mirror of
https://gitea.com/gitea/tea.git
synced 2026-10-26 19:11:25 +01:00
168 lines
9.6 KiB
Go
168 lines
9.6 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package app
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"gitea.dev/tea/internal/auth"
|
|
"gitea.dev/tea/internal/git"
|
|
"gitea.dev/tea/internal/services"
|
|
"gitea.dev/tea/internal/settings"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestGiteaGitCredentialHelperClonesPrivateRepository(t *testing.T) {
|
|
gitea, deps, out, diagnostics := giteaDeps(t)
|
|
deps.Settings = settings.New(filepath.Join(t.TempDir(), "configuration with spaces"))
|
|
deps.Credentials.Dir = deps.Settings.Dir
|
|
var repo services.Repository
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"repo", "create", fmt.Sprintf("tea-git-helper-%d", time.Now().UnixNano()), "--private", "--auto-init", "--json"}))
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &repo))
|
|
require.True(t, repo.Private)
|
|
t.Cleanup(func() {
|
|
if err := Execute(context.Background(), deps, []string{"repo", "delete", "-R", repo.FullName, "--yes"}); err != nil {
|
|
t.Errorf("repository cleanup: %v", err)
|
|
}
|
|
})
|
|
user, _, _ := strings.Cut(repo.FullName, "/")
|
|
require.NoError(t, testManager(t, deps).Register(gitea.url, user, "file", "token", auth.HostOptions{}, auth.Credential{AccessToken: gitea.token}))
|
|
binaryDir := filepath.Join(t.TempDir(), "binary with 'quote'")
|
|
require.NoError(t, os.MkdirAll(binaryDir, 0o700))
|
|
binary := filepath.Join(binaryDir, "tea")
|
|
if os.PathSeparator == '\\' {
|
|
binary += ".exe"
|
|
}
|
|
build := exec.CommandContext(context.Background(), "go", "build", "-o", binary, ".")
|
|
build.Dir = filepath.Join("..", "..")
|
|
output, err := build.CombinedOutput()
|
|
require.NoError(t, err, "build: %s", output)
|
|
deps.Executable = func() (string, error) { return binary, nil }
|
|
// The temporary global file exercises setup's default scope without touching
|
|
// the user's Git configuration. Git invokes the compiled helper as a child.
|
|
environment := []string{}
|
|
for _, entry := range os.Environ() {
|
|
key, _, _ := strings.Cut(entry, "=")
|
|
if strings.HasPrefix(key, "GIT_TRACE") || key == "GIT_CURL_VERBOSE" {
|
|
continue
|
|
}
|
|
environment = append(environment, entry)
|
|
}
|
|
globalConfig := filepath.Join(t.TempDir(), "gitconfig")
|
|
environment = append(environment, "GIT_CONFIG_GLOBAL="+globalConfig, "GIT_CONFIG_NOSYSTEM=1", "TEA_CONFIG_DIR="+deps.Settings.Dir, "GITEA_TOKEN=", "GITEA_INSTANCE_URL=", "TEA_HOST=", "TEA_USER=", "TEA_REPO=")
|
|
runner := git.System{Env: environment, ErrOut: diagnostics}
|
|
deps.Git = runner
|
|
_, anonymousErr := runner.Output(context.Background(), "", false, "-c", "credential.helper=", "clone", "--", repo.CloneURL, filepath.Join(t.TempDir(), "anonymous-clone"))
|
|
require.Error(t, anonymousErr, "private repository must reject an unauthenticated clone")
|
|
out.Reset()
|
|
diagnostics.Reset()
|
|
teaClone := filepath.Join(t.TempDir(), "tea-private-clone")
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"repo", "clone", repo.FullName, teaClone, "--no-input", "--json=id"}))
|
|
require.JSONEq(t, fmt.Sprintf(`{"id":%d}`, repo.ID), out.String())
|
|
_, localHelperErr := runner.Output(context.Background(), teaClone, false, "config", "--local", "--get-all", "credential."+gitea.url+".helper")
|
|
var missingLocalHelper *git.CommandError
|
|
require.ErrorAs(t, localHelperErr, &missingLocalHelper)
|
|
require.Equal(t, 1, missingLocalHelper.ExitCode)
|
|
// Build a changed PR on the private repository, then fetch it without setup.
