ESD-1615-fix(nat-gateway): validate speed/session matrix on update path

[Phil-Browne]

Follow-up to #507. That PR added client-side speed/session-count matrix validation, but only on the create path. nat-gateway update --speed X --session-count Y still let an unsupported pair through to the API.

• Refactor validateNATGatewaySpeedSessionMatrix to take speed/session-count directly instead of the create request.
• Call it from UpdateNATGateway after the partial-update merge, so it validates the effective (merged) values.
• Tests for the update path: rejects unsupported speed, rejects unsupported session count, allows a supported pair, and falls open on matrix-fetch failure.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.29%. Comparing base (dee5b8d) to head (60ca995).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #515   +/-   ##
=======================================
  Coverage   79.29%   79.29%           
=======================================
  Files         193      193           
  Lines       18683    18688    +5     
=======================================
+ Hits        14814    14819    +5     
  Misses       2820     2820           
  Partials     1049     1049           

Files with missing lines	Coverage Δ
...ternal/commands/nat_gateway/nat_gateway_actions.go	82.03% <100.00%> (+0.23%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR closes a validation gap in the NAT gateway update workflow by applying the same speed/session-count matrix validation that already existed on the create path, ensuring unsupported combinations are rejected client-side before hitting the API.

Changes:

• Refactors validateNATGatewaySpeedSessionMatrix to accept speed and sessionCount directly (instead of a create request).
• Adds matrix validation to UpdateNATGateway after the partial-update merge so the effective (merged) values are validated.
• Adds update-path test coverage for unsupported speed/session-count combinations and for “fail open” behavior when the matrix cannot be fetched.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/commands/nat_gateway/nat_gateway_actions.go	Refactors the matrix validation helper and applies it to the update path after defaults are merged.
internal/commands/nat_gateway/nat_gateway_test.go	Adds focused tests ensuring update rejects invalid matrix pairs and fails open when the matrix fetch fails.

[penzeliz-megaport]

The matrix check is correct on the create path, but on update it over-rejects. UpdateNATGateway calls validateNATGatewaySpeedSessionMatrix(..., req.Speed, req.Config.SessionCount, ...) (nat_gateway_actions.go ~L319) after mergeUpdateDefaults, so req.Speed / SessionCount hold the original gateway's values when the user didn't touch them. A name/term/auto-renew-only update on a grandfathered gateway whose speed/session pair was later removed from the matrix (matrix non-empty, so fail-open doesn't trigger) is rejected client-side with "speed not supported", even though speed and session weren't changed. Gate the call on speed or session-count actually changing, e.g. cmd.Flags().Changed("speed") || explicit.SessionCount.

[Phil-Browne]

Fixed in 9df9901. Rather than gating on cmd.Flags().Changed("speed") || explicit.SessionCount (which only covers the flag input path), the update now compares the post-merge req.Speed / req.Config.SessionCount against the original gateway's values and only calls validateNATGatewaySpeedSessionMatrix when one of them actually differs. This covers all three input modes (flags, JSON, interactive) uniformly, since mergeUpdateDefaults always resolves both fields to either the new value or the original one.

Added a regression test (TestUpdateNATGateway_MatrixSkippedWhenSpeedAndSessionUnchanged) that reproduces the grandfathered-gateway scenario: original speed/session pair excluded from the matrix, name-only update, expects success.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.