ContainerImage.Pinniped/internal/registry/clientsecretrequest/rest_test.go

// Copyright 2022 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0

package clientsecretrequest

import (
	"bytes"
	"context"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"strings"
	"testing"

	"github.com/stretchr/testify/require"
	corev1 "k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apimachinery/pkg/types"
	genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
	"k8s.io/apiserver/pkg/registry/rest"
	kubefake "k8s.io/client-go/kubernetes/fake"
	coretesting "k8s.io/client-go/testing"
	"k8s.io/klog/v2"

	clientsecretapi "go.pinniped.dev/generated/latest/apis/supervisor/clientsecret"
	"go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
	supervisorfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
	"go.pinniped.dev/internal/oidcclientsecretstorage"
	"go.pinniped.dev/internal/plog"
)

func TestNew(t *testing.T) {
	r := NewREST(
		schema.GroupResource{Group: "bears", Resource: "panda"},
		nil,
		nil,
		"foobar",
		4,
		nil,
		nil,
		nil,
	)

	require.NotNil(t, r)
	require.True(t, r.NamespaceScoped())
	require.Equal(t, []string{"pinniped"}, r.Categories())

	require.IsType(t, &clientsecretapi.OIDCClientSecretRequest{}, r.New())
	require.IsType(t, &clientsecretapi.OIDCClientSecretRequestList{}, r.NewList())

	ctx := context.Background()

	// check the simple invariants of our no-op list
	list, err := r.List(ctx, nil)
	require.NoError(t, err)
	require.NotNil(t, list)
	require.IsType(t, &clientsecretapi.OIDCClientSecretRequestList{}, list)
	require.Equal(t, "0", list.(*clientsecretapi.OIDCClientSecretRequestList).ResourceVersion)
	require.NotNil(t, list.(*clientsecretapi.OIDCClientSecretRequestList).Items)
	require.Len(t, list.(*clientsecretapi.OIDCClientSecretRequestList).Items, 0)

	// make sure we can turn lists into tables if needed
	table, err := r.ConvertToTable(ctx, list, nil)
	require.NoError(t, err)
	require.NotNil(t, table)
	require.Equal(t, "0", table.ResourceVersion)
	require.Nil(t, table.Rows)

	// exercise group resource - force error by passing a runtime.Object that does not have an embedded object meta
	_, err = r.ConvertToTable(ctx, &metav1.APIGroup{}, nil)
	require.Error(t, err, "the resource panda.bears does not support being converted to a Table")
}

func TestCreate(t *testing.T) {
	type wantHashes struct {
		UID    string
		hashes []string
	}
	type args struct {
		ctx              context.Context
		obj              runtime.Object
		createValidation rest.ValidateObjectFunc
		options          *metav1.CreateOptions
	}
	namespace := "some-namespace"
	namespacedContext := genericapirequest.WithNamespace(
		genericapirequest.WithRequestInfo(
			genericapirequest.NewContext(),
			&genericapirequest.RequestInfo{
				APIGroup:   "clientsecret.supervisor.pinniped.dev",
				APIVersion: "v1alpha1",
				Resource:   "oidcclientsecretrequests",
			},
		),
		namespace,
	)

	fakeRandomBytes := "0123456789abcdefghijklmnopqrstuv"
	fakeHexEncodedRandomBytes := hex.EncodeToString([]byte(fakeRandomBytes))
	fakeBcryptRandomBytes := fakeHexEncodedRandomBytes + ":4-fake-hash"

	fakeNow := metav1.Now()
	fakeTimeNowFunc := func() metav1.Time { return fakeNow }