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"branch", "create", "feature", "-R", repo.FullName}))
|
|
deps.Streams.In = strings.NewReader(`{"branch":"feature","content":"dGVzdAo=","message":"Disposable private PR fixture"}`)
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"api", "repos/" + repo.FullName + "/contents/change.txt", "--input", "-"}))
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"pr", "create", "-R", repo.FullName, "--title", "Private checkout", "--head", "feature", "--base", repo.DefaultBranch, "--json"}))
|
|
var pull services.Pull
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &pull))
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"pr", "checkout", fmt.Sprint(pull.Number), "-R", repo.FullName, "--cwd", teaClone, "--no-input", "--json"}))
|
|
var checkout git.CheckoutResult
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &checkout))
|
|
require.Equal(t, pull.HeadSHA, checkout.Commit)
|
|
require.Equal(t, "feature", checkout.Branch)
|
|
branchesBefore, err := runner.Output(context.Background(), teaClone, false, "for-each-ref", "--format=%(refname):%(objectname)", "refs/heads/")
|
|
require.NoError(t, err)
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"pr", "checkout", fmt.Sprint(pull.Number), "-R", repo.FullName, "--cwd", teaClone, "--detach", "--no-input", "--json"}))
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &checkout))
|
|
require.True(t, checkout.Detached)
|
|
require.Empty(t, checkout.Branch)
|
|
require.Equal(t, pull.HeadSHA, checkout.Commit)
|
|
branchesAfter, err := runner.Output(context.Background(), teaClone, false, "for-each-ref", "--format=%(refname):%(objectname)", "refs/heads/")
|
|
require.NoError(t, err)
|
|
require.Equal(t, branchesBefore, branchesAfter)
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"pr", "checkout", fmt.Sprint(pull.Number), "-R", repo.FullName, "--cwd", teaClone, "--no-input", "--json"}))
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &checkout))
|
|
require.False(t, checkout.Detached)
|
|
require.Equal(t, "feature", checkout.Branch)
|
|
branchesAfter, err = runner.Output(context.Background(), teaClone, false, "for-each-ref", "--format=%(refname):%(objectname)", "refs/heads/")
|
|
require.NoError(t, err)
|
|
require.Equal(t, branchesBefore, branchesAfter)
|
|
_, err = runner.Output(context.Background(), teaClone, false, "switch", "--detach", pull.HeadSHA)
|
|
require.NoError(t, err)
|
|
_, headErr := runner.Output(context.Background(), teaClone, false, "symbolic-ref", "--quiet", "HEAD")
|
|
var detachedHead *git.CommandError
|
|
require.ErrorAs(t, headErr, &detachedHead)
|
|
require.Equal(t, 1, detachedHead.ExitCode)
|
|
deps.Streams.In = strings.NewReader(`{"branch":"feature","content":"bmV4dAo=","message":"Disposable fast-forward fixture"}`)
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"api", "repos/" + repo.FullName + "/contents/next.txt", "--input", "-"}))
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"pr", "view", fmt.Sprint(pull.Number), "-R", repo.FullName, "--json"}))
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &pull))
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"pr", "checkout", fmt.Sprint(pull.Number), "-R", repo.FullName, "--cwd", teaClone, "--update", "--no-input", "--json"}))
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &checkout))
|
|
require.Equal(t, pull.HeadSHA, checkout.Commit)
|
|
localHead, err := runner.Output(context.Background(), teaClone, false, "rev-parse", "HEAD")
|
|
require.NoError(t, err)
|
|
require.Equal(t, pull.HeadSHA, localHead)
|
|
deps.Streams.In = strings.NewReader(fmt.Sprintf(`{"branch":%q,"content":"c3luYwo=","message":"Disposable sync fixture"}`, repo.DefaultBranch))
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"api", "repos/" + repo.FullName + "/contents/sync.txt", "--input", "-"}))
|
|
out.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"repo", "sync", "-R", repo.FullName, "--cwd", teaClone, "--no-input", "--json=branch,commit,remote"}))
|
|
var synced git.SyncResult
|
|
require.NoError(t, json.Unmarshal(out.Bytes(), &synced))
|
|
require.Equal(t, repo.DefaultBranch, synced.Branch)
|
|
// Sync updates the branch without switching to it, so read the branch rather than HEAD.
|
|
localHead, err = runner.Output(context.Background(), teaClone, false, "rev-parse", "refs/heads/"+synced.Branch)
|
|
require.NoError(t, err)
|
|
require.Equal(t, synced.Commit, localHead)
|
|
contents, err := runner.Output(context.Background(), teaClone, false, "show", synced.Branch+":sync.txt")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "sync", strings.TrimSpace(contents))
|
|
if endpoint := os.Getenv("GITEA_TEA_TEST_SSH_ENDPOINT"); endpoint != "" {
|
|
verifySSHCloneAndCheckout(t, deps, repo, pull, user, environment, endpoint)
|
|
}
|
|
// The per-operation helper does not create a global Git configuration file.
|
|
_, err = os.Stat(globalConfig)
|
|
require.True(t, os.IsNotExist(err))
|
|
out.Reset()
|
|
diagnostics.Reset()
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "setup-git", "--host", gitea.url, "--no-input"}))
|
|
require.NoError(t, Execute(context.Background(), deps, []string{"auth", "setup-git", "--host", gitea.url, "--no-input"}))
|
|
require.Empty(t, out.String())
|
|
destination := filepath.Join(t.TempDir(), "private-clone")
|
|
_, err = runner.Output(context.Background(), "", false, "clone", "--", repo.CloneURL, destination)
|
|
require.NoError(t, err, "private repository clone failed")
|
|
inside, err := runner.Output(context.Background(), destination, false, "rev-parse", "--is-inside-work-tree")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "true", inside)
|
|
// No credential is embedded in either the persisted remote or helper command.
|
|
remote, err := runner.Output(context.Background(), destination, false, "remote", "get-url", "origin")
|
|
require.NoError(t, err)
|
|
require.Equal(t, repo.CloneURL, remote)
|
|
require.False(t, strings.Contains(remote, gitea.token), "remote contains credentials")
|
|
helper, err := runner.Output(context.Background(), "", false, "config", "--global", "--get-all", "credential."+gitea.url+".helper")
|
|
require.NoError(t, err)
|
|
require.Len(t, strings.Split(helper, "\n"), 1)
|
|
require.False(t, strings.Contains(helper, gitea.token), "helper command contains credentials")
|
|
}
|