refactor: simplify auth secret handling

thde · thde · commit 032fcc68535c · 2026-02-16T16:53:26.000+01:00
diff --git a/api/gitinfo/auth.go b/api/gitinfo/auth.go
@@ -30,28 +30,27 @@ func (a Auth) HasBasicAuth() bool {
 	return a.Username != nil && a.Password != nil
 }
 
-func (a Auth) Secret(app *apps.Application) *corev1.Secret {
-	data := map[string][]byte{}
-
-	if a.SSHPrivateKey != nil {
-		data[PrivateKeySecretKey] = []byte(*a.SSHPrivateKey)
-	} else if a.Username != nil && a.Password != nil {
-		data[UsernameSecretKey] = []byte(*a.Username)
-		data[PasswordSecretKey] = []byte(*a.Password)
-	}
-
+// NewAuthSecret returns a new secret for the given application. It can be used as
+// a key for Get/Delete operations or as a base for populating credentials.
+func NewAuthSecret(app *apps.Application) *corev1.Secret {
 	return &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      AuthSecretName(app),
 			Namespace: app.Namespace,
 		},
-		Data: data,
 	}
 }
 
-// UpdateSecret replaces the data of the secret with the data from GitAuth. Only
-// replaces fields which are non-nil.
-func (a Auth) UpdateSecret(secret *corev1.Secret) {
+// ApplyToSecret writes the Auth credentials into the given secret's Data field.
+// Only writes fields which are non-nil.
+func (a Auth) ApplyToSecret(secret *corev1.Secret) {
+	if secret.Data == nil {
+		secret.Data = make(map[string][]byte)
+	}
+	if secret.Annotations == nil {
+		secret.Annotations = make(map[string]string)
+	}
+
 	if a.SSHPrivateKey != nil {
 		secret.Data[PrivateKeySecretKey] = []byte(*a.SSHPrivateKey)
 	}
@@ -63,9 +62,6 @@ func (a Auth) UpdateSecret(secret *corev1.Secret) {
 	if a.Password != nil {
 		secret.Data[PasswordSecretKey] = []byte(*a.Password)
 	}
-	if secret.Annotations == nil {
-		secret.Annotations = make(map[string]string)
-	}
 }
 
 // Enabled returns true if any kind of credentials are set in the GitAuth
diff --git a/create/application.go b/create/application.go
@@ -161,7 +161,8 @@ func (cmd *applicationCmd) Run(ctx context.Context, client *api.Client) error {
 			return fmt.Errorf("the credentials are given but they are empty: %w", err)
 		}
 
-		secret := auth.Secret(newApp)
+		secret := gitinfo.NewAuthSecret(newApp)
+		auth.ApplyToSecret(secret)
 		// for git auth we create a separate secret and then reference it in the app.
 		if err := client.Create(ctx, secret); err != nil {
 			if kerrors.IsAlreadyExists(err) {
@@ -172,7 +173,7 @@ func (cmd *applicationCmd) Run(ctx context.Context, client *api.Client) error {
 						return err
 					}
 
-					auth.UpdateSecret(secret)
+					auth.ApplyToSecret(secret)
 					if err := client.Update(ctx, secret); err != nil {
 						return err
 					}
@@ -201,7 +202,7 @@ func (cmd *applicationCmd) Run(ctx context.Context, client *api.Client) error {
 
 	if err := c.createResource(appWaitCtx); err != nil {
 		if auth.Enabled() {
-			secret := auth.Secret(newApp)
+			secret := gitinfo.NewAuthSecret(newApp)
 			if gitErr := client.Delete(ctx, secret); gitErr != nil {
 				return errors.Join(err, fmt.Errorf("unable to delete git auth secret: %w", gitErr))
 			}
diff --git a/create/application_test.go b/create/application_test.go
@@ -150,8 +150,7 @@ func TestCreateApplication(t *testing.T) {
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
 				is := require.New(t)
-				auth := gitinfo.Auth{Username: cmd.Git.Username, Password: cmd.Git.Password}
-				authSecret := auth.Secret(app)
+				authSecret := gitinfo.NewAuthSecret(app)
 				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
@@ -176,8 +175,7 @@ func TestCreateApplication(t *testing.T) {
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
 				is := require.New(t)
-				auth := gitinfo.Auth{SSHPrivateKey: cmd.Git.SSHPrivateKey}
-				authSecret := auth.Secret(app)
+				authSecret := gitinfo.NewAuthSecret(app)
 				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
@@ -201,8 +199,7 @@ func TestCreateApplication(t *testing.T) {
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
 				is := require.New(t)
-				auth := gitinfo.Auth{SSHPrivateKey: cmd.Git.SSHPrivateKey}
-				authSecret := auth.Secret(app)
+				authSecret := gitinfo.NewAuthSecret(app)
 				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
@@ -226,8 +223,7 @@ func TestCreateApplication(t *testing.T) {
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
 				is := require.New(t)
-				auth := gitinfo.Auth{SSHPrivateKey: ptr.To("notused")}
-				authSecret := auth.Secret(app)
+				authSecret := gitinfo.NewAuthSecret(app)
 				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
@@ -251,8 +247,7 @@ func TestCreateApplication(t *testing.T) {
 			},
 			checkApp: func(t *testing.T, cmd applicationCmd, app *apps.Application) {
 				is := require.New(t)
-				auth := gitinfo.Auth{SSHPrivateKey: ptr.To("notused")}
-				authSecret := auth.Secret(app)
+				authSecret := gitinfo.NewAuthSecret(app)
 				if err := apiClient.Get(t.Context(), api.ObjectName(authSecret), authSecret); err != nil {
 					t.Fatal(err)
 				}
diff --git a/delete/application_test.go b/delete/application_test.go
@@ -214,7 +214,7 @@ func dummyApp(name, namespace string) *apps.Application {
 }
 
 func gitSecretFor(app *apps.Application) *corev1.Secret {
-	s := gitinfo.Auth{}.Secret(app)
+	s := gitinfo.NewAuthSecret(app)
 	s.TypeMeta = metav1.TypeMeta{
 		APIVersion: corev1.SchemeGroupVersion.String(),
 		Kind:       "Secret",
diff --git a/update/application.go b/update/application.go
@@ -195,10 +195,10 @@ func (cmd *applicationCmd) Run(ctx context.Context, client *api.Client) error {
 		}
 
 		if auth.Enabled() {
-			secret := auth.Secret(app)
+			secret := gitinfo.NewAuthSecret(app)
 			if err := client.Get(ctx, client.Name(secret.Name), secret); err != nil {
 				if errors.IsNotFound(err) {
-					auth.UpdateSecret(secret)
+					auth.ApplyToSecret(secret)
 					if err := client.Create(ctx, secret); err != nil {
 						return err
 					}
@@ -209,7 +209,7 @@ func (cmd *applicationCmd) Run(ctx context.Context, client *api.Client) error {
 				return err
 			}
 
-			auth.UpdateSecret(secret)
+			auth.ApplyToSecret(secret)
 			if err := client.Update(ctx, secret); err != nil {
 				return err
 			}
@@ -501,12 +501,12 @@ func warnIfDockerfileNotEnabled(w format.Writer, app *apps.Application, flag str
 }
 
 func gitAuthFromApp(ctx context.Context, client *api.Client, app *apps.Application) (gitinfo.Auth, error) {
-	auth := &gitinfo.Auth{}
-	secret := auth.Secret(app)
+	secret := gitinfo.NewAuthSecret(app)
 	if err := client.Get(ctx, client.Name(secret.Name), secret); err != nil {
 		return gitinfo.Auth{}, err
 	}
+	var auth gitinfo.Auth
 	auth.UpdateFromSecret(secret)
 
-	return *auth, nil
+	return auth, nil
 }
diff --git a/update/application_test.go b/update/application_test.go
@@ -620,7 +620,9 @@ func TestApplication(t *testing.T) {
 
 			objects := []client.Object{tc.orig}
 			if tc.gitAuth != nil {
-				objects = append(objects, tc.gitAuth.Secret(tc.orig))
+				secret := gitinfo.NewAuthSecret(tc.orig)
+				tc.gitAuth.ApplyToSecret(secret)
+				objects = append(objects, secret)
 			}
 			apiClient := test.SetupClient(t,
 				test.WithObjects(objects...),

