From 64cf54fef566bc48384a6059e8d885ee639d2b23 Mon Sep 17 00:00:00 2001
From: Lorenzo Felletti <lorenzo97.felletti@gmail.com>
Date: Sat, 21 Feb 2026 16:06:00 +0000
Subject: [PATCH 1/2] test(api): add findAuthSecret test

---
 api/includes.go |  2 +-
 api/krm_test.go | 98 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 99 insertions(+), 1 deletion(-)

diff --git a/api/includes.go b/api/includes.go
index 0bbbf37..3477976 100644
--- a/api/includes.go
+++ b/api/includes.go
@@ -51,7 +51,7 @@ func (i Includes) initialiseMap(include *kyaml.RNode) {
 	}
 }
 
-// toMap converts a kyaml.RNode YAML contento to a map[string]interface{}.
+// toMap converts a kyaml.RNode YAML content to a map[string]interface{}.
 func toMap(include *kyaml.RNode) (map[string]interface{}, error) {
 	marshalled, err := include.MarshalJSON()
 	if err != nil {
diff --git a/api/krm_test.go b/api/krm_test.go
index 50f89ff..42674de 100644
--- a/api/krm_test.go
+++ b/api/krm_test.go
@@ -4,7 +4,11 @@ import (
 	"testing"
 
 	"github.com/Workday/cuestomize/internal/pkg/testhelpers"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/resid"
+	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 const (
@@ -63,3 +67,97 @@ func TestKRMInput_ExtractIncludes(t *testing.T) {
 		})
 	}
 }
+
+func TestFindAuthSecret(t *testing.T) {
+	tests := []struct {
+		name          string
+		selector      types.Selector
+		items         []*kyaml.RNode
+		expectedName  string
+		expectedError string
+	}{
+		{
+			name: "selector kind is not Secret",
+			selector: types.Selector{
+				ResId: resid.ResId{
+					Gvk: resid.Gvk{Kind: "ConfigMap"},
+				},
+			},
+			items:         []*kyaml.RNode{},
+			expectedError: `kind must be Secret, got: "ConfigMap"`,
+		},
+		{
+			name: "secret not found",
+			selector: types.Selector{
+				ResId: resid.ResId{
+					Gvk: resid.Gvk{Kind: "Secret"}, Name: "my-secret",
+				},
+			},
+			items: []*kyaml.RNode{
+				createTestNode(t, "v1", "Secret", "default", "other-secret"),
+			},
+			expectedError: "no items matched for selector",
+		},
+		{
+			name: "secret found by name",
+			selector: types.Selector{
+				ResId: resid.ResId{
+					Gvk: resid.Gvk{Kind: "Secret"}, Name: "my-secret",
+				},
+			},
+			items: []*kyaml.RNode{
+				createTestNode(t, "v1", "Secret", "default", "other-secret"),
+				createTestNode(t, "v1", "Secret", "default", "my-secret"),
+			},
+			expectedName: "my-secret",
+		},
+		{
+			name: "secret found by name and namespace",
+			selector: types.Selector{
+				ResId: resid.ResId{
+					Gvk:       resid.Gvk{Kind: "Secret"},
+					Name:      "my-secret",
+					Namespace: "my-ns",
+				},
+			},
+			items: []*kyaml.RNode{
+				createTestNode(t, "v1", "Secret", "default", "my-secret"),
+				createTestNode(t, "v1", "Secret", "my-ns", "my-secret"),
+			},
+			expectedName: "my-secret",
+		},
+		{
+			name: "secret found by label",
+			selector: types.Selector{
+				ResId:         resid.ResId{Gvk: resid.Gvk{Kind: "Secret"}},
+				LabelSelector: "app=my-app",
+			},
+			items: []*kyaml.RNode{
+				func() *kyaml.RNode {
+					node := createTestNode(t, "v1", "Secret", "default", "labeled-secret")
+					node.SetLabels(map[string]string{"app": "my-app"})
+					return node
+				}(),
+			},
+			expectedName: "labeled-secret",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			secret, err := findAuthSecret(&tt.selector, tt.items)
+			if tt.expectedError != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.expectedError)
+				assert.Nil(t, secret)
+			} else {
+				require.NoError(t, err)
+				assert.NotNil(t, secret)
+				assert.Equal(t, tt.expectedName, secret.Name)
+				if tt.selector.Namespace != "" {
+					assert.Equal(t, tt.selector.Namespace, secret.Namespace)
+				}
+			}
+		})
+	}
+}

From 2cdf8204849d0de71aee462234524c2af94424dd Mon Sep 17 00:00:00 2001
From: Lorenzo Felletti <lorenzo97.felletti@gmail.com>
Date: Sat, 21 Feb 2026 16:15:36 +0000
Subject: [PATCH 2/2] lint suggestion

---
 api/krm_test.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/api/krm_test.go b/api/krm_test.go
index 42674de..fb56739 100644
--- a/api/krm_test.go
+++ b/api/krm_test.go
@@ -134,8 +134,9 @@ func TestFindAuthSecret(t *testing.T) {
 			},
 			items: []*kyaml.RNode{
 				func() *kyaml.RNode {
+					t.Helper()
 					node := createTestNode(t, "v1", "Secret", "default", "labeled-secret")
-					node.SetLabels(map[string]string{"app": "my-app"})
+					require.NoError(t, node.SetLabels(map[string]string{"app": "my-app"}))
 					return node
 				}(),
 			},