apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
name: "[Stable][Hypershift] Authentication"
crd: 0000_10_config-operator_01_authentication.crd-Default-Hypershift.yaml
tests:
  onCreate:
    - name: Should be able to create a minimal Authentication
      initial: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec: {} # No spec is required for a Authentication
      expected: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec: {}
    - name: Should be able to use the OIDC type
      initial: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
      expected: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
    - name: Cannot set username claim prefix with policy NoPrefix
      initial: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            claimMappings:
              username:
                claim: "preferred_username"
                prefixPolicy: NoPrefix
                prefix:
                  prefixString: "myoidc:"
      expectedError: "prefix must be set if prefixPolicy is 'Prefix', but must remain unset otherwise"
    - name: Can set username claim prefix with policy Prefix
      initial: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            claimMappings:
              username:
                claim: "preferred_username"
                prefixPolicy: Prefix
                prefix:
                  prefixString: "myoidc:"
      expected: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            claimMappings:
              username:
                claim: "preferred_username"
                prefixPolicy: Prefix
                prefix:
                  prefixString: "myoidc:"
    - name: Cannot leave username claim prefix blank with policy Prefix
      initial: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            claimMappings:
              username:
                claim: "preferred_username"
                prefixPolicy: Prefix
      expectedError: "prefix must be set if prefixPolicy is 'Prefix', but must remain unset otherwise"
    - name: Can set OIDC providers with no username prefixing
      initial: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            claimMappings:
              username:
                claim: "preferred_username"
                prefixPolicy: NoPrefix
      expected: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            claimMappings:
              username:
                claim: "preferred_username"
                prefixPolicy: NoPrefix
  onUpdate:
    - name: Updating OIDC provider with a client that's not in the status
      initial: &initConfig |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            oidcClients:
              - componentNamespace: namespace
                componentName: preexisting
                clientID: someclient
              - componentNamespace: namespace
                componentName: name
                clientID: legitclient
        status:
          oidcClients:
          - componentNamespace: namespace
            componentName: name
          - componentNamespace: namespace2
            componentName: name2
          - componentNamespace: namespace2
            componentName: name3
      updated: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            oidcClients:
            - componentNamespace: namespace
              componentName: preexisting
              clientID: someclient
            - componentNamespace: namespace
              componentName: name
              clientID: legitclient
            - componentNamespace: dif-namespace # new client here
              componentName: tehName
              clientID: cool-client
        status:
          oidcClients:
          - componentNamespace: namespace
            componentName: name
          - componentNamespace: namespace2
            componentName: name2
          - componentNamespace: namespace2
            componentName: name3
      expectedError: "all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients"
    - name: Updating OIDC provider with a client that's different from the previous one
      initial: *initConfig
      updated: |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            oidcClients:
            - componentNamespace: dif-namespace
              componentName: tehName
              clientID: cool-client
        status:
          oidcClients:
          - componentNamespace: namespace
            componentName: name
          - componentNamespace: namespace2
            componentName: name2
          - componentNamespace: namespace2
            componentName: name3
      expectedError: "all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients"
    - name: Updating previously existing client
      initial: *initConfig
      updated: &prevExistingUpdated |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            oidcClients:
              - componentNamespace: namespace
                componentName: preexisting
                clientID: different-client
        status:
          oidcClients:
          - componentNamespace: namespace
            componentName: name
          - componentNamespace: namespace2
            componentName: name2
          - componentNamespace: namespace2
            componentName: name3
      expected: *prevExistingUpdated
    - name: Removing a configured client from the status (== component unregister)
      initial: *initConfig
      updated: &removeFromStatus |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            oidcClients:
              - componentNamespace: namespace
                componentName: preexisting
                clientID: different-client
              - componentNamespace: namespace
                componentName: name
                clientID: legitclient
        status:
          oidcClients:
          - componentNamespace: namespace2
            componentName: name2
          - componentNamespace: namespace2
            componentName: name3
      expected: *removeFromStatus
    - name: Simply add a valid client
      initial: *initConfig
      updated: &addClient |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
          oidcProviders:
          - name: myoidc
            issuer:
              issuerURL: https://meh.tld
              audiences: ['openshift-aud']
            oidcClients:
              - componentNamespace: namespace
                componentName: preexisting
                clientID: different-client
              - componentNamespace: namespace
                componentName: name
                clientID: legitclient
              - componentNamespace: namespace2
                componentName: name3
                clientID: justavalidclient
        status:
          oidcClients:
          - componentNamespace: namespace
            componentName: name
          - componentNamespace: namespace2
            componentName: name2
          - componentNamespace: namespace2
            componentName: name3
      expected: *addClient
    - name: Remove all oidcProviders
      initial: *initConfig
      updated: &removeFromStatus |
        apiVersion: config.openshift.io/v1
        kind: Authentication
        spec:
          type: OIDC
        status:
          oidcClients:
          - componentNamespace: namespace2
            componentName: name2
          - componentNamespace: namespace2
            componentName: name3
      expected: *removeFromStatus
