mirror of
https://gitea.com/gitea/tea.git
synced 2026-10-26 19:11:25 +01:00
876 lines
40 KiB
Go
876 lines
40 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package app
|
|
|
|
import (
|
|
"bytes"
|
|
"cmp"
|
|
"context"
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"encoding/json"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"gitea.dev/tea/internal/auth"
|
|
"gitea.dev/tea/internal/clierr"
|
|
"gitea.dev/tea/internal/settings"
|
|
"gitea.dev/tea/internal/terminal"
|
|
"gitea.dev/tea/internal/transport"
|
|
"github.com/stretchr/testify/require"
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
type statusKeyring struct{ reads []string }
|
|
|
|
func (s *statusKeyring) Get(_, identity string) (string, error) {
|
|
s.reads = append(s.reads, identity)
|
|
return `{"access_token":"private-status-token"}`, nil
|
|
}
|
|
|
|
func (*statusKeyring) Set(string, string, string) error { return nil }
|
|
func (*statusKeyring) Delete(string, string) error { return nil }
|
|
|
|
type channelBrowser struct{ opened chan string }
|
|
|
|
func (b *channelBrowser) Open(_ context.Context, resource, _ string) error {
|
|
select {
|
|
case b.opened <- resource:
|
|
default:
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func TestLoginValidatesUserEnvironmentWithFlagPrecedence(t *testing.T) {
|
|
server := newAuthenticatedServer(http.NotFoundHandler())
|
|
defer server.Close()
|
|
for _, test := range []struct {
|
|
name, environment, flag string
|
|
accepted bool
|
|
}{
|
|
{"environment matches", "ALICE", "", true},
|
|
{"environment mismatches", "bob", "", false},
|
|
{"flag overrides environment", "bob", "alice", true},
|
|
{"flag mismatches", "alice", "bob", false},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
deps, _, _ := testDeps(t)
|
|
deps.Streams.In = strings.NewReader("private-login-token\n")
|
|
deps.Getenv = envFunc(map[string]string{"TEA_USER": test.environment})
|
|
args := []string{"auth", "login", "--host", server.URL, "--with-token", "--credential-store", "file", "--no-input"}
|
|
if test.flag != "" {
|
|
args = append(args, "--user", test.flag)
|
|
}
|
|
err := Execute(context.Background(), deps, args)
|
|
if test.accepted {
|
|
require.NoError(t, err)
|
|
} else {
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
|
require.NotContains(t, err.Error(), "private-login-token")
|
|
}
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
if test.accepted {
|
|
require.Equal(t, "alice", snapshot.Hosts.Hosts[server.URL].User)
|
|
} else {
|
|
require.Empty(t, snapshot.Hosts.Hosts)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestLoginWithTokenPromptsWithoutEchoOnATerminal(t *testing.T) {
|
|
server := newAuthenticatedServer(http.NotFoundHandler())
|
|
defer server.Close()
|
|
args := []string{"auth", "login", "--host", server.URL, "--with-token", "--credential-store", "file"}
|
|
deps, _, _ := testDeps(t)
|
|
deps.Streams.In = strings.NewReader("echoed-token\n")
|
|
deps.Streams.InTTY, deps.Streams.ErrTTY = true, true
|
|
prompt := &scriptedPrompter{secret: " private-login-token "}
|
|
deps.Prompter = prompt
|
|
err := Execute(context.Background(), deps, append(args, "--no-input"))
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err), "%v", err)
|
|
require.ErrorContains(t, err, "tea auth login --with-token < token.txt")
|
|
require.Empty(t, prompt.secrets)
|
|
require.NoError(t, Execute(context.Background(), deps, args))
|
|
require.Equal(t, []string{"Paste an access token"}, prompt.secrets)
|
|
credential, err := deps.Credentials.Load(server.URL, "alice", settings.StoreFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "private-login-token", credential.AccessToken)
|
|
}
|
|
|
|
func TestLoginInsecureInstance(t *testing.T) {
|
|
server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
}))
|
|
server.Config.ErrorLog = log.New(io.Discard, "", 0)
|
|
server.StartTLS()
|
|
defer server.Close()
|
|
deps, _, _ := testDeps(t)
|
|
login := func(flags ...string) error {
|
|
deps.Streams.In = strings.NewReader("token\n")
|
|
return Execute(context.Background(), deps, append([]string{"auth", "login", "--host", server.URL, "--with-token", "--credential-store", "file", "--no-input"}, flags...))
