gitea-mcp/cmd/gitea-mcp/healthz_live_test.go

package main

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/stretchr/testify/require"
)

// readinessFunc is what the handler asks. Named here so the test can drive it.
type fakeReadiness struct{ calls int }

// ready reports not-ready on the first call and ready afterwards — the shape of
// an IdP that was down when the process booted and came back a minute later.
func (f *fakeReadiness) ready(context.Context) (bool, error) {
	f.calls++
	if f.calls == 1 {
		return false, errBoot
	}
	return true, nil
}

var errBoot = &bootErr{}

type bootErr struct{}

func (*bootErr) Error() string { return "oidc discovery: status 503" }

// A health endpoint that answers from a value captured at startup is not a
// health endpoint.
//
// newHealthzHandler marshalled its body ONCE and served the same bytes for the
// process lifetime. On 2026-09-14 gitea-mcp reported jwt.status=degraded for six
// days after Authentik recovered, because the answer had been computed before
// Authentik was up and could never change. The pod was 1/1 Running and
// readiness-green throughout.
//
// Fixing mcp-chassis#4 alone does not fix this: the validator would recover and
// /healthz would keep saying degraded.
func TestHealthz_ReflectsCurrentState_NotBootState(t *testing.T) {
	f := &fakeReadiness{}
	h := newHealthzHandler(true, f.ready)

	first := decodeHealth(t, h)
	require.Equal(t, "degraded", first.JWT.Status, "first call: issuer still down")
	require.NotEmpty(t, first.JWT.LastError, "degraded must say why")

	second := decodeHealth(t, h)
	require.Equal(t, "enabled", second.JWT.Status,
		"the issuer recovered; /healthz must notice without a restart")
	require.Empty(t, second.JWT.LastError)

	require.Equal(t, 2, f.calls, "readiness must be evaluated per request, not cached at startup")
}

// With no issuer configured, JWT auth is disabled by choice and readiness is
// never consulted — a static-token-only server must not be reported degraded.
func TestHealthz_NoIssuer_IsDisabledNotDegraded(t *testing.T) {
	f := &fakeReadiness{}
	h := newHealthzHandler(false, f.ready)

	got := decodeHealth(t, h)
	require.Equal(t, "disabled", got.JWT.Status)
	require.Zero(t, f.calls, "no issuer configured means nothing to probe")
}

// readyz is what the kubelet probes. It must FAIL while JWT auth is degraded, so
// k8s stops routing to a pod that will 401 every OAuth caller — and so the
// probe's own cadence becomes the retry loop.
func TestReadyz_FailsWhileDegraded_ThenPasses(t *testing.T) {
	f := &fakeReadiness{}
	h := newReadyzHandler(true, f.ready)

	rec := httptest.NewRecorder()
	h(rec, httptest.NewRequest(http.MethodGet, "/readyz", nil))
	require.Equal(t, http.StatusServiceUnavailable, rec.Code,
		"a pod that cannot validate any JWT must not be in the Service")

	rec = httptest.NewRecorder()
	h(rec, httptest.NewRequest(http.MethodGet, "/readyz", nil))
	require.Equal(t, http.StatusOK, rec.Code, "recovered without a restart")
}

// A static-token-only server is always ready. Making readyz depend on an issuer
// it was never given would take every static-only MCP out of its Service.
func TestReadyz_NoIssuer_AlwaysReady(t *testing.T) {
	f := &fakeReadiness{}
	h := newReadyzHandler(false, f.ready)

	rec := httptest.NewRecorder()
	h(rec, httptest.NewRequest(http.MethodGet, "/readyz", nil))
	require.Equal(t, http.StatusOK, rec.Code)
	require.Zero(t, f.calls)
}

func decodeHealth(t *testing.T, h http.HandlerFunc) healthStatus {
	t.Helper()
	rec := httptest.NewRecorder()
	h(rec, httptest.NewRequest(http.MethodGet, "/healthz", nil))
	var got healthStatus
	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
	return got
}