feat: add client for cyberark service discovery

[SgtCoDFish]

Currently, the only aim of this is to fetch the URL of the Identity API. A future PR will use this client to fetch that API URL and log in via Identity.

I've written this to be specific to Identity, but to be easily extensible later if we want to discover other services.

[Copilot]

Pull Request Overview

This PR introduces a CyberArk service discovery client designed specifically to fetch the Identity API endpoint while also laying the groundwork for extending discovery to other services. Key changes include:

• A new client implementation in discovery.go with configurable endpoints.
• Unit tests in discovery_test.go covering various scenarios including successful responses, missing services, and malformed JSON.
• Test data documentation in README.md detailing the discovery responses.

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/internal/cyberark/servicediscovery/testdata/README.md	Added documentation for test data.
pkg/internal/cyberark/servicediscovery/discovery_test.go	Introduced thorough tests for different scenarios.
pkg/internal/cyberark/servicediscovery/discovery.go	Implemented the discovery client with error handling.

Files not reviewed (1)

• pkg/internal/cyberark/servicediscovery/testdata/discovery_success.json: Language not supported

Comments suppressed due to low confidence (2)

pkg/internal/cyberark/servicediscovery/discovery_test.go:141

• Consider comparing errors using errors.Is or errors.As rather than converting them to strings, to improve the robustness and clarity of the tests.

if err.Error() != testSpec.expectedError.Error() {

pkg/internal/cyberark/servicediscovery/discovery.go:82

• [nitpick] Consider using the %w verb for error wrapping (e.g. fmt.Errorf(... %w)) so that the original error context is preserved.

return "", fmt.Errorf("failed to build a valid URL for subdomain %s; possibly an invalid endpoint: %s", subdomain, err)

[wallrj]

I haven't been involved in the discussions around this new feature so I'm a bit out of the loop and don't know the plan.

But it looks like a nice self-contained start.

Some of the canned responses in the test server didn't match what I got from the live server, but that might be because I'm not making the right requests.

[wallrj]

I'd like to know how to recreate or update this data.
I tried using curl , but got an empty response.

$ curl https://platform-discovery.integration-cyberark.cloud/api/v2/services/subdomain/venafi-test; echo
{}

[SgtCoDFish]

That tenant was decommissioned and replaced with a new one I'm using to test the Identity client. There's a different example tenant which can be used for getting this kind of data: curl -v https://platform-discovery.integration-cyberark.cloud/api/v2/services/subdomain/beyonceknowles

I didn't want to add the old one or the one above to that README because I don't know if they're intended to be long lived, so my instinct is to avoid referring to either in code right now!

[wallrj]

I get a different response when I use curl to GET that endpoint:

$ curl -v https://platform-discovery.integration-cyberark.cloud/api/v2/services/asd | jq
...
> GET /api/v2/services/asd HTTP/2
...
< HTTP/2 400
...
{
  "error": "input validation error"
}

[SgtCoDFish]

Ah that's my fault for just making up a random identifier; I'll update this in the Identity client which is to follow!

[SgtCoDFish]

Thanks for the review Richard, really appreciate it!