From 9a17b389dd5dbf2697698e4d5126e1922ec0d5e2 Mon Sep 17 00:00:00 2001
From: afsuyadi <afsuyadi@gmail.com>
Date: Fri, 16 Oct 2026 21:45:08 +0700
Subject: [PATCH] test(kubernetes): cover attribute handler's main paths

---
 tests/providers/kubernetes/test_attribute.py | 53 ++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/tests/providers/kubernetes/test_attribute.py b/tests/providers/kubernetes/test_attribute.py
index f1439b1b..b6a062db 100644
--- a/tests/providers/kubernetes/test_attribute.py
+++ b/tests/providers/kubernetes/test_attribute.py
@@ -1,6 +1,16 @@
 import os
 
+import yaml
+
 from tirith.core.core import start_policy_evaluation
+from tirith.providers.common import ProviderError
+from tirith.providers.kubernetes.handler import provide
+
+
+def _load_input():
+    test_dir = os.path.dirname(os.path.realpath(__file__))
+    with open(os.path.join(test_dir, "input.yml")) as f:
+        return list(yaml.safe_load_all(f))
 
 
 def test_get_value():
@@ -15,3 +25,46 @@ def test_get_value():
     for item in result["evaluators"][0]["result"]:
         assert "context" not in item
         assert item["message"].startswith("Found ")
+
+
+def test_kind_not_found():
+    result = provide(
+        {"operation_type": "attribute", "kubernetes_kind": "ConfigMap", "attribute_path": "metadata.name"},
+        _load_input(),
+    )
+
+    assert len(result) == 1
+    assert result[0]["err"] == "kind: ConfigMap is not found"
+    assert isinstance(result[0]["value"], ProviderError)
+    assert result[0]["value"].severity_value == 1
+
+
+def test_plain_path():
+    result = provide(
+        {"operation_type": "attribute", "kubernetes_kind": "Role", "attribute_path": "metadata.name"},
+        _load_input(),
+    )
+
+    assert result == [{"value": "access-role", "meta": None, "err": None}]
+
+
+def test_wildcard_path():
+    result = provide(
+        {
+            "operation_type": "attribute",
+            "kubernetes_kind": "Deployment",
+            "attribute_path": "spec.selector.matchLabels.*",
+        },
+        _load_input(),
+    )
+
+    assert result == [{"value": ["wfs-demo", "wfs-demp"], "meta": None, "err": None}]
+
+
+def test_missing_attribute():
+    result = provide(
+        {"operation_type": "attribute", "kubernetes_kind": "RoleBinding", "attribute_path": "metadata.labels"},
+        _load_input(),
+    )
+
+    assert result == [{"value": None, "meta": None, "err": None}]