|
|
}
|
|
require.Error(t, login())
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(login("--client-id", "custom")))
|
|
require.NoError(t, login("--insecure"))
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
host := snapshot.Hosts.Hosts[server.URL]
|
|
require.True(t, host.Insecure)
|
|
require.Empty(t, host.OAuthClientID)
|
|
configureHost(t, deps, server.URL, settings.Host{Insecure: true, OAuthClientID: "custom"})
|
|
require.NoError(t, login())
|
|
snapshot, err = deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
require.Equal(t, "custom", snapshot.Hosts.Hosts[server.URL].OAuthClientID)
|
|
}
|
|
|
|
func TestAuthSwitchInvalidTargetsAreUsageErrors(t *testing.T) {
|
|
for _, host := range []string{"invalid-host", "https://unconfigured.example.org"} {
|
|
deps, out, _ := testDeps(t)
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(Execute(context.Background(), deps, []string{"auth", "switch", "alice", "--host", host})))
|
|
require.Empty(t, out.String())
|
|
}
|
|
deps, out, _ := testDeps(t)
|
|
configureHost(t, deps, "https://example.org", settings.Host{User: "alice", Users: tokenAccounts(settings.StoreFile, "alice")})
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(Execute(context.Background(), deps, []string{"auth", "switch", "bob", "--host", "https://example.org"})))
|
|
require.Empty(t, out.String())
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
require.Equal(t, "alice", snapshot.Hosts.Hosts["https://example.org"].User)
|
|
configureHost(t, deps, "https://example.org", settings.Host{Users: tokenAccounts(settings.StoreFile, "Alice")})
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "switch", "alice", "--host", "https://example.org"}))
|
|
snapshot, err = deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
require.Equal(t, "Alice", snapshot.Hosts.Hosts["https://example.org"].User)
|
|
}
|
|
|
|
func TestLogoutRejectsUnknownAccountBeforeConfirmation(t *testing.T) {
|
|
deps, out, diagnostics := testDeps(t)
|
|
keyring := &statusKeyring{}
|
|
deps.Credentials.Keyring = keyring
|
|
configureHost(t, deps, "https://example.org", settings.Host{User: "alice", Users: tokenAccounts(settings.StoreKeyring, "alice")})
|
|
err := Execute(context.Background(), deps, []string{"auth", "logout", "--host", "https://example.org", "--user", "bob", "--no-input"})
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
|
require.EqualError(t, err, `account "bob" is not logged in on https://example.org (accounts: alice)`)
|
|
require.Empty(t, out.String())
|
|
require.Empty(t, diagnostics.String())
|
|
require.Empty(t, keyring.reads)
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
require.Equal(t, "alice", snapshot.Hosts.Hosts["https://example.org"].User)
|
|
}
|
|
|
|
func TestAuthStatusFiltersBeforeReadingCredentials(t *testing.T) {
|
|
deps, out, _ := testDeps(t)
|
|
keyring := &statusKeyring{}
|
|
deps.Credentials.Keyring = keyring
|
|
for _, host := range []string{"https://example.org/base", "https://other.example.org"} {
|
|
configureHost(t, deps, host, settings.Host{User: "alice", Users: tokenAccounts(settings.StoreKeyring, "alice", "bob")})
|
|
}
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--host", "https://EXAMPLE.org/base/", "--user", "BOB", "--json"}))
|
|
require.Equal(t, []string{auth.Identity("https://example.org/base", "bob")}, keyring.reads)
|
|
require.JSONEq(t, `[{"host":"https://example.org/base","user":"bob","active":false,"method":"token","credential_store":"keyring","credential_available":true,"expires_at":null,"verified":null,"error":""}]`, out.String())
|
|
out.Reset()
|
|
keyring.reads = nil
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--host", "https://unconfigured.example.org", "--json"}))
|
|
require.JSONEq(t, `[]`, out.String())
|
|
require.Empty(t, keyring.reads)
|
|
out.Reset()
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(Execute(context.Background(), deps, []string{"auth", "status", "--host", "ftp://invalid-host"})))
|
|
err := Execute(context.Background(), deps, []string{"auth", "status", "--host", "unconfigured.example.org"})
|
|
require.Equal(t, clierr.Authentication, clierr.ExitCode(err))
|
|
require.EqualError(t, err, "not logged in to https://unconfigured.example.org; run tea auth login --host https://unconfigured.example.org")
|
|
require.Empty(t, out.String())
|
|
require.Empty(t, keyring.reads)
|
|
}
|
|
|
|
func TestLogoutSelectsAccountWithoutAuthentication(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name string
|
|
flags []string
|
|
environment map[string]string
|
|
selected string
|
|
}{
|
|
{name: "active account", selected: "alice"},
|
|
{name: "environment account", environment: map[string]string{"TEA_HOST": "https://example.org", "TEA_USER": "bob", "GITEA_TOKEN": "expired"}, selected: "bob"},
|
|
{name: "flag overrides environment", flags: []string{"--host", "https://example.org", "--user", "alice"}, environment: map[string]string{"TEA_HOST": "https://other.example.org", "TEA_USER": "bob"}, selected: "alice"},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
deps, out, _ := testDeps(t)
|
|
keyring := &statusKeyring{}
|
|
deps.Credentials.Keyring = keyring
|
|
deps.Getenv = envFunc(test.environment)
|
|
accounts := tokenAccounts(settings.StoreKeyring, "bob", "charlie")
|
|
accounts["alice"] = settings.Account{AuthMethod: settings.AuthOAuth, CredentialStore: settings.StoreKeyring}
|
|
configureHost(t, deps, "https://example.org", settings.Host{User: "alice", Users: accounts})
|
|
args := append([]string{"auth", "logout", "--yes", "--no-input"}, test.flags...)
