1// SPDX-License-Identifier: MIT
2
3package host
4
5import (
6 "testing"
7
8 ermite "bnema.dev/ermite-api/gen/ermite"
9
10 "bnema.dev/ermite-runner/internal/execstream"
11 "bnema.dev/ermite-runner/internal/execstream/execpb"
12)
13
14const (
15 oidcPublicURL = "https://ermite.bnema.dev/-/oidc/token?api-version=2.0"
16 oidcToken = "ermiteoidc_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
17)
18
19// The executor gets Job.id_token_url, its origin rewritten to the guest forge
20// like github.server_url (path and query kept), and the token, only when the
21// server sent both.
22func TestIDTokenRequestReachesTheExecutor(t *testing.T) {
23 for _, tc := range []struct {
24 name, url, token, guest string
25 wantURL, wantToken string
26 }{
27 {"guest forge", oidcPublicURL, oidcToken, "http://ermite.bnema.dev:8088", "http://ermite.bnema.dev:8088/-/oidc/token?api-version=2.0", oidcToken},
28 {"no guest forge", oidcPublicURL, oidcToken, "", oidcPublicURL, oidcToken},
29 {"other origin", "https://other.example/-/oidc/token?api-version=2.0", oidcToken, "http://ermite.bnema.dev:8088", "https://other.example/-/oidc/token?api-version=2.0", oidcToken},
30 {"url only", oidcPublicURL, "", "http://ermite.bnema.dev:8088", "", ""},
31 {"token only", "", oidcToken, "http://ermite.bnema.dev:8088", "", ""},
32 {"none", "", "", "", "", ""},
33 } {
34 t.Run(tc.name, func(t *testing.T) {
35 h := newHarness(t, simpleScript("x"))
36 job := testJob("j1")
37 job.Contexts = publicContexts
38 job.IdTokenUrl, job.IdTokenRequestToken = tc.url, tc.token
39 h.srv.jobs = []*ermite.Job{job}
40 h.runner.Cfg.GuestForgeOrigin = tc.guest
41 var spec *execpb.JobSpec
42 inner := h.driver.script
43 h.driver.script = func(t *testing.T, c *execstream.Conn, run *execpb.Run, cn <-chan *execpb.Cancel) {
44 spec = run.Job
45 inner(t, c, run, cn)
46 }
47 h.run(t)
48 eventually(t, "CompleteJob", func() bool { return h.srv.completeCount() == 1 })
49 if spec == nil {
50 t.Fatal("no Run")
51 }
52 if spec.GetIdTokenUrl() != tc.wantURL || spec.GetIdTokenRequestToken() != tc.wantToken {
53 t.Errorf("got %q %q, want %q %q", spec.GetIdTokenUrl(), spec.GetIdTokenRequestToken(), tc.wantURL, tc.wantToken)
54 }
55 })
56 }
57}
58
59func TestRewriteOrigin(t *testing.T) {
60 for _, tc := range []struct{ in, want string }{
61 {"https://ermite.bnema.dev/-/oidc/token?api-version=2.0", "http://g:8088/-/oidc/token?api-version=2.0"},
62 {"https://ermite.bnema.dev:443?a=b", "http://g:8088?a=b"},
63 {"https://ermite.bnema.dev", "http://g:8088"},
64 {"https://other.example/x", "https://other.example/x"},
65 {"https://u@ermite.bnema.dev/x", "https://u@ermite.bnema.dev/x"},
66 } {
67 if got, _ := rewriteOrigin(tc.in, "https://ermite.bnema.dev", "http://g:8088"); got != tc.want {
68 t.Errorf("rewriteOrigin(%q) = %q, want %q", tc.in, got, tc.want)
69 }
70 }
71}