1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package usecase_test
4
5import (
6 "context"
7 "errors"
8 "fmt"
9 "testing"
10 "time"
11
12 "github.com/stretchr/testify/assert"
13 "github.com/stretchr/testify/mock"
14 "github.com/stretchr/testify/require"
15
16 "bnema.dev/ermite/internal/domain"
17 "bnema.dev/ermite/internal/ports"
18 "bnema.dev/ermite/internal/ports/mocks"
19 "bnema.dev/ermite/internal/usecase"
20)
21
22type pushFixture struct {
23 meta *mocks.RepoMetaStore
24 git *mocks.GitRepos
25 bus *mocks.EventBus
26 clock *mocks.Clock
27 tokens *mocks.TokenStore
28 cirepo *mocks.CIRepoTokenStore
29 sched *mocks.MaintenanceScheduler
30 pushes *usecase.Pushes
31}
32
33func newPushFixture(t *testing.T) *pushFixture {
34 t.Helper()
35 f := &pushFixture{
36 meta: mocks.NewRepoMetaStore(t),
37 git: mocks.NewGitRepos(t),
38 bus: mocks.NewEventBus(t),
39 clock: mocks.NewClock(t),
40 tokens: mocks.NewTokenStore(t),
41 cirepo: mocks.NewCIRepoTokenStore(t),
42 sched: mocks.NewMaintenanceScheduler(t),
43 }
44 f.clock.EXPECT().Now().Return(now).Maybe()
45 repos := usecase.NewRepos(f.meta, f.git, f.bus, f.clock)
46 auth := usecase.NewAuth(domain.HashTokenSecret(rootSecret), f.tokens, f.clock).WithRepoTokens(f.cirepo)
47 f.pushes = usecase.NewPushes(f.meta, repos, f.git, f.bus, f.clock, f.sched, auth)
48 return f
49}
50
51const (
52 oidA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
53 oidB = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
54)
55
56func TestPushesOpen(t *testing.T) {
57 t.Parallel()
58 ctx := context.Background()
59 n := name(t, "tools")
60 priv := domain.Repo{Name: n, Visibility: domain.VisibilityPrivate}
61 pub := domain.Repo{Name: n, Visibility: domain.VisibilityPublic}
62
63 tests := []struct {
64 name string
65 p domain.Principal
66 repo *domain.Repo // nil: missing
67 create bool
68 want error
69 }{
70 {"anonymous", domain.Anonymous(), &pub, false, domain.ErrUnauthenticated},
71 {"root, existing", domain.Root(), &priv, false, nil},
72 {"writer, existing", tokenPrincipal(domain.ScopeRepoWrite), &priv, false, nil},
73 {"writer limited to the repo", tokenPrincipal(domain.ScopeRepoWrite, "tools"), &priv, false, nil},
74 {"writer limited to another repo, private", tokenPrincipal(domain.ScopeRepoWrite, "other"), &priv, false, domain.ErrNotFound},
75 {"writer limited to another repo, public", tokenPrincipal(domain.ScopeRepoWrite, "other"), &pub, false, domain.ErrForbidden},
76 {"reader of a private repo", tokenPrincipal(domain.ScopeRepoRead), &priv, false, domain.ErrForbidden},
77 {"reader of a public repo", tokenPrincipal(domain.ScopeRepoRead), &pub, false, domain.ErrForbidden},
78 {"token with no relevant scope, private", tokenPrincipal(domain.ScopeMRWrite), &priv, false, domain.ErrNotFound},
79 {"missing, no create", domain.Root(), nil, false, domain.ErrNotFound},
80 {"missing, reader may not create", tokenPrincipal(domain.ScopeRepoRead), nil, true, domain.ErrNotFound},
81 {"missing, writer limited elsewhere", tokenPrincipal(domain.ScopeRepoWrite, "other"), nil, true, domain.ErrNotFound},
82 {"existing, writer limited to branches", branchLimited(domain.ScopeRepoWrite), &priv, false, nil},
83 {"missing, writer limited to branches may not create", branchLimited(domain.ScopeRepoWrite), nil, true, domain.ErrNotFound},
84 {"missing, writer limited to branches and to the repo may not create", branchLimited(domain.ScopeRepoWrite, "tools"), nil, true, domain.ErrNotFound},
85 }
86 for _, tt := range tests {
87 t.Run(tt.name, func(t *testing.T) {
88 t.Parallel()
89 f := newPushFixture(t)
90 if !tt.p.IsAnonymous() {
91 if tt.repo != nil {
92 f.meta.EXPECT().Get(ctx, n).Return(*tt.repo, nil)
93 } else {
94 f.meta.EXPECT().Get(ctx, n).Return(domain.Repo{}, domain.ErrNotFound)
95 }
96 }
97 // The bus mock expects no Publish: nothing is created here.