|
|
require.NoError(t, Execute(context.Background(), deps, args))
|
|
require.Empty(t, out.String())
|
|
require.Equal(t, []string{auth.Identity("https://example.org", test.selected)}, keyring.reads)
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
host := snapshot.Hosts.Hosts["https://example.org"]
|
|
require.NotContains(t, host.Users, test.selected)
|
|
require.Len(t, host.Users, 2)
|
|
if test.selected == "alice" {
|
|
require.Empty(t, host.User)
|
|
} else {
|
|
require.Equal(t, "alice", host.User)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAuthLoginSSHKeyPersistsAndSignsSubsequentRequests(t *testing.T) {
|
|
keyPath := writeAppTempSSHKey(t, "")
|
|
var requests []http.Header
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
requests = append(requests, r.Header.Clone())
|
|
switch {
|
|
case r.Method == http.MethodGet && strings.HasSuffix(r.URL.Path, "/api/v1/user"):
|
|
require.NotEmpty(t, r.Header.Get("Signature"))
|
|
require.Empty(t, r.Header.Get("Authorization"))
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
case r.Method == http.MethodGet && strings.Contains(r.URL.Path, "/api/v1/repos/alice/project/issues"):
|
|
require.NotEmpty(t, r.Header.Get("Signature"))
|
|
require.Empty(t, r.Header.Get("Authorization"))
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`[]`))
|
|
default:
|
|
t.Fatalf("unexpected %s %s", r.Method, r.URL.Path)
|
|
}
|
|
}))
|
|
defer server.Close()
|
|
|
|
deps, _, _ := testDeps(t)
|
|
require.NoError(t, Execute(context.Background(), deps, []string{
|
|
"auth", "login", "--host", server.URL, "--ssh-key", keyPath, "--no-input", "--yes",
|
|
}))
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
account := snapshot.Hosts.Hosts[server.URL].Users["alice"]
|
|
require.Equal(t, settings.Account{AuthMethod: "httpsign", SSHKey: keyPath}, account)
|
|
require.Empty(t, account.CredentialStore)
|
|
|
|
require.NoError(t, Execute(context.Background(), deps, []string{
|
|
"issue", "list", "-R", "alice/project", "--host", server.URL, "--json",
|
|
}))
|
|
require.GreaterOrEqual(t, len(requests), 2)
|
|
for _, header := range requests {
|
|
require.NotEmpty(t, header.Get("Signature"))
|
|
require.Empty(t, header.Get("Authorization"))
|
|
}
|
|
}
|
|
|
|
func TestAuthLoginSSHKeyCertificateUsesSSHAuthMethod(t *testing.T) {
|
|
dir := t.TempDir()
|
|
keyPath := filepath.Join(dir, "id_ed25519")
|
|
_, userKey, err := ed25519.GenerateKey(rand.Reader)
|
|
require.NoError(t, err)
|
|
_, caKey, err := ed25519.GenerateKey(rand.Reader)
|
|
require.NoError(t, err)
|
|
userSigner, err := ssh.NewSignerFromKey(userKey)
|
|
require.NoError(t, err)
|
|
caSigner, err := ssh.NewSignerFromKey(caKey)
|
|
require.NoError(t, err)
|
|
block, err := ssh.MarshalPrivateKey(userKey, "")
|
|
require.NoError(t, err)
|
|
require.NoError(t, os.WriteFile(keyPath, pem.EncodeToMemory(block), 0o600))
|
|
cert := &ssh.Certificate{
|
|
Key: userSigner.PublicKey(),
|
|
CertType: ssh.UserCert,
|
|
ValidPrincipals: []string{"alice"},
|
|
ValidAfter: 0,
|
|
ValidBefore: ssh.CertTimeInfinity,
|
|
}
|
|
require.NoError(t, cert.SignCert(rand.Reader, caSigner))
|
|
require.NoError(t, os.WriteFile(keyPath+"-cert.pub", ssh.MarshalAuthorizedKey(cert), 0o600))
|
|
|
|
var method settings.Account
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
require.NotEmpty(t, r.Header.Get("Signature"))
|
|
require.NotEmpty(t, r.Header.Get("x-ssh-certificate"))
|
|
require.Empty(t, r.Header.Get("Authorization"))
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
}))
|
|
defer server.Close()
|
|
|
|
deps, _, _ := testDeps(t)
|
|
require.NoError(t, Execute(context.Background(), deps, []string{
|
|
"auth", "login", "--host", server.URL, "--ssh-key", keyPath, "--no-input", "--yes",
|
|
}))
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
method = snapshot.Hosts.Hosts[server.URL].Users["alice"]
|
|
require.Equal(t, "ssh", method.AuthMethod)
|
|
require.Equal(t, "yes", method.SSHCertPrincipal)
|
|
require.Equal(t, keyPath, method.SSHKey)
|
|
}
|
|
|
|
func TestAuthLoginEncryptedSSHKeyPromptsForPassphrase(t *testing.T) {
|
|
keyPath := writeAppTempSSHKey(t, "correct horse")
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
require.NotEmpty(t, r.Header.Get("Signature"))
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
}))
|
|
defer server.Close()
|
|
|
|
deps, _, _ := testDeps(t)
|
|
err := Execute(context.Background(), deps, []string{"auth", "login", "--host", server.URL, "--ssh-key", keyPath, "--no-input"})
|
|
require.Equal(t, clierr.Authentication, clierr.ExitCode(err))
|
|
require.ErrorContains(t, err, "ssh-agent")
|
|
|
|
prompter := &scriptedPrompter{secret: "correct horse", accept: true}
|
|
deps.Prompter = prompter
|
|
deps.Streams.InTTY, deps.Streams.ErrTTY = true, true
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "login", "--host", server.URL, "--ssh-key", keyPath}))
|
|
require.Equal(t, []string{"Passphrase for " + keyPath}, prompter.secrets)
|
|
}
|
|
|
|
func TestAuthLoginMethodFlagsAreMutuallyExclusive(t *testing.T) {
|
|
keyPath := writeAppTempSSHKey(t, "")
|
|
deps, out, _ := testDeps(t)
|
|
deps.Streams.In = strings.NewReader("token\n")
|
|
for _, args := range [][]string{
|
|
{"auth", "login", "--host", "https://example.org", "--with-token", "--oauth", "--no-input"},
|
|
{"auth", "login", "--host", "https://example.org", "--with-token", "--ssh-key", keyPath, "--no-input"},
|
|
{"auth", "login", "--host", "https://example.org", "--oauth", "--ssh-agent-key", "SHA256:abc", "--no-input"},
|
|
{"auth", "login", "--host", "https://example.org", "--ssh-key", keyPath, "--ssh-agent-principal", "git", "--no-input"},
|
|
{"auth", "login", "--host", "https://example.org", "--ssh-agent-key", "SHA256:abc", "--ssh-agent-principal", "git", "--no-input"},
|
|
{"auth", "login", "--host", "https://example.org", "--no-input"},
|
|
} {
|
|
t.Run(strings.Join(args[3:], " "), func(t *testing.T) {
|
|
err := Execute(context.Background(), deps, args)
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
|
if strings.Count(strings.Join(args, " "), "--") > 2 {
|
|
require.ErrorContains(t, err, "select one of --with-token, --oauth, --ssh-key")
|
|
} else {
|
|
require.ErrorContains(t, err, "select how to log in: --with-token, --oauth or --ssh-key")
|
|
}
|
|
require.Empty(t, out.String())
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAuthLoginValidatesMethodBeforePromptingForHost(t *testing.T) {
|
|
for args, want := range map[string]string{
|
|
"auth login --with-token --oauth": "select one of",
|
|
"auth login --with-token --client-id x": "--client-id requires --oauth",
|
|
"auth login --with-token --scopes all": "--scopes requires --oauth",
|
|
"auth login --oauth --scopes nope": "--scopes must be all, read:activitypub",
|
|
} {
|
|
t.Run(args, func(t *testing.T) {
|
|
deps, out, _ := testDeps(t)
|
|
prompt := &scriptedPrompter{input: "https://example.org"}
|
|
deps.Prompter = prompt
|
|
deps.Streams.InTTY, deps.Streams.ErrTTY = true, true
|
|
err := Execute(context.Background(), deps, strings.Fields(args))
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
|
require.ErrorContains(t, err, want)
|
|
require.Empty(t, prompt.asked)
|
|
require.Empty(t, out.String())
|
|
})
|
|
}
|
|
}
|
|
|
|
// writeAppTempSSHKey writes a new ed25519 private key, encrypted when passphrase is set.
