/apiResources.navigation.test.tsx

@@ -0,0 +1,232 @@
+// @vitest-environment jsdom
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import {
+  customResourceDefinitionRef,
+  kindToPluralWithGroup,
+  knownKindForPluralWithGroup,
+  resetNavigationMap,
+} from "@skyhook-io/k8s-ui/utils/navigation";
+import { useAPIResources } from "./apiResources";
+import { MetadataSection } from "@skyhook-io/k8s-ui/components/ui/drawer-components";
+
+beforeEach(() => vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true));
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+  resetNavigationMap();
+});
+
+it.each(["unwatched", "syncing", "denied", "deferred", "unsupported", "synced", undefined])(
+  "bounds definition polling for inventory state %s",
+  async (state) => {
+    vi.useFakeTimers();
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    const root = createRoot(document.createElement("div"));
+    const fetch = vi.fn(() => Promise.resolve(Response.json([{
+      group: "apiextensions.k8s.io", version: "v1", kind: "CustomResourceDefinition",
+      name: "customresourcedefinitions", namespaced: false, isCrd: false, verbs: ["get", "list", "watch"],
+      ...(state ? { observation: { state } } : {}),
+    }])));
+    vi.stubGlobal("fetch", fetch);
+    function Probe() {
+      useAPIResources();
+      return null;
+    }
+    try {
+      await act(async () => root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>));
+      await act(async () => { await vi.advanceTimersByTimeAsync(120_001); });
+      const calls = fetch.mock.calls.length;
+      if (state === "unwatched" || state === "syncing") expect(calls).toBeGreaterThan(1);
+      else expect(calls).toBe(1);
+      await act(async () => { await vi.advanceTimersByTimeAsync(60_000); });
+      expect(fetch).toHaveBeenCalledTimes(calls);
+    } finally {
+      await act(async () => root.unmount());
+      client.clear();
+    }
+  },
+);
+
+it("refreshes definitions until their inventory syncs, without relying on topology", async () => {
+  vi.useFakeTimers();
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const root = createRoot(document.createElement("div"));
+  let synced = false;
+  const fetch = vi.fn(() => Promise.resolve(Response.json([
+    {
+      group: "apiextensions.k8s.io", version: "v1", kind: "CustomResourceDefinition",
+      name: "customresourcedefinitions", namespaced: false, isCrd: false, verbs: ["get", "list", "watch"],
+      observation: { state: synced ? "synced" : "syncing" },
+    },
+    {
+      group: "plants.example.io", version: "v1", kind: "Cactus", name: "cacti",
+      namespaced: true, isCrd: true, verbs: ["get"],
+      ...(synced ? { definitionName: "cacti.plants.example.io" } : {}),
+    },
+  ])));
+  vi.stubGlobal("fetch", fetch);
+  function Probe() {
+    useAPIResources();
+    return null;
+  }
+  try {
+    await act(async () => {
+      root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>);
+    });
+    await act(async () => { await vi.advanceTimersByTimeAsync(0); });
+    expect(fetch).toHaveBeenCalledTimes(1);
+    expect(customResourceDefinitionRef("plants.example.io/v1", "Cactus")).toBeNull();
+    synced = true;
+    await act(async () => { await vi.advanceTimersByTimeAsync(3000); });
+    await act(async () => { await vi.advanceTimersByTimeAsync(1); });
+    expect(fetch).toHaveBeenCalledTimes(2);
+    expect(customResourceDefinitionRef("plants.example.io/v1", "Cactus")?.name).toBe("cacti.plants.example.io");
+    await act(async () => { await vi.advanceTimersByTimeAsync(6000); });
+    expect(fetch).toHaveBeenCalledTimes(2);
+  } finally {
+    await act(async () => root.unmount());
+    client.clear();
+  }
+});
+
+it("renders a definition link when discovery arrives after the instance", async () => {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const element = document.createElement("div");
+  const root = createRoot(element);
+  const resource = {
+    group: "plants.example.io", version: "v1", kind: "Cactus", name: "cacti",
+    namespaced: true, isCrd: true, verbs: ["get"], definitionName: "cacti.plants.example.io",
+  };
+  let finishDiscovery!: (response: Response) => void;
+  let fail = false;
+  vi.stubGlobal("fetch", vi.fn(() => fail
+    ? Promise.resolve(new Response("{}", { status: 500 }))
+    : new Promise<Response>((resolve) => { finishDiscovery = resolve; })));
+  function Probe() {
+    useAPIResources();
+    return <MetadataSection data={{ apiVersion: "plants.example.io/v1", kind: "Cactus", metadata: { name: "live" } }} />;
+  }
+  try {
+    await act(async () => root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>));
+    expect(element.textContent).not.toContain("cacti.plants.example.io");
+    await act(async () => { finishDiscovery(Response.json([resource])); });
+    await vi.waitFor(async () => {
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)); });
+      expect(element.textContent).toContain("cacti.plants.example.io");
+    });
+    fail = true;
+    await act(async () => { await client.invalidateQueries({ queryKey: ["api-resources"] }); });
+    await vi.waitFor(async () => {
+      await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)); });
+      expect(element.textContent).not.toContain("cacti.plants.example.io");
+    });
+  } finally {
+    await act(async () => root.unmount());
+    client.clear();
+  }
+});
+
+it("clears confirmed definitions after a failed refresh and cancels discovery from an old cluster", async () => {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  const root = createRoot(document.createElement("div"));
+  const resource = {
+    group: "plants.example.io",
+    version: "v1",
+    kind: "Cactus",
+    name: "cacti",
+    namespaced: true,
+    isCrd: true,
+    verbs: ["get"],
+    definitionName: "cacti.plants.example.io",
+  };
+  let fail = false;
+  let hold = false;
+  let pendingSignal: AbortSignal | undefined;
+  vi.stubGlobal(
+    "fetch",
+    vi.fn((_input: unknown, init?: RequestInit) => {
+      if (hold) {
+        pendingSignal = init?.signal as AbortSignal;
+        return new Promise<Response>(() => {});
+      }
+      return Promise.resolve(
+        fail ? new Response("{}", { status: 500 }) : Response.json([resource]),
+      );
+    }),
+  );
+  function Probe() {
+    useAPIResources();
+    return null;
+  }
+  const settle = async () => {
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+  };
+  try {
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={client}>
+          <Probe />
+        </QueryClientProvider>,
+      );
+    });
+    await vi.waitFor(async () => {
+      await settle();
+      expect(
+        customResourceDefinitionRef("plants.example.io/v1", "Cactus")?.name,
+      ).toBe(resource.definitionName);
+    });
+    expect(
+      knownKindForPluralWithGroup("helmreleases", "helm.toolkit.fluxcd.io"),
+    ).toBe("HelmRelease");
+    expect(
+      customResourceDefinitionRef("helm.toolkit.fluxcd.io/v2", "HelmRelease"),
+    ).toBeNull();
+    fail = true;
+    await act(async () => {
+      await client.invalidateQueries({ queryKey: ["api-resources"] });
+    });
+    await vi.waitFor(async () => {
+      await settle();
+      expect(
+        customResourceDefinitionRef("plants.example.io/v1", "Cactus"),
+      ).toBeNull();
+    });
+    expect(
+      knownKindForPluralWithGroup("helmreleases", "helm.toolkit.fluxcd.io"),
+    ).toBe("HelmRelease");
+    expect(kindToPluralWithGroup("Cactus", "plants.example.io")).toBe("cacti");
+    fail = false;
+    await act(async () => {
+      await client.invalidateQueries({ queryKey: ["api-resources"] });
+    });
+    await vi.waitFor(async () => {
+      await settle();
+      expect(
+        customResourceDefinitionRef("plants.example.io/v1", "Cactus")?.name,
+      ).toBe(resource.definitionName);
+    });
+    hold = true;
+    await act(async () => {
+      void client.invalidateQueries({ queryKey: ["api-resources"] });
+    });
+    expect(pendingSignal?.aborted).toBe(false);
+    resetNavigationMap();
+    await act(async () => {
+      client.removeQueries();
+    });
+    expect(pendingSignal?.aborted).toBe(true);
+    expect(
+      customResourceDefinitionRef("plants.example.io/v1", "Cactus"),
+    ).toBeNull();
+  } finally {
+    await act(async () => root.unmount());
+    client.clear();
+  }
+});

package/src/api/apiResources.ts

@@ -1,8 +1,12 @@
+import { useEffect } from "react";
+import { initNavigationMap } from "@skyhook-io/k8s-ui/utils/navigation";
 import { useQuery } from "@tanstack/react-query";
 import type { APIResource } from "../types";
 import { apiUrl, getAuthHeaders, getCredentialsMode } from "./config";
 import { readErrorBody } from "./httpErrors";
 
+const definitionPollDeadlines = new WeakMap<object, number>();
+
 // Re-export pure functions from package
 export {
   categorizeResources,
@@ -15,8 +19,9 @@ export {
 } from "@skyhook-io/k8s-ui";
 export type { ResourceCategory } from "@skyhook-io/k8s-ui";
 
-async function fetchJSON<T>(path: string): Promise<T> {
+async function fetchJSON<T>(path: string, signal?: AbortSignal): Promise<T> {
   const response = await fetch(apiUrl(path), {
+    signal,
     credentials: getCredentialsMode(),
     headers: getAuthHeaders(),
   });
@@ -27,13 +32,51 @@ async function fetchJSON<T>(path: string): Promise<T> {
   return response.json();
 }
 
+// Known GitOps navigation identities, not installation or CRD-existence evidence.
+export const GITOPS_KINDS: APIResource[] = [
+  { name: 'applications', kind: 'Application', group: 'argoproj.io', version: 'v1alpha1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'applicationsets', kind: 'ApplicationSet', group: 'argoproj.io', version: 'v1alpha1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'appprojects', kind: 'AppProject', group: 'argoproj.io', version: 'v1alpha1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'kustomizations', kind: 'Kustomization', group: 'kustomize.toolkit.fluxcd.io', version: 'v1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'helmreleases', kind: 'HelmRelease', group: 'helm.toolkit.fluxcd.io', version: 'v2', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'gitrepositories', kind: 'GitRepository', group: 'source.toolkit.fluxcd.io', version: 'v1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'ocirepositories', kind: 'OCIRepository', group: 'source.toolkit.fluxcd.io', version: 'v1beta2', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'helmrepositories', kind: 'HelmRepository', group: 'source.toolkit.fluxcd.io', version: 'v1', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+  { name: 'alerts', kind: 'Alert', group: 'notification.toolkit.fluxcd.io', version: 'v1beta3', namespaced: true, verbs: ['list', 'get'], isCrd: true },
+]
+
+
 // Fetch all API resources from the cluster
 export function useAPIResources() {
-  return useQuery<APIResource[]>({
+  const result = useQuery<APIResource[]>({
     queryKey: ["api-resources"],
-    queryFn: () => fetchJSON("/api-resources"),
+    queryFn: ({ signal }) => fetchJSON("/api-resources", signal),
     staleTime: 5 * 60 * 1000, // 5 minutes - resources don't change often
+    refetchInterval: (query) => {
+      const state = query.state.data?.find(resource =>
+        resource.group === "apiextensions.k8s.io" && resource.name === "customresourcedefinitions")?.observation?.state;
+      if (state !== "unwatched" && state !== "syncing") {
+        definitionPollDeadlines.delete(query);
+        return false;
+      }
+      let deadline = definitionPollDeadlines.get(query);
+      if (deadline === undefined) {
+        deadline = Date.now() + 2 * 60 * 1000;
+        definitionPollDeadlines.set(query, deadline);
+      }
+      return Date.now() < deadline ? 3000 : false;
+    },
   });
+  useEffect(() => {
+    // Route identities survive a failed refresh; permission-dependent links do not.
+    const actual = result.isError
+      ? (result.data ?? []).map(resource => ({ ...resource, definitionName: undefined }))
+      : result.data ?? [];
+    const knownOnly = GITOPS_KINDS.filter(known => !actual.some(resource =>
+      resource.group === known.group && (resource.kind === known.kind || resource.name === known.name)));
+    initNavigationMap([...actual, ...knownOnly]);
+  }, [result.data, result.isError]);
+  return result;
 }
 
