pepr 0.46.1 → 0.46.2

package/src/lib/assets/defaultTestObjects.ts

@@ -1,533 +1,154 @@
-import { GenericClass } from "kubernetes-fluent-client";
+import { GenericClass, GroupVersionKind } from "kubernetes-fluent-client";
 import { Event } from "../enums";
-import { CapabilityExport } from "../types";
-import { describe, beforeEach, jest, it, expect } from "@jest/globals";
+import { Binding, CapabilityExport } from "../types";
+import { defaultFilters } from "../filter/adjudicators/defaultTestObjects";
 import { V1PolicyRule as PolicyRule } from "@kubernetes/client-node";
-import fs from "fs";
-import { clusterRole } from "./rbac";
-import * as helpers from "../helpers";
+import { AdmissionRequest, GroupVersionResource } from "../common-types";
+import { Operation } from "../enums";
+
+export const createMockAdmissionRequest = (
+  kind: GroupVersionKind = { kind: "kind", group: "group", version: "version" },
+  resource: GroupVersionResource = { group: "group", version: "version", resource: "resource" },
+  object: { metadata: { name: string } } = { metadata: { name: "create-me" } },
+  operation: Operation = Operation.CREATE,
+): AdmissionRequest => ({
+  uid: "uid",
+  kind,
+  resource,
+  name: "",
+  object,
+  operation,
+  userInfo: {},
+});
+
+export const createMockRbacRule = (
+  apiGroups: string[] = ["pepr.dev"],
+  resources: string[] = ["peprstores"],
+  verbs: string[] = ["create", "get", "patch", "watch"],
+): PolicyRule => ({
+  apiGroups,
+  resources,
+  verbs,
+});
+
+export const createMockBinding = (
+  kindDetails: { group?: string; version?: string; kind?: string; plural?: string } = {},
+  options: { isWatch?: boolean; event?: Event; isFinalize?: boolean } = {},
+): Binding => {
+  const { group = "pepr.dev", version = "v1", kind = "peprstore", plural = "peprstores" } = kindDetails;
+
+  const { isWatch = false, event = Event.CREATE, isFinalize } = options;
+
+  return {
+    kind: { group, version, kind, plural },
+    isWatch,
+    ...(isFinalize !== undefined && { isFinalize }),
+    event,
+    model: {} as GenericClass,
+    filters: { ...defaultFilters, regexName: "" },
+  };
+};
+
+export const createMockCapability = (
+  rbacRules = [createMockRbacRule()],
+  bindings = [createMockBinding()],
+): CapabilityExport => ({
+  name: "",
+  hasSchedule: false,
+  description: "",
+  rbac: rbacRules,
+  bindings,
+});
 