|
|
func writeAppTempSSHKey(t *testing.T, passphrase string) string {
|
|
t.Helper()
|
|
_, privateKey, err := ed25519.GenerateKey(rand.Reader)
|
|
require.NoError(t, err)
|
|
var block *pem.Block
|
|
if passphrase == "" {
|
|
block, err = ssh.MarshalPrivateKey(privateKey, "")
|
|
} else {
|
|
block, err = ssh.MarshalPrivateKeyWithPassphrase(privateKey, "", []byte(passphrase))
|
|
}
|
|
require.NoError(t, err)
|
|
path := filepath.Join(t.TempDir(), "id_ed25519")
|
|
require.NoError(t, os.WriteFile(path, pem.EncodeToMemory(block), 0o600))
|
|
return path
|
|
}
|
|
|
|
func TestAuthRefreshExpiredCredentialOnlyOnce(t *testing.T) {
|
|
requests := 0
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
requests++
|
|
require.Equal(t, "/login/oauth/access_token", r.URL.Path)
|
|
require.NoError(t, r.ParseForm())
|
|
require.Equal(t, "original-refresh", r.Form.Get("refresh_token"))
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = fmt.Fprintln(w, `{"access_token":"new-access","refresh_token":"rotated-refresh","expires_in":3600,"token_type":"Bearer"}`)
|
|
}))
|
|
defer server.Close()
|
|
deps, out, diagnostics := testDeps(t)
|
|
now := time.Now()
|
|
deps.Now = func() time.Time { return now }
|
|
manager := testManager(t, deps)
|
|
require.NoError(t, manager.Register(server.URL, "alice", "file", "oauth", auth.HostOptions{OAuthClientID: "client"}, auth.Credential{AccessToken: "expired", RefreshToken: "original-refresh", ExpiresAt: now.Add(-time.Hour)}))
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "refresh", "--host", server.URL, "--user", "alice", "--no-input"}))
|
|
require.Equal(t, 1, requests)
|
|
credential, err := deps.Credentials.Load(server.URL, "alice", "file")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "rotated-refresh", credential.RefreshToken)
|
|
require.Equal(t, "new-access", credential.AccessToken)
|
|
require.Empty(t, out.String())
|
|
require.Empty(t, diagnostics.String())
|
|
}
|
|
|
|
func TestAuthRefreshRejectsTokenAccounts(t *testing.T) {
|
|
deps, out, _ := testDeps(t)
|
|
manager := testManager(t, deps)
|
|
require.NoError(t, manager.Register("https://example.org", "alice", "file", "token", auth.HostOptions{}, auth.Credential{AccessToken: "token"}))
|
|
err := Execute(context.Background(), deps, []string{"auth", "refresh", "--host", "https://example.org", "--user", "alice", "--no-input"})
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
|
require.ErrorContains(t, err, "only OAuth accounts")
|
|
require.Empty(t, out.String())
|
|
}
|
|
|
|
func TestAuthStatusVerifyChecksStoredCredentials(t *testing.T) {
|
|
requests := 0
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path == "/api/v1/user" {
|
|
requests++
|
|
}
|
|
switch {
|
|
case r.Header.Get("Authorization") != "token valid-status-token":
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
case r.URL.Path == "/api/v1/token":
|
|
_, _ = w.Write([]byte(`{"scopes":["write:repository","read:user"]}`))
|
|
default:
|
|
require.Equal(t, "/api/v1/user", r.URL.Path)
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
}
|
|
}))
|
|
defer server.Close()
|
|
deps, out, _ := testDeps(t)
|
|
expires := time.Date(2030, 1, 2, 3, 4, 5, 0, time.UTC)
|
|
require.NoError(t, deps.Credentials.Save(server.URL, "alice", settings.StoreFile, auth.Credential{AccessToken: "valid-status-token", RefreshToken: "refresh", ExpiresAt: expires}))
|
|
require.NoError(t, deps.Credentials.Save(server.URL, "bob", settings.StoreFile, auth.Credential{AccessToken: "revoked-status-token"}))
|
|
accounts := tokenAccounts(settings.StoreFile, "bob", "carol")
|
|
accounts["alice"] = settings.Account{AuthMethod: settings.AuthOAuth, CredentialStore: settings.StoreFile}
|
|
configureHost(t, deps, server.URL, settings.Host{User: "alice", Users: accounts})
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--json=user,verified,error"}))
|
|
require.Zero(t, requests)
|
|
require.JSONEq(t, `[{"user":"alice","verified":null,"error":""},{"user":"bob","verified":null,"error":""},{"user":"carol","verified":null,"error":"credential unavailable; run tea auth login for this instance and account"}]`, out.String())
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--verify", "--json"}))
|
|
require.Equal(t, 2, requests)
|
|
var rows []struct {
|
|
User string `json:"user"`
|
|
ExpiresAt *time.Time `json:"expires_at"`
|
|
Verified *bool `json:"verified"`
|
|
Error string `json:"error"`
|
|
}
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &rows))
|
|
require.Len(t, rows, 3)
|
|
