@skyhook-io/radar-app 1.9.7 → 1.11.0

package/src/components/resources/renderers/CNPGDeclarativeRenderer.tsx

@@ -0,0 +1,227 @@
+import { Share2 } from 'lucide-react'
+import {
+  CNPGDatabaseRenderer as BaseDatabase,
+  CNPGPublicationRenderer as BasePublication,
+  CNPGSubscriptionRenderer as BaseSubscription,
+} from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGDeclarativeRenderer'
+import { ResourceLink, Section, RelationshipGroup } from '@skyhook-io/k8s-ui'
+import { LookupFailureNote } from '@skyhook-io/k8s-ui/components/resources/renderers/LookupFailureNote'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useResources } from '../../../api/client'
+import { splitCNPGDeclarativeByApplied } from '../resource-utils-cnpg'
+
+const CNPG_GROUP = 'postgresql.cnpg.io'
+
+/**
+ * Resolves a PostgreSQL-side name back to the CR that declares it.
+ *
+ * A Publication says it lives in database `demo_app`; the Database CR is called
+ * `demo-app` and carries `spec.name: demo_app`. The two are not the same string,
+ * so the page can name the database and still leave the reader with no way to
+ * open it — the dead end this exists to close.
+ *
+ * Returns undefined when nothing matches, and the caller falls back to plain
+ * text: an unresolved name is still the truth, it just isn't a link.
+ */
+function useDeclaredRef(
+  plural: 'databases' | 'publications',
+  namespace: string,
+  cluster: string | undefined,
+  pgName: string | undefined,
+  onNavigate?: (ref: ResourceRef) => void,
+) {
+  const enabled = !!namespace && !!cluster && !!pgName
+  const { data } = useResources<any>(plural, namespace, CNPG_GROUP, { enabled })
+  if (!enabled) return undefined
+  const match = (data ?? []).find(
+    (o: any) => o?.spec?.cluster?.name === cluster && o?.spec?.name === pgName,
+  )
+  if (!match) return undefined
+  return (
+    <ResourceLink
+      name={pgName as string}
+      kind={plural}
+      namespace={match?.metadata?.namespace ?? namespace}
+      group={CNPG_GROUP}
+      label={pgName}
+      onNavigate={
+        onNavigate
+          ? () =>
+              onNavigate({
+                kind: plural === 'databases' ? 'Database' : 'Publication',
+                namespace: match?.metadata?.namespace ?? namespace,
+                name: match?.metadata?.name ?? '',
+                group: CNPG_GROUP,
+              })
+          : undefined
+      }
+    />
+  )
+}
+
+/**
+ * Database, with the objects that replicate out of it.
+ *
+ * The link only exists in one direction in the API: a Publication names its
+ * database, a Database names nothing. Without this, "what publishes from here"
+ * has no answer on the page that raises the question.
+ */
+export function CNPGDatabaseRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const ns = data?.metadata?.namespace ?? ''
+  const cluster = data?.spec?.cluster?.name
+  const dbname = data?.spec?.name
+  const enabled = !!ns && !!cluster && !!dbname
+
+  const publications = useResources<any>('publications', ns, CNPG_GROUP, { enabled })
+  const subscriptions = useResources<any>('subscriptions', ns, CNPG_GROUP, { enabled })
+
+  const inThisDatabase = (o: any) =>
+    o?.spec?.cluster?.name === cluster && o?.spec?.dbname === dbname
+  const pubs = (publications.data ?? []).filter(inThisDatabase)
+  const subs = (subscriptions.data ?? []).filter(inThisDatabase)
+
+  const toRef = (kind: 'Publication' | 'Subscription') => (o: any) => ({
+    kind,
+    namespace: o?.metadata?.namespace ?? ns,
+    name: o?.metadata?.name ?? '',
+    group: CNPG_GROUP,
+  })
+
+  // Three states, not two — the same distinction the status badge and the issue
+  // detector make. Applied is replicating. `applied: false` is a failed apply
+  // the operator can explain. ABSENT is not yet reconciled, and calling that
+  // "exists in Kubernetes and not in PostgreSQL" condemns every object in its
+  // first seconds.