98 err := f.pushes.Open(ctx, tt.p, n, tt.create)
99 if tt.want != nil {
100 assert.ErrorIs(t, err, tt.want)
101 return
102 }
103 require.NoError(t, err)
104 })
105 }
106
107 t.Run("creates a private repository and publishes RepoCreated", func(t *testing.T) {
108 t.Parallel()
109 f := newPushFixture(t)
110 f.meta.EXPECT().Get(ctx, n).Return(domain.Repo{}, domain.ErrNotFound)
111 f.git.EXPECT().Stage(ctx).Return(ports.StagedID("s1"), nil)
112 want := domain.Repo{Name: n, Visibility: domain.VisibilityPrivate, CreatedAt: now, Settings: domain.DefaultRepoSettings()}
113 f.meta.EXPECT().Create(ctx, want).Return(nil)
114 f.git.EXPECT().Publish(ctx, ports.StagedID("s1"), n).Return(nil)
115 f.bus.EXPECT().Publish(ctx, domain.RepoCreated{Repo: n, Visibility: domain.VisibilityPrivate, At: now}).Return()
116
117 require.NoError(t, f.pushes.Open(ctx, tokenPrincipal(domain.ScopeRepoWrite, "tools"), n, true))
118 })
119
120 t.Run("a concurrent first push wins: this one pushes to its repository", func(t *testing.T) {
121 t.Parallel()
122 f := newPushFixture(t)
123 f.meta.EXPECT().Get(ctx, n).Return(domain.Repo{}, domain.ErrNotFound).Once()
124 f.git.EXPECT().Stage(ctx).Return(ports.StagedID("s1"), nil)
125 f.meta.EXPECT().Create(ctx, mock.Anything).Return(domain.ErrAlreadyExists)
126 f.git.EXPECT().Discard(mock.Anything, ports.StagedID("s1")).Return(nil)
127 f.meta.EXPECT().Get(ctx, n).Return(priv, nil).Once()
128
129 // The bus mock expects no Publish: the repository was not created here.
130 require.NoError(t, f.pushes.Open(ctx, domain.Root(), n, true))
131 })
132
133 t.Run("store failure", func(t *testing.T) {
134 t.Parallel()
135 f := newPushFixture(t)
136 boom := errors.New("boom")
137 f.meta.EXPECT().Get(ctx, n).Return(domain.Repo{}, boom)
138 err := f.pushes.Open(ctx, domain.Root(), n, true)
139 assert.ErrorIs(t, err, boom)
140 })
141
142 t.Run("create failure is returned and nothing is published", func(t *testing.T) {
143 t.Parallel()
144 f := newPushFixture(t)
145 boom := errors.New("boom")
146 f.meta.EXPECT().Get(ctx, n).Return(domain.Repo{}, domain.ErrNotFound)
147 f.git.EXPECT().Stage(ctx).Return(ports.StagedID(""), boom)
148 err := f.pushes.Open(ctx, domain.Root(), n, true)
149 assert.ErrorIs(t, err, boom)
150 })
151}
152
153func TestPushesCheck(t *testing.T) {
154 t.Parallel()
155 ctx := context.Background()
156 n := name(t, "tools")
157 ups := []domain.RefUpdate{{Old: domain.ZeroOID, New: oidA, Ref: "refs/heads/main"}}
158 writer := domain.TokenPrincipal(domain.Token{ID: "w1", Scopes: scopes(domain.ScopeRepoWrite), Repos: names(t, "tools")})
159 reader := domain.TokenPrincipal(domain.Token{ID: "r1", Scopes: scopes(domain.ScopeRepoRead)})
160
161 t.Run("root is always valid and needs no lookup", func(t *testing.T) {
162 t.Parallel()
163 f := newPushFixture(t) // the token store mock expects no call
164 require.NoError(t, f.check(ctx, domain.Root(), n, ups))
165 })
166
167 t.Run("a writer whose token still exists", func(t *testing.T) {
168 t.Parallel()
169 f := newPushFixture(t)
170 f.tokens.EXPECT().Get(ctx, "w1").Return(domain.Token{ID: "w1", Scopes: scopes(domain.ScopeRepoWrite)}, nil)
171 require.NoError(t, f.check(ctx, writer, n, ups))
172 })
173
174 t.Run("a token revoked during the push is rejected", func(t *testing.T) {
175 t.Parallel()
176 f := newPushFixture(t)
177 f.tokens.EXPECT().Get(ctx, "w1").Return(domain.Token{}, domain.ErrNotFound)
178 assert.ErrorIs(t, f.check(ctx, writer, n, ups), domain.ErrRejected)
179 })
180
181 t.Run("a token that expired during the push is rejected", func(t *testing.T) {
182 t.Parallel()
183 f := newPushFixture(t)
184 f.tokens.EXPECT().Get(ctx, "w1").Return(domain.Token{ID: "w1", Scopes: scopes(domain.ScopeRepoWrite), ExpiresAt: now.Add(-time.Second)}, nil)
185 assert.ErrorIs(t, f.check(ctx, writer, n, ups), domain.ErrRejected)
186 })
187
188 t.Run("a store failure fails closed", func(t *testing.T) {
189 t.Parallel()
190 f := newPushFixture(t)
191 boom := errors.New("boom")