	tests := []struct {
		name              string
		args              args
		seedOIDCClients   []*v1alpha1.OIDCClient
		seedHashes        func(storage *oidcclientsecretstorage.OIDCClientSecretStorage)
		addReactors       func(*kubefake.Clientset, *supervisorfake.Clientset)
		fakeByteGenerator io.Reader
		fakeHasher        byteHasher
		want              runtime.Object
		wantErrStatus     *metav1.Status
		wantHashes        *wantHashes
		wantLogLines      []string
	}{
		{
			name: "wrong type of request object provided",
			args: args{
				ctx: namespacedContext,
				obj: &metav1.Status{},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `not an OIDCClientSecretRequest: &v1.Status{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ` +
					`ListMeta:v1.ListMeta{SelfLink:"", ResourceVersion:"", Continue:"", RemainingItemCount:(*int64)(nil)},` +
					` Status:"", Message:"", Reason:"", Details:(*v1.StatusDetails)(nil), Code:0}`,
				Reason: metav1.StatusReasonBadRequest,
				Code:   http.StatusBadRequest,
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:not an OIDCClientSecretRequest`,
				`END`,
			},
		},
		{
			name: "bad options for dry run",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client-name",
					},
				},
				options: &metav1.CreateOptions{DryRun: []string{"stuff"}},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "client.oauth.pinniped.dev-some-client-name" ` +
					`is invalid: dryRun: Unsupported value: []string{"stuff"}`,
				Reason: metav1.StatusReasonInvalid,
				Code:   http.StatusUnprocessableEntity,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "OIDCClientSecretRequest",
					Name:  "client.oauth.pinniped.dev-some-client-name",
					Causes: []metav1.StatusCause{{
						Type:    "FieldValueNotSupported",
						Message: "Unsupported value: []string{\"stuff\"}",
						Field:   "dryRun",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:dryRun not supported`,
				`END`,
			},
		},
		{
			name: "incorrect namespace on request context",
			args: args{
				ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), "wrong-namespace"),
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client-name",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Message: `namespace must be some-namespace on OIDCClientSecretRequest, was wrong-namespace`,
				Reason:  metav1.StatusReasonBadRequest,
				Code:    http.StatusBadRequest,
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:namespace must be some-namespace on OIDCClientSecretRequest, was wrong-namespace`,
				`END`,
			},
		},
		{
			name: "create validation: failure from kube api-server rest.ValidateObjectFunc",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client-name",
					},
				},
				createValidation: func(ctx context.Context, obj runtime.Object) error {
					return apierrors.NewInternalError(errors.New("some-error-here"))
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Message: "Internal error occurred: some-error-here",
				Reason:  metav1.StatusReasonInternalError,
				Code:    http.StatusInternalServerError,
				Details: &metav1.StatusDetails{
					Causes: []metav1.StatusCause{{
						Message: "some-error-here",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:validation webhook,msg:Internal error occurred: some-error-here`,
				`END`,
			},
		},
		{
			name: "create validation: no namespace on the request context",
			args: args{
				ctx: genericapirequest.NewContext(),
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client-name",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Message: "Internal error occurred: no namespace information found in request context",
				Reason:  metav1.StatusReasonInternalError,
				Code:    http.StatusInternalServerError,
				Details: &metav1.StatusDetails{
					Causes: []metav1.StatusCause{{
						Message: "no namespace information found in request context",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:no namespace information found in request context`,
				`END`,
			},
		},
		{
			name: "create validation: namespace on object does not match namespace on request",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name:      "client.oauth.pinniped.dev-some-client-name",
						Namespace: "not-a-matching-namespace",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Message: "the namespace of the provided object does not match the namespace sent on the request",
				Reason:  metav1.StatusReasonBadRequest,
				Code:    http.StatusBadRequest,
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:the namespace of the provided object does not match the namespace sent on the request`,
				`END`,
			},
		},
		{
			name: "create validation: generateName is unsupported",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						GenerateName: "foo",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "" is invalid: [metadata.generateName: ` +
					`Invalid value: "foo": generateName is not supported, metadata.name: Required value: name or generateName is required]`,
				Reason: metav1.StatusReasonInvalid,
				Code:   http.StatusUnprocessableEntity,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "OIDCClientSecretRequest",
					Name:  "",
					Causes: []metav1.StatusCause{{
						Type:    metav1.CauseTypeFieldValueInvalid,
						Message: `Invalid value: "foo": generateName is not supported`,
						Field:   "metadata.generateName",
					}, {
						Type:    metav1.CauseTypeFieldValueRequired,
						Message: "Required value: name or generateName is required",
						Field:   "metadata.name",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:[metadata.generateName: Invalid value: "foo": generateName is not supported, metadata.name: Required value: name or generateName is required]`,
				`END`,
			},
		},
		{
			name: "create validation: name cannot exactly match client.oauth.pinniped.dev-",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "client.oauth.pinniped.dev-" is invalid: ` +
					`metadata.name: Invalid value: "client.oauth.pinniped.dev-": must not equal 'client.oauth.pinniped.dev-'`,
				Reason: metav1.StatusReasonInvalid,
