mirror of
https://gitea.com/gitea/tea.git
synced 2026-10-26 11:01:25 +01:00
feat!: rebuild tea on Cobra with explicit noun/verb commands (#1126)
- **switch tea to the Cobra command tree:** `internal/app` wires the packages from parts 1–4 into explicit noun/verb commands with `--repo`, `--json` / `--jq`, `--sudo` and `--debug`; `main.go` points at it. Build, release and docs tooling (`tools/cli-docs`, Makefile, goreleaser, snap, CI) and README / CONTRIBUTING are updated. - **remove the urfave/cli command tree:** deletes `cmd/`, `modules/`, the old integration tests, contrib completion scripts and the generated `docs/CLI.md`, and drops their dependencies. This commit only deletes. ## Breaking changes This is a breaking release. It requires Gitea 28 or newer; configuration moves to separate `config.yml` and `hosts.yml` files and requires fresh authentication, and command names, aliases, flags and output formats change. `docs/migration-1.0.md` maps every old command, flag and environment variable to its replacement. ## Issues fixes #1118 fixes #1116 fixes #1115 fixes #1094 fixes #1091 fixes #1073 fixes #1052 fixes #1032 fixes #1023 fixes #966 fixes #908 fixes #833 fixes #831 fixes #817 fixes #804 fixes #779 fixes #770 fixes #737 fixes #697 fixes #726 fixes #677 fixes #672 fixes #633 fixes #632 fixes #560 fixes #556 fixes #523 fixes #516 fixes #510 fixes #504 fixes #500 fixes #482 fixes #406 fixes #403 fixes #373 fixes #351 fixes #344 fixes #326 fixes #325 fixes #323 fixes #246 fixes #240 fixes #232 fixes #197 fixes #172 fixes #141 fixes #69 fixes #1110 fixes #569 fixes #480 fixes #666 fixes #670 fixes #457 fixes #643 fixes #498 fixes #490 fixes #1069 fixes #834 fixes #602 fixes #328 fixes #417 fixes #571 fixes #1029 fixes #489 fixes #1050 fixes #162 fixes #430 fixes #1087 fixes #683 Reviewed-on: https://gitea.com/gitea/tea/pulls/1126 Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>
This commit is contained in:
bircni committed
1 parent
12e415a7a7
commit
f02245449b
456 files changed
+18892
-34015
No files matched your search
@@ -0,0 +1,522 @@
|
||||
// Copyright 2026 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package app
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"gitea.dev/tea/internal/auth"
|
||||
"gitea.dev/tea/internal/clierr"
|
||||
"gitea.dev/tea/internal/settings"
|
||||
"gitea.dev/tea/internal/transport"
|
||||
"github.com/stretchr/testify/require"
|
||||
"golang.org/x/crypto/ssh"
|
||||
)
|
||||
|
||||
type statusKeyring struct{ reads []string }
|
||||
|
||||
func (s *statusKeyring) Get(_, identity string) (string, error) {
|
||||
s.reads = append(s.reads, identity)
|
||||
return `{"access_token":"private-status-token"}`, nil
|
||||
}
|
||||
|
||||
func (*statusKeyring) Set(string, string, string) error { return nil }
|
||||
func (*statusKeyring) Delete(string, string) error { return nil }
|
||||
|
||||
type channelBrowser struct{ opened chan string }
|
||||
|
||||
func (b *channelBrowser) Open(_ context.Context, resource, _ string) error {
|
||||
select {
|
||||
case b.opened <- resource:
|
||||
default:
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func TestLoginValidatesUserEnvironmentWithFlagPrecedence(t *testing.T) {
|
||||
server := newAuthenticatedServer(http.NotFoundHandler())
|
||||
defer server.Close()
|
||||
for _, test := range []struct {
|
||||
name, environment, flag string
|
||||
accepted bool
|
||||
}{
|
||||
{"environment matches", "ALICE", "", true},
|
||||
{"environment mismatches", "bob", "", false},