 export const mockCapabilities: CapabilityExport[] = [
-  {
-    rbac: [
-      {
-        apiGroups: ["pepr.dev"],
-        resources: ["peprstores"],
-        verbs: ["create", "get", "patch", "watch"],
-      },
-    ],
-    bindings: [
-      {
-        kind: { group: "pepr.dev", version: "v1", kind: "peprstore", plural: "peprstores" },
-        isWatch: false,
-        event: Event.CREATE,
-        model: {} as GenericClass,
-        filters: {
-          name: "",
-          regexName: "",
-          namespaces: [],
-          regexNamespaces: [],
-          labels: {},
-          annotations: {},
-          deletionTimestamp: false,
-        },
-      },
-    ],
-    hasSchedule: false,
-    name: "",
-    description: "",
-  },
-  {
-    rbac: [
-      {
-        apiGroups: ["apiextensions.k8s.io"],
-        resources: ["customresourcedefinitions"],
-        verbs: ["patch", "create"],
-      },
-    ],
-    bindings: [
-      {
-        kind: {
+  createMockCapability(),
+  createMockCapability(
+    [createMockRbacRule(["apiextensions.k8s.io"], ["customresourcedefinitions"], ["patch", "create"])],
+    [
+      createMockBinding(
+        {
           group: "apiextensions.k8s.io",
           version: "v1",
           kind: "customresourcedefinition",
           plural: "customresourcedefinitions",
         },
-        isWatch: false,
-        isFinalize: false,
-        event: Event.CREATE,
-        model: {} as GenericClass,
-        filters: {
-          name: "",
-          regexName: "",
-          namespaces: [],
-          regexNamespaces: [],
-          labels: {},
-          annotations: {},
-          deletionTimestamp: false,
-        },
-      },
+        { isWatch: false, event: Event.CREATE, isFinalize: false },
+      ),
     ],
-    hasSchedule: false,
-    name: "",
-    description: "",
-  },
-  {
-    rbac: [
-      {
-        apiGroups: [""],
-        resources: ["namespaces"],
-        verbs: ["watch"],
-      },
+  ),
+  createMockCapability(
+    [createMockRbacRule([""], ["namespaces"], ["watch"])],
+    [
+      createMockBinding(
+        { group: "", version: "v1", kind: "namespace", plural: "namespaces" },
+        { isWatch: true, event: Event.CREATE, isFinalize: false },
+      ),
     ],
-    bindings: [
-      {
-        kind: { group: "", version: "v1", kind: "namespace", plural: "namespaces" },
-        isWatch: true,
-        isFinalize: false,
-        event: Event.CREATE,
-        model: {} as GenericClass,
-        filters: {
-          name: "",
-          regexName: "",
-          namespaces: [],
-          regexNamespaces: [],
-          labels: {},
-          annotations: {},
-          deletionTimestamp: false,
-        },
-      },
-    ],
-    hasSchedule: false,
-    name: "",
-    description: "",
-  },
-  {
-    rbac: [
-      {
-        apiGroups: [""],
-        resources: ["configmaps"],
-        verbs: ["watch"],
-      },
-    ],
-    bindings: [
-      {
-        kind: { group: "", version: "v1", kind: "configmap", plural: "configmaps" },
-        isWatch: true,
-        isFinalize: false,
-        event: Event.CREATE,
-        model: {} as GenericClass,
-        filters: {
-          name: "",
-          regexName: "",
-          namespaces: [],
-          regexNamespaces: [],
-          labels: {},
-          annotations: {},
-          deletionTimestamp: false,
-        },
-      },
+  ),
+  createMockCapability(
+    [createMockRbacRule([""], ["configmaps"], ["watch"])],
+    [
+      createMockBinding(
+        { group: "", version: "v1", kind: "configmap", plural: "configmaps" },
+        { isWatch: true, event: Event.CREATE, isFinalize: false },
+      ),
     ],
-    hasSchedule: false,
-    name: "",
-    description: "",
-  },
+  ),
 ];
-describe("RBAC generation", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    const mockPackageJsonRBAC = {};
-
-    jest.spyOn(fs, "readFileSync").mockImplementation((path: unknown) => {
-      if (typeof path === "string" && path.includes("package.json")) {
-        return JSON.stringify({ rbac: mockPackageJsonRBAC });
-      }
-      return "{}";
-    });
-  });
-
-  it("should generate correct ClusterRole rules in scoped mode", () => {
-    const result = clusterRole("test-role", mockCapabilities, "scoped", []);
-
-    expect(result.rules).toEqual([
-      {
-        apiGroups: ["pepr.dev"],
-        resources: ["peprstores"],
-        verbs: ["create", "get", "patch", "watch"],
-      },
-      {
-        apiGroups: ["apiextensions.k8s.io"],
-        resources: ["customresourcedefinitions"],
