refactor: extract unified ingress helpers.

[pantierra]

This creates a networking.tpl with shared helpers for the unified ingress. This PR should not change anything on the output. No behaviour-change, just a mere refactoring.

[lhoupert]

Hey! I opened a PR #569 to contribute to your own PR by adding some tests to lock the bug1 I identified in #568 and fix also a bug in the networking _helper

[claude]

Claude finished @pantierra's task in 4m 29s —— View job

---

Todo

• Gather context (PR diff, changed files)
• Review diff for correctness/security/best-practice issues
• Apply ponytail-review over-engineering pass
• Post final review

---

✅ No blocking issues — safe to merge.

Traced the extraction of eoapi.enabledIngressServices / eoapi.ingressPaths / eoapi.traefikStripPrefixes / eoapi.browserIngressPath / eoapi.browserRedirectEnabled in charts/eoapi/templates/_helpers/networking.tpl against the three previously-duplicated service-list loops it replaces (ingress.yaml's eoapi.ingressPaths/eoapi.hasEnabledService and traefik-middleware.yaml's strip-prefix loop). The stripPrefix boolean algebra (not (skipStripPrefix or (usesAuthProxy and enabled)) → (not skipStripPrefix) and (not (usesAuthProxy and enabled))) is logically equivalent via De Morgan's, the mockOidcServer → testing.mockOidcServer value resolution is preserved via ternary, and the browser bare-path helpers (eoapi.browserIngressPath, eoapi.browserRedirectEnabled) are byte-for-byte the same conditions as before, just centralized so ingress.yaml and traefik-middleware.yaml can't drift out of sync (which was the bug this whole peel-PR stack is fixing).

Two things worth a quick look, neither blocking:

• charts/eoapi/templates/_helpers/networking.tpl:29 — (($service.service).port | default 8080) relies on Go template's nil-safe parenthesized field access when $service.service is unset. This is an existing idiom already used elsewhere in this same file ((($service | default dict).ingress), ((.Values.browser).ingress).path) and in the repo, so it's consistent, but it's a bit fragile if a future editor removes the parens. Not new risk introduced by this PR.
• eoapi.enabledIngressServices gets called (and its JSON re-encoded/decoded) three separate times per render — once each from eoapi.hasEnabledService, eoapi.ingressPaths, and eoapi.traefikStripPrefixes. This is a Helm-template constraint (no way to share a computed value across include calls without a serialize round-trip), not a design mistake, and chart render cost is negligible either way.

Confirmed the templates: + explicit template: additions in the five test files follow the chart's existing convention for helper .tpl files (autoscaling_test.yaml, doc-server_test.yaml, gitsha_test.yaml, etc. all do the same), so this isn't a new pattern.

Note: I wasn't able to execute helm unittest/helm template in this sandbox (the tool approval for helm commands wasn't available), so this review is based on static template tracing rather than actual render output — worth confirming CI's helm-unittest run is green before merge.

No Simplify (ponytail) findings — the refactor is already the minimal DRY shape given Helm's cross-template constraints; nothing reinvented, no unneeded abstraction.

---

💰 Estimated review cost: $1.11 · 4m29s · 29 turns

[pantierra]

Rebased onto peel PRs that should land first:

1. chore: drop unused ingress pathType and cert-manager schema #578 chore(values): dead pathType / cert-manager schema
2. test: cover ingress disable paths and traefik strip-prefix edges #579 test(helm): existing ingress coverage
3. fix: tolerate null browser.service and browser.ingress #580 fix(helm): nil browser.service / browser.ingress
4. fix: keep chart rewrite and middleware annotations above user overrides #581 fix(helm): chart annotation precedence

This PR keeps only the networking.tpl centralization (browser + auth-proxy ingress split). After those four merge, rebase this branch onto main.

[pantierra]

Rebased on these. Minimal refactor here. Follow up then in a next step: #586

This is ready for review.