Niklas Ye
e1103f2b7d
Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
package tdclient
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestWithTokenSetsAuthorizationHeader(t *testing.T) {
|
|
var gotAuth string
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
gotAuth = r.Header.Get("Authorization")
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
c := New(srv.URL).WithToken("tdsa_abc123")
|
|
if err := c.DeleteTeam(context.Background(), 1); err != nil {
|
|
t.Fatalf("DeleteTeam() error = %v", err)
|
|
}
|
|
if want := "Bearer tdsa_abc123"; gotAuth != want {
|
|
t.Errorf("Authorization header = %q, want %q", gotAuth, want)
|
|
}
|
|
}
|
|
|
|
// Every delete is idempotent: the thing already being gone is success, any
|
|
// other failure is not.
|
|
func TestDeletesTreatNotFoundAsSuccess(t *testing.T) {
|
|
status := http.StatusNotFound
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(status)
|
|
}))
|
|
defer srv.Close()
|
|
c := New(srv.URL)
|
|
ctx := context.Background()
|
|
|
|
for name, call := range map[string]func() error{
|
|
"team": func() error { return c.DeleteTeam(ctx, 1) },
|
|
"switch": func() error { return c.DeleteDeadmanSwitch(ctx, 1, 2) },
|
|
"integration": func() error { return c.DeleteIntegration(ctx, 1, 2) },
|
|
} {
|
|
status = http.StatusNotFound
|
|
if err := call(); err != nil {
|
|
t.Errorf("%s: 404 should be success, got %v", name, err)
|
|
}
|
|
status = http.StatusConflict
|
|
if err := call(); err == nil {
|
|
t.Errorf("%s: 409 should be an error", name)
|
|
}
|
|
}
|
|
}
|