From f0f5e42dc0562a5d86864dd4fc84d9cd83d3123d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20B=C4=9Bh=C3=A1vka?=
 <ondrej.behavka@stackit.cloud>
Date: Mon, 15 Dec 2025 08:30:28 +0100
Subject: [PATCH] Add tests and fix small issue with the SA URL passing

---
 internal/resolver/config_test.go | 16 ++++++++++++++--
 internal/resolver/resolver.go    | 10 ++++++----
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/internal/resolver/config_test.go b/internal/resolver/config_test.go
index bf0bbd51..4522eb23 100644
--- a/internal/resolver/config_test.go
+++ b/internal/resolver/config_test.go
@@ -79,6 +79,16 @@ func TestLoadConfig(t *testing.T) {
 		require.Equal(t, "auth-token", cfg.AuthTokenSecretKey)
 		require.Equal(t, int64(600), cfg.AcmeTxtRecordTTL)
 	})
+
+	t.Run("custom service account base url", func(t *testing.T) {
+		t.Parallel()
+
+		rawCfg := &v1.JSON{Raw: []byte(`{"projectId":"test", "authTokenSecretNamespace": "test", "serviceAccountBaseUrl": "https://custom.stackit.cloud/dns"}`)}
+		cfg, err := d.LoadConfig(rawCfg)
+		require.NoError(t, err)
+		require.Equal(t, "test", cfg.ProjectId)
+		require.Equal(t, "https://custom.stackit.cloud/dns", cfg.ServiceAccountBaseUrl)
+	})
 }
 
 func TestDefaultConfigProvider_LoadConfigNamespaceFile(t *testing.T) {
@@ -152,13 +162,15 @@ func TestGetRepositoryConfig_WithSaKeyPath(t *testing.T) {
 	}
 
 	cfg := &StackitDnsProviderConfig{
-		ApiBasePath: "https://api.stackit.cloud",
-		ProjectId:   "test-project",
+		ApiBasePath:           "https://api.stackit.cloud",
+		ProjectId:             "test-project",
+		ServiceAccountBaseUrl: "https://sa-custom.stackit.cloud",
 	}
 
 	config, err := r.getRepositoryConfig(cfg)
 	require.NoError(t, err)
 	require.Equal(t, saKeyPath, config.SaKeyPath)
+	require.Equal(t, "https://sa-custom.stackit.cloud", config.ServiceAccountBaseUrl)
 	require.True(t, config.UseSaKey)
 }
 
diff --git a/internal/resolver/resolver.go b/internal/resolver/resolver.go
index 8d36beea..a53ec10e 100644
--- a/internal/resolver/resolver.go
+++ b/internal/resolver/resolver.go
@@ -240,10 +240,11 @@ func (s *stackitDnsProviderResolver) getRepositoryConfig(
 	cfg *StackitDnsProviderConfig,
 ) (repository.Config, error) {
 	config := repository.Config{
-		ApiBasePath: cfg.ApiBasePath,
-		ProjectId:   cfg.ProjectId,
-		HttpClient:  s.httpClient,
-		UseSaKey:    false,
+		ApiBasePath:           cfg.ApiBasePath,
+		ProjectId:             cfg.ProjectId,
+		HttpClient:            s.httpClient,
+		UseSaKey:              false,
+		ServiceAccountBaseUrl: cfg.ServiceAccountBaseUrl,
 	}
 
 	switch {
@@ -253,6 +254,7 @@ func (s *stackitDnsProviderResolver) getRepositoryConfig(
 		s.logger.Info(
 			"Using service account key for authentication",
 			zap.String("saKeyPath", config.SaKeyPath),
+			zap.String("serviceAccountBaseUrl", config.ServiceAccountBaseUrl),
 		)
 	default:
 		authToken, err := s.getAuthToken(cfg)