				Code:   http.StatusUnprocessableEntity,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "OIDCClientSecretRequest",
					Name:  "client.oauth.pinniped.dev-",
					Causes: []metav1.StatusCause{{
						Type:    metav1.CauseTypeFieldValueInvalid,
						Message: `Invalid value: "client.oauth.pinniped.dev-": must not equal 'client.oauth.pinniped.dev-'`,
						Field:   "metadata.name",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:metadata.name: Invalid value: "client.oauth.pinniped.dev-": must not equal 'client.oauth.pinniped.dev-'`,
				`END`,
			},
		},
		{
			name: "create validation: name must contain prefix client.oauth.pinniped.dev-",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "does-not-contain-the-prefix",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "does-not-contain-the-prefix" is invalid: ` +
					`metadata.name: Invalid value: "does-not-contain-the-prefix": must start with 'client.oauth.pinniped.dev-'`,
				Reason: metav1.StatusReasonInvalid,
				Code:   http.StatusUnprocessableEntity,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "OIDCClientSecretRequest",
					Name:  "does-not-contain-the-prefix",
					Causes: []metav1.StatusCause{{
						Type:    metav1.CauseTypeFieldValueInvalid,
						Message: `Invalid value: "does-not-contain-the-prefix": must start with 'client.oauth.pinniped.dev-'`,
						Field:   "metadata.name",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:metadata.name: Invalid value: "does-not-contain-the-prefix": must start with 'client.oauth.pinniped.dev-'`,
				`END`,
			},
		},
		{
			name: "create validation: name with invalid characters should error",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-contains/invalid/characters",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "client.oauth.pinniped.dev-contains/invalid/characters" ` +
					`is invalid: metadata.name: Invalid value: "client.oauth.pinniped.dev-contains/invalid/characters": may not contain '/'`,
				Reason: metav1.StatusReasonInvalid,
				Code:   http.StatusUnprocessableEntity,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "OIDCClientSecretRequest",
					Name:  "client.oauth.pinniped.dev-contains/invalid/characters",
					Causes: []metav1.StatusCause{{
						Type:    metav1.CauseTypeFieldValueInvalid,
						Message: `Invalid value: "client.oauth.pinniped.dev-contains/invalid/characters": may not contain '/'`,
						Field:   "metadata.name",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:metadata.name: Invalid value: "client.oauth.pinniped.dev-contains/invalid/characters": may not contain '/'`,
				`END`,
			},
		},
		{
			name: "create validation: name validation may return multiple errors",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name:         "multiple/errors/aggregated",
						GenerateName: "no-generate-allowed",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "multiple/errors/aggregated" is invalid: [metadata.generateName: ` +
					`Invalid value: "no-generate-allowed": generateName is not supported, metadata.name: ` +
					`Invalid value: "multiple/errors/aggregated": must start with 'client.oauth.pinniped.dev-', metadata.name: ` +
					`Invalid value: "multiple/errors/aggregated": may not contain '/']`,
				Reason: metav1.StatusReasonInvalid,
				Code:   http.StatusUnprocessableEntity,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "OIDCClientSecretRequest",
					Name:  "multiple/errors/aggregated",
					Causes: []metav1.StatusCause{{
						Type:    metav1.CauseTypeFieldValueInvalid,
						Message: `Invalid value: "no-generate-allowed": generateName is not supported`,
						Field:   "metadata.generateName",
					}, {
						Type:    metav1.CauseTypeFieldValueInvalid,
						Message: `Invalid value: "multiple/errors/aggregated": must start with 'client.oauth.pinniped.dev-'`,
						Field:   "metadata.name",
					}, {
						Type:    metav1.CauseTypeFieldValueInvalid,
						Message: `Invalid value: "multiple/errors/aggregated": may not contain '/'`,
						Field:   "metadata.name",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`failureType:request validation,msg:[metadata.generateName: Invalid value: "no-generate-allowed": generateName is not supported, metadata.name: Invalid value: "multiple/errors/aggregated": must start with 'client.oauth.pinniped.dev-', metadata.name: Invalid value: "multiple/errors/aggregated": may not contain '/']`,
				`END`,
			},
		},
		{
			name: "oidcClient does not exist 404",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-oidc-client-does-not-exist-404",
					},
				},
			},
			want: nil,
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "client.oauth.pinniped.dev-oidc-client-does-not-exist-404" ` +
					`is invalid: metadata.name: Not found: "client.oauth.pinniped.dev-oidc-client-does-not-exist-404"`,
				Reason: metav1.StatusReasonInvalid,
				Code:   http.StatusUnprocessableEntity,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "OIDCClientSecretRequest",
					Name:  "client.oauth.pinniped.dev-oidc-client-does-not-exist-404",
					Causes: []metav1.StatusCause{{
						Type:    metav1.CauseTypeFieldValueNotFound,
						Message: `Not found: "client.oauth.pinniped.dev-oidc-client-does-not-exist-404"`,
						Field:   "metadata.name",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`failureType:oidcClientsClient.Get,msg:oidcclients.config.supervisor.pinniped.dev "client.oauth.pinniped.dev-oidc-client-does-not-exist-404" not found`,
				`END`,
			},
		},
		{
			name: "unexpected error getting oidcClient 500",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-internal-error-could-not-get-client",
					},
				},
			},
			addReactors: func(kubeClient *kubefake.Clientset, supervisorClient *supervisorfake.Clientset) {
				supervisorClient.PrependReactor("get", "oidcclients", func(action coretesting.Action) (bool, runtime.Object, error) {
					return true, nil, errors.New("unexpected error darn")
				})
			},
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Code:    http.StatusInternalServerError,
				Reason:  metav1.StatusReasonInternalError,
				Message: `Internal error occurred: getting client "client.oauth.pinniped.dev-internal-error-could-not-get-client" failed`,
				Details: &metav1.StatusDetails{
					Causes: []metav1.StatusCause{{
						Message: `getting client "client.oauth.pinniped.dev-internal-error-could-not-get-client" failed`,
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`failureType:oidcClientsClient.Get,msg:unexpected error darn`,
				`END`,
			},
		},
		{
			name: "failed to get kube secret for oidcClient",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-no-secret-for-oidcclient",
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-no-secret-for-oidcclient",
					Namespace: namespace,
				},
			}},
			addReactors: func(kubeClient *kubefake.Clientset, supervisorClient *supervisorfake.Clientset) {
				kubeClient.PrependReactor("get", "secrets", func(action coretesting.Action) (bool, runtime.Object, error) {
					return true, nil, errors.New("sadly no secrets")
				})
			},
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Code:    http.StatusInternalServerError,
				Reason:  metav1.StatusReasonInternalError,
				Message: `Internal error occurred: getting secret for client "client.oauth.pinniped.dev-no-secret-for-oidcclient" failed`,
				Details: &metav1.StatusDetails{
					Causes: []metav1.StatusCause{{
						Message: `getting secret for client "client.oauth.pinniped.dev-no-secret-for-oidcclient" failed`,
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`failureType:secretStorage.Get,msg:failed to get client secret for uid : failed to get oidc-client-secret for signature : sadly no secrets`,
				`END`,
			},
		},
		{
			name: "failed to generate new client secret for oidcClient",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-fail-to-generate-secret",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			fakeByteGenerator: readerAlwaysErrors{},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-fail-to-generate-secret",
					Namespace: namespace,
				},
			}},
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Code:    http.StatusInternalServerError,
				Reason:  metav1.StatusReasonInternalError,
				Message: `Internal error occurred: client secret generation failed`,
				Details: &metav1.StatusDetails{
					Causes: []metav1.StatusCause{{
						Message: `client secret generation failed`,
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`failureType:generateSecret,msg:could not generate client secret: always errors`,
				`END`,
			},
		},
		{
			name: "failed to generate hash for new client secret for oidcClient",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-fail-to-hash-secret",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			fakeHasher: func(password []byte, cost int) ([]byte, error) {
				return nil, errors.New("can't hash stuff")
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-fail-to-hash-secret",
					Namespace: namespace,
				},
			}},
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Code:    http.StatusInternalServerError,
				Reason:  metav1.StatusReasonInternalError,
				Message: `Internal error occurred: hash generation failed`,
				Details: &metav1.StatusDetails{
					Causes: []metav1.StatusCause{{
						Message: `hash generation failed`,
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`failureType:bcrypt.GenerateFromPassword,msg:can't hash stuff`,
				`END`,
			},
		},
		{
			name: "happy path: no secrets exist, create secret and hash for found oidcclient",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-happy-new-secret",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-happy-new-secret",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-happy-new-secret",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: true,
					RevokeOldSecrets:  false,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    fakeHexEncodedRandomBytes,
					TotalClientSecrets: 1,
				},
			},
			wantErrStatus: nil,
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					fakeBcryptRandomBytes,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`secretStorage.Set`,
				`END`,
			},
		},
		{
			name: "happy path: secret exists, prepend new secret hash to secret to the list of hashes for found oidcclient",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-append-new-secret-hash",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-append-new-secret-hash",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
						},
					),
				)
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-append-new-secret-hash",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					fakeBcryptRandomBytes,
					"hashed-password-1",
					"hashed-password-2",
				},
			},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-append-new-secret-hash",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: true,
					RevokeOldSecrets:  false,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    fakeHexEncodedRandomBytes,
					TotalClientSecrets: 3,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`secretStorage.Set`,
				`END`,
			},
		},
		{
			name: "happy path: secret exists, append new secret hash to secret and revoke old for found oidcclient",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-append-new-secret-hash",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  true,
					},
				},
			},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-append-new-secret-hash",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
						},
					))
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-append-new-secret-hash",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					fakeBcryptRandomBytes,
				},
			},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-append-new-secret-hash",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: true,
					RevokeOldSecrets:  true,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    fakeHexEncodedRandomBytes,
					TotalClientSecrets: 1,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`secretStorage.Set`,
				`END`,
			},
		},
		{
			name: "happy path: secret exists, revoke old secrets but retain latest for found oidcclient",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: false,