-        verbs: ["patch", "create"],
-      },
-      {
-        apiGroups: [""],
-        resources: ["namespaces"],
-        verbs: ["watch"],
-      },
-      {
-        apiGroups: [""],
-        resources: ["configmaps"],
-        verbs: ["watch"],
-      },
-    ]);
-  });
-
-  it("should generate a ClusterRole with wildcard rules when not in scoped mode", () => {
-    const expectedWildcardRules = [
-      {
-        apiGroups: ["*"],
-        resources: ["*"],
-        verbs: ["create", "delete", "get", "list", "patch", "update", "watch"],
-      },
-    ];
-
-    const result = clusterRole("test-role", mockCapabilities, "admin", []);
-
-    expect(result.rules).toEqual(expectedWildcardRules);
-  });
-
-  it("should return an empty rules array when capabilities are empty in scoped mode", () => {
-    const result = clusterRole("test-role", [], "scoped", []);
-
-    expect(result.rules).toEqual([]);
-  });
-
-  it("should include finalize verbs if isFinalize is true in scoped mode", () => {
-    const capabilitiesWithFinalize: CapabilityExport[] = [
-      {
-        rbac: [
-          {
-            apiGroups: ["pepr.dev"],
-            resources: ["peprstores"],
-            verbs: ["patch"],
-          },
-        ],
-        bindings: [
-          {
-            kind: { group: "pepr.dev", version: "v1", kind: "peprstore", plural: "peprstores" },
-            isWatch: false,
-            isFinalize: true,
-            event: Event.CREATE,
-            model: {} as GenericClass,
-            filters: {
-              name: "",
-              regexName: "",
-              namespaces: [],
-              regexNamespaces: [],
-              labels: {},
-              annotations: {},
-              deletionTimestamp: false,
-            },
-          },
-        ],
-        hasSchedule: false,
-        name: "",
-        description: "",
-      },
-    ];
-
-    const result = clusterRole(
-      "test-role",
-      capabilitiesWithFinalize,
-      "scoped",
-      capabilitiesWithFinalize.flatMap(c => c.rbac).filter((rule): rule is PolicyRule => rule !== undefined),
-    );
-
-    expect(result.rules).toEqual([
-      {
-        apiGroups: ["pepr.dev"],
-        resources: ["peprstores"],
-        verbs: ["patch"],
-      },
-      {
-        apiGroups: ["apiextensions.k8s.io"],
-        resources: ["customresourcedefinitions"],
-        verbs: ["patch", "create"],
-      },
-    ]);
-  });
-
-  it("should deduplicate verbs and resources in rules", () => {
-    const capabilitiesWithDuplicates: CapabilityExport[] = [
-      {
-        rbac: [
-          {
-            apiGroups: ["pepr.dev"],
-            resources: ["peprstores"],
-            verbs: ["create", "get"],
-          },
-        ],
-        bindings: [
-          {
-            kind: { group: "pepr.dev", version: "v1", kind: "peprlog", plural: "peprlogs" },
-            isWatch: false,
-            event: Event.CREATE,
-            model: {} as GenericClass,
-            filters: {
-              name: "",
-              regexName: "",
-              namespaces: [],
-              regexNamespaces: [],
-              labels: {},
-              annotations: {},
-              deletionTimestamp: false,
-            },
-          },
-        ],
-        hasSchedule: false,
-        name: "",
-        description: "",
-      },
-      {
-        rbac: [
-          {
-            apiGroups: ["pepr.dev"],
-            resources: ["peprstores"],
-            verbs: ["get", "patch"],
-          },
-        ],
-        bindings: [
-          {
-            kind: { group: "pepr.dev", version: "v1", kind: "peprlog", plural: "peprlogs" },
-            isWatch: false,
-            event: Event.CREATE,
-            model: {} as GenericClass,
-            filters: {
-              name: "",
-              regexName: "",
-              namespaces: [],
-              regexNamespaces: [],
-              labels: {},
-              annotations: {},
-              deletionTimestamp: false,
-            },
-          },
-        ],
-        hasSchedule: false,
-        name: "",
-        description: "",
-      },
-    ];
-
-    const result = clusterRole(
-      "test-role",
-      capabilitiesWithDuplicates,
-      "scoped",
-      capabilitiesWithDuplicates.flatMap(c => c.rbac).filter((rule): rule is PolicyRule => rule !== undefined),
-    );
-
-    // Filter out only the rules for 'pepr.dev' and 'peprstores'
-    const filteredRules = result.rules?.filter(
-      rule => rule.apiGroups?.includes("pepr.dev") && rule.resources?.includes("peprstores"),
-    );
 
