🐛 Fix failing Go tests: IsAllowedOrigin and ValidateToken

[clubanderson]

Summary

• TestServer_IsAllowedOrigin: The test expected https://deep.sub.ibm.com to be rejected by the wildcard https://*.ibm.com, but the matchOrigin implementation intentionally matches any subdomain depth. Updated the test expectation to true to match the implementation behavior.
• TestServer_ValidateToken: The "Valid query parameter token" test sent a plain GET request, but validateToken() only accepts query parameter tokens on WebSocket upgrade requests (per Agent token passed via URL query parameter — token leaked in server logs #3895). Added the Upgrade: websocket header to the test and added a new test case verifying query tokens are rejected on non-upgrade requests.

These two test failures caused the Release workflow (#4214), Nightly unit-test (#4215), and Nightly Test Suite (#4217) to fail.

Test plan

• go test ./pkg/agent/ -run "TestServer_IsAllowedOrigin|TestServer_ValidateToken" passes locally
• CI build/lint/test pass

Fixes #4214 #4215 #4217

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mikespreitzer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for kubestellarconsole canceled.

Name	Link
🔨 Latest commit	eeee89d
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69ce63792b03c50008baec95

[github-actions]

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

• Claude Code (Opus 4.5 / 4.6) — recommended
• GitHub Copilot
• Cursor
• Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

---

This is an automated message.

[Copilot]

Pull request overview

Updates Go unit tests in pkg/agent/server_test.go to align expectations with existing agent-server behavior around CORS wildcard matching and authentication-token validation.

Changes:

• Update TestServer_IsAllowedOrigin to expect deep subdomains to match https://*.ibm.com (implementation matches any subdomain depth).
• Update TestServer_ValidateToken to only accept ?token= when the request is a WebSocket upgrade (Upgrade: websocket), and add a negative test asserting query tokens are rejected for non-upgrade HTTP requests.

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey