test the VALID UNTIL flag

Author: ThoSap

src/main/java/it/aboutbits/postgresql/crd/role/RoleReconciler.java

@@ -45,7 +45,8 @@ public UpdateControl<Role> reconcile(
         var name = resource.getMetadata().getName();
         var namespace = resource.getMetadata().getNamespace();
 
-        log.info("Reconciling Role [resource={}/{}, status.phase={}]",
+        log.info(
+                "Reconciling Role [resource={}/{}, status.phase={}]",
                 namespace,
                 name,
                 status.getPhase()
@@ -102,7 +103,8 @@ public UpdateControl<Role> reconcile(
 
                 // Create the role if it doesn't exist yet
                 if (!RoleUtil.roleExists(tx, spec)) {
-                    log.info("Creating Role [resource={}/{}]",
+                    log.info(
+                            "Creating Role [resource={}/{}]",
                             namespace,
                             name
                     );
@@ -133,7 +135,8 @@ public UpdateControl<Role> reconcile(
                 }
 
                 if (roleLoginMatches && passwordMatches && flagsMatch) {
-                    log.info("Role up-to-date [resource={}/{}]",
+                    log.info(
+                            "Role up-to-date [resource={}/{}]",
                             namespace,
                             name
                     );
@@ -143,7 +146,8 @@ public UpdateControl<Role> reconcile(
 
                 var changePassword = loginExpected && !passwordMatches;
 
-                log.info("Updating Role flags [resource={}/{}]",
+                log.info(
+                        "Updating Role flags [resource={}/{}]",
                         namespace,
                         name
                 );
@@ -155,7 +159,8 @@ public UpdateControl<Role> reconcile(
                         password
                 );
 
-                log.info("Updating Role membership [resource={}/{}]",
+                log.info(
+                        "Updating Role membership [resource={}/{}]",
                         namespace,
                         name
                 );

src/main/java/it/aboutbits/postgresql/crd/role/RoleUtil.java

@@ -18,6 +18,7 @@
 
 import static it.aboutbits.postgresql.core.infrastructure.persistence.Tables.PG_AUTHID;
 import static it.aboutbits.postgresql.core.infrastructure.persistence.Tables.PG_AUTH_MEMBERS;
+import static org.jooq.impl.DSL.field;
 import static org.jooq.impl.DSL.keyword;
 import static org.jooq.impl.DSL.multiset;
 import static org.jooq.impl.DSL.name;
@@ -127,7 +128,7 @@ public static RoleSpec.Flags fetchCurrentFlags(
                         PG_AUTHID.ROLREPLICATION.as("replication"),
                         PG_AUTHID.ROLBYPASSRLS.as("bypassrls"),
                         PG_AUTHID.ROLCONNLIMIT.as("connectionLimit"),
-                        PG_AUTHID.ROLVALIDUNTIL.as("validUntil"),
+                        field("nullif({0}, 'infinity')", PG_AUTHID.ROLVALIDUNTIL.getDataType(), PG_AUTHID.ROLVALIDUNTIL).as("validUntil"),
                         multiset(
                                 select(parent.ROLNAME)
                                         .from(PG_AUTH_MEMBERS)
@@ -194,7 +195,7 @@ private static Query buildCreateRole(
         }
         if (flags.getValidUntil() != null) {
             options.add(keyword(RoleFlags.VALID_UNTIL.flag()));
-            options.add(val(flags.getValidUntil()));
+            options.add(val(flags.getValidUntil().toString()));
         }
         if (!flags.getInRole().isEmpty()) {
             options.add(keyword(RoleFlags.IN_ROLE.flag()));
@@ -281,9 +282,11 @@ private static Query buildAlterRole(
         options.add(keyword(RoleFlags.CONNECTION_LIMIT.flag()));
         options.add(val(flags.getConnectionLimit()));
 
+        options.add(keyword(RoleFlags.VALID_UNTIL.flag()));
         if (flags.getValidUntil() != null) {
-            options.add(keyword(RoleFlags.VALID_UNTIL.flag()));
-            options.add(val(flags.getValidUntil()));
+            options.add(val(flags.getValidUntil().toString()));
+        } else {
+            options.add(val("infinity"));
         }
 
         return query(
@@ -386,7 +389,7 @@ private static Query buildCommentOnRole(
                 ))
                 .from(PG_AUTHID)
                 .where(PG_AUTHID.ROLNAME.eq(roleName))
-                .fetchOneInto(String.class);
+                .fetchSingleInto(String.class);
     }
 
     private static @Nullable String normalizeComment(@Nullable String comment) {

src/test/java/it/aboutbits/postgresql/crd/role/RoleReconcilerTest.java

@@ -425,6 +425,77 @@ void connectionLimit_updatesCorrectly() throws SQLException {
         ).isEqualTo(-1);
     }
 
+    @Test
+    @DisplayName("When the VALID UNTIL is changed, it should be updated in the database")
+    void validUntil_updatesCorrectly() throws SQLException {
+        // given
+        var clusterConnection = given.one()
+                .clusterConnection()
+                .withName("test-role-valid-until")
+                .returnFirst();
+
+        var dsl = postgreSQLContextFactory.getDSLContext(clusterConnection);
+
+        var roleName = "test-role-valid-until";
+
+        var role = buildRole(
+                roleName,
+                clusterConnection.getMetadata().getName(),
+                /*login*/ false
+        );
+
+        var expiry = OffsetDateTime.now(ZoneOffset.UTC)
+                .plusDays(1)
+                .truncatedTo(ChronoUnit.SECONDS);
+
+        // 1. Set a valid until date
+        role.getSpec().getFlags().setValidUntil(expiry);
+
+        // when
+        var reconciled = applyRole(role);
+        var initialGeneration = reconciled.getStatus().getObservedGeneration();
+
+        var currentFlags = RoleUtil.fetchCurrentFlags(dsl, role.getSpec());
+
+        // then
+        assertThat(
+                currentFlags.getValidUntil()
+        ).isEqualTo(expiry);
+
+        // 2. Change valid until date
+        var newExpiry = expiry.plusDays(1);
+        role.getSpec().getFlags().setValidUntil(newExpiry);
+
+        // when
+        applyRole(
+                role,
+                r -> r.getStatus().getObservedGeneration() == initialGeneration + 1
+        );
+
+        currentFlags = RoleUtil.fetchCurrentFlags(dsl, role.getSpec());
+
+        // then
+        assertThat(
+                currentFlags.getValidUntil()
+        ).isEqualTo(newExpiry);
+
+        // 3. Reset valid until to null (infinity)
+        role.getSpec().getFlags().setValidUntil(null);
+
+        // when
+        applyRole(
+                role,
+                r -> r.getStatus().getObservedGeneration() == initialGeneration + 2
+        );
+
+        currentFlags = RoleUtil.fetchCurrentFlags(dsl, role.getSpec());
+
+        // then
+        assertThat(
+                currentFlags.getValidUntil()
+        ).isNull();
+    }
+
     private <T> T getRoleFlagValue(
             DSLContext dsl,
             String roleName,
@@ -433,7 +504,7 @@ private <T> T getRoleFlagValue(
         return dsl.select(field)
                 .from(PG_AUTHID)
                 .where(PG_AUTHID.ROLNAME.eq(roleName))
-                .fetchSingleInto(field.getType());
+                .fetchSingle(field);
     }
 
     private static Stream<Arguments> provideBooleanFlags() {