-    expect(filteredRules).toEqual([
-      {
-        apiGroups: ["pepr.dev"],
-        resources: ["peprstores"],
-        verbs: ["create", "get", "patch", "watch"],
-      },
-    ]);
-  });
-});
-describe("clusterRole", () => {
-  // Mocking the readRBACFromPackageJson function to return null
-  jest.mock("./rbac", () => ({
-    ...(jest.requireActual("./rbac") as object),
-    readRBACFromPackageJson: jest.fn(() => null),
-  }));
-
-  // Mocking createRBACMap to isolate the behavior of clusterRole function
-  jest.mock("../helpers", () => ({
-    ...(jest.requireActual("../helpers") as object),
-    createRBACMap: jest.fn(),
-  }));
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    jest.restoreAllMocks();
-  });
-
-  it("should handle keys with less than 3 segments and set group to an empty string", () => {
-    jest.spyOn(helpers, "createRBACMap").mockReturnValue({
-      nodes: {
-        plural: "nodes",
-        verbs: ["get"],
-      },
-    });
-
-    const capabilitiesWithShortKey: CapabilityExport[] = [
-      {
-        rbac: [
-          {
-            apiGroups: [""],
-            resources: ["nodes"],
-            verbs: ["get"],
-          },
-        ],
-        bindings: [
-          {
-            kind: { group: "", version: "v1", kind: "node", plural: "nodes" },
-            isWatch: false,
-            event: Event.CREATE,
-            model: {} as GenericClass,
-            filters: {
-              name: "",
-              regexName: "",
-              namespaces: [],
-              regexNamespaces: [],
-              labels: {},
-              annotations: {},
-              deletionTimestamp: false,
-            },
-          },
-        ],
-        hasSchedule: false,
-        name: "",
-        description: "",
-      },
-    ];
-
-    const result = clusterRole(
-      "test-role",
-      capabilitiesWithShortKey,
-      "scoped",
-      capabilitiesWithShortKey.flatMap(c => c.rbac).filter((rule): rule is PolicyRule => rule !== undefined),
-    );
-
-    expect(result.rules).toEqual([
-      {
-        apiGroups: [""],
-        resources: ["nodes"],
-        verbs: ["get"],
-      },
-    ]);
-  });
-
-  it("should handle keys with 3 or more segments and set group correctly", () => {
-    jest.spyOn(helpers, "createRBACMap").mockReturnValue({
-      "apps/v1/deployments": {
-        plural: "deployments",
-        verbs: ["create"],
-      },
-    });
-
-    const capabilitiesWithLongKey: CapabilityExport[] = [
-      {
-        rbac: [
-          {
-            apiGroups: ["apps"],
-            resources: ["deployments"],
-            verbs: ["create"],
-          },
-        ],
-        bindings: [
-          {
-            kind: { group: "apps", version: "v1", kind: "deployment", plural: "deployments" },
-            isWatch: false,
-            event: Event.CREATE,
-            model: {} as GenericClass,
-            filters: {
-              name: "",
-              regexName: "",
-              namespaces: [],
-              regexNamespaces: [],
-              labels: {},
-              annotations: {},
-              deletionTimestamp: false,
-            },
-          },
-        ],
-        hasSchedule: false,
-        name: "",
-        description: "",
-      },
-    ];
-
-    const result = clusterRole(
-      "test-role",
-      capabilitiesWithLongKey,
-      "scoped",
-      capabilitiesWithLongKey.flatMap(c => c.rbac).filter((rule): rule is PolicyRule => rule !== undefined),
-    );
-
-    expect(result.rules).toEqual([
-      {
-        apiGroups: ["apps"],
-        resources: ["deployments"],
-        verbs: ["create"],
-      },
-    ]);
-  });
-
-  it("should handle non-array custom RBAC by defaulting to an empty array", () => {
-    // Mock readRBACFromPackageJson to return a non-array value
-    jest.spyOn(fs, "readFileSync").mockImplementation(() => {
-      return JSON.stringify({
-        pepr: {
-          rbac: "not-an-array", // Simulate invalid RBAC structure
-        },
-      });
-    });
-
-    const result = clusterRole(
-      "test-role",
-      mockCapabilities,
-      "scoped",
-      mockCapabilities.flatMap(c => c.rbac).filter((rule): rule is PolicyRule => rule !== undefined),
-    );
-
-    // The result should only contain rules from the capabilities, not from the invalid custom RBAC
-    expect(result.rules).toEqual([
-      {
-        apiGroups: ["pepr.dev"],
-        resources: ["peprstores"],
-        verbs: ["create", "get", "patch", "watch"],
-      },
-      {
-        apiGroups: ["apiextensions.k8s.io"],
-        resources: ["customresourcedefinitions"],
-        verbs: ["patch", "create"],
-      },
-      {
-        apiGroups: [""],
-        resources: ["namespaces"],
-        verbs: ["watch"],
-      },
-      {
-        apiGroups: [""],
-        resources: ["configmaps"],
-        verbs: ["watch"],
-      },
-    ]);
-  });
-
-  it("should default to an empty verbs array if rule.verbs is undefined", () => {
-    // Simulate a custom RBAC rule with empty verbs
-    const customRbacWithNoVerbs: PolicyRule[] = [
-      {
-        apiGroups: ["pepr.dev"],
-        resources: ["customresources"],
-        verbs: [], // Set verbs to an empty array to satisfy the V1PolicyRule type
-      },
-    ];
+export const capabilityWithFinalize: CapabilityExport[] = [
+  createMockCapability(
+    [createMockRbacRule(["pepr.dev"], ["peprstores"], ["patch"])],
+    [
+      createMockBinding(
+        { group: "pepr.dev", version: "v1", kind: "peprstore", plural: "peprstores" },
+        { isWatch: false, event: Event.CREATE, isFinalize: true },
+      ),
+    ],
+  ),
+];
 
