From 9ece9dcbc39ffdbc12a462168c98e048eb9590db Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Thu, 3 Sep 2026 01:03:27 +0300
Subject: [PATCH] test(mariadb): cover every issuer state the projection claims
 to ignore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The case titled "renders regardless of tls.issuer" set issuer: operator,
which is the chart default, so both sides of its claim were the same
side. Hiding the sentinel behind the cert-manager gate — the one edit
the title rules out — left it green.

Being ungated is the projection's entire contract, so each state is now
its own case: the default, operator, cert-manager, and an explicit null,
which the issuer helper treats as unset rather than as a spelling of the
default.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../mariadb/tests/tenant_projection_test.yaml | 29 +++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/packages/apps/mariadb/tests/tenant_projection_test.yaml b/packages/apps/mariadb/tests/tenant_projection_test.yaml
index 5d54a2cdf..b297b3512 100644
--- a/packages/apps/mariadb/tests/tenant_projection_test.yaml
+++ b/packages/apps/mariadb/tests/tenant_projection_test.yaml
@@ -57,8 +57,16 @@ tests:
 
   # Ungated: unlike nats/qdrant, TLS is always served here (see the tls.issuer
   # discussion in the README), so the source Secret exists for every release
-  # regardless of tls.issuer.
-  - it: renders regardless of tls.issuer
+  # regardless of tls.issuer. Being ungated is the projection's whole contract,
+  # so every issuer state is spelled out. One case setting the chart default
+  # would assert the same branch the cases above already cover, and hiding the
+  # sentinel behind the cert-manager gate would still pass it.
+  - it: renders under the default issuer
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: renders under tls.issuer=operator
     set:
       tls:
         issuer: operator
@@ -66,6 +74,23 @@ tests:
       - hasDocuments:
           count: 1
 
+  - it: renders under tls.issuer=cert-manager
+    set:
+      tls:
+        issuer: cert-manager
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  # The chart resolves the issuer through a helper that treats an explicit null
+  # as unset, so this is a third state rather than a spelling of the default.
+  - it: renders when tls is explicitly null
+    set:
+      tls: null
+    asserts:
+      - hasDocuments:
+          count: 1
+
   - it: renders the source and target names from the release, not a fixed string
     release:
       name: other-mariadb