🧪 test(hub): cover the lite-enrollment GitHub auth path — verifyGitHubRepoAccess and discoverLiteInstallation

[kubestellar-hive]

What this covers

Files/functions claimed: src/pkg/hub/lite_enrollment.go — verifyGitHubRepoAccess, discoverLiteInstallation, validateLiteGitHubHost, liteRepoAccessHTTPClient — via new test file src/pkg/hub/lite_enrollment_authcheck_test.go. Test-only; no production code changes.

Disjoint from the open PR snapshot: #4939 covers pkg/linearagent + dashboard Linear token export, #4931 covers dashboard state-readout handlers, #4946/#4923/#4905 cover cmd/*. None touch pkg/hub/lite_enrollment.go.

Why

Every existing test stubs verifyLiteRepoAccess, so the REAL verifyGitHubRepoAccess — the function that decides whether an enrolling user's GitHub token actually has admin/maintain on the target repo, i.e. the lite-enrollment authorization gate — sat at 7.1% coverage. A regression that returns true for a push-only token would silently over-grant enrollment. discoverLiteInstallation (App-installation auto-discovery when the enrollment supplies no installation_id) was at 36.4%.

New tests

• verifyGitHubRepoAccess: admin/maintain grant access; push-only does NOT; 401/403/404 are (false, nil) not errors; 5xx surfaces as an error naming status + body snippet; malformed JSON is a decode error; transport failure is reported; GHE hosts are checked against their /api/v3 base with the caller's bearer token and Accept header asserted; private/internal hosts (incl. 169.254.169.254) are rejected before any request leaves the process (SSRF gate).
• validateLiteGitHubHost: public GHE hostname passes; unresolvable host fails closed (complements the literal-prefix cases in lite_enrollment_branches_test.go).
• liteRepoAccessHTTPClient: a public redirect within the limit is allowed (the blocking branches are already covered in reach_pr_source_test.go).
• discoverLiteInstallation: cluster App with no uploaded key → actionable installation_id is required; non-RSA (EC) key → not usable for discovery; discovery success (id adopted) and org-not-found against a local httptest server.

Requests reach a local httptest server via a test-scoped http.DefaultTransport swap (the production client uses a nil Transport), mirroring pkg/dashboard/import_test_transport_test.go; DNS is stubbed with the existing stubPrivateURLResolver helper. Hermetic — no real network.

Coverage

function	before	after
verifyGitHubRepoAccess	7.1%	92.9%
discoverLiteInstallation	36.4%	100%
validateLiteGitHubHost	80.0%	100%
liteRepoAccessHTTPClient	83.3%	100%

Full go test ./pkg/hub/ passes (141s), go vet clean, gofmt clean.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but does not touch CHANGELOG.md.

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a line under ## Unreleased. If it is a refactor, a
test-only change, or dependency churn, no entry is needed and you can
ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey