revert: tea 1.0 rewrite (#1122–#1126) (#1146)

Reverts #1126, #1125, #1124, #1123 and #1122. `go.mod` keeps the Go 1.26 line with toolchain `go1.26.9` (instead of the original `go1.26.6`) so the security fix from #1131 isn't lost. reopens #69 reopens #141 reopens #162 reopens #172 reopens #197 reopens #232 reopens #240 reopens #246 reopens #323 reopens #325 reopens #326 reopens #328 reopens #344 reopens #351 reopens #373 reopens #403 reopens #406 reopens #417 reopens #430 reopens #457 reopens #480 reopens #482 reopens #489 reopens #490 reopens #498 reopens #500 reopens #504 reopens #510 reopens #516 reopens #523 reopens #556 reopens #560 reopens #569 reopens #571 reopens #602 reopens #632 reopens #633 reopens #643 reopens #666 reopens #670 reopens #672 reopens #677 reopens #683 reopens #697 reopens #726 reopens #737 reopens #770 reopens #779 reopens #804 reopens #817 reopens #831 reopens #833 reopens #834 reopens #908 reopens #966 reopens #1023 reopens #1029 reopens #1032 reopens #1050 reopens #1052 reopens #1069 reopens #1073 reopens #1087 reopens #1091 reopens #1094 reopens #1110 reopens #1115 reopens #1116 reopens #1118 Reviewed-on: https://gitea.com/gitea/tea/pulls/1146 Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>
2026-10-27 03:21:25 +01:00 · 2026-10-18 20:56:33 +00:00
1 parent 33bb12729e
commit c5f674111a
@@ -0,0 +1,129 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Regression test for the redirect_uri propagation bug: with --redirect-url
+// omitted, the callback listener picks a free port and opts.RedirectURL is
+// rewritten in place. The OAuth2 config must see that rewritten URL so the
+// token exchange sends the same redirect_uri the authorize step advertised
+// (RFC 6749 §4.1.3).
+func TestPerformBrowserOAuthFlow_RedirectURIMatchesAcrossAuthorizeAndExchange(t *testing.T) {
+	var (
+		mu                   sync.Mutex
+		authorizeRedirectURI string
+		exchangeRedirectURI  string
+	)
+
+	idp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/login/oauth/authorize":
+			mu.Lock()
+			authorizeRedirectURI = r.URL.Query().Get("redirect_uri")
+			mu.Unlock()
+			cb, err := url.Parse(r.URL.Query().Get("redirect_uri"))
+			require.NoError(t, err)
+			q := cb.Query()
+			q.Set("code", "test-code")
+			q.Set("state", r.URL.Query().Get("state"))
+			cb.RawQuery = q.Encode()
+			http.Redirect(w, r, cb.String(), http.StatusFound)
+
+		case "/login/oauth/access_token":
+			require.NoError(t, r.ParseForm())
+			mu.Lock()
+			exchangeRedirectURI = r.PostForm.Get("redirect_uri")
+			mu.Unlock()
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"access_token": "test-token",
+				"token_type":   "Bearer",
+				"expires_in":   3600,
+			})
+
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(idp.Close)
+
+	// Replace the real browser opener with a goroutine that fetches the
+	// authorize URL, just like a real browser would.
+	origOpenBrowser := openBrowser
+	t.Cleanup(func() { openBrowser = origOpenBrowser })
+	openBrowser = func(authURL string) error {
+		go func() {
+			resp, err := http.Get(authURL)
+			if err == nil {
+				resp.Body.Close()
+			}
+		}()
+		return nil
+	}
+
+	// Leave RedirectURL empty so tea picks a random port.
+	_, token, err := performBrowserOAuthFlow(context.Background(), OAuthOptions{
+		URL:      idp.URL,
+		ClientID: "test-client-id",
+	})
+	require.NoError(t, err)
+	require.Equal(t, "test-token", token.AccessToken)
+
+	mu.Lock()
+	defer mu.Unlock()
+	require.NotEmpty(t, authorizeRedirectURI)
+	require.NotEmpty(t, exchangeRedirectURI)
+	assert.Equal(t, authorizeRedirectURI, exchangeRedirectURI,
+		"redirect_uri must match between authorize and token exchange (RFC 6749 §4.1.3)")
+}
+
+// Regression test for the browser opener hang: xdg-open does not exit until
+// the browser it launched does, and the callback is only consumed after
+// openBrowser returns. Waiting on the opener hangs the CLI even though the
+// user authenticated successfully.
+func TestOpenBrowser_DoesNotWaitForOpener(t *testing.T) {
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+		t.Skip("xdg-open is not the opener on this platform")
+	}
+
+	const (
+		fakeOpenerSleepTime = 10 * time.Second
+		openBrowserTimeout  = 2 * time.Second
+	)
+
+	// A stand-in xdg-open that holds the foreground the way a browser it had
+	// to launch would.
+	dir := t.TempDir()
+	opener := filepath.Join(dir, "xdg-open")
+	script := fmt.Sprintf("#!/bin/sh\nexec sleep %d\n", int(fakeOpenerSleepTime.Seconds()))
+	require.NoError(t, os.WriteFile(opener, []byte(script), 0o755))
+	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	done := make(chan error, 1)
+	go func() { done <- openBrowser("http://127.0.0.1:1/") }()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(openBrowserTimeout):
+		t.Fatal("openBrowser blocked on the opener; the callback would never be consumed")
+	}
+}