|
||||
{"flag overrides environment", "bob", "alice", true},
|
||||
{"flag mismatches", "alice", "bob", false},
|
||||
} {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
deps, _, _ := testDeps(t)
|
||||
deps.Streams.In = strings.NewReader("private-login-token\n")
|
||||
deps.Getenv = envFunc(map[string]string{"TEA_USER": test.environment})
|
||||
args := []string{"auth", "login", "--host", server.URL, "--with-token", "--credential-store", "file", "--no-input"}
|
||||
if test.flag != "" {
|
||||
args = append(args, "--user", test.flag)
|
||||
}
|
||||
err := Execute(context.Background(), deps, args)
|
||||
if test.accepted {
|
||||
require.NoError(t, err)
|
||||
} else {
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
||||
require.NotContains(t, err.Error(), "private-login-token")
|
||||
}
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
if test.accepted {
|
||||
require.Equal(t, "alice", snapshot.Hosts.Hosts[server.URL].User)
|
||||
} else {
|
||||
require.Empty(t, snapshot.Hosts.Hosts)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginInsecureInstance(t *testing.T) {
|
||||
server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||||
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
||||
}))
|
||||
server.Config.ErrorLog = log.New(io.Discard, "", 0)
|
||||
server.StartTLS()
|
||||
defer server.Close()
|
||||
deps, _, _ := testDeps(t)
|
||||
login := func(flags ...string) error {
|
||||
deps.Streams.In = strings.NewReader("token\n")
|
||||
return Execute(context.Background(), deps, append([]string{"auth", "login", "--host", server.URL, "--with-token", "--credential-store", "file", "--no-input"}, flags...))
|
||||
}
|
||||
require.Error(t, login())
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(login("--client-id", "custom")))
|
||||
require.NoError(t, login("--insecure"))
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
host := snapshot.Hosts.Hosts[server.URL]
|
||||
require.True(t, host.Insecure)
|
||||
require.Empty(t, host.OAuthClientID)
|
||||
configureHost(t, deps, server.URL, settings.Host{Insecure: true, OAuthClientID: "custom"})
|
||||
require.NoError(t, login())
|
||||
snapshot, err = deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "custom", snapshot.Hosts.Hosts[server.URL].OAuthClientID)
|
||||
}
|
||||
|
||||
func TestAuthSwitchInvalidTargetsAreUsageErrors(t *testing.T) {
|
||||
for _, host := range []string{"invalid-host", "https://unconfigured.example.org"} {
|
||||
deps, out, _ := testDeps(t)
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(Execute(context.Background(), deps, []string{"auth", "switch", "alice", "--host", host})))
|
||||
require.Empty(t, out.String())
|
||||
}
|
||||
deps, out, _ := testDeps(t)
|
||||
configureHost(t, deps, "https://example.org", settings.Host{User: "alice", Users: tokenAccounts(settings.StoreFile, "alice")})
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(Execute(context.Background(), deps, []string{"auth", "switch", "bob", "--host", "https://example.org"})))
|
||||
require.Empty(t, out.String())
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "alice", snapshot.Hosts.Hosts["https://example.org"].User)
|
||||
configureHost(t, deps, "https://example.org", settings.Host{Users: tokenAccounts(settings.StoreFile, "Alice")})
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "switch", "alice", "--host", "https://example.org"}))
|
||||
snapshot, err = deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "Alice", snapshot.Hosts.Hosts["https://example.org"].User)
|
||||
}
|
||||
|
||||
func TestLogoutRejectsUnknownAccountBeforeConfirmation(t *testing.T) {
|
||||
deps, out, diagnostics := testDeps(t)
|
||||
keyring := &statusKeyring{}
|
||||
deps.Credentials.Keyring = keyring
|
||||
configureHost(t, deps, "https://example.org", settings.Host{User: "alice", Users: tokenAccounts(settings.StoreKeyring, "alice")})
|
||||
err := Execute(context.Background(), deps, []string{"auth", "logout", "--host", "https://example.org", "--user", "bob", "--no-input"})
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
||||
require.ErrorContains(t, err, "account is not configured")
|
||||
require.Empty(t, out.String())
|
||||
require.Empty(t, diagnostics.String())
|
||||
require.Empty(t, keyring.reads)
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "alice", snapshot.Hosts.Hosts["https://example.org"].User)
|
||||
}
|
||||
|
||||
func TestAuthStatusFiltersBeforeReadingCredentials(t *testing.T) {
|
||||
deps, out, _ := testDeps(t)
|
||||
keyring := &statusKeyring{}
|
||||
deps.Credentials.Keyring = keyring
|
||||
for _, host := range []string{"https://example.org/base", "https://other.example.org"} {
|
||||
configureHost(t, deps, host, settings.Host{User: "alice", Users: tokenAccounts(settings.StoreKeyring, "alice", "bob")})
|
||||
}
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--host", "https://EXAMPLE.org/base/", "--user", "BOB", "--json"}))
|
||||
require.Equal(t, []string{auth.Identity("https://example.org/base", "bob")}, keyring.reads)
|
||||
require.JSONEq(t, `[{"host":"https://example.org/base","user":"bob","active":false,"credential_store":"keyring","credential_available":true,"expires_at":null,"verified":null,"error":""}]`, out.String())
|
||||
out.Reset()
|
||||
keyring.reads = nil
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--host", "https://unconfigured.example.org", "--json"}))
|
||||
require.JSONEq(t, `[]`, out.String())
|
||||
require.Empty(t, keyring.reads)
|
||||
out.Reset()
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(Execute(context.Background(), deps, []string{"auth", "status", "--host", "invalid-host"})))
|
||||
require.Empty(t, out.String())
|
||||
require.Empty(t, keyring.reads)
|
||||
}
|
||||
|
||||
func TestLogoutSelectsAccountWithoutAuthentication(t *testing.T) {
|
||||
for _, test := range []struct {
|
||||
name string
|
||||
flags []string
|
||||
environment map[string]string
|
||||
selected string
|
||||
}{
|
||||
{name: "active account", selected: "alice"},
|
||||
{name: "environment account", environment: map[string]string{"TEA_HOST": "https://example.org", "TEA_USER": "bob", "GITEA_TOKEN": "expired"}, selected: "bob"},
|
||||
{name: "flag overrides environment", flags: []string{"--host", "https://example.org", "--user", "alice"}, environment: map[string]string{"TEA_HOST": "https://other.example.org", "TEA_USER": "bob"}, selected: "alice"},
|
||||
} {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
deps, out, _ := testDeps(t)
|
||||
keyring := &statusKeyring{}
|
||||
deps.Credentials.Keyring = keyring
|
||||
deps.Getenv = envFunc(test.environment)
|
||||
accounts := tokenAccounts(settings.StoreKeyring, "bob", "charlie")
|
||||
accounts["alice"] = settings.Account{AuthMethod: settings.AuthOAuth, CredentialStore: settings.StoreKeyring}
|
||||
configureHost(t, deps, "https://example.org", settings.Host{User: "alice", Users: accounts})
|
||||
args := append([]string{"auth", "logout", "--yes", "--no-input"}, test.flags...)
