feat: prioritize user provided system trust url

pkg/config/config.go

@@ -294,7 +294,8 @@ func (c *Config) GetStepConfig(flagValues map[string]interface{}, paramJSON stri
 	}
 
 	// hooks need to have been loaded from the defaults before the server URL is known
-	err = c.setSystemTrustConfiguration(stepConfig.HookConfig)
+	// stepConfig.Config is passed so that a user-provided "systemTrustURL" can override the hook default
+	err = c.setSystemTrustConfiguration(stepConfig.HookConfig, stepConfig.Config)
 	if err != nil {
 		log.Entry().WithError(err).Debug("System Trust lookup skipped due to missing or incorrect configuration")
 	} else {

pkg/config/systemtrust.go

@@ -32,8 +32,10 @@ func resolveAllSystemTrustReferences(config *StepConfig, params []StepParameters
 	}
 }
 
-// setSystemTrustConfiguration sets the server URL for the System Trust by taking it from the hooks
-func (c *Config) setSystemTrustConfiguration(hookConfig map[string]interface{}) error {
+// setSystemTrustConfiguration sets the server URL for the System Trust by taking it from the hooks.
+// If stepConfig contains a "systemTrustURL" value (e.g. set via CPE or pipeline config), it takes
+// precedence over the default hook serverURL, allowing users to point to a staging instance.
+func (c *Config) setSystemTrustConfiguration(hookConfig map[string]interface{}, stepConfig map[string]interface{}) error {
 	systemTrustHook, ok := hookConfig["systemtrust"].(map[string]interface{})
 	if !ok {
 		return errors.New("no System Trust hook configuration found")
@@ -43,6 +45,12 @@ func (c *Config) setSystemTrustConfiguration(hookConfig map[string]interface{})
 	} else {
 		return errors.New("no System Trust server URL found")
 	}
+	// Allow the user to override the default hook serverURL via a "systemTrustURL" parameter
+	// (e.g. set in .pipeline/config.yml, via CPE, or as a step parameter).
+	if overrideURL, ok := stepConfig["systemTrustURL"].(string); ok && overrideURL != "" {
+		log.Entry().Infof("Overriding System Trust server URL with user-provided value: %s", overrideURL)
+		c.systemTrustConfiguration.ServerURL = overrideURL
+	}
 	if tokenEndPoint, ok := systemTrustHook["tokenEndPoint"].(string); ok {
 		c.systemTrustConfiguration.TokenEndPoint = tokenEndPoint
 	} else {

pkg/config/systemtrust_test.go

@@ -23,6 +23,7 @@ const testServerURL = "https://www.project-piper.io"
 const testTokenEndPoint = "tokens"
 const testTokenQueryParamName = "systems" // no longer used by the new implementation, but kept in config
 const mockSonarToken = "mockSonarToken"
+const testStagingServerURL = "https://staging.trust.tools.sap"
 
 var testFullURL = fmt.Sprintf("%s/%s", testServerURL, testTokenEndPoint)
 var mockSingleTokenResponse = fmt.Sprintf("{\"sonar\": \"%s\"}", mockSonarToken)
@@ -109,3 +110,48 @@ func mustCompactJSON(t *testing.T, s string) string {
 	}
 	return buf.String()
 }
+
+func TestSetSystemTrustConfiguration(t *testing.T) {
+	hookConfig := map[string]interface{}{
+		"systemtrust": map[string]interface{}{
+			"serverURL":           testServerURL,
+			"tokenEndPoint":       testTokenEndPoint,
+			"tokenQueryParamName": testTokenQueryParamName,
+		},
+	}
+
+	t.Run("Uses hook serverURL when no systemTrustURL in stepConfig", func(t *testing.T) {
+		c := &Config{}
+		c.systemTrustConfiguration.Token = "testToken"
+		err := c.setSystemTrustConfiguration(hookConfig, map[string]interface{}{})
+		assert.NoError(t, err)
+		assert.Equal(t, testServerURL, c.systemTrustConfiguration.ServerURL)
+	})
+
+	t.Run("Overrides serverURL with user-provided systemTrustURL from stepConfig", func(t *testing.T) {
+		c := &Config{}
+		c.systemTrustConfiguration.Token = "testToken"
+		err := c.setSystemTrustConfiguration(hookConfig, map[string]interface{}{
+			"systemTrustURL": testStagingServerURL,
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, testStagingServerURL, c.systemTrustConfiguration.ServerURL)
+	})
+
+	t.Run("Does not override when systemTrustURL is empty string", func(t *testing.T) {
+		c := &Config{}
+		c.systemTrustConfiguration.Token = "testToken"
+		err := c.setSystemTrustConfiguration(hookConfig, map[string]interface{}{
+			"systemTrustURL": "",
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, testServerURL, c.systemTrustConfiguration.ServerURL)
+	})
+
+	t.Run("Returns error when no token set", func(t *testing.T) {
+		c := &Config{}
+		err := c.setSystemTrustConfiguration(hookConfig, map[string]interface{}{})
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "no System Trust token found")
+	})
+}