Add shared test helpers and improve test coverage

Extract shared test helpers into pkg/internal/transporttest:
UnwrapTransport, MakeSelfSignedCA, MustParseURL. Replace local
copies in transport, proxy, and observe_idps test files.

Add TestBuildIDPTransport to verify that with the feature gate
enabled and a component proxy with trusted CA configured, the
IDP transport builder wires the proxy function and loads the CA.

Add Test_validateIdPConnectivity_hashDedup to verify hash-based
dedup: successful validation saves the hash and skips redundant
checks; failed validation does not save the hash, allowing retry.

Enable the AuthenticationComponentProxy feature gate in
TestObserveIdentityProviders to exercise the gate-enabled path
with no proxy configured (no-op fallback to environment).

Author: tchap

pkg/controllers/common/proxy_test.go

@@ -18,6 +18,8 @@ import (
 	operatorv1 "github.com/openshift/api/operator/v1"
 	operatorv1listers "github.com/openshift/client-go/operator/listers/operator/v1"
 	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
+
+	"github.com/openshift/cluster-authentication-operator/pkg/internal/transporttest"
 )
 
 var (
@@ -236,8 +238,8 @@ func TestResolvedProxy_IsProxyConfigured(t *testing.T) {
 }
 
 func TestResolvedProxy_ProxyFunc(t *testing.T) {
-	httpsURL := mustParseURL(t, "https://idp.example.com/.well-known/openid-configuration")
-	httpURL := mustParseURL(t, "http://idp.example.com/callback")
+	httpsURL := transporttest.MustParseURL(t, "https://idp.example.com/.well-known/openid-configuration")
+	httpURL := transporttest.MustParseURL(t, "http://idp.example.com/callback")
 
 	tests := []struct {
 		name         string
@@ -337,15 +339,6 @@ func TestResolvedProxy_ProxyFunc(t *testing.T) {
 	}
 }
 
-func mustParseURL(t *testing.T, raw string) *url.URL {
-	t.Helper()
-	u, err := url.Parse(raw)
-	if err != nil {
-		t.Fatalf("failed to parse URL %q: %v", raw, err)
-	}
-	return u
-}
-
 func TestResolveProxy_FeatureGateError(t *testing.T) {
 	ch := make(chan struct{})
 	fga := featuregates.NewHardcodedFeatureGateAccessForTesting(nil, nil, ch, errors.New("not yet observed"))

pkg/controllers/configobservation/oauth/observe_idps_test.go

@@ -2,10 +2,12 @@ package oauth
 
 import (
 	"fmt"
+	"net/http"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -16,13 +18,15 @@ import (
 
 	configv1 "github.com/openshift/api/config/v1"
 	"github.com/openshift/api/features"
+	operatorv1 "github.com/openshift/api/operator/v1"
 	configlistersv1 "github.com/openshift/client-go/config/listers/config/v1"
 	operatorv1listers "github.com/openshift/client-go/operator/listers/operator/v1"
 	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	"github.com/openshift/library-go/pkg/operator/events"
 	"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
 
 	"github.com/openshift/cluster-authentication-operator/pkg/controllers/configobservation"
+	"github.com/openshift/cluster-authentication-operator/pkg/internal/transporttest"
 )
 
 type mockResourceSyncer struct {
@@ -232,6 +236,57 @@ func TestObserveIdentityProviders(t *testing.T) {
 	}
 }
 