|
||||
require.NoError(t, Execute(context.Background(), deps, args))
|
||||
require.Empty(t, out.String())
|
||||
require.Equal(t, []string{auth.Identity("https://example.org", test.selected)}, keyring.reads)
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
host := snapshot.Hosts.Hosts["https://example.org"]
|
||||
require.NotContains(t, host.Users, test.selected)
|
||||
require.Len(t, host.Users, 2)
|
||||
if test.selected == "alice" {
|
||||
require.Empty(t, host.User)
|
||||
} else {
|
||||
require.Equal(t, "alice", host.User)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthLoginSSHKeyPersistsAndSignsSubsequentRequests(t *testing.T) {
|
||||
keyPath := writeAppTempSSHKey(t, "")
|
||||
var requests []http.Header
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
requests = append(requests, r.Header.Clone())
|
||||
switch {
|
||||
case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/api/v1/user"):
|
||||
require.NotEmpty(t, r.Header.Get("Signature"))
|
||||
require.Empty(t, r.Header.Get("Authorization"))
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
||||
case r.Method == http.MethodGet && strings.Contains(r.URL.Path, "/api/v1/repos/alice/project/issues"):
|
||||
require.NotEmpty(t, r.Header.Get("Signature"))
|
||||
require.Empty(t, r.Header.Get("Authorization"))
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = w.Write([]byte(`[]`))
|
||||
default:
|
||||
t.Fatalf("unexpected %s %s", r.Method, r.URL.Path)
|
||||
}
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
deps, _, _ := testDeps(t)
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{
|
||||
"auth", "login", "--host", server.URL, "--ssh-key", keyPath, "--no-input", "--yes",
|
||||
}))
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
account := snapshot.Hosts.Hosts[server.URL].Users["alice"]
|
||||
require.Equal(t, settings.Account{AuthMethod: "httpsign", SSHKey: keyPath}, account)
|
||||
require.Empty(t, account.CredentialStore)
|
||||
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{
|
||||
"issue", "list", "-R", "alice/project", "--host", server.URL, "--json",
|
||||
}))
|
||||
require.GreaterOrEqual(t, len(requests), 2)
|
||||
for _, header := range requests {
|
||||
require.NotEmpty(t, header.Get("Signature"))
|
||||
require.Empty(t, header.Get("Authorization"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthLoginSSHKeyCertificateUsesSSHAuthMethod(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
keyPath := filepath.Join(dir, "id_ed25519")
|
||||
_, userKey, err := ed25519.GenerateKey(rand.Reader)
|
||||
require.NoError(t, err)
|
||||
_, caKey, err := ed25519.GenerateKey(rand.Reader)
|
||||
require.NoError(t, err)
|
||||
userSigner, err := ssh.NewSignerFromKey(userKey)
|
||||
require.NoError(t, err)
|
||||
caSigner, err := ssh.NewSignerFromKey(caKey)
|
||||
require.NoError(t, err)
|
||||
block, err := ssh.MarshalPrivateKey(userKey, "")
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, os.WriteFile(keyPath, pem.EncodeToMemory(block), 0o600))
|
||||
cert := &ssh.Certificate{
|
||||
Key: userSigner.PublicKey(),
|
||||
CertType: ssh.UserCert,
|
||||
ValidPrincipals: []string{"alice"},
|
||||
ValidAfter: 0,
|
||||
ValidBefore: ssh.CertTimeInfinity,
|
||||
}
|
||||
require.NoError(t, cert.SignCert(rand.Reader, caSigner))
|
||||
require.NoError(t, os.WriteFile(keyPath+"-cert.pub", ssh.MarshalAuthorizedKey(cert), 0o600))
|
||||
|
||||
var method settings.Account
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
require.NotEmpty(t, r.Header.Get("Signature"))
|
||||
require.NotEmpty(t, r.Header.Get("x-ssh-certificate"))
|
||||
