fix: coderabbit comments

Co-authored-by: Codex <noreply@openai.com>

Author: steveiliop56

.coderabbit.yaml

@@ -1,3 +1,6 @@
+# yaml-language-server: $schema=https://www.coderabbit.ai/integrations/schema.v2.json
 issue_enrichment:
   auto_enrich:
     enabled: false
+reviews:
+  profile: chill

internal/service/kubernetes_service.go

@@ -50,15 +50,22 @@ var supportedResources = []watchedResource{
 }
 
 func hostMatchesHostname(host string, hostname string) bool {
+	if host == "" {
+		return true
+	}
 	host = normalizeDomain(host)
 	hostname = normalizeDomain(hostname)
 	if suffix, ok := strings.CutPrefix(host, "*."); ok {
-		return strings.HasSuffix(hostname, "."+suffix)
+		prefix, matches := strings.CutSuffix(hostname, "."+suffix)
+		return matches && prefix != "" && !strings.Contains(prefix, ".")
 	}
 	return host == hostname
 }
 
 func hostCoversName(host string, name string) bool {
+	if host == "" {
+		return true
+	}
 	host = strings.ToLower(host)
 	if strings.HasPrefix(host, "*.") {
 		return true
@@ -312,14 +319,26 @@ func (k *KubernetesService) resyncGVR(res watchedResource, ctx context.Context)
 		k.log.App.Warn().Err(err).Str("res", res.pretty()).Msg("Failed to list resources for resync")
 		return err
 	}
+	seen := make(map[resourceKey]struct{}, len(list.Items))
 	for _, item := range list.Items {
+		seen[resourceKey{typ: res.typ, namespace: item.GetNamespace(), name: item.GetName()}] = struct{}{}
 		newTypedItem, err := new(typedItem).fromUnstructured(res.typ, &item)
 		if err != nil {
 			k.log.App.Warn().Err(err).Str("res", res.pretty()).Msg("Failed to decode resource, skipping")
 			continue
 		}
 		k.updateFromItem(res, newTypedItem)
 	}
+	k.mu.Lock()
+	for key := range k.apps {
+		if key.typ != res.typ {
+			continue
+		}
+		if _, ok := seen[key]; !ok {
+			delete(k.apps, key)
+		}
+	}
+	k.mu.Unlock()
 	k.log.App.Debug().Str("res", res.pretty()).Int("count", len(list.Items)).Msg("Resync complete")
 	return nil
 }

internal/service/kubernetes_service_test.go

@@ -1,6 +1,10 @@
 package service
 
 import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
@@ -11,6 +15,8 @@ import (
 	networking "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
 )
 
 func watchedResourceForTest(t *testing.T, typ ResourceType) watchedResource {
@@ -88,6 +94,23 @@ func TestKubernetesServiceUpdateFromItem(t *testing.T) {
 			}, "Dashboard.example.com"),
 			domain: "dashboard.example.com", allow: "alice",
 		},
+		{
+			name:     "Hostless Ingress matches a configured domain",
+			resource: ResourceTypeIngress,
+			item: testIngress("ingress", map[string]string{
+				"tinyauth.apps.dashboard.config.domain": "dashboard.example.com",
+				"tinyauth.apps.dashboard.users.allow":   "alice",
+			}, ""),
+			domain: "dashboard.example.com", wantConfigDomain: "dashboard.example.com", allow: "alice",
+		},
+		{
+			name:     "Hostless Ingress matches an app name",
+			resource: ResourceTypeIngress,
+			item: testIngress("ingress", map[string]string{
+				"tinyauth.apps.dashboard.users.allow": "alice",
+			}, ""),
+			domain: "dashboard.example.com", allow: "alice",
+		},
 	}
 
 	for _, test := range tests {
@@ -99,6 +122,10 @@ func TestKubernetesServiceUpdateFromItem(t *testing.T) {
 			require.NotNil(t, app)
 			assert.Equal(t, test.allow, app.Users.Allow)
 			assert.Equal(t, test.wantConfigDomain, app.Config.Domain)
+			if test.item.ingress.Spec.Rules[0].Host == "" {
+				key := resourceKey{typ: test.resource, namespace: "default", name: "ingress"}
+				assert.Equal(t, []string{""}, service.apps[key].hosts)
+			}
 		})
 	}
 }
@@ -132,6 +159,68 @@ func TestKubernetesServiceUpdateFromItemRemovesStaleEntries(t *testing.T) {
 	}
 }
 