						RevokeOldSecrets:  true,
					},
				},
			},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-some-client",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
						},
					))
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					"hashed-password-1",
				},
			},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-some-client",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: false,
					RevokeOldSecrets:  true,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    "",
					TotalClientSecrets: 1,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`secretStorage.Set`,
				`END`,
			},
		},
		{
			name: "secret exists but oidcclient secret has too many hashes, fails to create when RevokeOldSecrets:false (max 5), secret is not updated",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-some-client",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
							"hashed-password-3",
							"hashed-password-4",
							"hashed-password-5",
						},
					))
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					"hashed-password-1",
					"hashed-password-2",
					"hashed-password-3",
					"hashed-password-4",
					"hashed-password-5",
				},
			},
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Message: `OIDCClient client.oauth.pinniped.dev-some-client has too many secrets, spec.revokeOldSecrets must be true`,
				Reason:  metav1.StatusReasonBadRequest,
				Code:    http.StatusBadRequest,
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`failureType:secretStorage.Set,msg:OIDCClient client.oauth.pinniped.dev-some-client has too many secrets, spec.revokeOldSecrets must be true`,
				`END`,
			},
			want: nil,
		},
		{
			name: "secret exists but oidcclient secret has too many hashes, fails to create when RevokeOldSecrets:false (greater than 5), secret is not updated",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-some-client",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
							"hashed-password-3",
							"hashed-password-4",
							"hashed-password-5",
							"hashed-password-6",
						},
					))
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					"hashed-password-1",
					"hashed-password-2",
					"hashed-password-3",
					"hashed-password-4",
					"hashed-password-5",
					"hashed-password-6",
				},
			},
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Message: `OIDCClient client.oauth.pinniped.dev-some-client has too many secrets, spec.revokeOldSecrets must be true`,
				Reason:  metav1.StatusReasonBadRequest,
				Code:    http.StatusBadRequest,
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`failureType:secretStorage.Set,msg:OIDCClient client.oauth.pinniped.dev-some-client has too many secrets, spec.revokeOldSecrets must be true`,
				`END`,
			},
		},
		{
			name: "attempted to create storage secret because it did not initially exist but was created by someone else while generating new client secret & hash",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			addReactors: func(kubeClient *kubefake.Clientset, supervisorClient *supervisorfake.Clientset) {
				kubeClient.PrependReactor("create", "secrets", func(action coretesting.Action) (bool, runtime.Object, error) {
					secret := action.(coretesting.UpdateAction).GetObject().(*corev1.Secret)
					return true, nil, apierrors.NewAlreadyExists(schema.GroupResource{Group: "", Resource: "secrets"}, secret.Name)
				})
			},
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `Operation cannot be fulfilled on oidcclientsecretrequests.clientsecret.supervisor.pinniped.dev ` +
					`"client.oauth.pinniped.dev-some-client": multiple concurrent secret generation requests for same client`,
				Reason: metav1.StatusReasonConflict,
				Code:   http.StatusConflict,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "oidcclientsecretrequests",
					Name:  "client.oauth.pinniped.dev-some-client",
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`failureType:secretStorage.Set,msg:failed to create client secret for uid 12345: failed to create oidc-client-secret for signature MTIzNDU: secrets "pinniped-storage-oidc-client-secret-gezdgnbv" already exists`,
				`END`,
			},
		},
		{
			name: "attempted to create storage secret because it did not initially exist but received a conflict error",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			addReactors: func(kubeClient *kubefake.Clientset, supervisorClient *supervisorfake.Clientset) {
				kubeClient.PrependReactor("create", "secrets", func(action coretesting.Action) (bool, runtime.Object, error) {
					secret := action.(coretesting.UpdateAction).GetObject().(*corev1.Secret)
					return true, nil, apierrors.NewConflict(
						schema.GroupResource{Group: "", Resource: "secrets"},
						secret.Name,
						errors.New("something deeply conflicted"),
					)
				})
			},
			wantErrStatus: &metav1.Status{
				Status: metav1.StatusFailure,
				Message: `Operation cannot be fulfilled on oidcclientsecretrequests.clientsecret.supervisor.pinniped.dev ` +
					`"client.oauth.pinniped.dev-some-client": multiple concurrent secret generation requests for same client`,
				Reason: metav1.StatusReasonConflict,
				Code:   http.StatusConflict,
				Details: &metav1.StatusDetails{
					Group: "clientsecret.supervisor.pinniped.dev",
					Kind:  "oidcclientsecretrequests",
					Name:  "client.oauth.pinniped.dev-some-client",
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`failureType:secretStorage.Set,msg:failed to create client secret for uid 12345: failed to create oidc-client-secret for signature MTIzNDU: Operation cannot be fulfilled on secrets "pinniped-storage-oidc-client-secret-gezdgnbv": something deeply conflicted`,
				`END`,
			},
		},
		{
			name: "attempted to create storage secret but received an unknown error",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			addReactors: func(kubeClient *kubefake.Clientset, supervisorClient *supervisorfake.Clientset) {
				kubeClient.PrependReactor("create", "secrets", func(action coretesting.Action) (bool, runtime.Object, error) {
					return true, nil, errors.New("some random error")