192 f.tokens.EXPECT().Get(ctx, "w1").Return(domain.Token{}, boom)
193 err := f.check(ctx, writer, n, ups)
194 require.ErrorIs(t, err, boom)
195 assert.NotErrorIs(t, err, domain.ErrRejected, "an internal failure, not a refusal")
196 })
197
198 t.Run("a token without write access is rejected", func(t *testing.T) {
199 t.Parallel()
200 f := newPushFixture(t)
201 f.tokens.EXPECT().Get(ctx, "r1").Return(domain.Token{ID: "r1", Scopes: scopes(domain.ScopeRepoRead)}, nil)
202 assert.ErrorIs(t, f.check(ctx, reader, n, ups), domain.ErrRejected)
203 })
204
205 t.Run("anonymous is rejected", func(t *testing.T) {
206 t.Parallel()
207 f := newPushFixture(t)
208 assert.ErrorIs(t, f.check(ctx, domain.Anonymous(), n, ups), domain.ErrRejected)
209 })
210}
211
212// AC5: a token limited to branch prefixes pushes only under them.
213func TestPushesCheckBranchPrefixes(t *testing.T) {
214 t.Parallel()
215 ctx := context.Background()
216 n := name(t, "tools")
217 limited := domain.TokenPrincipal(domain.Token{
218 ID: "b1", Scopes: scopes(domain.ScopeRepoWrite), BranchPrefixes: []string{"agent/claude/", "bot/"},
219 })
220 up := func(old, new, ref string) domain.RefUpdate { return domain.RefUpdate{Old: old, New: new, Ref: ref} }
221
222 tests := []struct {
223 name string
224 updates []domain.RefUpdate
225 refused string // the ref named by the error; "" = accepted
226 }{
227 {"create under the prefix", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/heads/agent/claude/x")}, ""},
228 {"force-push under the prefix", []domain.RefUpdate{up(oidA, oidB, "refs/heads/agent/claude/x")}, ""},
229 {"delete under the prefix", []domain.RefUpdate{up(oidA, domain.ZeroOID, "refs/heads/agent/claude/x")}, ""},
230 {"second prefix", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/heads/bot/y")}, ""},
231 {"several under the prefixes", []domain.RefUpdate{
232 up(domain.ZeroOID, oidA, "refs/heads/agent/claude/a"), up(domain.ZeroOID, oidA, "refs/heads/bot/b"),
233 }, ""},
234 {"main", []domain.RefUpdate{up(oidA, oidB, "refs/heads/main")}, "refs/heads/main"},
235 {"delete main", []domain.RefUpdate{up(oidA, domain.ZeroOID, "refs/heads/main")}, "refs/heads/main"},
236 {"the prefix itself without a name", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/heads/agent/claude")}, "refs/heads/agent/claude"},
237 {"a sibling that shares the text", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/heads/agent/claudex/y")}, "refs/heads/agent/claudex/y"},
238 {"a tag", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/tags/v1")}, "refs/tags/v1"},
239 {"a tag named like the prefix", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/tags/agent/claude/v1")}, "refs/tags/agent/claude/v1"},
240 {"a notes ref", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/notes/commits")}, "refs/notes/commits"},
241 {"a ref outside refs/heads", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/agent/claude/x")}, "refs/agent/claude/x"},
242 {"a path trick", []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/heads/agent/claude/../main")}, "refs/heads/agent/claude/../main"},
243 {"mixed push: one allowed, one forbidden", []domain.RefUpdate{
244 up(domain.ZeroOID, oidA, "refs/heads/agent/claude/ok"), up(oidA, oidB, "refs/heads/main"),
245 }, "refs/heads/main"},
246 {"mixed push, forbidden first", []domain.RefUpdate{
247 up(oidA, oidB, "refs/heads/main"), up(domain.ZeroOID, oidA, "refs/heads/agent/claude/ok"),
248 }, "refs/heads/main"},
249 }
250 for _, tt := range tests {
251 t.Run(tt.name, func(t *testing.T) {
252 t.Parallel()
253 f := newPushFixture(t)
254 f.tokens.EXPECT().Get(ctx, "b1").Return(domain.Token{ID: "b1", Scopes: scopes(domain.ScopeRepoWrite)}, nil)
255 err := f.check(ctx, limited, n, tt.updates)
256 if tt.refused == "" {
257 require.NoError(t, err)
258 return
259 }
260 require.ErrorIs(t, err, domain.ErrRejected)
261 assert.Contains(t, err.Error(), tt.refused+" is outside the branches this token may push (agent/claude/, bot/)")