+// TestBuildIDPTransport verifies that when the feature gate is enabled and the
+// Authentication CR has a component proxy with a trusted CA, the transport
+// builder wires the proxy function and loads the CA into the transport.
+func TestBuildIDPTransport(t *testing.T) {
+	_, caPEM := transporttest.MakeSelfSignedCA(t)
+	proxyCA := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{Name: "my-proxy-ca", Namespace: "openshift-config"},
+		Data:       map[string]string{"ca-bundle.crt": string(caPEM)},
+	}
+	authCR := &operatorv1.Authentication{
+		ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
+		Spec: operatorv1.AuthenticationSpec{
+			Proxy: operatorv1.AuthenticationProxyConfig{
+				HTTPSProxy: "http://proxy:3128",
+				TrustedCA:  operatorv1.AuthenticationConfigMapReference{Name: "my-proxy-ca"},
+			},
+		},
+	}
+
+	cmIndexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
+	require.NoError(t, cmIndexer.Add(proxyCA))
+
+	authIndexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
+	require.NoError(t, authIndexer.Add(authCR))
+
+	listers := configobservation.Listers{
+		ConfigMapLister:    corelistersv1.NewConfigMapLister(cmIndexer),
+		OperatorAuthLister: operatorv1listers.NewAuthenticationLister(authIndexer),
+		FeatureGateAccessor: featuregates.NewHardcodedFeatureGateAccess(
+			[]configv1.FeatureGateName{features.FeatureGateAuthenticationComponentProxy},
+			nil,
+		),
+	}
+
+	buildTransport, err := buildIDPTransport(listers)
+	require.NoError(t, err)
+
+	// Call without an IdP CA — should still succeed because the proxy CA is loaded.
+	rt, err := buildTransport("", "")
+	require.NoError(t, err)
+
+	tr := transporttest.UnwrapTransport(t, rt)
+	require.NotNil(t, tr.Proxy, "transport should have a proxy function set")
+
+	// Verify proxy is wired: an HTTPS request should be proxied.
+	proxyURL, err := tr.Proxy(&http.Request{URL: transporttest.MustParseURL(t, "https://idp.example.com")})
+	require.NoError(t, err)
+	require.NotNil(t, proxyURL)
+	require.Equal(t, "http://proxy:3128", proxyURL.String())
+}
+
 func eventsReasonMessage(e []*corev1.Event) []string {
 	reasonMessages := make([]string, 0, len(e))
 	for _, ev := range e {

pkg/controllers/proxyconfig/proxyconfig_controller_test.go

@@ -90,17 +90,6 @@ func Test_checkProxyConfig(t *testing.T) {
 	}
 }
 
-type workingHTTPRoundTripper struct{}
-type faultyHTTPRoundTripper struct{}
-
-func (s *workingHTTPRoundTripper) RoundTrip(_ *http.Request) (*http.Response, error) {
-	return &http.Response{StatusCode: 200}, nil
-}
-
-func (s *faultyHTTPRoundTripper) RoundTrip(_ *http.Request) (*http.Response, error) {
-	return &http.Response{StatusCode: 404}, nil
-}
-
 func Test_extractIdPURLs(t *testing.T) {
 	tests := []struct {
 		name string
@@ -324,3 +313,71 @@ func Test_validateIdPConnectivity(t *testing.T) {
 		})
 	}
 }
+
+func Test_validateIdPConnectivity_hashDedup(t *testing.T) {
+	idps := []configv1.IdentityProvider{{
+		IdentityProviderConfig: configv1.IdentityProviderConfig{
+			Type:   configv1.IdentityProviderTypeGitLab,
+			GitLab: &configv1.GitLabIdentityProvider{URL: "https://gitlab.example.com"},
+		},
+	}}
+	oauthConfig := &configv1.OAuth{
+		ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
+		Spec:       configv1.OAuthSpec{IdentityProviders: idps},
+	}
+	indexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
+	if err := indexer.Add(oauthConfig); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("second call with same config skips validation", func(t *testing.T) {
+		recorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))
+		p := &proxyConfigChecker{
+			oauthLister: configv1listers.NewOAuthLister(indexer),
+		}
+
+		reachable := &http.Client{Transport: &workingHTTPRoundTripper{}}
+		p.validateIdPConnectivity(context.Background(), recorder, reachable, "http://proxy:3128", "", "")
+		if len(recorder.Events()) != 0 {
+			t.Fatalf("first call should emit no events for reachable endpoints, got %d", len(recorder.Events()))
+		}
+
+		followupRecorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))
+		unreachable := &http.Client{Transport: &faultyHTTPRoundTripper{}}
+		p.validateIdPConnectivity(context.Background(), followupRecorder, unreachable, "http://proxy:3128", "", "")
+		if len(followupRecorder.Events()) != 0 {
+			t.Fatalf("second call with same config should skip validation, got %d events", len(followupRecorder.Events()))
+		}
+	})
+
+	t.Run("hash not saved on failure allows retry", func(t *testing.T) {
+		recorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))
+		p := &proxyConfigChecker{
+			oauthLister: configv1listers.NewOAuthLister(indexer),
+		}
+
+		unreachable := &http.Client{Transport: &faultyHTTPRoundTripper{}}
+		p.validateIdPConnectivity(context.Background(), recorder, unreachable, "http://proxy:3128", "", "")
+		if len(recorder.Events()) != 1 {
+			t.Fatalf("expected 1 event on failure, got %d", len(recorder.Events()))
+		}
+
+		followupRecorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))
+		p.validateIdPConnectivity(context.Background(), followupRecorder, unreachable, "http://proxy:3128", "", "")
+		if len(followupRecorder.Events()) != 1 {
+			t.Fatalf("expected 1 event on retry after failure, got %d", len(followupRecorder.Events()))
+		}
+	})
+}
+
+type workingHTTPRoundTripper struct{}
+
+func (s *workingHTTPRoundTripper) RoundTrip(_ *http.Request) (*http.Response, error) {
+	return &http.Response{StatusCode: 200}, nil
+}
+
+type faultyHTTPRoundTripper struct{}
+
+func (s *faultyHTTPRoundTripper) RoundTrip(_ *http.Request) (*http.Response, error) {
+	return &http.Response{StatusCode: 404}, nil
+}

pkg/internal/transporttest/transporttest.go

@@ -0,0 +1,60 @@
+package transporttest
+
+import (
+	"net/http"
+	"net/url"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/openshift/library-go/pkg/crypto"
+)
+
+// UnwrapTransport recursively unwraps a RoundTripper (e.g. from
+// DebugWrappers) until it reaches the underlying *http.Transport.
+func UnwrapTransport(t *testing.T, rt http.RoundTripper) *http.Transport {
+	t.Helper()
+	type unwrapper interface {
+		WrappedRoundTripper() http.RoundTripper
+	}
+	for {
+		if tr, ok := rt.(*http.Transport); ok {
+			return tr
+		}
+		u, ok := rt.(unwrapper)
+		if !ok {
+			t.Fatalf("cannot unwrap %T to *http.Transport", rt)
+		}
+		rt = u.WrappedRoundTripper()
+	}
+}
+
+// MakeSelfSignedCA generates a self-signed CA certificate and returns
+// the CA object and its PEM-encoded certificate bytes.
+func MakeSelfSignedCA(t *testing.T) (*crypto.CA, []byte) {
+	t.Helper()
+	tmpDir := t.TempDir()
+	ca, err := crypto.MakeSelfSignedCA(
+		path.Join(tmpDir, "ca.crt"),
+		path.Join(tmpDir, "ca.key"),
+		"", "testCA", time.Hour*24,
+	)
+	if err != nil {
+		t.Fatalf("failed to create self-signed CA: %v", err)
+	}
+	certPEM, _, err := ca.Config.GetPEMBytes()
+	if err != nil {
+		t.Fatalf("failed to get CA PEM bytes: %v", err)
+	}
+	return ca, certPEM
+}
+
+// MustParseURL parses a raw URL string and fails the test if it is invalid.
+func MustParseURL(t *testing.T, rawURL string) *url.URL {
+	t.Helper()
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		t.Fatalf("failed to parse URL %q: %v", rawURL, err)
+	}
+	return u
+}