test: add unit tests for core logic (Phase 4.1 - partial)

Implemented comprehensive unit tests for Result type system, retry logic,
and validators. Using Vitest framework with 36/39 tests passing.

Tests Created:
- types.test.ts - Result type system (22 tests) ✅
  - Ok/Err creation
  - Type narrowing with discriminated unions
  - tryCatch/tryCatchAsync helpers
  - Pattern matching examples
  - Chained operations

- retry.test.ts - Exponential backoff (14 tests) ✅
  - Success on first attempt
  - Retry on failure
  - Exponential backoff with jitter
  - Error aggregation
  - Edge cases (null values, empty errors)
  - Default options

- validators.test.ts - Input validation (3 failed due to localStorage mock)
  - Secret name validation
  - Namespace validation
  - Secret key validation
  - Secret value validation
  - PEM certificate validation

Test Framework:
- Vitest 3.2.4 (via Headlamp plugin)
- Fake timers for retry tests
- Mock functions for async operations

Test Coverage:
- Result types: 100% (22/22 passing)
- Retry logic: 100% (14/14 passing)
- Validators: Partial (localStorage mocking issue)

Next Steps:
- Fix validators test localStorage mock
- Add crypto function tests
- Add hook tests (requires React testing library)
- Add component tests

Progress: Phase 4.1 partially complete
Test Files: 2/3 passing (36/39 tests)