-    jest.spyOn(fs, "readFileSync").mockImplementation(() => {
-      return JSON.stringify({
-        pepr: {
-          rbac: customRbacWithNoVerbs,
-        },
-      });
-    });
+export const capabilityWithDuplicates: CapabilityExport[] = [
+  createMockCapability(
+    [createMockRbacRule(["pepr.dev"], ["peprstores"], ["create", "get"])],
+    [
+      createMockBinding(
+        { group: "pepr.dev", version: "v1", kind: "peprlog", plural: "peprlogs" },
+        { isWatch: false, event: Event.CREATE },
+      ),
+    ],
+  ),
+  createMockCapability(
+    [createMockRbacRule(["pepr.dev"], ["peprstores"], ["get", "patch"])],
+    [
+      createMockBinding(
+        { group: "pepr.dev", version: "v1", kind: "peprlog", plural: "peprlogs" },
+        { isWatch: false, event: Event.CREATE },
+      ),
+    ],
+  ),
+];
 
-    const result = clusterRole("test-role", mockCapabilities, "scoped", customRbacWithNoVerbs);
+export const capabilityWithShortKey: CapabilityExport[] = [
+  createMockCapability(
+    [createMockRbacRule([""], ["nodes"], ["get"])],
+    [
+      createMockBinding(
+        { group: "", version: "v1", kind: "node", plural: "nodes" },
+        { isWatch: false, event: Event.CREATE },
+      ),
+    ],
+  ),
+];
 
-    // Check that the verbs array is empty for the custom RBAC rule
-    expect(result.rules).toContainEqual({
-      apiGroups: ["pepr.dev"],
-      resources: ["customresources"],
-      verbs: [],
-    });
-  });
-});
+export const capabilityWithLongKey: CapabilityExport[] = [
+  createMockCapability(
+    [createMockRbacRule(["apps"], ["deployments"], ["create"])],
+    [
+      createMockBinding(
+        { group: "apps", version: "v1", kind: "deployment", plural: "deployments" },
+        { isWatch: false, event: Event.CREATE },
+      ),
+    ],
+  ),
+];

package/src/lib/assets/yaml/overridesFile.ts

@@ -5,7 +5,7 @@ import { dumpYaml } from "@kubernetes/client-node";
 import { clusterRole } from "../rbac";
 import { promises as fs } from "fs";
 
-type ChartOverrides = {
+export type ChartOverrides = {
   apiPath: string;
   capabilities: CapabilityExport[];
   config: ModuleConfig;