unit tests for auth resolution + local.yaml invariants

pkg/k8s/client_test.go:
- URLResolution_TrailingSlashNormalized: target with a trailing slash still matches.
- URLResolution_MultipleMatches_ErrorListsContexts: the ambiguity error names the
  conflicting contexts + 'disambiguate'.
- ResolveKubeconfigAuth_NoteOn{Active,NonActive}Match: the 'Using kubeconfig context
  <name>' note is printed on a single match (os.Stderr captured).
pkg/functions/function_unit_test.go:
- LocalAuth_LocalYAMLMode0600 + TightensPreexisting0644: credential file is 0600,
  incl. re-tightening a pre-existing 0644 file.
- LocalAuth_NotInFuncYAML: credentials never serialize into func.yaml; the cluster URL
  does.

Author: gauron99

pkg/functions/function_unit_test.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -459,3 +460,95 @@ func TestLocalAuth_MultipleEntries(t *testing.T) {
 		t.Fatal("cluster-b auth not found or wrong")
 	}
 }
+
+// TestLocalAuth_LocalYAMLMode0600 ensures the credential file is written 0600.
+func TestLocalAuth_LocalYAMLMode0600(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("file mode bits are not meaningful on Windows")
+	}
+	root := FromTempDirectory(t)
+	f, err := fn.New().Init(fn.Function{Runtime: "go", Root: root})
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Local.SetAuth("https://cluster.example.com:6443", fn.ClusterTLS{}, fn.UserAuth{Token: "secret"})
+	if err := f.Write(); err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(filepath.Join(root, ".func", "local.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := info.Mode().Perm(); perm != 0o600 {
+		t.Fatalf("local.yaml mode = %o, want 0600", perm)
+	}
+}
+
+// TestLocalAuth_TightensPreexisting0644 ensures a pre-existing, loosened
+// local.yaml is re-tightened to 0600 on every Write -- unconditionally, even
+// when the rewrite carries no credentials (os.WriteFile does not change the
+// mode of an already-existing file). local.yaml is private machine-local
+// state and must never be left group/world-readable.
+func TestLocalAuth_TightensPreexisting0644(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("file mode bits are not meaningful on Windows")
+	}
+	root := FromTempDirectory(t)
+	f, err := fn.New().Init(fn.Function{Runtime: "go", Root: root})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Write a local.yaml, then loosen it as an older func (or a stray umask)
+	// would have.
+	if err := f.Write(); err != nil {
+		t.Fatal(err)
+	}
+	localPath := filepath.Join(root, ".func", "local.yaml")
+	if err := os.Chmod(localPath, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// Reload and write again WITHOUT any credentials -> must still be
+	// re-tightened to 0600. The invariant holds regardless of auth content.
+	// (A non-auth change is needed to force a write, since Write() no-ops when
+	// the function is unmodified.)
+	if f, err = fn.NewFunction(root); err != nil {
+		t.Fatal(err)
+	}
+	f.Local.Remote = true
+	if err := f.Write(); err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(localPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := info.Mode().Perm(); perm != 0o600 {
+		t.Fatalf("pre-existing local.yaml not tightened: mode = %o, want 0600", perm)
+	}
+}
+
+// TestLocalAuth_NotInFuncYAML ensures credentials never leak into the
+// source-controlled func.yaml, while the (non-secret) cluster URL is recorded.
+func TestLocalAuth_NotInFuncYAML(t *testing.T) {
+	root := FromTempDirectory(t)
+	f := fn.Function{Runtime: "go", Root: root,
+		Deploy: fn.DeploySpec{Cluster: "https://cluster.example.com:6443"}}
+	f, err := fn.New().Init(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Local.SetAuth("https://cluster.example.com:6443", fn.ClusterTLS{}, fn.UserAuth{Token: "super-secret-token"})
+	if err := f.Write(); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := os.ReadFile(filepath.Join(root, "func.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(raw), "super-secret-token") {
+		t.Fatalf("func.yaml leaked the stored token:\n%s", raw)
+	}
+	if !strings.Contains(string(raw), "https://cluster.example.com:6443") {
+		t.Fatalf("func.yaml should record the (non-secret) cluster URL:\n%s", raw)
+	}
+}

pkg/k8s/client_test.go

@@ -2,6 +2,7 @@ package k8s
 
 import (
 	"encoding/base64"
+	"io"
 	"os"
 	"path/filepath"
 	"testing"
@@ -513,6 +514,99 @@ func TestBuildClientConfig_URLResolution_NoMatch(t *testing.T) {
 	}
 }
 