require.Equal(t, "alice", rows[0].User)
|
|
require.True(t, rows[0].ExpiresAt.Equal(expires))
|
|
require.True(t, *rows[0].Verified)
|
|
require.Empty(t, rows[0].Error)
|
|
for _, row := range rows[1:] {
|
|
require.False(t, *row.Verified, row.User)
|
|
require.Nil(t, row.ExpiresAt)
|
|
require.NotEmpty(t, row.Error)
|
|
}
|
|
require.Equal(t, "credential unavailable", rows[2].Error)
|
|
require.NotContains(t, out.String(), "status-token")
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--verify", "--user", "alice"}))
|
|
require.Equal(t, server.URL+"\talice\ttrue\toauth\tfile\ttrue\ttrue\t2030-01-02T03:04:05Z\t\n", out.String())
|
|
}
|
|
|
|
func TestAuthStatusVerifyRefreshesExpiredOAuthToken(t *testing.T) {
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
switch r.URL.Path {
|
|
case "/login/oauth/access_token":
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"access_token": "fresh", "refresh_token": "refresh2", "expires_in": 3600, "token_type": "Bearer"})
|
|
case "/api/v1/token":
|
|
_, _ = w.Write([]byte(`{"scopes":["all"]}`))
|
|
default:
|
|
if r.Header.Get("Authorization") != "token fresh" {
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
return
|
|
}
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
}
|
|
}))
|
|
defer server.Close()
|
|
deps, out, _ := testDeps(t)
|
|
require.NoError(t, deps.Credentials.Save(server.URL, "alice", settings.StoreFile, auth.Credential{AccessToken: "stale", RefreshToken: "refresh", ExpiresAt: time.Now().Add(-time.Hour)}))
|
|
configureHost(t, deps, server.URL, settings.Host{User: "alice", Users: map[string]settings.Account{"alice": {AuthMethod: settings.AuthOAuth, CredentialStore: settings.StoreFile}}})
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--verify", "--json=user,verified,error"}))
|
|
require.JSONEq(t, `[{"user":"alice","verified":true,"error":""}]`, out.String())
|
|
}
|
|
|
|
func TestOAuthLoginOpensAuthorizationURLInBrowser(t *testing.T) {
|
|
opened := make(chan string, 1)
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
switch r.URL.Path {
|
|
case "/login/oauth/access_token":
|
|
require.NoError(t, r.ParseForm())
|
|
require.Equal(t, "authorization_code", r.Form.Get("grant_type"))
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"access_token": "access", "refresh_token": "refresh", "expires_in": 3600, "token_type": "Bearer"})
|
|
case "/api/v1/user":
|
|
require.Equal(t, "token access", r.Header.Get("Authorization"))
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
default:
|
|
t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
|
|
w.WriteHeader(http.StatusNotFound)
|
|
}
|
|
}))
|
|
defer server.Close()
|
|
browser := &channelBrowser{opened: opened}
|
|
deps, _, diagnostics := testDeps(t)
|
|
deps.Browser = browser
|
|
deps.Credentials = &auth.Store{Dir: deps.Settings.Dir, Keyring: &statusKeyring{}}
|
|
deps.Streams.InTTY, deps.Streams.ErrTTY = true, true
|
|
deps.Client = func(instance, token string, insecure bool) *transport.Client {
|
|
client := transport.New(instance, token, insecure)
|
|
client.HTTP = server.Client()
|
|
return client
|
|
}
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
done := make(chan error, 1)
|
|
go func() {
|
|
done <- Execute(ctx, deps, []string{"auth", "login", "--host", server.URL, "--oauth", "--client-id", "test-client", "--credential-store", "file", "--yes"})
|
|
}()
|
|
var resource string
|
|
select {
|
|
case resource = <-opened:
|
|
case <-time.After(3 * time.Second):
|
|
t.Fatal("browser was not opened")
|
|
}
|
|
u, err := url.Parse(resource)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "/login/oauth/authorize", u.Path)
|
|
require.Equal(t, "test-client", u.Query().Get("client_id"))
|
|
redirect := u.Query().Get("redirect_uri")
|
|
state := u.Query().Get("state")
|
|
require.NotEmpty(t, redirect)
|
|
require.NotEmpty(t, state)
|
|
callback, err := http.Get(redirect + "?code=valid-code&state=" + url.QueryEscape(state))
|
|
require.NoError(t, err)
|
|
require.Equal(t, http.StatusOK, callback.StatusCode)
|
|
_ = callback.Body.Close()
|
|
require.NoError(t, <-done)
|
|
require.Contains(t, diagnostics.String(), "Open this URL to authorize tea:")
|
|
require.Contains(t, diagnostics.String(), resource)
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
normalized, err := settings.NormalizeHost(server.URL)
|
|
require.NoError(t, err)
|
|
require.Contains(t, snapshot.Hosts.Hosts[normalized].Users, "alice")
|
|
}
|
|
|
|
// loginPrompter answers the interactive login and account choices, recording what it was asked.