				})
			},
			wantErrStatus: &metav1.Status{
				Status:  metav1.StatusFailure,
				Message: `Internal error occurred: setting client secret failed`,
				Reason:  metav1.StatusReasonInternalError,
				Code:    http.StatusInternalServerError,
				Details: &metav1.StatusDetails{
					Causes: []metav1.StatusCause{{
						Message: "setting client secret failed",
					}},
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`failureType:secretStorage.Set,msg:failed to create client secret for uid 12345: failed to create oidc-client-secret for signature MTIzNDU: some random error`,
				`END`,
			},
		},
		{
			name: "happy path noop: do not create a new secret, do not revoke old secrets, but there is no existing storage secret",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-happy-new-secret",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: false,
						RevokeOldSecrets:  true,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-happy-new-secret",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-happy-new-secret",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: false,
					RevokeOldSecrets:  true,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    "",
					TotalClientSecrets: 0,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`END`,
			},
		},
		{
			name: "happy path noop: do not create a new secret, revoke old secrets, but there is no existing storage secret",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: false,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-some-client",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: false,
					RevokeOldSecrets:  false,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    "",
					TotalClientSecrets: 0,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`END`,
			},
		},
		{
			name: "happy path noop: do not create a new secret, revoke old secrets, and there is an existing storage secret",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: false,
						RevokeOldSecrets:  false,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-some-client",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
						},
					))
			},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					"hashed-password-1",
					"hashed-password-2",
				},
			},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-some-client",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: false,
					RevokeOldSecrets:  false,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    "",
					TotalClientSecrets: 2,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`END`,
			},
		},
		{
			name: "happy path: generate new secret and revoking old secret when there was a single secret hash to start with",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  true,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-some-client",
						"12345",
						[]string{
							"hashed-password-1",
						},
					))
			},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					fakeBcryptRandomBytes,
				},
			},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-some-client",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: true,
					RevokeOldSecrets:  true,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    fakeHexEncodedRandomBytes,
					TotalClientSecrets: 1,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`secretStorage.Set`,
				`END`,
			},
		},
		{
			name: "happy path: generate new secret when existing secrets is max (5)",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  true,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-some-client",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
							"hashed-password-3",
							"hashed-password-4",
							"hashed-password-5",
						},
					))
			},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					fakeBcryptRandomBytes,
				},
			},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-some-client",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: true,
					RevokeOldSecrets:  true,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    fakeHexEncodedRandomBytes,
					TotalClientSecrets: 1,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`secretStorage.Set`,
				`END`,
			},
		},
		{
			name: "happy path: generate new secret when existing secrets exceeds maximum (5)",
			args: args{
				ctx: namespacedContext,
				obj: &clientsecretapi.OIDCClientSecretRequest{
					ObjectMeta: metav1.ObjectMeta{
						Name: "client.oauth.pinniped.dev-some-client",
					},
					Spec: clientsecretapi.OIDCClientSecretRequestSpec{
						GenerateNewSecret: true,
						RevokeOldSecrets:  true,
					},
				},
			},
			seedOIDCClients: []*v1alpha1.OIDCClient{{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "client.oauth.pinniped.dev-some-client",
					Namespace: namespace,
					UID:       "12345",
				},
			}},
			seedHashes: func(storage *oidcclientsecretstorage.OIDCClientSecretStorage) {
				require.NoError(t,
					storage.Set(
						context.Background(),
						"",
						"client.oauth.pinniped.dev-some-client",
						"12345",
						[]string{
							"hashed-password-1",
							"hashed-password-2",
							"hashed-password-3",
							"hashed-password-4",
							"hashed-password-5",
							"hashed-password-6",
						},
					))
			},
			wantHashes: &wantHashes{
				UID: "12345",
				hashes: []string{
					fakeBcryptRandomBytes,
				},
			},
			want: &clientsecretapi.OIDCClientSecretRequest{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "client.oauth.pinniped.dev-some-client",
					Namespace:         namespace,
					CreationTimestamp: fakeNow,
				},
				Spec: clientsecretapi.OIDCClientSecretRequestSpec{
					GenerateNewSecret: true,
					RevokeOldSecrets:  true,
				},
				Status: clientsecretapi.OIDCClientSecretRequestStatus{
					GeneratedSecret:    fakeHexEncodedRandomBytes,
					TotalClientSecrets: 1,
				},
			},
			wantLogLines: []string{
				`"create"`,
				`"validateRequest"`,
				`oidcClientsClient.Get`,
				`secretStorage.Get`,
				`generateSecret`,
				`bcrypt.GenerateFromPassword`,
				`secretStorage.Set`,
				`END`,
			},
		},
	}
	for _, tt := range tests {
		tt := tt