Original file line number	Diff line number	Diff line change
`@@ -161,7 +161,8 @@ func (cmd applicationCmd) Run(ctx context.Context, client api.Client) error {`
`161`	`161`	`return fmt.Errorf("the credentials are given but they are empty: %w", err)`
`162`	`162`	`}`
`163`	`163`
`164`		`- secret := auth.Secret(newApp)`
	`164`	`+ secret := gitinfo.NewAuthSecret(newApp)`
	`165`	`+ auth.ApplyToSecret(secret)`
`165`	`166`	`// for git auth we create a separate secret and then reference it in the app.`
`166`	`167`	`if err := client.Create(ctx, secret); err != nil {`
`167`	`168`	`if kerrors.IsAlreadyExists(err) {`
`@@ -172,7 +173,7 @@ func (cmd applicationCmd) Run(ctx context.Context, client api.Client) error {`
`172`	`173`	`return err`
`173`	`174`	`}`
`174`	`175`
`175`		`- auth.UpdateSecret(secret)`
	`176`	`+ auth.ApplyToSecret(secret)`
`176`	`177`	`if err := client.Update(ctx, secret); err != nil {`
`177`	`178`	`return err`
`178`	`179`	`}`
`@@ -201,7 +202,7 @@ func (cmd applicationCmd) Run(ctx context.Context, client api.Client) error {`
`201`	`202`
`202`	`203`	`if err := c.createResource(appWaitCtx); err != nil {`
`203`	`204`	`if auth.Enabled() {`
`204`		`- secret := auth.Secret(newApp)`
	`205`	`+ secret := gitinfo.NewAuthSecret(newApp)`
`205`	`206`	`if gitErr := client.Delete(ctx, secret); gitErr != nil {`
`206`	`207`	`return errors.Join(err, fmt.Errorf("unable to delete git auth secret: %w", gitErr))`
`207`	`208`	`}`
Original file line number	Diff line number	Diff line change
`@@ -214,7 +214,7 @@ func dummyApp(name, namespace string) *apps.Application {`
`214`	`214`	`}`
`215`	`215`
`216`	`216`	`func gitSecretFor(app apps.Application) corev1.Secret {`
`217`		`- s := gitinfo.Auth{}.Secret(app)`
	`217`	`+ s := gitinfo.NewAuthSecret(app)`
`218`	`218`	`s.TypeMeta = metav1.TypeMeta{`
`219`	`219`	`APIVersion: corev1.SchemeGroupVersion.String(),`
`220`	`220`	`Kind: "Secret",`
Original file line number	Diff line number	Diff line change
`@@ -195,10 +195,10 @@ func (cmd applicationCmd) Run(ctx context.Context, client api.Client) error {`
`195`	`195`	`}`
`196`	`196`
`197`	`197`	`if auth.Enabled() {`
`198`		`- secret := auth.Secret(app)`
	`198`	`+ secret := gitinfo.NewAuthSecret(app)`
`199`	`199`	`if err := client.Get(ctx, client.Name(secret.Name), secret); err != nil {`
`200`	`200`	`if errors.IsNotFound(err) {`
`201`		`- auth.UpdateSecret(secret)`
	`201`	`+ auth.ApplyToSecret(secret)`
`202`	`202`	`if err := client.Create(ctx, secret); err != nil {`
`203`	`203`	`return err`
`204`	`204`	`}`
`@@ -209,7 +209,7 @@ func (cmd applicationCmd) Run(ctx context.Context, client api.Client) error {`
`209`	`209`	`return err`
`210`	`210`	`}`
`211`	`211`
`212`		`- auth.UpdateSecret(secret)`
	`212`	`+ auth.ApplyToSecret(secret)`
`213`	`213`	`if err := client.Update(ctx, secret); err != nil {`
`214`	`214`	`return err`
`215`	`215`	`}`
`@@ -501,12 +501,12 @@ func warnIfDockerfileNotEnabled(w format.Writer, app *apps.Application, flag str`
`501`	`501`	`}`
`502`	`502`
`503`	`503`	`func gitAuthFromApp(ctx context.Context, client api.Client, app apps.Application) (gitinfo.Auth, error) {`
`504`		`- auth := &gitinfo.Auth{}`
`505`		`- secret := auth.Secret(app)`
	`504`	`+ secret := gitinfo.NewAuthSecret(app)`
`506`	`505`	`if err := client.Get(ctx, client.Name(secret.Name), secret); err != nil {`
`507`	`506`	`return gitinfo.Auth{}, err`
`508`	`507`	`}`
	`508`	`+ var auth gitinfo.Auth`
`509`	`509`	`auth.UpdateFromSecret(secret)`
`510`	`510`
`511`		`- return *auth, nil`
	`511`	`+ return auth, nil`
`512`	`512`	`}`