|
|
type loginPrompter struct {
|
|
scriptedPrompter
|
|
answers terminal.LoginAnswers
|
|
questions terminal.LoginQuestions
|
|
prefilled terminal.LoginAnswers
|
|
choice int
|
|
options []string
|
|
}
|
|
|
|
func (p *loginPrompter) Login(_ context.Context, questions terminal.LoginQuestions, answers *terminal.LoginAnswers) error {
|
|
p.questions, p.prefilled = questions, *answers
|
|
host := answers.Host
|
|
*answers = p.answers
|
|
answers.Host = cmp.Or(answers.Host, host)
|
|
return nil
|
|
}
|
|
|
|
func (p *loginPrompter) Choose(_ context.Context, _ string, choices []terminal.Choice, _ string) (string, error) {
|
|
p.options = make([]string, len(choices))
|
|
for i, choice := range choices {
|
|
p.options[i] = choice.Label
|
|
}
|
|
return choices[p.choice].Value, nil
|
|
}
|
|
|
|
// terminalDeps returns testDeps on a terminal, where tea prompts and reports mutations.
|
|
func terminalDeps(t *testing.T) (Dependencies, *bytes.Buffer, *bytes.Buffer) {
|
|
t.Helper()
|
|
deps, out, diagnostics := testDeps(t)
|
|
deps.Streams.InTTY, deps.Streams.OutTTY, deps.Streams.ErrTTY = true, true, true
|
|
return deps, out, diagnostics
|
|
}
|
|
|
|
func TestAuthLoginAsksHowToLogIn(t *testing.T) {
|
|
server := newAuthenticatedServer(http.NotFoundHandler())
|
|
defer server.Close()
|
|
deps, _, diagnostics := terminalDeps(t)
|
|
prompt := &loginPrompter{answers: terminal.LoginAnswers{Method: terminal.LoginToken, Token: "pasted-token", Store: settings.StoreFile}}
|
|
deps.Prompter = prompt
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "login", "--host", server.URL}))
|
|
require.Equal(t, terminal.LoginAnswers{Host: server.URL, Method: terminal.LoginToken, Store: settings.StoreKeyring, SSHKey: prompt.prefilled.SSHKey, SetupGit: true}, prompt.prefilled)
|
|
require.False(t, prompt.questions.Host)
|
|
require.True(t, prompt.questions.Method && prompt.questions.Store && prompt.questions.SetupGit)
|
|
require.Equal(t, "Create one at https://gitea.com/user/settings/applications", prompt.questions.TokenHint("https://gitea.com"))
|
|
credential, err := deps.Credentials.Load(server.URL, "alice", settings.StoreFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "pasted-token", credential.AccessToken)
|
|
require.Equal(t, "✓ Logged in to "+server.URL+" as alice (token, file store)\n", withoutANSI(diagnostics.String()))
|
|
// Without --host, the sole instance is the suggestion; logging in again replaces the token.
|
|
diagnostics.Reset()
|
|
prompt.answers.Token, prompt.accept = "rotated-token", true
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "login"}))
|
|
require.True(t, prompt.questions.Host)
|
|
require.Equal(t, server.URL, prompt.prefilled.Host)
|
|
require.Equal(t, []string{"alice is already logged in to " + server.URL + ". Replace the stored credential?"}, prompt.confirmations)
|
|
credential, err = deps.Credentials.Load(server.URL, "alice", settings.StoreFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "rotated-token", credential.AccessToken)
|
|
}
|
|
|
|
func TestAuthLoginReplacesACredentialOnlyWhenConfirmed(t *testing.T) {
|
|
server := newAuthenticatedServer(http.NotFoundHandler())
|
|
defer server.Close()
|
|
deps, _, _ := testDeps(t)
|
|
configureAccounts(t, deps, server.URL, "alice", "alice")
|
|
login := func(extra ...string) error {
|
|
deps.Streams.In = strings.NewReader("new-token\n")
|
|
return Execute(context.Background(), deps, append([]string{"auth", "login", "--host", server.URL, "--with-token", "--credential-store", "file", "--no-input"}, extra...))
|
|
}
|
|
err := login()
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
|
require.EqualError(t, err, "confirmation required to replace the stored credential of alice on "+server.URL+"; rerun with --yes")
|
|
credential, err := deps.Credentials.Load(server.URL, "alice", settings.StoreFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "alice-token", credential.AccessToken)
|
|
require.NoError(t, login("--yes"))
|
|
credential, err = deps.Credentials.Load(server.URL, "alice", settings.StoreFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "new-token", credential.AccessToken)
|
|
// A named account is confirmed before tea asks for its token.
