Guard Get routability for consistency with List

The List op gained a routability guard from review feedback so a
GVK-mapped but non-routable family (the pre-seeded
virtualmachineinstances) is refused rather than routed to the agent.
Get resolves the same GVR->GVK mapping and had the same gap, so the
guard is applied to Get too: it returns ErrOpNotRoutable for a
mapped-but-direct-only family before calling the agent, and the
caller then falls back to the direct path. Added a regression test
mirroring the List one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RC3BDHCFmJBdxvGVW69FAr

Author: HiranAdikari

dc-api/internal/providers/clusteraccess/agent.go

@@ -129,6 +129,13 @@ func (a *AgentBacked) ref(gvr schema.GroupVersionResource, ns, name string) (age
 // error so callers' existing IsNotFound / "not found" checks fire unchanged on
 // both seams.
 func (a *AgentBacked) Get(ctx context.Context, gvr schema.GroupVersionResource, ns, name string, _ metav1.GetOptions) (*unstructured.Unstructured, error) {
+	// Routability guard FIRST (mirrors List): a GVR can be GVK-mapped yet not be a
+	// routable family for Get — e.g. the pre-seeded virtualmachineinstances, which
+	// has no RouteVerbs. Refuse rather than issue a read the agent's SA may not be
+	// permitted to serve; the caller falls back to the direct path.
+	if verbs, ok := RoutableVerbs(gvr); !ok || !verbs[VerbGet] {
+		return nil, fmt.Errorf("clusteraccess: get of %s not routable: %w", gvr.String(), agentgw.ErrOpNotRoutable)
+	}
 	ref, err := a.ref(gvr, ns, name)
 	if err != nil {
 		return nil, err

dc-api/internal/providers/clusteraccess/clusteraccess_test.go

@@ -40,9 +40,11 @@ type fakeSession struct {
 	listCalled  bool                // set true the moment List is invoked
 
 	getStatusCalled bool // set by GetStatus, asserts the OP_UNSUPPORTED fallback fired
+	getObjectCalled bool // set by GetObject, asserts the routability guard fired first
 }
 
 func (f *fakeSession) GetObject(ctx context.Context, ref agentgw.ResourceRef) (agentgw.GetObjectResult, error) {
+	f.getObjectCalled = true
 	f.lastRef = ref
 	if f.block {
 		<-ctx.Done()
@@ -192,6 +194,27 @@ func TestAgentBackedList_PreSeededGVKNotRoutable(t *testing.T) {
 	}
 }
 
+// TestAgentBackedGet_PreSeededGVKNotRoutable mirrors the List guard for Get: the
+// pre-seeded virtualmachineinstances GVR is GVK-mapped but has no RouteVerbs, so
+// Get must be REFUSED with ErrOpNotRoutable and the agent's GetObject never invoked.
+func TestAgentBackedGet_PreSeededGVKNotRoutable(t *testing.T) {
+	vmiGVR := schema.GroupVersionResource{Group: "kubevirt.io", Version: "v1", Resource: "virtualmachineinstances"}
+	if _, _, ok := DefaultGVKMapper().GVK(vmiGVR); !ok {
+		t.Fatalf("precondition: VMI GVR %s must be GVK-mapped", vmiGVR)
+	}
+
+	sess := &fakeSession{}
+	a := NewAgentBacked(sess, "lk", "zone-1", "dc-api", DefaultGVKMapper(), zerolog.Nop())
+
+	_, err := a.Get(context.Background(), vmiGVR, "dc-t-p", "vmi-1", metav1.GetOptions{})
+	if !errors.Is(err, agentgw.ErrOpNotRoutable) {
+		t.Errorf("mapped-but-not-routable GVR must yield ErrOpNotRoutable for Get, got %v", err)
+	}
+	if sess.getObjectCalled {
+		t.Error("agent GetObject must NOT be invoked for a non-routable family")
+	}
+}
+
 func TestAgentBackedList_AgentUnavailableIsRetryable(t *testing.T) {
 	sess := &fakeSession{
 		list: func(ref agentgw.ListRef) (agentgw.ListResult, error) {