 // The report families the server watches (reportGroups in

package/src/api/client.helmSource.test.ts

@@ -0,0 +1,39 @@
+import { QueryClient, QueryObserver } from '@tanstack/react-query'
+import { describe, expect, it } from 'vitest'
+import { invalidateHelmAfterSourceChange } from './client'
+
+describe('invalidateHelmAfterSourceChange', () => {
+  it('refreshes OCI inventory and an open release source status query', async () => {
+    const queryClient = new QueryClient()
+    const inventoryKey = ['helm-oci-sources']
+    const statusKey = ['helm-source-status', 'production', 'release']
+    let sourceStatus = {
+      configured: true,
+      available: true,
+      candidates: [{ type: 'oci' as const, reference: 'oci://registry.example.com/charts/example' }],
+    }
+    const observer = new QueryObserver(queryClient, {
+      queryKey: statusKey,
+      queryFn: async () => sourceStatus,
+    })
+    const unsubscribe = observer.subscribe(() => undefined)
+
+    const versionsKey = ['helm-release-versions', 'production', 'release']
+    queryClient.setQueryData(inventoryKey, ['oci://registry.example.com/charts'])
+    queryClient.setQueryData(versionsKey, ['1.0.0'])
+    await observer.refetch()
+
+    sourceStatus = { configured: false, available: false, candidates: [] }
+    await invalidateHelmAfterSourceChange(queryClient)
+
+    expect(queryClient.getQueryState(inventoryKey)?.isInvalidated).toBe(true)
+    expect(queryClient.getQueryState(versionsKey)?.isInvalidated).toBe(true)
+    expect(observer.getCurrentResult().data).toEqual({
+      configured: false,
+      available: false,
+      candidates: [],
+    })
+
+    unsubscribe()
+  })
+})

package/src/api/client.namespaceSwitch.hook.test.tsx

@@ -0,0 +1,54 @@
+// @vitest-environment jsdom
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, expect, it, vi } from "vitest";
+import { useSetActiveNamespace } from "./client";
+
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+});
+
+// The server already reports the requested pick, but the POST never answers.
+async function timedOutSwitch(cacheScoped: boolean) {
+  vi.useFakeTimers();
+  const scope = { actives: ["team-a"], kubeconfigNamespace: "", mode: "namespace", accessibleNamespaces: ["team-a"], deniedNamespaces: [], authoritative: true, canClearNamespace: true, cacheScoped };
+  const calls: string[] = [];
+  vi.stubGlobal("fetch", vi.fn((url: string, init?: RequestInit) => {
+    calls.push(`${init?.method ?? "GET"} ${new URL(url, "http://radar").pathname}`);
+    if (init?.method === "POST") {
+      return new Promise((_, reject) => init.signal?.addEventListener("abort", () => reject(Object.assign(new Error("aborted"), { name: "AbortError" }))));
+    }
+    return Promise.resolve(new Response(JSON.stringify(scope), { status: 200, headers: { "Content-Type": "application/json" } }));
+  }));
+  const client = new QueryClient({ defaultOptions: { mutations: { retry: false } } });
+  client.setQueryData(["namespace-scope"], { ...scope, actives: [] });
+  let mutate!: ReturnType<typeof useSetActiveNamespace>["mutateAsync"];
+  function Probe() {
+    mutate = useSetActiveNamespace().mutateAsync;
+    return null;
+  }
+  const root = createRoot(document.createElement("div"));
+  act(() => root.render(<QueryClientProvider client={client}><Probe /></QueryClientProvider>));
+  const outcome = mutate({ namespaces: ["team-a"] }).then(() => "applied", (error: Error) => error.message);
+  await vi.advanceTimersByTimeAsync(cacheScoped ? 120_000 : 15_000);
+  const result = { outcome: await outcome, calls };
+  act(() => root.unmount());
+  client.clear();
+  return result;
+}
+
+it("accepts a timed-out view-filter switch the server applied", async () => {
+  const { outcome, calls } = await timedOutSwitch(false);
+  expect(outcome).toBe("applied");
+  expect(calls).toContain("GET /api/cluster/namespace-scope");
+});
+
+it("keeps a timed-out rescope an error even when the scope already names its target", async () => {
+  const { outcome, calls } = await timedOutSwitch(true);
+  expect(outcome).toMatch(/rescope timed out/);
+  expect(calls).not.toContain("GET /api/cluster/namespace-scope");
+});