require.Empty(t, r.Header.Get("Authorization"))
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
deps, _, _ := testDeps(t)
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{
|
||||
"auth", "login", "--host", server.URL, "--ssh-key", keyPath, "--no-input", "--yes",
|
||||
}))
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
method = snapshot.Hosts.Hosts[server.URL].Users["alice"]
|
||||
require.Equal(t, "ssh", method.AuthMethod)
|
||||
require.Equal(t, "yes", method.SSHCertPrincipal)
|
||||
require.Equal(t, keyPath, method.SSHKey)
|
||||
}
|
||||
|
||||
func TestAuthLoginEncryptedSSHKeyPromptsForPassphrase(t *testing.T) {
|
||||
keyPath := writeAppTempSSHKey(t, "correct horse")
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
require.NotEmpty(t, r.Header.Get("Signature"))
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
deps, _, _ := testDeps(t)
|
||||
err := Execute(context.Background(), deps, []string{"auth", "login", "--host", server.URL, "--ssh-key", keyPath, "--no-input"})
|
||||
require.Equal(t, clierr.Authentication, clierr.ExitCode(err))
|
||||
require.ErrorContains(t, err, "ssh-agent")
|
||||
|
||||
prompter := &scriptedPrompter{secret: "correct horse", accept: true}
|
||||
deps.Prompter = prompter
|
||||
deps.Streams.InTTY, deps.Streams.ErrTTY = true, true
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "login", "--host", server.URL, "--ssh-key", keyPath}))
|
||||
require.Equal(t, []string{"Passphrase for " + keyPath}, prompter.secrets)
|
||||
}
|
||||
|
||||
func TestAuthLoginMethodFlagsAreMutuallyExclusive(t *testing.T) {
|
||||
keyPath := writeAppTempSSHKey(t, "")
|
||||
deps, out, _ := testDeps(t)
|
||||
deps.Streams.In = strings.NewReader("token\n")
|
||||
for _, args := range [][]string{
|
||||
{"auth", "login", "--host", "https://example.org", "--with-token", "--oauth", "--no-input"},
|
||||
{"auth", "login", "--host", "https://example.org", "--with-token", "--ssh-key", keyPath, "--no-input"},
|
||||
{"auth", "login", "--host", "https://example.org", "--oauth", "--ssh-agent-key", "SHA256:abc", "--no-input"},
|
||||
{"auth", "login", "--host", "https://example.org", "--ssh-key", keyPath, "--ssh-agent-principal", "git", "--no-input"},
|
||||
{"auth", "login", "--host", "https://example.org", "--ssh-agent-key", "SHA256:abc", "--ssh-agent-principal", "git", "--no-input"},
|
||||
{"auth", "login", "--host", "https://example.org", "--no-input"},
|
||||
} {
|
||||
t.Run(strings.Join(args[3:], " "), func(t *testing.T) {
|
||||
err := Execute(context.Background(), deps, args)
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
||||
require.ErrorContains(t, err, "select exactly one")
|
||||
require.Empty(t, out.String())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthLoginValidatesMethodBeforePromptingForHost(t *testing.T) {
|
||||
for args, want := range map[string]string{
|
||||
"auth login": "select exactly one",
|
||||
"auth login --with-token --client-id x": "--client-id requires --oauth",
|
||||
} {
|
||||
t.Run(args, func(t *testing.T) {
|
||||
deps, out, _ := testDeps(t)
|
||||
prompt := &scriptedPrompter{input: "https://example.org"}
|
||||
deps.Prompter = prompt
|
||||
deps.Streams.InTTY, deps.Streams.ErrTTY = true, true
|
||||
err := Execute(context.Background(), deps, strings.Fields(args))
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
||||
require.ErrorContains(t, err, want)
|
||||
require.Empty(t, prompt.asked)
|
||||
require.Empty(t, out.String())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// writeAppTempSSHKey writes a new ed25519 private key, encrypted when passphrase is set.
