Fix lint errors: Split test and extract helper function

- Split TestValidateAPIServerEndpoint into two functions:
  - TestValidateAPIServerEndpoint_ValidCases (37 lines)
  - TestValidateAPIServerEndpoint_InvalidCases (40 lines)
- Extract setupInClusterContext helper to reduce nesting complexity
- Reduces if config.UseInCluster block from complexity 6 to 1
- All tests still pass (14 validation tests + integration test)
- Backend linter passes with no errors

Addresses lint errors: funlen and nestif.

Co-authored-by: illume <9541+illume@users.noreply.github.com>

Author: Copilot

backend/cmd/headlamp.go

@@ -428,29 +428,7 @@ func createHeadlampHandler(config *HeadlampConfig) http.Handler {
 
 	// In-cluster
 	if config.UseInCluster {
-		context, err := kubeconfig.GetInClusterContext(
-			config.InClusterContextName,
-			config.OidcIdpIssuerURL,
-			config.OidcClientID, config.OidcClientSecret,
-			strings.Join(config.OidcScopes, ","),
-			config.OidcSkipTLSVerify,
-			config.OidcCACert,
-			config.APIServerEndpoint)
-		if err != nil {
-			logger.Log(logger.LevelError, nil, err, "Failed to get in-cluster context")
-		} else {
-			context.Source = kubeconfig.InCluster
-
-			err = context.SetupProxy()
-			if err != nil {
-				logger.Log(logger.LevelError, nil, err, "Failed to setup proxy for in-cluster context")
-			}
-
-			err = config.KubeConfigStore.AddContext(context)
-			if err != nil {
-				logger.Log(logger.LevelError, nil, err, "Failed to add in-cluster context")
-			}
-		}
+		setupInClusterContext(config)
 	}
 
 	if config.StaticDir != "" {
@@ -1095,6 +1073,34 @@ func (c *HeadlampConfig) OIDCTokenRefreshMiddleware(next http.Handler) http.Hand
 	})
 }
 
+// setupInClusterContext sets up the in-cluster Kubernetes context.
+func setupInClusterContext(config *HeadlampConfig) {
+	context, err := kubeconfig.GetInClusterContext(
+		config.InClusterContextName,
+		config.OidcIdpIssuerURL,
+		config.OidcClientID, config.OidcClientSecret,
+		strings.Join(config.OidcScopes, ","),
+		config.OidcSkipTLSVerify,
+		config.OidcCACert,
+		config.APIServerEndpoint)
+	if err != nil {
+		logger.Log(logger.LevelError, nil, err, "Failed to get in-cluster context")
+		return
+	}
+
+	context.Source = kubeconfig.InCluster
+
+	err = context.SetupProxy()
+	if err != nil {
+		logger.Log(logger.LevelError, nil, err, "Failed to setup proxy for in-cluster context")
+	}
+
+	err = config.KubeConfigStore.AddContext(context)
+	if err != nil {
+		logger.Log(logger.LevelError, nil, err, "Failed to add in-cluster context")
+	}
+}
+
 func StartHeadlampServer(config *HeadlampConfig) {
 	tel, err := telemetry.NewTelemetry(config.TelemetryConfig)
 	if err != nil {

backend/pkg/kubeconfig/kubeconfig_test.go

@@ -827,114 +827,106 @@ func TestHandleConfigLoadError(t *testing.T) {
 	}
 }
 
-func TestValidateAPIServerEndpoint(t *testing.T) {
+func TestValidateAPIServerEndpoint_ValidCases(t *testing.T) {
 	tests := []struct {
-		name        string
-		endpoint    string
-		wantResult  string
-		wantErr     bool
-		errContains string
+		name       string
+		endpoint   string
+		wantResult string
 	}{
 		{
 			name:       "empty string returns empty",
 			endpoint:   "",
 			wantResult: "",
-			wantErr:    false,
 		},
 		{
 			name:       "whitespace only returns empty",
 			endpoint:   "   \t\n   ",
 			wantResult: "",
-			wantErr:    false,
 		},
 		{
 			name:       "valid https URL",
 			endpoint:   "https://kube-oidc-proxy.example.com:443",
 			wantResult: "https://kube-oidc-proxy.example.com:443",
-			wantErr:    false,
 		},
 		{
 			name:       "valid https URL with whitespace is trimmed",
 			endpoint:   "  https://kube-oidc-proxy.example.com:443  ",
 			wantResult: "https://kube-oidc-proxy.example.com:443",
-			wantErr:    false,
 		},
+		{
+			name:       "URL with root path is allowed",
+			endpoint:   "https://proxy.example.com:443/",
+			wantResult: "https://proxy.example.com:443/",
+		},
+		{
+			name:       "URL without port",
+			endpoint:   "https://proxy.example.com",
+			wantResult: "https://proxy.example.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := kubeconfig.ValidateAPIServerEndpoint(tt.endpoint)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantResult, result)
+		})
+	}
+}
+
+func TestValidateAPIServerEndpoint_InvalidCases(t *testing.T) {
+	tests := []struct {
+		name        string
+		endpoint    string
+		errContains string
+	}{
 		{
 			name:        "http URL is rejected",
 			endpoint:    "http://insecure-proxy.example.com:443",
-			wantErr:     true,
 			errContains: "must be a full https:// URL",
 		},
 		{
 			name:        "missing scheme is rejected",
 			endpoint:    "kube-oidc-proxy.example.com:443",
-			wantErr:     true,
 			errContains: "must be an absolute URL with scheme and host",
 		},
 		{
 			name:        "relative URL is rejected",
 			endpoint:    "/path/to/proxy",
-			wantErr:     true,
 			errContains: "must be an absolute URL with scheme and host",
 		},
 		{
 			name:        "URL with embedded credentials is rejected",
 			endpoint:    "https://user:password@proxy.example.com:443",
-			wantErr:     true,
 			errContains: "must not include user info (credentials)",
 		},
 		{
 			name:        "URL with empty hostname is rejected",
 			endpoint:    "https://:443",
-			wantErr:     true,
 			errContains: "must be an absolute URL with scheme and host",
 		},
 		{
 			name:        "URL with query string is rejected",
 			endpoint:    "https://proxy.example.com:443?token=secret",
-			wantErr:     true,
 			errContains: "must not include a query string",
 		},
 		{
 			name:        "URL with fragment is rejected",
 			endpoint:    "https://proxy.example.com:443#section",
-			wantErr:     true,
 			errContains: "must not include a fragment",
 		},
 		{
 			name:        "URL with path is rejected",
 			endpoint:    "https://proxy.example.com:443/api/v1",
-			wantErr:     true,
 			errContains: "path must be empty or '/'",
 		},
-		{
-			name:       "URL with root path is allowed",
-			endpoint:   "https://proxy.example.com:443/",
-			wantResult: "https://proxy.example.com:443/",
-			wantErr:    false,
-		},
-		{
-			name:       "URL without port",
-			endpoint:   "https://proxy.example.com",
-			wantResult: "https://proxy.example.com",
-			wantErr:    false,
-		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result, err := kubeconfig.ValidateAPIServerEndpoint(tt.endpoint)
-
-			if tt.wantErr {
-				require.Error(t, err)
-
-				if tt.errContains != "" {
-					assert.Contains(t, err.Error(), tt.errContains)
-				}
-			} else {
-				require.NoError(t, err)
-				assert.Equal(t, tt.wantResult, result)
-			}
+			_, err := kubeconfig.ValidateAPIServerEndpoint(tt.endpoint)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errContains)
 		})
 	}
 }