+func TestKubernetesServiceResyncRemovesMissingResources(t *testing.T) {
+	log := logger.NewLogger().WithTestConfig()
+	log.Init()
+	service := newKubernetesServiceForTest(log)
+	res := watchedResourceForTest(t, ResourceTypeIngress)
+
+	live := testIngress("keep", map[string]string{
+		"tinyauth.apps.keep.config.domain": "keep.example.com",
+	}, "keep.example.com")
+	items := []networking.Ingress{*live.ingress}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(w).Encode(networking.IngressList{
+			TypeMeta: metav1.TypeMeta{APIVersion: "networking.k8s.io/v1", Kind: "IngressList"},
+			Items:    items,
+		}); err != nil {
+			t.Errorf("encode ingress list: %v", err)
+		}
+	}))
+	defer server.Close()
+	client, err := dynamic.NewForConfig(&rest.Config{Host: server.URL})
+	require.NoError(t, err)
+	service.client = client
+	stale := resourceKey{typ: res.typ, namespace: "default", name: "gone"}
+	otherNamespace := resourceKey{typ: res.typ, namespace: "other", name: "keep"}
+	otherType := resourceKey{typ: ResourceType("other"), namespace: "default", name: "gone"}
+	for _, key := range []resourceKey{stale, otherNamespace, otherType} {
+		service.addResourceEntries(key, nil, []resourceEntry{{name: "app"}})
+	}
+
+	require.NoError(t, service.resyncGVR(res, context.Background()))
+	assert.Contains(t, service.apps, resourceKey{typ: res.typ, namespace: "default", name: "keep"})
+	assert.NotContains(t, service.apps, stale)
+	assert.NotContains(t, service.apps, otherNamespace)
+	assert.Contains(t, service.apps, otherType)
+
+	items = nil
+	require.NoError(t, service.resyncGVR(res, context.Background()))
+	assert.NotContains(t, service.apps, resourceKey{typ: res.typ, namespace: "default", name: "keep"})
+	assert.Contains(t, service.apps, otherType)
+}
+
+func TestKubernetesServiceResyncKeepsResourcesOnListFailure(t *testing.T) {
+	log := logger.NewLogger().WithTestConfig()
+	log.Init()
+	service := newKubernetesServiceForTest(log)
+	res := watchedResourceForTest(t, ResourceTypeIngress)
+	key := resourceKey{typ: res.typ, namespace: "default", name: "keep"}
+	service.addResourceEntries(key, nil, []resourceEntry{{name: "app"}})
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "list failed", http.StatusServiceUnavailable)
+	}))
+	defer server.Close()
+	client, err := dynamic.NewForConfig(&rest.Config{Host: server.URL})
+	require.NoError(t, err)
+	service.client = client
+
+	require.Error(t, service.resyncGVR(res, context.Background()))
+	assert.Contains(t, service.apps, key)
+}
+
 func TestTypedItemFromUnstructured(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -227,9 +316,14 @@ func TestKubernetesHostMatching(t *testing.T) {
 	}{
 		{"Exact host", "app.example.com", "app.example.com", true},
 		{"Case insensitive exact host", "App.Example.com", "app.example.com", true},
-		{"Wildcard host", "*.example.com", "deep.app.example.com", true},
+		{"Wildcard host", "*.example.com", "app.example.com", true},
+		{"Wildcard host is case insensitive", "*.Example.com", "App.example.com", true},
 		{"Wildcard does not match its apex", "*.example.com", "example.com", false},
+		{"Wildcard rejects empty label", "*.example.com", ".example.com", false},
+		{"Wildcard rejects multiple labels", "*.example.com", "deep.app.example.com", false},
+		{"Wildcard rejects other suffix", "*.example.com", "app.other.com", false},
 		{"Different host", "app.example.com", "other.example.com", false},
+		{"Empty host matches any hostname", "", "other.example.com", true},
 	}
 
 	for _, test := range tests {
@@ -238,3 +332,21 @@ func TestKubernetesHostMatching(t *testing.T) {
 		})
 	}
 }
+
+func TestKubernetesHostCoversName(t *testing.T) {
+	tests := []struct {
+		host string
+		name string
+		want bool
+	}{
+		{"", "dashboard", true},
+		{"dashboard.example.com", "dashboard", true},
+		{"Dashboard.example.com", "dashboard", true},
+		{"*.example.com", "dashboard", true},
+		{"other.example.com", "dashboard", false},
+	}
+
+	for _, test := range tests {
+		assert.Equal(t, test.want, hostCoversName(test.host, test.name))
+	}
+}