@@ -18,155 +18,6 @@ import (
1818 "github.com/stacklok/toolhive/pkg/container/kubernetes"
1919)
2020
21- func TestGenerateAuthzArgs (t * testing.T ) {
22- t .Parallel ()
23-
24- scheme := runtime .NewScheme ()
25- require .NoError (t , mcpv1alpha1 .AddToScheme (scheme ))
26- require .NoError (t , corev1 .AddToScheme (scheme ))
27-
28- tests := []struct {
29- name string
30- mcpServer * mcpv1alpha1.MCPServer
31- configMaps []corev1.ConfigMap
32- expectedArgs []string
33- }{
34- {
35- name : "no authz config" ,
36- mcpServer : & mcpv1alpha1.MCPServer {
37- ObjectMeta : metav1.ObjectMeta {
38- Name : "test-server" ,
39- Namespace : "test-namespace" ,
40- },
41- Spec : mcpv1alpha1.MCPServerSpec {
42- Image : "test-image" ,
43- },
44- },
45- expectedArgs : nil ,
46- },
47- {
48- name : "configmap authz config" ,
49- mcpServer : & mcpv1alpha1.MCPServer {
50- ObjectMeta : metav1.ObjectMeta {
51- Name : "test-server" ,
52- Namespace : "test-namespace" ,
53- },
54- Spec : mcpv1alpha1.MCPServerSpec {
55- Image : "test-image" ,
56- AuthzConfig : & mcpv1alpha1.AuthzConfigRef {
57- Type : mcpv1alpha1 .AuthzConfigTypeConfigMap ,
58- ConfigMap : & mcpv1alpha1.ConfigMapAuthzRef {
59- Name : "test-authz-config" ,
60- Key : "authz.json" ,
61- },
62- },
63- },
64- },
65- configMaps : []corev1.ConfigMap {
66- {
67- ObjectMeta : metav1.ObjectMeta {
68- Name : "test-authz-config" ,
69- Namespace : "test-namespace" ,
70- },
71- Data : map [string ]string {
72- "authz.json" : `{
73- "version": "1.0",
74- "type": "cedarv1",
75- "cedar": {
76- "policies": ["permit(principal, action == Action::\"call_tool\", resource == Tool::\"weather\");"],
77- "entities_json": "[]"
78- }
79- }` ,
80- },
81- },
82- },
83- expectedArgs : []string {"--authz-config=/etc/toolhive/authz/authz.json" },
84- },
85- {
86- name : "inline authz config" ,
87- mcpServer : & mcpv1alpha1.MCPServer {
88- ObjectMeta : metav1.ObjectMeta {
89- Name : "test-server" ,
90- Namespace : "test-namespace" ,
91- },
92- Spec : mcpv1alpha1.MCPServerSpec {
93- Image : "test-image" ,
94- AuthzConfig : & mcpv1alpha1.AuthzConfigRef {
95- Type : mcpv1alpha1 .AuthzConfigTypeInline ,
96- Inline : & mcpv1alpha1.InlineAuthzConfig {
97- Policies : []string {
98- `permit(principal, action == Action::"call_tool", resource == Tool::"weather");` ,
99- `permit(principal, action == Action::"get_prompt", resource == Prompt::"greeting");` ,
100- },
101- EntitiesJSON : "[]" ,
102- },
103- },
104- },
105- },
106- expectedArgs : []string {"--authz-config=/etc/toolhive/authz/authz.json" },
107- },
108- {
109- name : "configmap authz config with default key" ,
110- mcpServer : & mcpv1alpha1.MCPServer {
111- ObjectMeta : metav1.ObjectMeta {
112- Name : "test-server" ,
113- Namespace : "test-namespace" ,
114- },
115- Spec : mcpv1alpha1.MCPServerSpec {
116- Image : "test-image" ,
117- AuthzConfig : & mcpv1alpha1.AuthzConfigRef {
118- Type : mcpv1alpha1 .AuthzConfigTypeConfigMap ,
119- ConfigMap : & mcpv1alpha1.ConfigMapAuthzRef {
120- Name : "test-authz-config" ,
121- // Key not specified, should default to "authz.json"
122- },
123- },
124- },
125- },
126- configMaps : []corev1.ConfigMap {
127- {
128- ObjectMeta : metav1.ObjectMeta {
129- Name : "test-authz-config" ,
130- Namespace : "test-namespace" ,
131- },
132- Data : map [string ]string {
133- "authz.json" : `{
134- "version": "1.0",
135- "type": "cedarv1",
136- "cedar": {
137- "policies": ["permit(principal, action, resource);"],
138- "entities_json": "[]"
139- }
140- }` ,
141- },
142- },
143- },
144- expectedArgs : []string {"--authz-config=/etc/toolhive/authz/authz.json" },
145- },
146- }
147-
148- for _ , tt := range tests {
149- t .Run (tt .name , func (t * testing.T ) {
150- t .Parallel ()
151-
152- // Create fake client with ConfigMaps
153- objects := []runtime.Object {tt .mcpServer }
154- for i := range tt .configMaps {
155- objects = append (objects , & tt .configMaps [i ])
156- }
157- fakeClient := fake .NewClientBuilder ().
158- WithScheme (scheme ).
159- WithRuntimeObjects (objects ... ).
160- Build ()
161-
162- reconciler := newTestMCPServerReconciler (fakeClient , scheme , kubernetes .PlatformKubernetes )
163-
164- args := reconciler .generateAuthzArgs (tt .mcpServer )
165- assert .Equal (t , tt .expectedArgs , args )
166- })
167- }
168- }
169-
17021func TestEnsureAuthzConfigMap (t * testing.T ) {
17122 t .Parallel ()
17223
0 commit comments