Skip to content

Commit 765e1a7

Browse files
JoseSzychoJoseSzycho
committed
fix: normalize Project to cammel case
1 parent 175ba65 commit 765e1a7

File tree

5 files changed

+22
-18
lines changed

5 files changed

+22
-18
lines changed

‎internal/indexer/consumer.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ import (
77
"sync"
88

99
"github.com/nats-io/nats.go/jetstream"
10+
"golang.org/x/text/cases"
11+
"golang.org/x/text/language"
1012
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
1113
"k8s.io/klog/v2"
1214
)
@@ -50,7 +52,9 @@ func extractTenantFromAuditEvent(event *auditEvent) (tenantName string, tenantTy
5052
}
5153

5254
if values, ok := event.User.Extra["iam.miloapis.com/parent-type"]; ok && len(values) > 0 {
53-
tenantType = values[0]
55+
// Normalize to title-case to match Milo's scope annotation conventions
56+
// (e.g. the annotation value "project" becomes "Project").
57+
tenantType = cases.Title(language.Und).String(values[0])
5458
}
5559
if values, ok := event.User.Extra["iam.miloapis.com/parent-name"]; ok && len(values) > 0 {
5660
tenantName = values[0]

‎internal/indexer/consumer_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ func TestExtractTenantFromAuditEvent_WithUserExtra(t *testing.T) {
163163
Extra map[string][]string `json:"extra,omitempty"`
164164
}{
165165
Extra: map[string][]string{
166-
"iam.miloapis.com/parent-type": {"project"},
166+
"iam.miloapis.com/parent-type": {"Project"},
167167
"iam.miloapis.com/parent-name": {"my-project"},
168168
},
169169
}
@@ -173,8 +173,8 @@ func TestExtractTenantFromAuditEvent_WithUserExtra(t *testing.T) {
173173
if name != "my-project" {
174174
t.Errorf("tenantName: got %q, want %q", name, "my-project")
175175
}
176-
if typ != "project" {
177-
t.Errorf("tenantType: got %q, want %q", typ, "project")
176+
if typ != "Project" {
177+
t.Errorf("tenantType: got %q, want %q", typ, "Project")
178178
}
179179
}
180180

@@ -200,7 +200,7 @@ func TestExtractTenantFromAuditEvent_PartialUserExtra_TypeOnlyNoName(t *testing.
200200
Extra map[string][]string `json:"extra,omitempty"`
201201
}{
202202
Extra: map[string][]string{
203-
"iam.miloapis.com/parent-type": {"project"},
203+
"iam.miloapis.com/parent-type": {"Project"},
204204
},
205205
}
206206

@@ -209,8 +209,8 @@ func TestExtractTenantFromAuditEvent_PartialUserExtra_TypeOnlyNoName(t *testing.
209209
if name != "platform" {
210210
t.Errorf("tenantName: got %q, want %q (expected fallback)", name, "platform")
211211
}
212-
if typ != "project" {
213-
t.Errorf("tenantType: got %q, want %q", typ, "project")
212+
if typ != "Project" {
213+
t.Errorf("tenantType: got %q, want %q", typ, "Project")
214214
}
215215
}
216216

‎internal/tenant/registry.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ type TenantDisengagementCallback func(tenantName string)
4040

4141
const (
4242
TenantTypePlatform = "platform"
43-
TenantTypeProject = "project"
43+
TenantTypeProject = "Project"
4444
)
4545

4646
// PlatformTenantInfo is the canonical TenantInfo for the platform tenant.