|
|
deps, _, _ = terminalDeps(t)
|
|
configureAccounts(t, deps, server.URL, "alice", "alice")
|
|
prompt := &scriptedPrompter{secret: "unused"}
|
|
deps.Prompter = prompt
|
|
err = Execute(context.Background(), deps, []string{"auth", "login", "--host", server.URL, "--with-token", "--user", "alice"})
|
|
require.Equal(t, clierr.Canceled, clierr.ExitCode(err))
|
|
require.Len(t, prompt.confirmations, 1)
|
|
require.Empty(t, prompt.secrets)
|
|
}
|
|
|
|
func TestAuthStatusShowsAccountsByInstance(t *testing.T) {
|
|
const instance = "https://example.org"
|
|
helper := "config --global --get-all credential." + instance + ".helper"
|
|
for _, tc := range []struct {
|
|
name string
|
|
users []string
|
|
env map[string]string
|
|
helper bool
|
|
want string
|
|
failure string
|
|
exitCode int
|
|
}{
|
|
{
|
|
name: "accounts", users: []string{"alice", "bob"}, helper: true,
|
|
want: instance + "\n ✓ Logged in as alice (token, file store) · active\n ✓ Logged in as bob (token, file store)\n - Git credential helper: configured (global)\n",
|
|
},
|
|
{
|
|
name: "environment token", users: []string{"alice"}, env: map[string]string{"GITEA_TOKEN": "env", "TEA_HOST": "example.org"},
|
|
want: instance + "\n ✓ Using GITEA_TOKEN from the environment\n ✓ Logged in as alice (token, file store) · active\n - Git credential helper: not configured; run tea auth setup-git\n",
|
|
},
|
|
{
|
|
name: "environment token only", env: map[string]string{"GITEA_TOKEN": "env", "GITEA_INSTANCE_URL": instance},
|
|
want: instance + "\n ✓ Using GITEA_TOKEN from the environment\n",
|
|
},
|
|
{name: "logged out", failure: "not logged in to any Gitea instance; run tea auth login", exitCode: clierr.Authentication},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
deps, out, _ := terminalDeps(t)
|
|
deps.Getenv = envFunc(tc.env)
|
|
if tc.helper {
|
|
deps.Git = &fakeGit{results: map[string]string{helper: "!'/usr/bin/tea' auth git-credential --host " + instance}}
|
|
}
|
|
if len(tc.users) > 0 {
|
|
configureAccounts(t, deps, instance, tc.users[0], tc.users...)
|
|
}
|
|
err := Execute(context.Background(), deps, []string{"auth", "status"})
|
|
if tc.failure != "" {
|
|
require.Equal(t, tc.exitCode, clierr.ExitCode(err))
|
|
require.EqualError(t, err, tc.failure)
|
|
} else {
|
|
require.NoError(t, err)
|
|
}
|
|
require.Equal(t, tc.want, withoutANSI(out.String()))
|
|
})
|
|
}
|
|
deps, out, _ := testDeps(t)
|
|
configureHost(t, deps, instance, settings.Host{User: "alice", Users: tokenAccounts(settings.StoreFile, "alice")})
|
|
err := Execute(context.Background(), deps, []string{"auth", "status"})
|
|
require.Equal(t, clierr.Authentication, clierr.ExitCode(err))
|
|
require.EqualError(t, err, "1 of 1 credentials cannot authenticate; log in again with tea auth login")
|
|
require.Equal(t, instance+"\talice\ttrue\ttoken\tfile\tfalse\t\t\tcredential unavailable; run tea auth login for this instance and account\n", out.String())
|
|
}
|
|
|
|
func TestAuthSwitchSelectsInstanceAndAccount(t *testing.T) {
|
|
const instance = "https://example.org"
|
|
deps, _, diagnostics := terminalDeps(t)
|
|
configureAccounts(t, deps, instance, "alice", "alice")
|
|
err := Execute(context.Background(), deps, []string{"auth", "switch"})
|
|
require.EqualError(t, err, "alice is the only account on "+instance+"; log in to another with tea auth login --host "+instance)
|
|
configureAccounts(t, deps, instance, "alice", "alice", "bob")
|
|
active := func() string {
|
|
s, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
return s.Hosts.Hosts[instance].User
|
|
}
|
|
for _, tc := range []struct {
|
|
args []string
|
|
want, diag string
|
|
}{
|
|
{nil, "bob", "✓ Switched active account for " + instance + " to bob\n"},
|
|
{nil, "alice", "✓ Switched active account for " + instance + " to alice\n"},
|
|
{[]string{"ALICE"}, "alice", "! alice is already the active account on " + instance + "\n"},
|
|
{[]string{"--user", "bob"}, "bob", "✓ Switched active account for " + instance + " to bob\n"},
|
|
} {
|
|
diagnostics.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, append([]string{"auth", "switch"}, tc.args...)))
|
|
require.Equal(t, tc.want, active())
|
|
require.Equal(t, tc.diag, withoutANSI(diagnostics.String()))
|
|
}
|
|
configureAccounts(t, deps, instance, "bob", "alice", "bob", "carol")
|
|
prompt := &loginPrompter{choice: 2}
|
|
deps.Prompter = prompt
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "switch"}))
|
|
require.Equal(t, []string{"alice", "bob (active)", "carol"}, prompt.options)
|
|
require.Equal(t, "carol", active())
|
|
err = Execute(context.Background(), deps, []string{"auth", "switch", "--no-input"})
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err))
|
|
require.EqualError(t, err, "name the account: tea auth switch <user> (accounts on "+instance+": alice, bob, carol)")
|
|
err = Execute(context.Background(), deps, []string{"auth", "switch", "dave"})
|
|
require.EqualError(t, err, `account "dave" is not logged in on `+instance+" (accounts: alice, bob, carol)")
|
|
}
|
|
|
|
func TestAuthTokenPrintsTheCredential(t *testing.T) {
|
|
server := newAuthenticatedServer(http.NotFoundHandler())
|
|
defer server.Close()
|
|
instance := server.URL
|
|
deps, out, _ := testDeps(t)
|
|
configureAccounts(t, deps, instance, "alice", "alice")
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "token"}))
|
|
require.Equal(t, "alice-token\n", out.String())
|
|
err := Execute(context.Background(), deps, []string{"auth", "token", "--user", "bob"})
|
|
require.Equal(t, clierr.Authentication, clierr.ExitCode(err))
|
|
out.Reset()
|
|
deps.Getenv = envFunc(map[string]string{"GITEA_TOKEN": "env-token", "TEA_HOST": instance})
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "token"}))
|
|
require.Equal(t, "env-token\n", out.String())
|
|
deps.Getenv = envFunc(nil)
|
|
configureHost(t, deps, instance, settings.Host{User: "alice", Users: map[string]settings.Account{"alice": {AuthMethod: settings.AuthHTTPSign, SSHKey: "/keys/id"}}})
|
|
require.EqualError(t, Execute(context.Background(), deps, []string{"auth", "token"}), "alice on "+instance+" signs requests with an SSH key and has no token")
|
|
require.EqualError(t, Execute(context.Background(), deps, []string{"auth", "token", "--json"}), "auth token prints the token; --json is not supported")
|
|
}
|
|
|
|
// rejectingGit records the input of Git commands that read standard input.