package/src/api/client.namespaceSwitch.test.ts

@@ -0,0 +1,107 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { QueryClient, QueryObserver } from "@tanstack/react-query";
+import { reconcileNamespaceSwitch, refreshAfterNamespaceSwitch } from "./client";
+
+function serveScope(actives: string[]) {
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () =>
+      new Response(
+        JSON.stringify({
+          actives,
+          kubeconfigNamespace: "default",
+          mode: actives.length ? "namespace" : "cluster-wide",
+          accessibleNamespaces: [],
+          deniedNamespaces: [],
+          authoritative: true,
+          canClearNamespace: true,
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      ),
+    ),
+  );
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("reconcileNamespaceSwitch", () => {
+  it("returns the server's scope when a timed-out switch was applied", async () => {
+    serveScope([]);
+    expect((await reconcileNamespaceSwitch([]))?.actives).toEqual([]);
+    serveScope(["b", "a"]);
+    expect((await reconcileNamespaceSwitch(["a", "b"]))?.actives).toEqual([
+      "b",
+      "a",
+    ]);
+  });
+
+  it("reports nothing when the server still holds another pick", async () => {
+    serveScope(["default"]);
+    expect(await reconcileNamespaceSwitch([])).toBeNull();
+  });
+
+  it("reports nothing when the scope cannot be read", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        throw new TypeError("network down");
+      }),
+    );
+    expect(await reconcileNamespaceSwitch([])).toBeNull();
+  });
+});
+
+describe('refreshAfterNamespaceSwitch', () => {
+  it('preserves in-flight requests and cached data when switching to All', async () => {
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+    let calls = 0
+    const resolvers: ((v: string) => void)[] = []
+    const observer = new QueryObserver(client, {
+      queryKey: ['fleet', ''],
+      queryFn: () => {
+        calls++
+        return new Promise<string>((resolve) => resolvers.push(resolve))
+      },
+    })
+    const unsubscribe = observer.subscribe(() => {})
+    await Promise.resolve()
+    expect(calls).toBe(1)
+
+    const cancel = vi.spyOn(client, 'cancelQueries')
+    const invalidate = vi.spyOn(client, 'invalidateQueries')
+    client.setQueryData(['capabilities'], 'unchanged')
+    const done = refreshAfterNamespaceSwitch(client, { cacheScoped: false, actives: [] })
+    await new Promise((r) => setTimeout(r, 0))
+    expect(calls).toBe(1)
+    expect(cancel).not.toHaveBeenCalled()
+    expect(invalidate).not.toHaveBeenCalled()
+    expect(client.getQueryState(['capabilities'])?.isInvalidated).toBe(false)
+    resolvers[0]('original request')
+    await done
+    await vi.waitFor(() => expect(client.getQueryData(['fleet', ''])).toBe('original request'))
+    unsubscribe()
+  })
+
+  it('leaves queries alone when switching to a named namespace', async () => {
+    const client = new QueryClient()
+    client.setQueryData(['fleet', 'db'], 'x')
+    await refreshAfterNamespaceSwitch(client, { cacheScoped: false, actives: ['db'] })
+    expect(client.getQueryState(['fleet', 'db'])?.isInvalidated).toBe(false)
+  })
+})
+
+
+it('invalidates inventory after a cache-scoped switch without cancelling requests or the scope query', async () => {
+  const client = new QueryClient()
+  client.setQueryData(['resource', 'pods', 'db', 'app'], 'pod')
+  client.setQueryData(['namespace-scope'], 'scope')
+  const cancel = vi.spyOn(client, 'cancelQueries')
+  const invalidate = vi.spyOn(client, 'invalidateQueries')
+  await refreshAfterNamespaceSwitch(client, { cacheScoped: true, actives: ['db'] })
+  expect(cancel).not.toHaveBeenCalled()
+  expect(invalidate.mock.calls[0][1]).toEqual({ cancelRefetch: false })
+  expect(client.getQueryState(['resource', 'pods', 'db', 'app'])?.isInvalidated).toBe(true)
+  expect(client.getQueryState(['namespace-scope'])?.isInvalidated).toBe(false)
+})