+  const p = splitCNPGDeclarativeByApplied(pubs)
+  const sub = splitCNPGDeclarativeByApplied(subs)
+  const tagged = (list: any[], kind: 'Publication' | 'Subscription') =>
+    list.map((o: any) => ({ o, kind }))
+  const livePubs = p.applied
+  const liveSubs = sub.applied
+  const notApplied = [...tagged(p.notApplied, 'Publication'), ...tagged(sub.notApplied, 'Subscription')]
+  const pending = [...tagged(p.pending, 'Publication'), ...tagged(sub.pending, 'Subscription')]
+
+  const loading = publications.isLoading || subscriptions.isLoading
+  // Two independent lookups: one can return rows while the other does not, and
+  // the groups below would then describe half the replication as all of it.
+  const lookupErrors = [publications.error, subscriptions.error]
+  const failed = lookupErrors.some(Boolean)
+
+  return (
+    <BaseDatabase
+      data={data}
+      onNavigate={onNavigate}
+      usedBy={
+        <Section title="Replication" icon={Share2} defaultExpanded>
+          {loading ? (
+            <div className="text-sm text-theme-text-tertiary">Looking for publications…</div>
+          ) : pubs.length === 0 && subs.length === 0 ? (
+            failed ? (
+              <LookupFailureNote
+                errors={lookupErrors}
+                what="what replicates out of this database"
+              />
+            ) : (
+              <div className="text-sm text-theme-text-tertiary">
+                Nothing publishes from or subscribes to this database.
+              </div>
+            )
+          ) : (
+            <div className="space-y-3">
+              {/* Rows are showing, so the failure means this list is short —
+                  not that nothing replicates. */}
+              <LookupFailureNote
+                errors={lookupErrors}
+                what="what replicates out of this database"
+                incomplete
+              />
+              {livePubs.length > 0 && (
+                <RelationshipGroup
+                  label="Publishes from here"
+                  refs={livePubs.map(toRef('Publication'))}
+                  onNavigate={onNavigate}
+                />
+              )}
+              {liveSubs.length > 0 && (
+                <RelationshipGroup
+                  label="Subscribes into here"
+                  refs={liveSubs.map(toRef('Subscription'))}
+                  onNavigate={onNavigate}
+                />
+              )}
+              {notApplied.length > 0 && (
+                <div className="space-y-1.5">
+                  <RelationshipGroup
+                    label="Declared, but not replicating"
+                    refs={notApplied.map(({ o, kind }) => toRef(kind)(o))}
+                    onNavigate={onNavigate}
+                  />
+                  <div className="text-xs text-warning-text">
+                    {notApplied.length === 1
+                      ? 'This exists in Kubernetes and not in PostgreSQL, so no data moves through it. Open it for the operator’s reason.'
+                      : 'These exist in Kubernetes and not in PostgreSQL, so no data moves through them. Open one for the operator’s reason.'}
+                  </div>
+                </div>
+              )}
+              {pending.length > 0 && (
+                <div className="space-y-1.5">
+                  <RelationshipGroup
+                    label="Not reconciled yet"
+                    refs={pending.map(({ o, kind }) => toRef(kind)(o))}
+                    onNavigate={onNavigate}
+                  />
+                  <div className="text-xs text-theme-text-secondary">
+                    The operator has not reported on these yet. They have not failed.
+                  </div>
+                </div>
+              )}
+            </div>
+          )}
+        </Section>
+      }
+    />
+  )
+}
+
+export function CNPGPublicationRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const ns = data?.metadata?.namespace ?? ''
+  const cluster = data?.spec?.cluster?.name
+  const database = useDeclaredRef('databases', ns, cluster, data?.spec?.dbname, onNavigate)
+  return <BasePublication data={data} onNavigate={onNavigate} links={{ database }} />
+}
+
+export function CNPGSubscriptionRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const ns = data?.metadata?.namespace ?? ''
+  const cluster = data?.spec?.cluster?.name
+  const database = useDeclaredRef('databases', ns, cluster, data?.spec?.dbname, onNavigate)
+  // The publication a subscription reads from lives on the *upstream* cluster in
+  // a real topology. Resolving locally is right for the single-cluster demo and
+  // simply finds nothing otherwise, which falls back to plain text rather than
+  // linking to the wrong object.
+  const publication = useDeclaredRef(
+    'publications',
+    ns,
+    cluster,
+    data?.spec?.publicationName,
+    onNavigate,
+  )
+  return <BaseSubscription data={data} onNavigate={onNavigate} links={{ database, publication }} />
+}

package/src/components/resources/renderers/CNPGImageCatalogRenderer.tsx

@@ -0,0 +1,123 @@
+import { Boxes } from 'lucide-react'
+import { CNPGImageCatalogRenderer as BaseImageCatalog } from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGDeclarativeRenderer'
+import { Section, RelationshipGroup } from '@skyhook-io/k8s-ui'
+import { LookupFailureNote } from '@skyhook-io/k8s-ui/components/resources/renderers/LookupFailureNote'
+import { getCNPGImageCatalogEntries } from '../resource-utils-cnpg'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useCNPGCatalogUsers } from '../../../api/policy'
+
+const CNPG_GROUP = 'postgresql.cnpg.io'
+
+/**
+ * Host wrapper adding the reverse lookup: which clusters are pinned to this
+ * catalog.
+ *
+ * This is the diagnosis path. A cluster that references a catalog lacking its
+ * major version reports "incomplete or invalid image catalog" and stops; the
+ * catalog is where you check what it offers, and from here you need to see who
+ * depends on it before changing anything.
+ */
+export function CNPGImageCatalogRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const kind = data?.kind
+  const name = data?.metadata?.name ?? ''
+  const namespace = data?.metadata?.namespace ?? ''
+  // A ClusterImageCatalog is cluster-scoped and referenceable from any namespace,
+  // so the answer's scope is not this resource's. Read server-side rather than
+  // filtering a client-side list: omitting the namespace there means "the
+  // caller's namespace view filter", which would answer a question about the
+  // whole cluster from whichever namespaces they happen to be showing.
+  const scoped = kind === 'ImageCatalog'
+  const clusters = useCNPGCatalogUsers(name, scoped ? namespace : '', !!name)
+
+  const users = clusters.data?.clusters ?? []
+
+  // A cluster asking for a major this catalog does not carry is the failure the
+  // catalog page exists to explain, and it is invisible from the cluster side —
+  // there the reference looks fine.
+  const majors = new Set(getCNPGImageCatalogEntries(data).map((e) => e.major))
+  const unmet = users.filter((c) => !majors.has(c.major as number))
+  const met = users.filter((c) => majors.has(c.major as number))
+
+  const toRef = (c: { namespace: string; name: string }) => ({
+    kind: 'Cluster',
+    namespace: c.namespace,
+    name: c.name,
+    group: CNPG_GROUP,
+  })
+
+  return (
+    <BaseImageCatalog
+      data={data}
+      usedBy={
+        <Section title="Used By" icon={Boxes} defaultExpanded>
+          {clusters.isLoading ? (
+            <div className="text-sm text-theme-text-tertiary">Looking for clusters…</div>
+          ) : users.length === 0 ? (
+            clusters.error ? (
+              <LookupFailureNote
+                errors={[clusters.error]}
+                what="which clusters use this catalog"
+              />
+            ) : (
+              <div className="text-sm text-theme-text-tertiary">
+                {/* "Changing it affects nothing" is a claim about the cluster,
+                    and this search does not cover one. A ClusterImageCatalog is
+                    referenced from any namespace, but the lookup that answers
+                    this falls back to the reader's namespace view filter, so a
+                    filtered reader is told an edit is safe on the strength of
+                    the namespaces they happen to be looking at. The namespaced
+                    ImageCatalog has no such gap — its users can only be in its
+                    own namespace, which is exactly what was searched. */}
+                {scoped
+                  ? 'No cluster in this namespace is pinned to this catalog. Changing it affects nothing here today.'
+                  : 'No cluster in view is pinned to this catalog. Clusters in namespaces you are not currently showing are not covered by this check.'}
+              </div>
+            )
+          ) : (
+            <div className="space-y-3">
+              {met.length > 0 && (
+                <RelationshipGroup label="Clusters" refs={met.map(toRef)} onNavigate={onNavigate} />
+              )}
+              {unmet.length > 0 && (
+                <div className="space-y-1.5">
+                  <RelationshipGroup
+                    label="Pinned to a version this catalog does not list"
+                    refs={unmet.map(toRef)}
+                    onNavigate={onNavigate}
+                  />
+                  {unmet.some((c) => !!c.image) && (
+                    <div className="text-xs text-theme-text-secondary">
+                      {`Running now: ${unmet
+                        .filter((c) => !!c.image)
+                        .map((c) => `${c.name} on ${c.image}`)
+                        .join(', ')}`}
+                    </div>
+                  )}
+                  <div className="text-xs text-warning-text">
+                    {/* What the catalog can prove, and no further. A cluster
+                        that already resolved an image keeps running on it, so
+                        "will not start" sends a responder hunting for
+                        crash-looping pods that are not there — the failure is
+                        the NEXT time an image has to be resolved. The named
+                        form only when there is a major to name: a reference
+                        missing one lands here too, and "asks for PostgreSQL
+                        undefined" would be worse than the general sentence. */}
+                    {unmet.length === 1 && typeof unmet[0]?.major === 'number'
+                      ? `${unmet[0]?.name} asks for PostgreSQL ${unmet[0].major}, which this catalog does not list. Whatever image it is running now, the next time it has to resolve one it will fail.`
+                      : 'These clusters ask for a major version this catalog does not list. Whatever image they are running now, the next time they have to resolve one they will fail.'}
+                  </div>
+                </div>
+              )}
+            </div>
+          )}
+        </Section>
+      }
+    />
+  )
+}

package/src/components/resources/renderers/CNPGObjectStoreRenderer.tsx

@@ -0,0 +1,152 @@
+import { Database } from 'lucide-react'
+import { CNPGObjectStoreRenderer as BaseCNPGObjectStoreRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGObjectStoreRenderer'
+import { Section, RelationshipGroup, CNPG_BARMAN_PLUGIN_NAME } from '@skyhook-io/k8s-ui'
+import { LookupFailureNote } from '@skyhook-io/k8s-ui/components/resources/renderers/LookupFailureNote'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useResources } from '../../../api/client'
+
+/**
+ * Host wrapper adding the reverse lookup the package renderer cannot do: which
+ * CNPG Clusters back up into this store.
+ *
+ * The Cluster page already links forward to its ObjectStore. Without this the
+ * relationship is one-way, so an operator reading a recovery window keyed by
+ * server name has no route to the cluster behind it.
+ */
+export function CNPGObjectStoreRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const namespace = data?.metadata?.namespace ?? ''
+  const storeName = data?.metadata?.name ?? ''
+
+  // Clusters reference their store by name within their own namespace, so the
+  // search is namespace-scoped rather than cluster-wide.
+  const clusters = useResources<any>('clusters', namespace, 'postgresql.cnpg.io', {
+    enabled: !!storeName && !!namespace,
+  })
+
+  // Servers the store holds data for, from its own status. Deliberately a
+  // separate question from the one below.
+  const servers: string[] = Object.keys(data?.status?.serverRecoveryWindow ?? {})
+
+  const users = (clusters.data ?? []).filter((c: any) => {
+    const plugins = c?.spec?.plugins
+    if (!Array.isArray(plugins)) return false
+    return plugins.some(
+      (p: any) =>
+        p?.name === CNPG_BARMAN_PLUGIN_NAME &&
+        p?.enabled !== false &&
+        p?.parameters?.barmanObjectName === storeName,
+    )
+  })
+
+  // A recovery window is keyed by the archive's server name, which defaults to
+  // the cluster's name and is overridden by the plugin's own `serverName`
+  // parameter — the ObjectStore rejects the field outright ("use the
+  // 'serverName' plugin parameter in the Cluster resource"), so the Cluster is
+  // the only place it can come from. Matching keys against cluster names alone
+  // reports a cluster that renamed its archive as a stranger.
+  const clusterForServer = new Map<string, string>()
+  for (const c of users) {
+    const plugin = (c?.spec?.plugins ?? []).find(
+      (p: any) => p?.name === CNPG_BARMAN_PLUGIN_NAME && p?.parameters?.barmanObjectName === storeName,
+    )
+    const server = plugin?.parameters?.serverName || c?.metadata?.name
+    if (server && c?.metadata?.name) clusterForServer.set(server, c.metadata.name)
+  }
+
+  // A recovery window is only advancing while WAL archiving works. The Cluster
+  // owns that condition, and the ObjectStore's own status cannot see it — so a
+  // server whose archiving has stopped reports its last successful backup and
+  // reads as green here while the recovery point is frozen. The page whose job is
+  // "how far back can I restore" is the last place that should have to be
+  // cross-checked against another screen.
+  const archivingFailing = new Set<string>()
+  for (const c of users) {
+    const stalled = (c?.status?.conditions ?? []).some(
+      (cond: any) => cond?.type === 'ContinuousArchiving' && cond?.status === 'False',
+    )
+    if (!stalled) continue
+    const plugin = (c?.spec?.plugins ?? []).find(
+      (p: any) => p?.name === CNPG_BARMAN_PLUGIN_NAME && p?.parameters?.barmanObjectName === storeName,
+    )
+    const server = plugin?.parameters?.serverName || c?.metadata?.name
+    if (server) archivingFailing.add(server)
+  }
+
+  // Named in the window, traceable to none of the clusters above — the gap the
+  // note explains.