		t.Run(tt.name, func(t *testing.T) {
			// t.Parallel() should not be used because we are mutating the global logger.
			var log bytes.Buffer
			logger := plog.TestZapr(t, &log)
			klog.SetLogger(logger)
			t.Cleanup(func() {
				klog.ClearLogger()
			})

			kubeClient := kubefake.NewSimpleClientset()
			secretsClient := kubeClient.CoreV1().Secrets(namespace)
			// Production code depends on secrets having a resource version.
			// Our seedHashes mechanism with the fake client unfortunately does not cause a resourceVersion to be set on the secret.
			// Therefore, we need to add this reactor before we seed hashes so our secrets have RVs.
			kubeClient.PrependReactor("create", "secrets", func(action coretesting.Action) (bool, runtime.Object, error) {
				secret := action.(coretesting.UpdateAction).GetObject().(*corev1.Secret)
				secret.ResourceVersion = "1"
				return false, nil, nil
			})

			oidcClientSecretStore := oidcclientsecretstorage.New(secretsClient)
			if tt.seedHashes != nil {
				tt.seedHashes(oidcClientSecretStore)
			}

			supervisorClient := supervisorfake.NewSimpleClientset()
			if tt.seedOIDCClients != nil {
				for _, client := range tt.seedOIDCClients {
					require.NoError(t, supervisorClient.Tracker().Add(client))
				}
			}
			oidcClientClient := supervisorClient.ConfigV1alpha1().OIDCClients(namespace)