|
|
type rejectingGit struct {
|
|
fakeGit
|
|
inputs []string
|
|
}
|
|
|
|
func (g *rejectingGit) Input(_ context.Context, _, input string, args ...string) (string, error) {
|
|
g.inputs = append(g.inputs, strings.Join(args, " ")+"\n"+input)
|
|
return "", nil
|
|
}
|
|
|
|
func TestLogoutAsksGitToForgetTheAccount(t *testing.T) {
|
|
const instance = "https://example.org:3000"
|
|
deps, _, diagnostics := terminalDeps(t)
|
|
runner := &rejectingGit{}
|
|
deps.Git = runner
|
|
configureAccounts(t, deps, instance, "alice", "alice", "bob")
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "logout", "--yes"}))
|
|
require.Equal(t, []string{"credential reject\nprotocol=https\nhost=example.org:3000\nusername=alice\npassword=alice-token\n\n"}, runner.inputs)
|
|
require.Equal(t, "✓ Logged out of "+instance+" (alice)\n✓ Switched active account for "+instance+" to bob\n", withoutANSI(diagnostics.String()))
|
|
err := Execute(context.Background(), deps, []string{"auth", "logout", "carol", "--yes"})
|
|
require.EqualError(t, err, `account "carol" is not logged in on `+instance+" (accounts: bob)")
|
|
}
|
|
|
|
func TestLogoutFindsNamedAccountOnAnotherInstanceThanTheClone(t *testing.T) {
|
|
deps, _, _ := testDeps(t)
|
|
deps.Credentials.Keyring = &statusKeyring{}
|
|
deps.Git = &fakeGit{results: map[string]string{"remote": "origin", "remote get-url origin": "https://a.example.org/alice/project.git"}}
|
|
configureHost(t, deps, "https://a.example.org", settings.Host{User: "alice", Users: tokenAccounts(settings.StoreKeyring, "alice")})
|
|
configureHost(t, deps, "https://b.example.org", settings.Host{User: "bob", Users: tokenAccounts(settings.StoreKeyring, "bob")})
|
|
require.NoError(t, deps.Settings.Update(settings.TargetPreferences, func(s *settings.Snapshot) error { s.Preferences.DefaultHost = "https://b.example.org"; return nil }))
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "logout", "bob", "--yes", "--no-input"}))
|
|
snapshot, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
require.NotContains(t, snapshot.Hosts.Hosts["https://b.example.org"].Users, "bob")
|
|
require.Contains(t, snapshot.Hosts.Hosts["https://a.example.org"].Users, "alice")
|
|
}
|
|
|
|
func TestAuthStatusVerifyHonorsInstanceInsecureForEnvironmentToken(t *testing.T) {
|
|
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path == "/api/v1/token" {
|
|
_, _ = w.Write([]byte(`{"scopes":["all"]}`))
|
|
return
|
|
}
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
}))
|
|
defer server.Close()
|
|
environment := map[string]string{"GITEA_INSTANCE_URL": server.URL, "GITEA_TOKEN": "secret"}
|
|
deps, out, _ := testDeps(t)
|
|
deps.Getenv = envFunc(environment)
|
|
require.Error(t, Execute(context.Background(), deps, []string{"auth", "status", "--verify"}))
|
|
out.Reset()
|
|
environment["GITEA_INSTANCE_INSECURE"] = "true"
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "status", "--verify", "--json=user,verified"}))
|
|
require.JSONEq(t, `[{"user":"alice","verified":true}]`, out.String())
|
|
}
|
|
|
|
// An instance with REQUIRE_SIGNIN_VIEW answers every unsigned request, /api/v1/version included,
|
|
// with 403; login must only make the signed requests.
|
|
func TestAuthLoginSSHKeyNeverAsksTheVersionOfAPrivateInstance(t *testing.T) {
|
|
keyPath := writeAppTempSSHKey(t, "")
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("Signature") == "" {
|
|
http.Error(w, `{"message":"Only signed in user is allowed to call APIs."}`, http.StatusForbidden)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`{"login":"alice"}`))
|
|
}))
|
|
defer server.Close()
|
|
deps, _, _ := testDeps(t)
|
|
require.NoError(t, Execute(context.Background(), deps, []string{
|
|
"auth", "login", "--host", server.URL, "--ssh-key", keyPath, "--no-input", "--yes",
|
|
}))
|
|
}
|
|
|
|
func TestAuthSwitchTreatsThePositionalAccountLikeUser(t *testing.T) {
|
|
const instance = "https://example.org"
|
|
deps, _, _ := terminalDeps(t)
|
|
configureAccounts(t, deps, instance, "alice", "alice", "bob")
|
|
err := Execute(context.Background(), deps, []string{"auth", "switch", "bob", "--user", "alice"})
|
|
require.Equal(t, clierr.Usage, clierr.ExitCode(err), "%v", err)
|
|
require.EqualError(t, err, "--user alice and the account bob differ")
|
|
s, err := deps.Settings.Load()
|
|
require.NoError(t, err)
|
|
require.Equal(t, "alice", s.Hosts.Hosts[instance].User)
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "switch", "BOB", "--user", "bob"}))
|
|
}
|