+  const unlisted = servers.filter((s) => !clusterForServer.has(s))
+
+  return (
+    <>
+      <BaseCNPGObjectStoreRenderer
+        data={data}
+        onNavigate={onNavigate}
+        // Server key -> the Cluster that archives under it. Built from the
+        // plugin parameters rather than by name, so a cluster that renamed its
+        // archive still resolves. Undefined while the lookup is unresolved.
+        clusterForServer={clusters.isLoading || clusters.error ? undefined : clusterForServer}
+        archivingFailing={clusters.isLoading || clusters.error ? undefined : archivingFailing}
+      />
+      <Section title="Used By" icon={Database} defaultExpanded>
+        {clusters.isLoading ? (
+          <div className="text-sm text-theme-text-tertiary">Looking for clusters…</div>
+        ) : users.length === 0 ? (
+          // Not the same as "nothing uses it" — the caller may not be able to
+          // list Clusters here, and a store with no users is worth noticing.
+          clusters.error ? (
+            <LookupFailureNote
+              errors={[clusters.error]}
+              what="which clusters use this store"
+            />
+          ) : (
+            <div className="text-sm text-theme-text-tertiary">
+              No cluster in this namespace backs up to this store.
+            </div>
+          )
+        ) : (
+          // The house pattern for "these other resources relate to this one":
+          // labelled group with a count, ref badges, truncate-then-expand.
+          <RelationshipGroup
+            label="Archiving here through the plugin"
+            refs={users.map((c: any) => ({
+              kind: 'Cluster',
+              namespace: c.metadata?.namespace ?? '',
+              name: c.metadata?.name ?? '',
+              group: 'postgresql.cnpg.io',
+            }))}
+            onNavigate={onNavigate}
+          />
+        )}
+        {/* This lookup can only see `spec.plugins`. A cluster still on the
+            deprecated in-tree `spec.backup.barmanObjectStore` names a
+            destination path and never references this CR, so it CANNOT appear
+            above however much data it has here. Read as blast radius — "who
+            breaks if I rotate these credentials" — the list would silently omit
+            every legacy-path cluster, which mid-migration is most of a fleet.
+            The recovery window is the other half of the answer. */}
+        {/* Only once the plugin lookup has actually answered. Derived while the
+            list is still loading — or after it failed — every server in the
+            window looks like an in-tree cluster, which is a claim about their
+            configuration made from having no data. */}
+        {!clusters.isLoading && !clusters.error && unlisted.length > 0 && (
+          <div className="mt-2 pt-2 border-t border-theme-border text-xs text-theme-text-secondary">
+            {/* Two causes reach this note and the screen cannot tell them
+                apart, so it names both rather than asserting the one that is
+                usually true: a cluster on the older in-tree settings never
+                references this record, and a cluster that renamed its archive
+                leaves the data it already wrote under the previous name. */}
+            {`${unlisted.join(', ')} ${unlisted.length === 1 ? 'has' : 'have'} data here but ${
+              unlisted.length === 1 ? 'is' : 'are'
+            } not listed above. This finds clusters through the barman-cloud plugin, so an archive written by a cluster on the older in-tree backup settings — or under a server name it has since changed — is not traced back to one.`}
+          </div>
+        )}
+      </Section>
+    </>
+  )
+}

package/src/components/resources/renderers/KyvernoPolicyCoverage.tsx

@@ -0,0 +1,65 @@
+import { useState } from 'react'
+import { useLocation } from 'react-router-dom'
+import { PolicyCoverageSection } from '@skyhook-io/k8s-ui/components/resources/renderers/PolicyCoverageSection'
+import type { PolicyCoverageSubject, ResourceRef } from '@skyhook-io/k8s-ui'
+import { usePolicyCoverage } from '../../../api/policy'
+
+/** Mirrors maxPolicyCoverageSubjectsHard in internal/server/policy_handlers.go —
+ *  asking for more than the server will send just returns the same list. */
+const COVERAGE_MAX_SUBJECTS = 5000
+
+/**
+ * Host wrapper for the policy coverage section — the inverse lookup that answers
+ * "which resources does this policy pass and fail".
