fix(tenants): correct tenant get route path

The tenant get route was using a hardcoded placeholder string instead of the actual API group and resource types. This prevented the router from correctly matching requests for specific tenants.

This change updates the path to use `types.CapsuleGroup` and `types.Tenants` to ensure the route is correctly constructed. Added unit tests for the path matching and e2e tests to verify tenant access control via the API.

Signed-off-by: Anisimov Evgeniy <anisimov.evgeniy.s@gmail.com>

Author: Anisimov.ev

e2e/tenant_test.go

@@ -0,0 +1,74 @@
+package e2e_test
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	capsulerbac "github.com/projectcapsule/capsule/pkg/api/rbac"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+
+	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+)
+
+var _ = Describe("Tenants", func() {
+	var aliceClient, bobClient *kubernetes.Clientset
+
+	tenant := &capsulev1beta2.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:   "tenant-get-owned-by-alice",
+			Labels: e2eLabels(),
+		},
+		Spec: capsulev1beta2.TenantSpec{
+			Owners: capsulerbac.OwnerListSpec{
+				{
+					CoreOwnerSpec: capsulerbac.CoreOwnerSpec{
+						UserSpec: capsulerbac.UserSpec{
+							Name: "alice",
+							Kind: "User",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	BeforeEach(func() {
+		var err error
+
+		aliceClient, err = loadKubeConfig("alice")
+		Expect(err).ToNot(HaveOccurred())
+		bobClient, err = loadKubeConfig("bob")
+		Expect(err).ToNot(HaveOccurred())
+
+		Eventually(func() error {
+			tenant.ResourceVersion = ""
+
+			return k8sClient.Create(context.TODO(), tenant)
+		}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
+	})
+
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tenant)).Should(Succeed())
+	})
+
+	It("Should allow tenant owners to get their tenant by name", func() {
+		getTenant := func(clientset *kubernetes.Clientset, name string) error {
+			_, err := clientset.RESTClient().
+				Get().
+				AbsPath("/apis/capsule.clastix.io/v1beta2/tenants/" + name).
+				DoRaw(context.Background())
+
+			return err
+		}
+
+		Eventually(func() error {
+			return getTenant(aliceClient, tenant.GetName())
+		}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed(), "Alice should get a tenant she owns by name")
+
+		Eventually(func() error {
+			return getTenant(bobClient, tenant.GetName())
+		}, defaultTimeoutInterval, defaultPollInterval).Should(HaveOccurred(), "Bob should not get a tenant he does not own by name")
+	})
+})

internal/modules/tenants/get.go

@@ -53,7 +53,7 @@ func (g get) GroupKind() schema.GroupKind {
 }
 
 func (g get) Path() string {
-	return "/apis/{}/v1beta2/tenants/{name}"
+	return "/apis/" + types.CapsuleGroup + "/v1beta2/" + types.Tenants + "/{name}"
 }
 
 func (g get) Methods() []string {

internal/modules/tenants/get_test.go

@@ -0,0 +1,32 @@
+// Copyright 2020-2025 Project Capsule Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package tenants
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+)
+
+func TestGetPathMatchesTenantByName(t *testing.T) {
+	matched := false
+
+	router := mux.NewRouter()
+	router.Path(Get(nil).Path()).Methods(http.MethodGet).HandlerFunc(func(_ http.ResponseWriter, request *http.Request) {
+		matched = true
+
+		if name := mux.Vars(request)["name"]; name != "3282" {
+			t.Fatalf("expected tenant name 3282, got %q", name)
+		}
+	})
+
+	request := httptest.NewRequest(http.MethodGet, "/apis/capsule.clastix.io/v1beta2/tenants/3282", nil)
+	router.ServeHTTP(httptest.NewRecorder(), request)
+
+	if !matched {
+		t.Fatal("tenant get route did not match")
+	}
+}