feat(rover): implement PatchAuthentication to map clientAuthMethod values

rover-ctl/pkg/handlers/v0/rover.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"maps"
 	"net/http"
+	"strings"
 
 	"github.com/pkg/errors"
 	"github.com/telekom/controlplane/rover-ctl/pkg/handlers/common"
@@ -67,10 +68,59 @@ func PatchRoverRequest(ctx context.Context, obj types.Object) error {
 		}
 	}
 
+	PatchAuthentication(spec)
+
 	obj.SetContent(spec)
 	return nil
 }
 
+// clientAuthMethodMapping maps rover-ctl YAML values to rover-server API enum values.
+var clientAuthMethodMapping = map[string]string{
+	"basic": "BASIC",
+	"body":  "POST", // Configures client authentication method, according to RFC 6749
+}
+
+// PatchAuthentication maps spec.authentication.m2m.clientAuthMethod from the rover-ctl
+// YAML format (basic/body) to the rover-server API format (BASIC/POST) and restructures
+// it into spec.authentication.clientAuthMethod.
+func PatchAuthentication(spec map[string]any) {
+	auth, exists := spec["authentication"]
+	if !exists {
+		return
+	}
+	authMap, ok := auth.(map[string]any)
+	if !ok {
+		return
+	}
+
+	m2m, exists := authMap["m2m"]
+	if !exists {
+		return
+	}
+	m2mMap, ok := m2m.(map[string]any)
+	if !ok {
+		return
+	}
+
+	clientAuthMethod, exists := m2mMap["clientAuthMethod"]
+	if !exists {
+		return
+	}
+	clientAuthMethodStr, ok := clientAuthMethod.(string)
+	if !ok {
+		return
+	}
+
+	apiValue, valid := clientAuthMethodMapping[strings.ToLower(clientAuthMethodStr)]
+	if !valid {
+		return
+	}
+
+	spec["authentication"] = map[string]any{
+		"clientAuthMethod": apiValue,
+	}
+}
+
 func PatchExposures(exposures []any) []map[string]any {
 	if len(exposures) == 0 {
 		return nil

rover-ctl/pkg/handlers/v0/rover_test.go

@@ -381,6 +381,122 @@ var _ = Describe("Rover Handler", func() {
 		})
 	})
 
+	Describe("PatchAuthentication", func() {
+		It("should map 'basic' to 'BASIC' in authentication.clientAuthMethod", func() {
+			obj := &types.UnstructuredObject{
+				Content: map[string]any{
+					"spec": map[string]any{
+						"authentication": map[string]any{
+							"m2m": map[string]any{
+								"clientAuthMethod": "basic",
+							},
+						},
+					},
+				},
+			}
+
+			err := v0.PatchRoverRequest(context.Background(), obj)
+			Expect(err).NotTo(HaveOccurred())
+
+			content := obj.GetContent()
+			auth, ok := content["authentication"].(map[string]any)
+			Expect(ok).To(BeTrue())
+			Expect(auth["clientAuthMethod"]).To(Equal("BASIC"))
+		})
+
+		It("should map 'body' to 'POST' in authentication.clientAuthMethod", func() {
+			obj := &types.UnstructuredObject{
+				Content: map[string]any{
+					"spec": map[string]any{
+						"authentication": map[string]any{
+							"m2m": map[string]any{
+								"clientAuthMethod": "body",
+							},
+						},
+					},
+				},
+			}
+
+			err := v0.PatchRoverRequest(context.Background(), obj)
+			Expect(err).NotTo(HaveOccurred())
+
+			content := obj.GetContent()
+			auth, ok := content["authentication"].(map[string]any)
+			Expect(ok).To(BeTrue())
+			Expect(auth["clientAuthMethod"]).To(Equal("POST"))
+		})
+
+		It("should not add authentication when it is missing", func() {
+			obj := &types.UnstructuredObject{
+				Content: map[string]any{
+					"spec": map[string]any{},
+				},
+			}
+
+			err := v0.PatchRoverRequest(context.Background(), obj)
+			Expect(err).NotTo(HaveOccurred())
+
+			content := obj.GetContent()
+			Expect(content).NotTo(HaveKey("authentication"))
+		})
+
+		It("should leave authentication untouched when clientAuthMethod has invalid value", func() {
+			obj := &types.UnstructuredObject{
+				Content: map[string]any{
+					"spec": map[string]any{
+						"authentication": map[string]any{
+							"m2m": map[string]any{
+								"clientAuthMethod": "invalid",
+							},
+						},
+					},
+				},
+			}
+
+			err := v0.PatchRoverRequest(context.Background(), obj)
+			Expect(err).NotTo(HaveOccurred())
+
+			content := obj.GetContent()
+			Expect(content).To(HaveKey("authentication"))
+		})
+
+		It("should leave authentication untouched when format is not a map", func() {
+			obj := &types.UnstructuredObject{
+				Content: map[string]any{
+					"spec": map[string]any{
+						"authentication": "not a map",
+					},
+				},
+			}
+
+			err := v0.PatchRoverRequest(context.Background(), obj)
+			Expect(err).NotTo(HaveOccurred())
+
+			content := obj.GetContent()
+			Expect(content).To(HaveKey("authentication"))
+		})
+
+		It("should leave authentication untouched when already in rover-server format", func() {
+			obj := &types.UnstructuredObject{
+				Content: map[string]any{
+					"spec": map[string]any{
+						"authentication": map[string]any{
+							"clientAuthMethod": "BASIC",
+						},
+					},
+				},
+			}
+
+			err := v0.PatchRoverRequest(context.Background(), obj)
+			Expect(err).NotTo(HaveOccurred())
+
+			content := obj.GetContent()
+			auth, ok := content["authentication"].(map[string]any)
+			Expect(ok).To(BeTrue())
+			Expect(auth["clientAuthMethod"]).To(Equal("BASIC"))
+		})
+	})
+
 	Describe("ResetSecret", func() {
 		It("should send a reset secret request and return new credentials", func() {
 			// Configure mock to return successful response

rover-server/internal/controller/__snapshots__/suite_controller_test.snap

@@ -1035,3 +1035,79 @@
  "team": "hyperion"
 }
 ---
+
+[Rover Controller Update rover resource should accept clientAuthMethod BASIC as produced by rover-ctl - 1]
+{
+ "exposures": [
+  {
+   "approval": "SIMPLE",
+   "basePath": "/eni/distr/v1",
+   "type": "api",
+   "upstream": "https://httpbin.org/anything",
+   "visibility": "WORLD"
+  }
+ ],
+ "id": "eni--hyperion--rover-local-sub",
+ "name": "rover-local-sub",
+ "status": {
+  "errors": [
+   {
+    "cause": "NoApproval",
+    "message": "Approval is either rejected or suspended"
+   }
+  ],
+  "processingState": "done",
+  "state": "blocked",
+  "warnings": [
+   {
+    "message": "Atleast one sub-resource is being processed"
+   }
+  ]
+ },
+ "subscriptions": [
+  {
+   "basePath": "/eni/distr/v1",
+   "type": "api"
+  }
+ ],
+ "zone": "dataplane1"
+}
+---
+
+[Rover Controller Update rover resource should accept clientAuthMethod POST as produced by rover-ctl - 1]
+{
+ "exposures": [
+  {
+   "approval": "SIMPLE",
+   "basePath": "/eni/distr/v1",
+   "type": "api",
+   "upstream": "https://httpbin.org/anything",
+   "visibility": "WORLD"
+  }
+ ],
+ "id": "eni--hyperion--rover-local-sub",
+ "name": "rover-local-sub",
+ "status": {
+  "errors": [
+   {
+    "cause": "NoApproval",
+    "message": "Approval is either rejected or suspended"
+   }
+  ],
+  "processingState": "done",
+  "state": "blocked",
+  "warnings": [
+   {
+    "message": "Atleast one sub-resource is being processed"
+   }
+  ]
+ },
+ "subscriptions": [
+  {
+   "basePath": "/eni/distr/v1",
+   "type": "api"
+  }
+ ],
+ "zone": "dataplane1"
+}
+---

rover-server/internal/controller/rover_test.go

@@ -221,6 +221,32 @@ var _ = Describe("Rover Controller", func() {
 			responseGroup, err := ExecuteRequest(req, groupToken)
 			ExpectStatusWithBody(responseGroup, err, http.StatusForbidden, "application/problem+json")
 		})
+
+		It("should accept clientAuthMethod BASIC as produced by rover-ctl", func() {
+			body := api.RoverUpdateRequest{
+				Zone: "dataplane1",
+				Authentication: api.Authentication{
+					ClientAuthMethod: api.BASIC,
+				},
+			}
+			jsonBody, _ := json.Marshal(body)
+			req := httptest.NewRequest(http.MethodPut, "/rovers/eni--hyperion--rover-local-sub", bytes.NewReader(jsonBody))
+			responseGroup, err := ExecuteRequest(req, groupToken)
+			ExpectStatusWithBody(responseGroup, err, http.StatusAccepted, "application/json")
+		})
+
+		It("should accept clientAuthMethod POST as produced by rover-ctl", func() {
+			body := api.RoverUpdateRequest{
+				Zone: "dataplane1",
+				Authentication: api.Authentication{
+					ClientAuthMethod: api.POST,
+				},
+			}
+			jsonBody, _ := json.Marshal(body)
+			req := httptest.NewRequest(http.MethodPut, "/rovers/eni--hyperion--rover-local-sub", bytes.NewReader(jsonBody))
+			responseGroup, err := ExecuteRequest(req, groupToken)
+			ExpectStatusWithBody(responseGroup, err, http.StatusAccepted, "application/json")
+		})
 	})
 
 	Context("Reset rover secret", func() {