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

headlamp-sealed-secrets/src/lib/retry.test.ts

@@ -0,0 +1,224 @@
+/**
+ * Unit tests for retry logic
+ *
+ * Tests exponential backoff with jitter
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { retryWithBackoff } from './retry';
+
+describe('retry logic', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  describe('retryWithBackoff', () => {
+    it('should return result on first success', async () => {
+      const successFn = vi.fn().mockResolvedValue({ ok: true, value: 'success' });
+
+      const promise = retryWithBackoff(successFn, { maxAttempts: 3, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.value).toBe('success');
+      }
+      expect(successFn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should retry on failure', async () => {
+      const failTwiceThenSucceed = vi
+        .fn()
+        .mockResolvedValueOnce({ ok: false, error: 'error1' })
+        .mockResolvedValueOnce({ ok: false, error: 'error2' })
+        .mockResolvedValueOnce({ ok: true, value: 'success' });
+
+      const promise = retryWithBackoff(failTwiceThenSucceed, { maxAttempts: 3, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.value).toBe('success');
+      }
+      expect(failTwiceThenSucceed).toHaveBeenCalledTimes(3);
+    });
+
+    it('should return aggregated error after max attempts', async () => {
+      const alwaysFail = vi.fn().mockResolvedValue({ ok: false, error: 'persistent error' });
+
+      const promise = retryWithBackoff(alwaysFail, { maxAttempts: 3, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(false);
+      if (result.ok === false) {
+        expect(result.error).toContain('Operation failed after 3 attempts');
+        expect(result.error).toContain('persistent error');
+      }
+      expect(alwaysFail).toHaveBeenCalledTimes(3);
+    });
+
+    it('should apply exponential backoff', async () => {
+      const failTwiceThenSucceed = vi
+        .fn()
+        .mockResolvedValueOnce({ ok: false, error: 'error1' })
+        .mockResolvedValueOnce({ ok: false, error: 'error2' })
+        .mockResolvedValueOnce({ ok: true, value: 'success' });
+
+      const promise = retryWithBackoff(failTwiceThenSucceed, { maxAttempts: 3, initialDelayMs: 1000 });
+
+      // Fast-forward through retries
+      await vi.runAllTimersAsync();
+      await promise;
+
+      // Should have been called 3 times (initial + 2 retries)
+      expect(failTwiceThenSucceed).toHaveBeenCalledTimes(3);
+    });
+
+    it('should handle function that throws', async () => {
+      const throwingFn = vi.fn().mockRejectedValue(new Error('Network error'));
+
+      const promise = retryWithBackoff(throwingFn, { maxAttempts: 3, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(false);
+      if (result.ok === false) {
+        expect(result.error).toContain('Network error');
+      }
+      expect(throwingFn).toHaveBeenCalledTimes(3);
+    });
+
+    it('should retry exactly maxAttempts times', async () => {
+      const alwaysFail = vi.fn().mockResolvedValue({ ok: false, error: 'error' });
+
+      const promise = retryWithBackoff(alwaysFail, { maxAttempts: 5, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      await promise;
+
+      expect(alwaysFail).toHaveBeenCalledTimes(5);
+    });
+
+    it('should handle single attempt', async () => {
+      const failOnce = vi.fn().mockResolvedValue({ ok: false, error: 'error' });
+
+      const promise = retryWithBackoff(failOnce, { maxAttempts: 1, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(false);
+      expect(failOnce).toHaveBeenCalledTimes(1);
+    });
+
+    it('should apply jitter to delay', async () => {
+      // Mock Math.random to return predictable values
+      const originalRandom = Math.random;
+      let callCount = 0;
+      Math.random = () => {
+        callCount++;
+        return callCount === 1 ? 0.5 : 0.8; // Different jitter values
+      };
+
+      const failTwice = vi
+        .fn()
+        .mockResolvedValueOnce({ ok: false, error: 'error1' })
+        .mockResolvedValueOnce({ ok: false, error: 'error2' })
+        .mockResolvedValueOnce({ ok: true, value: 'success' });
+
+      const promise = retryWithBackoff(failTwice, { maxAttempts: 3, initialDelayMs: 1000 });
+      await vi.runAllTimersAsync();
+      await promise;
+
+      Math.random = originalRandom;
+      expect(failTwice).toHaveBeenCalledTimes(3);
+    });
+
+    it('should work with different base delays', async () => {
+      const failOnce = vi
+        .fn()
+        .mockResolvedValueOnce({ ok: false, error: 'error' })
+        .mockResolvedValueOnce({ ok: true, value: 'success' });
+
+      // Test with 500ms base delay
+      const promise = retryWithBackoff(failOnce, { maxAttempts: 2, initialDelayMs: 500 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(true);
+      expect(failOnce).toHaveBeenCalledTimes(2);
+    });
+
+    it('should preserve error messages in aggregate', async () => {
+      const specificError = vi.fn().mockResolvedValue({
+        ok: false,
+        error: 'Certificate expired on 2024-01-01',
+      });
+
+      const promise = retryWithBackoff(specificError, { maxAttempts: 2, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(false);
+      if (result.ok === false) {
+        expect(result.error).toContain('Certificate expired on 2024-01-01');
+        expect(result.error).toContain('2024-01-01');
+      }
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle immediate success', async () => {
+      const immediate = vi.fn().mockResolvedValue({ ok: true, value: 42 });
+
+      const result = await retryWithBackoff(immediate, { maxAttempts: 1, initialDelayMs: 100 });
+
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.value).toBe(42);
+      }
+      expect(immediate).toHaveBeenCalledTimes(1);
+    });
+
+    it('should handle null values', async () => {
+      const nullValue = vi.fn().mockResolvedValue({ ok: true, value: null });
+
+      const result = await retryWithBackoff(nullValue, { maxAttempts: 3, initialDelayMs: 100 });
+
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.value).toBe(null);
+      }
+    });
+
+    it('should handle empty error messages', async () => {
+      const emptyError = vi.fn().mockResolvedValue({ ok: false, error: '' });
+
+      const promise = retryWithBackoff(emptyError, { maxAttempts: 2, initialDelayMs: 100 });
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result.ok).toBe(false);
+      if (result.ok === false) {
+        expect(result.error).toContain('Operation failed');
+      }
+    });
+
+    it('should use default options when not provided', async () => {
+      const successFn = vi.fn().mockResolvedValue({ ok: true, value: 'default success' });
+
+      const result = await retryWithBackoff(successFn);
+
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.value).toBe('default success');
+      }
+    });
+  });
+});

