gitprovider_controller_unit_test.go

// SPDX-License-Identifier: Apache-2.0

package controller

import (
	"context"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/types"
	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/client/fake"

	configbutleraiv1alpha3 "github.com/ConfigButler/gitops-reverser/api/v1alpha3"
	gitpkg "github.com/ConfigButler/gitops-reverser/internal/git"
)

func TestValidateCommitConfiguration_InvalidTemplate(t *testing.T) {
	reconciler := &GitProviderReconciler{}
	provider := &configbutleraiv1alpha3.GitProvider{
		Spec: configbutleraiv1alpha3.GitProviderSpec{
			Commit: &configbutleraiv1alpha3.CommitSpec{
				Message: &configbutleraiv1alpha3.CommitMessageSpec{
					EventTemplate: "{{.Operation",
				},
			},
		},
	}

	err := reconciler.validateCommitConfiguration(provider)
	require.Error(t, err)
	assert.Contains(t, err.Error(), "invalid commit configuration")
	assert.Empty(t, provider.Status.SigningPublicKey)
}

func TestValidateCommitConfiguration_SigningEnabled(t *testing.T) {
	reconciler := &GitProviderReconciler{}
	provider := &configbutleraiv1alpha3.GitProvider{
		Status: configbutleraiv1alpha3.GitProviderStatus{
			SigningPublicKey: "ssh-ed25519 AAAA old",
		},
		Spec: configbutleraiv1alpha3.GitProviderSpec{
			Commit: &configbutleraiv1alpha3.CommitSpec{
				Signing: &configbutleraiv1alpha3.CommitSigningSpec{
					SecretRef: configbutleraiv1alpha3.LocalSecretReference{
						Name: "signing-secret",
					},
				},
			},
		},
	}

	err := reconciler.validateCommitConfiguration(provider)
	require.NoError(t, err)
	assert.Empty(t, provider.Status.SigningPublicKey)
}

func TestEnsureSigningKey_GeneratesMissingSecret(t *testing.T) {
	ctx := context.Background()
	reconciler := &GitProviderReconciler{Client: newGitProviderTestClient(t)}
	provider := &configbutleraiv1alpha3.GitProvider{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "provider",
			Namespace: "default",
		},
		Spec: configbutleraiv1alpha3.GitProviderSpec{
			Commit: &configbutleraiv1alpha3.CommitSpec{
				Signing: &configbutleraiv1alpha3.CommitSigningSpec{
					SecretRef:           configbutleraiv1alpha3.LocalSecretReference{Name: "signing-secret"},
					GenerateWhenMissing: true,
				},
			},
		},
	}

	err := reconciler.ensureSigningKey(ctx, provider)
	require.NoError(t, err)
	assert.Contains(t, provider.Status.SigningPublicKey, "ssh-ed25519 ")

	var secret corev1.Secret
	require.NoError(t, reconciler.Get(ctx, types.NamespacedName{Name: "signing-secret", Namespace: "default"}, &secret))
	assert.NotEmpty(t, secret.Data[gitpkg.SigningKeyDataKey])
	assert.NotEmpty(t, secret.Data[gitpkg.SigningPublicKeyDataKey])
	assert.Equal(t, provider.Status.SigningPublicKey, string(secret.Data[gitpkg.SigningPublicKeyDataKey]))
}

func TestEnsureSigningKey_UsesExistingKey(t *testing.T) {
	ctx := context.Background()
	privateKey, publicKey, err := gitpkg.GenerateSSHSigningKeyPair(nil)
	require.NoError(t, err)

	secret := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "signing-secret",
			Namespace: "default",
		},
		Data: map[string][]byte{
			gitpkg.SigningKeyDataKey: privateKey,
		},
	}

	reconciler := &GitProviderReconciler{Client: newGitProviderTestClient(t, secret)}
	provider := &configbutleraiv1alpha3.GitProvider{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "provider",
			Namespace: "default",
		},
		Spec: configbutleraiv1alpha3.GitProviderSpec{
			Commit: &configbutleraiv1alpha3.CommitSpec{
				Signing: &configbutleraiv1alpha3.CommitSigningSpec{
					SecretRef: configbutleraiv1alpha3.LocalSecretReference{Name: "signing-secret"},
				},
			},
		},
	}

	err = reconciler.ensureSigningKey(ctx, provider)
	require.NoError(t, err)
	assert.Equal(t, string(publicKey), provider.Status.SigningPublicKey)

	var updatedSecret corev1.Secret
	require.NoError(
		t,
		reconciler.Get(ctx, types.NamespacedName{Name: "signing-secret", Namespace: "default"}, &updatedSecret),
	)
	_, hasPublicKey := updatedSecret.Data[gitpkg.SigningPublicKeyDataKey]
	assert.False(t, hasPublicKey)
}

func TestEnsureSigningKey_MissingSecretWithoutGeneration(t *testing.T) {
	ctx := context.Background()
	reconciler := &GitProviderReconciler{Client: newGitProviderTestClient(t)}
	provider := &configbutleraiv1alpha3.GitProvider{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "provider",
			Namespace: "default",
		},
		Spec: configbutleraiv1alpha3.GitProviderSpec{
			Commit: &configbutleraiv1alpha3.CommitSpec{
				Signing: &configbutleraiv1alpha3.CommitSigningSpec{
					SecretRef: configbutleraiv1alpha3.LocalSecretReference{Name: "signing-secret"},
				},
			},
		},
	}

	err := reconciler.ensureSigningKey(ctx, provider)
	require.Error(t, err)
	assert.Contains(t, err.Error(), "not found")
	assert.Empty(t, provider.Status.SigningPublicKey)
}

func newGitProviderTestClient(t *testing.T, objects ...runtime.Object) ctrlclient.Client {
	t.Helper()

	scheme := runtime.NewScheme()
	require.NoError(t, clientgoscheme.AddToScheme(scheme))
	require.NoError(t, configbutleraiv1alpha3.AddToScheme(scheme))

	return fake.NewClientBuilder().
		WithScheme(scheme).
		WithRuntimeObjects(objects...).
		Build()
}