+ *
+ * The package renderers take it as a slot rather than fetching it themselves, so
+ * a library consumer that does not wire this endpoint keeps the original policy
+ * drawer and nothing breaks.
+ */
+export function KyvernoPolicyCoverage({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const name = data?.metadata?.name ?? ''
+  // A namespaced Kyverno Policy reports as "namespace/name"; the server tries
+  // both shapes, so the namespace is passed through whenever the policy has one.
+  const namespace = data?.metadata?.namespace ?? ''
+  // The server bounds each rule's subject list so an ordinary drawer open stays
+  // small. Asking for the rest raises that bound once, up to the server's own
+  // ceiling — past which the response says what it could not send.
+  const [limit, setLimit] = useState<number | undefined>(undefined)
+
+  // The header's namespace filter is applied SERVER-side from session state, so
+  // the same URL returns a different body once it changes and nothing in the
+  // request distinguishes the two. Without it in the cache key, a policy opened
+  // under "All namespaces" keeps serving that body after the filter narrows —
+  // the view then shows other people's namespaces under your scope, and which
+  // behaviour you get depends on where you navigated from.
+  const viewFilter = useLocation().search
+  const query = usePolicyCoverage(name, namespace || undefined, !!name, limit, viewFilter)
+
+  return (
+    <PolicyCoverageSection
+      resource={data}
+      data={query.data ?? null}
+      loading={query.isLoading}
+      error={query.error as Error | null}
+      onLoadMore={limit ? undefined : () => setLimit(COVERAGE_MAX_SUBJECTS)}
+      loadingMore={query.isFetching}
+      onSelectSubject={
+        onNavigate
+          ? (subject: PolicyCoverageSubject) =>
+              onNavigate({
+                kind: subject.kind,
+                namespace: subject.namespace ?? '',
+                name: subject.name,
+                group: subject.group,
+              })
+          : undefined
+      }
+    />
+  )
+}

package/src/components/resources/renderers/KyvernoPolicyQueued.render.test.tsx

@@ -0,0 +1,59 @@
+import { describe, expect, it, vi } from 'vitest'
+import { renderToString } from 'react-dom/server'
+
+// The denial is the state under test, so the fetch is stubbed rather than run.
+const forbidden = Object.assign(new Error('forbidden'), { status: 403 })
+let queuedResult: { data?: unknown; error?: unknown } = {}
+
+vi.mock('../../../api/policy', () => ({
+  usePolicyQueued: () => queuedResult,
+}))
+vi.mock('../../../api/client', () => ({
+  isForbiddenError: (e: any) => e?.status === 403,
+}))
+
+const { KyvernoPolicyQueued } = await import('./KyvernoPolicyQueued')
+
+const generating = {
+  kind: 'ClusterPolicy',
+  metadata: { name: 'gen-companion' },
+  spec: { rules: [{ name: 'g', generate: {} }] },
+}
+const validating = {
+  kind: 'ClusterPolicy',
+  metadata: { name: 'require-labels' },
+  spec: { rules: [{ name: 'v', validate: {} }] },
+}
+
+/**
+ * A denial here is cluster-static, so disclosing it everywhere would be noise on
+ * the majority of policies that only validate. Staying silent about it on a
+ * policy that DOES queue is worse: a stuck backlog then looks exactly like a
+ * healthy policy with nothing pending, on the page someone checks to find out.
+ */
+describe('KyvernoPolicyQueued — a denial you cannot see', () => {
+  it('says it cannot check when the policy actually queues work', () => {
+    queuedResult = { error: forbidden }
+    const html = renderToString(<KyvernoPolicyQueued data={generating} />)
+    expect(html).toContain('permission')
+    expect(html).toContain('Queued Work')
+  })
+
+  it('stays silent for a policy that never queues anything', () => {
+    queuedResult = { error: forbidden }
+    expect(renderToString(<KyvernoPolicyQueued data={validating} />)).toBe('')
+  })
+
+  it('stays silent when there is genuinely nothing queued', () => {
+    queuedResult = { data: { requests: 0 } }
+    expect(renderToString(<KyvernoPolicyQueued data={generating} />)).toBe('')
+  })
+
+  // A fault is not a denial: it is neither permanent nor beyond acting on, so it
+  // is loud regardless of what the policy does.
+  it('reports a genuine fault on any policy', () => {
+    queuedResult = { error: new Error('could not read queued work') }
+    const html = renderToString(<KyvernoPolicyQueued data={validating} />)
+    expect(html).toContain('could not read queued work')
+  })
+})