headlamp-sealed-secrets/src/lib/validators.test.ts

@@ -0,0 +1,217 @@
+/**
+ * Unit tests for validators
+ *
+ * Tests validation functions for Kubernetes names, secret keys, and values
+ */
+
+// Mock localStorage before importing any modules that might use it
+const localStorageMock = {
+  getItem: () => null,
+  setItem: () => {},
+  removeItem: () => {},
+  clear: () => {},
+};
+(global as any).localStorage = localStorageMock;
+
+import { describe, expect, it } from 'vitest';
+import {
+  validateNamespace,
+  validatePEMCertificate,
+  validateSecretKey,
+  validateSecretName,
+  validateSecretValue,
+} from './validators';
+
+describe('validators', () => {
+  describe('validateSecretName', () => {
+    it('should accept valid Kubernetes names', () => {
+      expect(validateSecretName('my-secret').valid).toBe(true);
+      expect(validateSecretName('secret-123').valid).toBe(true);
+      expect(validateSecretName('a').valid).toBe(true);
+      expect(validateSecretName('test-secret-name').valid).toBe(true);
+      expect(validateSecretName('x'.repeat(253)).valid).toBe(true); // Max length
+    });
+
+    it('should reject names with uppercase letters', () => {
+      const result = validateSecretName('My-Secret');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('lowercase');
+    });
+
+    it('should reject names starting with hyphen', () => {
+      const result = validateSecretName('-secret');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('start and end with an alphanumeric');
+    });
+
+    it('should reject names ending with hyphen', () => {
+      const result = validateSecretName('secret-');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('start and end with an alphanumeric');
+    });
+
+    it('should reject names with underscores', () => {
+      const result = validateSecretName('secret_name');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('lowercase alphanumeric characters or hyphens');
+    });
+
+    it('should reject empty names', () => {
+      const result = validateSecretName('');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('Name is required');
+    });
+
+    it('should reject names exceeding 253 characters', () => {
+      const result = validateSecretName('x'.repeat(254));
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('253 characters');
+    });
+
+    it('should reject names with special characters', () => {
+      expect(validateSecretName('secret@name').valid).toBe(false);
+      expect(validateSecretName('secret.name').valid).toBe(false);
+      expect(validateSecretName('secret:name').valid).toBe(false);
+      expect(validateSecretName('secret name').valid).toBe(false);
+    });
+
+    it('should reject names starting with numbers followed by hyphen', () => {
+      const result = validateSecretName('123-secret');
+      expect(result.valid).toBe(true); // This is actually valid
+    });
+  });
+
+  describe('validateNamespace', () => {
+    it('should accept valid namespace names', () => {
+      expect(validateNamespace('default').valid).toBe(true);
+      expect(validateNamespace('kube-system').valid).toBe(true);
+      expect(validateNamespace('my-namespace').valid).toBe(true);
+      expect(validateNamespace('ns-123').valid).toBe(true);
+    });
+
+    it('should reject invalid namespace names', () => {
+      expect(validateNamespace('').valid).toBe(false);
+      expect(validateNamespace('My-Namespace').valid).toBe(false);
+      expect(validateNamespace('-namespace').valid).toBe(false);
+      expect(validateNamespace('namespace-').valid).toBe(false);
+      expect(validateNamespace('namespace_name').valid).toBe(false);
+    });
+
+    it('should reject namespaces exceeding 63 characters', () => {
+      const result = validateNamespace('x'.repeat(64));
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('63 characters');
+    });
+  });
+
+  describe('validateSecretKey', () => {
+    it('should accept valid secret keys', () => {
+      expect(validateSecretKey('password').valid).toBe(true);
+      expect(validateSecretKey('api-key').valid).toBe(true);
+      expect(validateSecretKey('api_key').valid).toBe(true);
+      expect(validateSecretKey('api.key').valid).toBe(true);
+      expect(validateSecretKey('API_KEY').valid).toBe(true);
+      expect(validateSecretKey('key123').valid).toBe(true);
+      expect(validateSecretKey('_key').valid).toBe(true);
+      expect(validateSecretKey('.key').valid).toBe(true);
+    });
+
+    it('should reject empty keys', () => {
+      const result = validateSecretKey('');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('Key name is required');
+    });
+
+    it('should reject keys with invalid characters', () => {
+      expect(validateSecretKey('key@name').valid).toBe(false);
+      expect(validateSecretKey('key name').valid).toBe(false);
+      expect(validateSecretKey('key:name').valid).toBe(false);
+      expect(validateSecretKey('key/name').valid).toBe(false);
+    });
+
+    it('should reject keys exceeding 253 characters', () => {
+      const result = validateSecretKey('x'.repeat(254));
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('253 characters');
+    });
+  });
+
+  describe('validateSecretValue', () => {
+    it('should accept non-empty values', () => {
+      expect(validateSecretValue('password123').valid).toBe(true);
+      expect(validateSecretValue('a').valid).toBe(true);
+      expect(validateSecretValue(' ').valid).toBe(true); // Space is valid
+      expect(validateSecretValue('multi\nline\nvalue').valid).toBe(true);
+      expect(validateSecretValue('special!@#$%^&*()chars').valid).toBe(true);
+    });
+
+    it('should reject empty values', () => {
+      const result = validateSecretValue('');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('Value is required');
+    });
+
+    it('should accept large values', () => {
+      const largeValue = 'x'.repeat(10000);
+      expect(validateSecretValue(largeValue).valid).toBe(true);
+    });
+
+    it('should warn about very large values', () => {
+      const veryLargeValue = 'x'.repeat(1000000); // 1MB
+      const result = validateSecretValue(veryLargeValue);
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('1MB');
+    });
+  });
+
+  describe('validatePEMCertificate', () => {
+    const validPEM = `-----BEGIN CERTIFICATE-----
+MIIBkTCB+wIJAKHHCgVZU1M0MA0GCSqGSIb3DQEBCwUAMBExDzANBgNVBAMMBnRl
+c3RjYTAeFw0yNDAxMDEwMDAwMDBaFw0yNTAxMDEwMDAwMDBaMBExDzANBgNVBAMM
+BnRlc3RjYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwKX5UvKZU8rKFXJN
+uTGBGGfLYmNHJ6U3kS7hVf8TQPKqKqEQ7vVwVnDFPFLPmqDYnVQH2hN4Z6YpXqKY
+KKKKKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKq
+KqKqKqKqKqKqKqKqKqKqKqIBAgMBAAEwDQYJKoZIhvcNAQELBQADgYEAoKKKKqKq
+KqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKq
+KqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKq
+KqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKq
+KqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKq
+KqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKqKq
+-----END CERTIFICATE-----`;
+
+    it('should accept valid PEM certificates', () => {
+      expect(validatePEMCertificate(validPEM).valid).toBe(true);
+    });
+
+    it('should reject empty certificates', () => {
+      const result = validatePEMCertificate('');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('required');
+    });
+
+    it('should reject certificates without BEGIN marker', () => {
+      const invalidPEM = validPEM.replace('-----BEGIN CERTIFICATE-----', '');
+      const result = validatePEMCertificate(invalidPEM);
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('BEGIN CERTIFICATE');
+    });
+
+    it('should reject certificates without END marker', () => {
+      const invalidPEM = validPEM.replace('-----END CERTIFICATE-----', '');
+      const result = validatePEMCertificate(invalidPEM);
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('END CERTIFICATE');
+    });
+
+    it('should reject non-PEM text', () => {
+      const result = validatePEMCertificate('This is not a PEM certificate');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('valid PEM');
+    });
+
+    it('should accept PEM with extra whitespace', () => {
+      const pemWithWhitespace = '\n\n' + validPEM + '\n\n';
+      expect(validatePEMCertificate(pemWithWhitespace).valid).toBe(true);
+    });
+  });
+});