|
||||
func writeAppTempSSHKey(t *testing.T, passphrase string) string {
|
||||
t.Helper()
|
||||
_, privateKey, err := ed25519.GenerateKey(rand.Reader)
|
||||
require.NoError(t, err)
|
||||
var block *pem.Block
|
||||
if passphrase == "" {
|
||||
block, err = ssh.MarshalPrivateKey(privateKey, "")
|
||||
} else {
|
||||
block, err = ssh.MarshalPrivateKeyWithPassphrase(privateKey, "", []byte(passphrase))
|
||||
}
|
||||
require.NoError(t, err)
|
||||
path := filepath.Join(t.TempDir(), "id_ed25519")
|
||||
require.NoError(t, os.WriteFile(path, pem.EncodeToMemory(block), 0o600))
|
||||
return path
|
||||
}
|
||||
|
||||
func TestAuthRefreshExpiredCredentialOnlyOnce(t *testing.T) {
|
||||
requests := 0
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
requests++
|
||||
require.Equal(t, "/login/oauth/access_token", r.URL.Path)
|
||||
require.NoError(t, r.ParseForm())
|
||||
require.Equal(t, "original-refresh", r.Form.Get("refresh_token"))
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = fmt.Fprintln(w, `{"access_token":"new-access","refresh_token":"rotated-refresh","expires_in":3600,"token_type":"Bearer"}`)
|
||||
}))
|
||||
defer server.Close()
|
||||
deps, out, diagnostics := testDeps(t)
|
||||
now := time.Now()
|
||||
deps.Now = func() time.Time { return now }
|
||||
manager := testManager(t, deps)
|
||||
require.NoError(t, manager.Register(server.URL, "alice", "file", "oauth", auth.HostOptions{OAuthClientID: "client"}, auth.Credential{AccessToken: "expired", RefreshToken: "original-refresh", ExpiresAt: now.Add(-time.Hour)}))
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "refresh", "--host", server.URL, "--user", "alice", "--no-input"}))
|
||||
require.Equal(t, 1, requests)
|
||||
credential, err := deps.Credentials.Load(server.URL, "alice", "file")
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "rotated-refresh", credential.RefreshToken)
|
||||
require.Equal(t, "new-access", credential.AccessToken)
|
||||
require.Empty(t, out.String())
|
||||
require.Empty(t, diagnostics.String())
|
||||
}
|
||||
|
||||
func TestAuthRefreshRejectsTokenAccounts(t *testing.T) {
|
||||
deps, out, _ := testDeps(t)
|
||||
manager := testManager(t, deps)
|
||||
require.NoError(t, manager.Register("https://example.org", "alice", "file", "token", auth.HostOptions{}, auth.Credential{AccessToken: "token"}))
|
||||
err := Execute(context.Background(), deps, []string{"auth", "refresh", "--host", "https://example.org", "--user", "alice", "--no-input"})
|
||||
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
||||
require.ErrorContains(t, err, "only OAuth accounts")
|
||||
require.Empty(t, out.String())
|
||||
}
|
||||
|
||||
func TestAuthStatusVerifyChecksStoredCredentials(t *testing.T) {
|
||||
requests := 0
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
requests++
|
||||
require.Equal(t, "/api/v1/user", r.URL.Path)
|
||||
if r.Header.Get("Authorization") != "token valid-status-token" {
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
||||
}))
|
||||
defer server.Close()
|
||||
deps, out, _ := testDeps(t)
|
||||
expires := time.Date(2030, 1, 2, 3, 4, 5, 0, time.UTC)
|
||||
require.NoError(t, deps.Credentials.Save(server.URL, "alice", settings.StoreFile, auth.Credential{AccessToken: "valid-status-token", RefreshToken: "refresh", ExpiresAt: expires}))
|
||||
require.NoError(t, deps.Credentials.Save(server.URL, "bob", settings.StoreFile, auth.Credential{AccessToken: "revoked-status-token"}))
|
||||
accounts := tokenAccounts(settings.StoreFile, "bob", "carol")
|
||||
accounts["alice"] = settings.Account{AuthMethod: settings.AuthOAuth, CredentialStore: settings.StoreFile}
|
||||
configureHost(t, deps, server.URL, settings.Host{User: "alice", Users: accounts})
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--json=user,verified,error"}))
|
||||
require.Zero(t, requests)
|
||||
require.JSONEq(t, `[{"user":"alice","verified":null,"error":""},{"user":"bob","verified":null,"error":""},{"user":"carol","verified":null,"error":""}]`, out.String())
|
||||
out.Reset()
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--verify", "--json"}))
|
||||
require.Equal(t, 2, requests)
|
||||
var rows []struct {
|
||||
User string `json:"user"`
|
||||
ExpiresAt *time.Time `json:"expires_at"`
|
||||
Verified *bool `json:"verified"`
|
||||
Error string `json:"error"`
|
||||
}
|
||||
require.NoError(t, json.Unmarshal(out.Bytes(), &rows))
|
||||
require.Len(t, rows, 3)
|
||||
require.Equal(t, "alice", rows[0].User)
|
||||
require.True(t, rows[0].ExpiresAt.Equal(expires))
|
||||
require.True(t, *rows[0].Verified)
|
||||
require.Empty(t, rows[0].Error)
|
||||
for _, row := range rows[1:] {
|
||||
require.False(t, *row.Verified, row.User)
|
||||
require.Nil(t, row.ExpiresAt)
|
||||
require.NotEmpty(t, row.Error)
|
||||
}
|
||||
require.Equal(t, "credential unavailable", rows[2].Error)
|
||||
require.NotContains(t, out.String(), "status-token")
|
||||
out.Reset()
|
||||
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--verify", "--user", "alice"}))
|
||||
require.Equal(t, server.URL+"\talice\tactive=true\tcredentials=true\texpires=2030-01-02T03:04:05Z\tverified=true\n", out.String())
|
||||
}
|
||||
|
||||
func TestOAuthLoginOpensAuthorizationURLInBrowser(t *testing.T) {
|
||||
opened := make(chan string, 1)
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
switch r.URL.Path {
|
||||
case "/login/oauth/access_token":
|
||||
require.NoError(t, r.ParseForm())
|
||||
require.Equal(t, "authorization_code", r.Form.Get("grant_type"))
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(map[string]any{"access_token": "access", "refresh_token": "refresh", "expires_in": 3600, "token_type": "Bearer"})
|
||||
case "/api/v1/user":
|
||||
require.Equal(t, "token access", r.Header.Get("Authorization"))
|
||||
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
||||
default:
|
||||
t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
|
||||
w.WriteHeader(http.StatusNotFound)
|
||||
}
|
||||
}))
|
||||
defer server.Close()
|
||||
browser := &channelBrowser{opened: opened}
|
||||
deps, _, diagnostics := testDeps(t)
|
||||
deps.Browser = browser
|
||||
deps.Credentials = &auth.Store{Dir: deps.Settings.Dir, Keyring: &statusKeyring{}}
|
||||
deps.Streams.InTTY, deps.Streams.ErrTTY = true, true
|
||||
deps.Client = func(instance, token string, insecure bool) *transport.Client {
|
||||
client := transport.New(instance, token, insecure)
|
||||
client.HTTP = server.Client()
|
||||
return client
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
done := make(chan error, 1)
|
||||
go func() {
|
||||
done <- Execute(ctx, deps, []string{"auth", "login", "--host", server.URL, "--oauth", "--client-id", "test-client", "--credential-store", "file", "--yes"})
|
||||
}()
|
||||
var resource string
|
||||
select {
|
||||
case resource = <-opened:
|
||||
case <-time.After(3 * time.Second):
|
||||
t.Fatal("browser was not opened")
|
||||
}
|
||||
u, err := url.Parse(resource)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "/login/oauth/authorize", u.Path)
|
||||
require.Equal(t, "test-client", u.Query().Get("client_id"))
|
||||
redirect := u.Query().Get("redirect_uri")
|
||||
state := u.Query().Get("state")
|
||||
require.NotEmpty(t, redirect)
|
||||
require.NotEmpty(t, state)
|
||||
callback, err := http.Get(redirect + "?code=valid-code&state=" + url.QueryEscape(state))
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, http.StatusOK, callback.StatusCode)
|
||||
_ = callback.Body.Close()
|
||||
require.NoError(t, <-done)
|
||||
require.Contains(t, diagnostics.String(), "Open this URL to authorize tea:")
|
||||
require.Contains(t, diagnostics.String(), resource)
|
||||
snapshot, err := deps.Settings.Load()
|
||||
require.NoError(t, err)
|
||||
normalized, err := settings.NormalizeHost(server.URL)
|
||||
require.NoError(t, err)
|
||||
require.Contains(t, snapshot.Hosts.Hosts[normalized].Users, "alice")
|
||||
}
|
||||
Reference in new issue
Block a user