			if tt.addReactors != nil {
				tt.addReactors(kubeClient, supervisorClient)
			}

			fakeHasher := tt.fakeHasher
			if tt.fakeHasher == nil {
				fakeHasher = func(password []byte, cost int) ([]byte, error) {
					return []byte(fmt.Sprintf("%s:%d-fake-hash", password, cost)), nil
				}
			}
			fakeByteGenerator := tt.fakeByteGenerator
			if tt.fakeByteGenerator == nil {
				fakeByteGenerator = strings.NewReader(fakeRandomBytes + "these extra bytes should be ignored since we only read 32 bytes")
			}

			r := NewREST(
				schema.GroupResource{Group: "bears", Resource: "panda"},
				secretsClient,
				oidcClientClient,
				namespace,
				4,
				fakeByteGenerator,
				fakeHasher,
				fakeTimeNowFunc,
			)

			got, err := r.Create(tt.args.ctx, tt.args.obj, tt.args.createValidation, tt.args.options)

			require.Equal(t, tt.want, got)
			if tt.wantErrStatus != nil {
				require.Equal(t, &apierrors.StatusError{ErrStatus: *tt.wantErrStatus}, err)
			} else {
				require.NoError(t, err)
			}

			if tt.wantHashes != nil {
				secretStoreName := oidcClientSecretStore.GetName(types.UID(tt.wantHashes.UID))
				secretGVR := schema.GroupVersionResource{
					Group:    corev1.SchemeGroupVersion.Group,
					Version:  corev1.SchemeGroupVersion.Version,
					Resource: "secrets",
				}
				storeSecret, err := kubeClient.Tracker().Get(secretGVR, namespace, secretStoreName)
				require.NoError(t, err)
				require.IsType(t, &corev1.Secret{}, storeSecret)
				secretHashes, err := oidcclientsecretstorage.ReadFromSecret(storeSecret.(*corev1.Secret))
				require.NoError(t, err)
				require.Equal(t, tt.wantHashes.hashes, secretHashes)
			} else {
				secrets, err := secretsClient.List(context.Background(), metav1.ListOptions{})
				require.NoError(t, err)
				require.Empty(t, secrets.Items)
			}

			requireLogLinesContain(t, log.String(), tt.wantLogLines)
		})
	}
}

type readerAlwaysErrors struct{}

func (r readerAlwaysErrors) Read(_ []byte) (n int, err error) {
	return 0, errors.New("always errors")
}

func requireLogLinesContain(t *testing.T, fullLog string, wantLines []string) {
	if len(wantLines) == 0 {
		require.Empty(t, fullLog)
		return
	}
	var jsonLog map[string]interface{}
	err := json.Unmarshal([]byte(fullLog), &jsonLog)
	require.NoError(t, err)
	require.Contains(t, jsonLog, "message")
	message := jsonLog["message"]
	require.IsType(t, "type of string", message)
	lines := strings.Split(strings.TrimSpace(message.(string)), "\n")

	require.Lenf(t, lines, len(wantLines), "actual log lines length should match expected length, actual lines:\n\n%s", strings.Join(lines, "\n"))
	for i := range wantLines {
		require.Containsf(t, lines[i], wantLines[i], "log line at index %d should have contained expected output", i)
	}
}