test: add coverage for preflight, k8s, gateway (#26)

internal/gateway/cli_test.go

@@ -308,3 +308,95 @@ func TestCLIPath_NotFound(t *testing.T) {
 		t.Errorf("CLIPath = %q, want empty", path)
 	}
 }
+
+func TestProviderCreate_Args(t *testing.T) {
+	dir := t.TempDir()
+	argsFile := filepath.Join(dir, "args")
+	bin := writeStub(t, `#!/bin/bash
+printf '%s\n' "$*" > `+argsFile+`
+`)
+	gw := NewCLI(bin)
+	gw.ProviderCreate("vertex-local", "google-vertex-ai", ProviderCreateOpts{
+		FromADC:     true,
+		Credentials: []string{"TOKEN=abc"},
+		Configs:     []string{"PROJECT=my-proj", "REGION=us-east5"},
+	})
+	data, _ := os.ReadFile(argsFile)
+	args := strings.TrimSpace(string(data))
+	for _, want := range []string{
+		"--name vertex-local",
+		"--type google-vertex-ai",
+		"--from-gcloud-adc",
+		"--credential TOKEN=abc",
+		"--config PROJECT=my-proj",
+		"--config REGION=us-east5",
+	} {
+		if !strings.Contains(args, want) {
+			t.Errorf("missing %q in: %s", want, args)
+		}
+	}
+}
+
+func TestInferenceSet_Args(t *testing.T) {
+	dir := t.TempDir()
+	argsFile := filepath.Join(dir, "args")
+	bin := writeStub(t, `#!/bin/bash
+printf '%s\n' "$*" > `+argsFile+`
+`)
+	gw := NewCLI(bin)
+	gw.InferenceSet("vertex-local", "claude-sonnet-4-6")
+	data, _ := os.ReadFile(argsFile)
+	args := strings.TrimSpace(string(data))
+	for _, want := range []string{
+		"inference set",
+		"--provider vertex-local",
+		"--model claude-sonnet-4-6",
+		"--no-verify",
+	} {
+		if !strings.Contains(args, want) {
+			t.Errorf("missing %q in: %s", want, args)
+		}
+	}
+}
+
+func TestGatewayAdd_Args(t *testing.T) {
+	dir := t.TempDir()
+	argsFile := filepath.Join(dir, "args")
+	bin := writeStub(t, `#!/bin/bash
+printf '%s\n' "$*" > `+argsFile+`
+`)
+	gw := NewCLI(bin)
+	gw.GatewayAdd("https://gw.example.com:443", "my-ocp", true)
+	data, _ := os.ReadFile(argsFile)
+	args := strings.TrimSpace(string(data))
+	for _, want := range []string{
+		"gateway add",
+		"https://gw.example.com:443",
+		"--name my-ocp",
+		"--local",
+	} {
+		if !strings.Contains(args, want) {
+			t.Errorf("missing %q in: %s", want, args)
+		}
+	}
+}
+
+func TestGatewayRemove(t *testing.T) {
+	bin := writeStub(t, `#!/bin/bash
+exit 0
+`)
+	gw := NewCLI(bin)
+	if err := gw.GatewayRemove("old-gw"); err != nil {
+		t.Errorf("GatewayRemove: %v", err)
+	}
+}
+
+func TestProviderProfileDelete(t *testing.T) {
+	bin := writeStub(t, `#!/bin/bash
+exit 0
+`)
+	gw := NewCLI(bin)
+	if err := gw.ProviderProfileDelete("profile-123"); err != nil {
+		t.Errorf("ProviderProfileDelete: %v", err)
+	}
+}

internal/k8s/kubectl_test.go

@@ -175,6 +175,109 @@ func TestIsTransient(t *testing.T) {
 	}
 }
 
+func TestRunKubectl_RetryExhausted(t *testing.T) {
+	dir := t.TempDir()
+	counterFile := filepath.Join(dir, "count")
+	os.WriteFile(counterFile, []byte("0"), 0o644)
+
+	writeStub(t, `#!/bin/bash
+COUNT=$(cat `+counterFile+`)
+COUNT=$((COUNT + 1))
+echo $COUNT > `+counterFile+`
+echo "connection refused" >&2
+exit 1
+`)
+	c := New("", "")
+	_, err := c.RunKubectl(context.Background(), "get", "pods")
+	if err == nil {
+		t.Error("expected error after retry exhaustion")
+	}
+	data, _ := os.ReadFile(counterFile)
+	if string(data) != "3\n" {
+		t.Errorf("expected 3 attempts, got %s", data)
+	}
+}
+
+func TestRunKubectlQuiet_DiscardsOutput(t *testing.T) {
+	writeStub(t, `#!/bin/bash
+echo "this should be discarded"
+echo "error output" >&2
+`)
+	c := New("", "")
+	err := c.RunKubectlQuiet(context.Background(), "get", "pods")
+	if err != nil {
+		t.Errorf("RunKubectlQuiet: %v", err)
+	}
+}
+
+func TestGetSecretField_Valid(t *testing.T) {
+	writeStub(t, `#!/bin/bash
+# Return base64-encoded "hello"
+echo -n "aGVsbG8="
+`)
+	c := New("", "default")
+	data, err := c.GetSecretField(context.Background(), "my-secret", "data-field")
+	if err != nil {
+		t.Fatalf("GetSecretField: %v", err)
+	}
+	if string(data) != "hello" {
+		t.Errorf("data = %q, want hello", string(data))
+	}
+}
+
+func TestGetSecretField_InvalidBase64(t *testing.T) {
+	writeStub(t, `#!/bin/bash
+echo -n "not-valid-base64!!!"
+`)
+	c := New("", "default")
+	_, err := c.GetSecretField(context.Background(), "my-secret", "field")
+	if err == nil {
+		t.Error("expected error for invalid base64")
+	}
+}
+
+func TestGetSecretField_Empty(t *testing.T) {
+	writeStub(t, `#!/bin/bash
+echo -n ""
+`)
+	c := New("", "default")
+	data, err := c.GetSecretField(context.Background(), "my-secret", "field")
+	if err != nil {
+		t.Fatalf("GetSecretField: %v", err)
+	}
+	if len(data) != 0 {
+		t.Errorf("expected empty, got %q", data)
+	}
+}
+
+func TestNamespaceExists(t *testing.T) {
+	writeStub(t, `#!/bin/bash
+[[ "$*" == *"my-ns"* ]] && exit 0
+exit 1
+`)
+	c := New("", "")
+	if !c.NamespaceExists(context.Background(), "my-ns") {
+		t.Error("expected namespace to exist")
+	}
+	if c.NamespaceExists(context.Background(), "missing-ns") {
+		t.Error("expected namespace to not exist")
+	}
+}
+
+func TestDefaultNamespace(t *testing.T) {
+	t.Setenv("OPENSHELL_NAMESPACE", "custom-ns")
+	if ns := DefaultNamespace(); ns != "custom-ns" {
+		t.Errorf("DefaultNamespace = %q, want custom-ns", ns)
+	}
+}
+
+func TestDefaultNamespace_Default(t *testing.T) {
+	t.Setenv("OPENSHELL_NAMESPACE", "")
+	if ns := DefaultNamespace(); ns != "openshell" {
+		t.Errorf("DefaultNamespace = %q, want openshell", ns)
+	}
+}
+
 func contains(s, substr string) bool {
 	return len(s) > 0 && len(substr) > 0 && s != substr && indexOf(s, substr) >= 0
 }