fix: Union derived rw and ro claims

Signed-off-by: Nelo-T. Wallus <red.brush9525@fastmail.com>
Signed-off-by: Nelo-T. Wallus <n.wallus@sap.com>

Author: ntnn

internal/registrar/claims.go

@@ -15,12 +15,15 @@
 package registrar
 
 import (
+	"cmp"
 	"fmt"
+	"slices"
 	"sort"
 
 	apisv1alpha2 "github.com/kcp-dev/sdk/apis/apis/v1alpha2"
 	"github.com/kubernetes-sigs/kro/pkg/graph"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
 
 	kropengine "go.opendefense.cloud/krop-controller/internal/engine"
 )
@@ -56,6 +59,33 @@ func DeriveClaims(foreign []schema.GroupResource, verbs []string, identity map[s
 	return claims
 }
 
+// mergeClaims merges multiple claim sets and combines the verbs for matching GR.
+func mergeClaims(inputs ...[]apisv1alpha2.PermissionClaim) []apisv1alpha2.PermissionClaim {
+	var all []apisv1alpha2.PermissionClaim
+	for _, in := range inputs {
+		all = append(all, in...)
+	}
+	slices.SortStableFunc(all, func(i, j apisv1alpha2.PermissionClaim) int {
+		if g := cmp.Compare(i.Group, j.Group); g != 0 {
+			return g
+		}
+
+		return cmp.Compare(i.Resource, j.Resource)
+	})
+
+	out := []apisv1alpha2.PermissionClaim{all[0]}
+	for _, in := range all {
+		last := out[len(out)-1]
+		if last.GroupResource != in.GroupResource {
+			out = append(out, in)
+			continue
+		}
+		last.Verbs = sets.List(sets.New(append(last.Verbs, in.Verbs...)...))
+	}
+
+	return out
+}
+
 // validateClaims rejects any foreign (non-core) permissionClaim whose identity
 // could not be resolved. A claim with Group != "" but IdentityHash == "" means the
 // owning APIExport isn't bound in the provider workspace, so the emitted claim

internal/registrar/claims_test.go

@@ -52,6 +52,48 @@ func TestDeriveClaims_CoreAndForeign(t *testing.T) {
 	}
 }
 
+func TestMergeClaims(t *testing.T) {
+	gr := func(g, r string) apisv1alpha2.GroupResource {
+		return apisv1alpha2.GroupResource{Group: g, Resource: r}
+	}
+	claim := func(g, r string, verbs ...string) apisv1alpha2.PermissionClaim {
+		return apisv1alpha2.PermissionClaim{GroupResource: gr(g, r), Verbs: verbs}
+	}
+
+	writable := []apisv1alpha2.PermissionClaim{
+		claim("b.example", "widgets", "get", "create"),
+		claim("access.opendefense.cloud", "scopes", "get", "create"),
+	}
+	external := []apisv1alpha2.PermissionClaim{
+		claim("access.opendefense.cloud", "scopes", "get"), // overlaps writable
+		claim("", "configmaps", "get"),
+	}
+
+	got := mergeClaims(writable, external)
+
+	wantGRs := []apisv1alpha2.GroupResource{
+		gr("", "configmaps"),
+		gr("access.opendefense.cloud", "scopes"),
+		gr("b.example", "widgets"),
+	}
+	gotGRs := make([]apisv1alpha2.GroupResource, len(got))
+	for i, c := range got {
+		gotGRs[i] = c.GroupResource
+	}
+	if !reflect.DeepEqual(gotGRs, wantGRs) {
+		t.Fatalf("order = %+v, want %+v", gotGRs, wantGRs)
+	}
+
+	// Overlapping GR keeps the writable (superset) verbs, not the read-only ones.
+	for _, c := range got {
+		if c.Group == "access.opendefense.cloud" && c.Resource == "scopes" {
+			if !reflect.DeepEqual(c.Verbs, []string{"get", "create"}) {
+				t.Fatalf("scopes verbs = %v, want writable superset [get create]", c.Verbs)
+			}
+		}
+	}
+}
+
 func TestValidateClaims(t *testing.T) {
 	tests := []struct {
 		name    string

internal/registrar/registrar.go

@@ -178,9 +178,9 @@ func (r *Registrar) Reconcile(ctx context.Context, req reconcile.Request) (recon
 	// Consumer-target template nodes get full CRUD claims (the engine writes them);
 	// consumer-target external refs get read-only claims (the engine only reads them).
 	writableGRs, externalGRs := ForeignConsumerGRs(g, instanceGR, routing)
-	claims := append(
+	claims := mergeClaims(
 		DeriveClaims(writableGRs, claimVerbs, identity),
-		DeriveClaims(externalGRs, readOnlyVerbs, identity)...,
+		DeriveClaims(externalGRs, readOnlyVerbs, identity),
 	)
 	// A foreign (non-core) claim with no identityHash would not authorize: the
 	// owning APIExport isn't bound in the provider workspace yet. Fail the publish