+func TestBuildClientConfig_URLResolution_TrailingSlashNormalized(t *testing.T) {
+	writeTestKubeconfig(t, multiContextKubeconfig())
+
+	// target has a trailing slash; the kubeconfig server does not -> must match.
+	cc, err := BuildClientConfig("https://cluster-a.example.com:6443/", "", "", fn.Local{})
+	if err != nil {
+		t.Fatalf("trailing-slash target failed to resolve: %v", err)
+	}
+	cfg, err := cc.ClientConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.BearerToken != "token-a" {
+		t.Fatalf("expected token-a via trailing-slash match, got %q", cfg.BearerToken)
+	}
+}
+
+func TestBuildClientConfig_URLResolution_MultipleMatches_ErrorListsContexts(t *testing.T) {
+	writeTestKubeconfig(t, clientcmdapi.Config{
+		CurrentContext: "ctx-1",
+		Contexts: map[string]*clientcmdapi.Context{
+			"ctx-1": {Cluster: "cluster-x", AuthInfo: "user-1"},
+			"ctx-2": {Cluster: "cluster-y", AuthInfo: "user-2"},
+			"ctx-3": {Cluster: "cluster-z", AuthInfo: "user-3"},
+		},
+		Clusters: map[string]*clientcmdapi.Cluster{
+			"cluster-x": {Server: "https://active.example.com:6443"},
+			"cluster-y": {Server: "https://shared.example.com:6443"},
+			"cluster-z": {Server: "https://shared.example.com:6443"},
+		},
+		AuthInfos: map[string]*clientcmdapi.AuthInfo{
+			"user-1": {Token: "tok-1"},
+			"user-2": {Token: "tok-2"},
+			"user-3": {Token: "tok-3"},
+		},
+	})
+
+	_, err := BuildClientConfig("https://shared.example.com:6443", "", "", fn.Local{})
+	if err == nil {
+		t.Fatal("expected error for multiple matching contexts")
+	}
+	// The improved error names the ambiguous contexts and how to disambiguate.
+	for _, want := range []string{"ctx-2", "ctx-3", "disambiguate"} {
+		if !contains(err.Error(), want) {
+			t.Fatalf("multi-match error missing %q: %v", want, err)
+		}
+	}
+}
+
+func TestResolveKubeconfigAuth_NoteOnActiveMatch(t *testing.T) {
+	writeTestKubeconfig(t, multiContextKubeconfig())
+	out := captureStderr(t, func() {
+		if _, err := BuildClientConfig("https://cluster-a.example.com:6443", "", "", fn.Local{}); err != nil {
+			t.Fatal(err)
+		}
+	})
+	if !contains(out, `Using kubeconfig context "active-ctx"`) {
+		t.Fatalf("expected active-context note, got %q", out)
+	}
+}
+
+func TestResolveKubeconfigAuth_NoteOnNonActiveMatch(t *testing.T) {
+	writeTestKubeconfig(t, multiContextKubeconfig())
+	out := captureStderr(t, func() {
+		if _, err := BuildClientConfig("https://cluster-b.example.com:6443", "", "", fn.Local{}); err != nil {
+			t.Fatal(err)
+		}
+	})
+	if !contains(out, `Using kubeconfig context "other-ctx"`) {
+		t.Fatalf("expected non-active-context note, got %q", out)
+	}
+}
+
+// captureStderr redirects os.Stderr for the duration of f and returns what was
+// written (resolveKubeconfigAuth prints its selection note to os.Stderr).
+func captureStderr(t *testing.T, f func()) string {
+	t.Helper()
+	old := os.Stderr
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	os.Stderr = w
+	defer func() { os.Stderr = old }()
+	f()
+	_ = w.Close()
+	b, err := io.ReadAll(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
 // --- YAML round-trip tests for []byte fields ---
 
 func TestAuthEntry_YAMLRoundTrip(t *testing.T) {