‎test/e2e/search-flow-multi-tenant-audit/chainsaw-test.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ spec:
9999
# Event A: project-tenant resource.
100100
# user.extra carries iam.miloapis.com/parent-type and parent-name so the
101101
# indexer's extractTenantFromAuditEvent() will resolve the tenant as
102-
# type="project", name="e2e-audit-test-project".
102+
# type="Project", name="e2e-audit-test-project".
103103
EVENT_A='{"auditID":"e2e-audit-project-event-001","verb":"create","objectRef":{"apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1","resource":"rolebindings","name":"e2e-audit-project-role","namespace":"default","uid":"e2e-audit-project-uid-00000001"},"responseObject":{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"name":"e2e-audit-project-role","namespace":"default","uid":"e2e-audit-project-uid-00000001","labels":{"e2e-multi-tenant-audit":"true"},"annotations":{"e2e.search.test/service":"audit-project-service-mt-rn2"}},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"Role","name":"view"},"subjects":[]},"user":{"extra":{"iam.miloapis.com/parent-type":["project"],"iam.miloapis.com/parent-name":["e2e-audit-test-project"]}}}'
104104
105105
# Event B: platform-tenant resource.
@@ -187,8 +187,8 @@ spec:
187187
limit: 10
188188
EOF
189189
)
190-
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-project-role")] | length > 0'
191-
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-project-role") | select(.tenant.name == "e2e-audit-test-project") | select(.tenant.type == "project")] | length > 0'
190+
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-project-role")] | length > 0' && \
191+
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-project-role") | select(.tenant.name == "e2e-audit-test-project") | select(.tenant.type == "Project")] | length > 0' && \
192192
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-project-role") | select(.resource._tenant != null)] | length == 0'
193193
check:
194194
($error): ~
@@ -216,7 +216,7 @@ spec:
216216
limit: 10
217217
EOF
218218
)
219-
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-platform-role")] | length > 0'
219+
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-platform-role")] | length > 0' && \
220220
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-audit-platform-role") | select(.tenant.name == "platform") | select(.tenant.type == "platform")] | length > 0'
221221
check:
222222
($error): ~
@@ -244,7 +244,7 @@ spec:
244244
limit: 10
245245
EOF
246246
)
247-
echo "$RESULT" | jq -e '[.status.results[]? | select(.tenant.type == "project")] | length >= 1'
247+
echo "$RESULT" | jq -e '[.status.results[]? | select(.tenant.type == "Project")] | length >= 1' && \
248248
echo "$RESULT" | jq -e '[.status.results[]? | select(.tenant.type == "platform")] | length >= 1'
249249
check:
250250
($error): ~

‎test/e2e/search-flow-multi-tenant/chainsaw-test.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ spec:
9494
# Build event JSON with INDEX_NAME substituted.
9595
# SpecHash is intentionally omitted so the consumer skips the hash check.
9696
EVENT1=$(printf \
97-
'{"id":"e2e-mt-project-resource-001","policyName":"e2e-multi-tenant-role-policy","indexName":"%s","tenant":"e2e-test-project","tenantType":"project","resource":{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"name":"e2e-project-role","uid":"e2e-project-uid-00000001","labels":{"e2e-multi-tenant":"true"},"annotations":{"e2e.search.test/service":"project-service-mt-rn1"}},"rules":[{"apiGroups":[""],"resources":["pods"],"verbs":["get"]}]}}' \
97+
'{"id":"e2e-mt-project-resource-001","policyName":"e2e-multi-tenant-role-policy","indexName":"%s","tenant":"e2e-test-project","tenantType":"Project","resource":{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"name":"e2e-project-role","uid":"e2e-project-uid-00000001","labels":{"e2e-multi-tenant":"true"},"annotations":{"e2e.search.test/service":"project-service-mt-rn1"}},"rules":[{"apiGroups":[""],"resources":["pods"],"verbs":["get"]}]}}' \
9898
"$INDEX_NAME")
9999
100100
EVENT2=$(printf \
@@ -178,8 +178,8 @@ spec:
178178
limit: 10
179179
EOF
180180
)
181-
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-project-role")] | length > 0'
182-
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-project-role") | select(.tenant.name == "e2e-test-project") | select(.tenant.type == "project")] | length > 0'
181+
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-project-role")] | length > 0' && \
182+
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-project-role") | select(.tenant.name == "e2e-test-project") | select(.tenant.type == "Project")] | length > 0' && \
183183
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-project-role") | select(.resource._tenant != null)] | length == 0'
184184
check:
185185
($error): ~
@@ -207,7 +207,7 @@ spec:
207207
limit: 10
208208
EOF
209209
)
210-
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-platform-role")] | length > 0'
210+
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-platform-role")] | length > 0' && \
211211
echo "$RESULT" | jq -e '[.status.results[]? | select(.resource.metadata.name == "e2e-platform-role") | select(.tenant.name == "platform") | select(.tenant.type == "platform")] | length > 0'
212212
check:
213213
($error): ~
@@ -235,7 +235,7 @@ spec:
235235
limit: 10
236236
EOF
237237
)
238-
echo "$RESULT" | jq -e '[.status.results[]? | select(.tenant.type == "project")] | length >= 1'
238+
echo "$RESULT" | jq -e '[.status.results[]? | select(.tenant.type == "Project")] | length >= 1' && \
239239
echo "$RESULT" | jq -e '[.status.results[]? | select(.tenant.type == "platform")] | length >= 1'
240240
check:
241241
($error): ~

0 commit comments

Comments
 (0)