262 })
263 }
264
265 t.Run("a token without limit pushes anywhere", func(t *testing.T) {
266 t.Parallel()
267 f := newPushFixture(t)
268 f.tokens.EXPECT().Get(ctx, "w1").Return(domain.Token{ID: "w1", Scopes: scopes(domain.ScopeRepoWrite)}, nil)
269 free := domain.TokenPrincipal(domain.Token{ID: "w1", Scopes: scopes(domain.ScopeRepoWrite)})
270 require.NoError(t, f.check(ctx, free, n, []domain.RefUpdate{
271 up(domain.ZeroOID, oidA, "refs/tags/v1"), up(oidA, oidB, "refs/heads/main"),
272 }))
273 })
274
275 t.Run("root pushes anywhere", func(t *testing.T) {
276 t.Parallel()
277 f := newPushFixture(t)
278 require.NoError(t, f.check(ctx, domain.Root(), n, []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/tags/v1")}))
279 })
280
281 t.Run("a limited token without repo:write is rejected for the repository first", func(t *testing.T) {
282 t.Parallel()
283 f := newPushFixture(t)
284 f.tokens.EXPECT().Get(ctx, "b2").Return(domain.Token{ID: "b2", Scopes: scopes(domain.ScopeRepoRead)}, nil)
285 p := domain.TokenPrincipal(domain.Token{ID: "b2", Scopes: scopes(domain.ScopeRepoRead), BranchPrefixes: []string{"a/"}})
286 err := f.check(ctx, p, n, []domain.RefUpdate{up(domain.ZeroOID, oidA, "refs/heads/a/x")})
287 require.ErrorIs(t, err, domain.ErrRejected)
288 assert.Contains(t, err.Error(), "no write access")
289 })
290}
291
292func TestPushesRecord(t *testing.T) {
293 t.Parallel()
294 ctx := context.Background()
295 n := name(t, "tools")
296 p := tokenPrincipal(domain.ScopeRepoWrite)
297 ups := []domain.RefUpdate{
298 {Old: domain.ZeroOID, New: oidA, Ref: "refs/heads/dev"},
299 {Old: domain.ZeroOID, New: oidB, Ref: "refs/heads/main"},
300 {Old: domain.ZeroOID, New: oidB, Ref: "refs/tags/v1"},
301 }
302
303 t.Run("sets pushed_at, publishes the exact updates, schedules maintenance", func(t *testing.T) {
304 t.Parallel()
305 f := newPushFixture(t)
306 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
307 repo := domain.Repo{Name: n, Visibility: domain.VisibilityPrivate, CreatedAt: now.Add(-time.Hour)}
308 expectRepoMutation(t, f.meta, repo, domain.Repo{Name: n, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt, PushedAt: now, ActiveAt: now}).Once()
309 f.git.EXPECT().DefaultBranch(ctx, n).Return("main", true, nil)
310 f.bus.EXPECT().Publish(ctx, domain.PushEvent{Repo: n, Updates: ups, At: now, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt}).Return()
311
312 require.NoError(t, f.pushes.Record(ctx, p, n, ups))
313 })
314
315 t.Run("tells the reader that the repository changed", func(t *testing.T) {
316 t.Parallel()
317 f := newPushFixture(t)
318 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
319 fresh := mocks.NewRepoFreshener(t)
320 fresh.EXPECT().Refresh(ctx, n).Return().Once()
321 f.pushes.WithFreshener(fresh)
322 expectPushMutation(t, f.meta, domain.Repo{Name: n}, nil)
323 f.git.EXPECT().DefaultBranch(ctx, n).Return("main", true, nil)
324 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
325 require.NoError(t, f.pushes.Record(ctx, p, n, ups))
326 })
327
328 t.Run("pushed_at preserves a later push", func(t *testing.T) {
329 t.Parallel()
330 f := newPushFixture(t)
331 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
332 later := domain.Repo{Name: n, PushedAt: now.Add(time.Second), ActiveAt: now.Add(time.Second)}
333 expectPushMutation(t, f.meta, later, nil) // a later push recorded meanwhile
334 f.git.EXPECT().DefaultBranch(ctx, n).Return("main", true, nil)
335 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
336 require.NoError(t, f.pushes.Record(ctx, p, n, ups))
337 })
338
339 t.Run("a deleted repository is not an error", func(t *testing.T) {
340 t.Parallel()
341 f := newPushFixture(t)
342 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
343 expectPushMutation(t, f.meta, domain.Repo{}, domain.ErrNotFound)
344 f.git.EXPECT().DefaultBranch(ctx, n).Return("main", true, nil)
345 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
346 require.NoError(t, f.pushes.Record(ctx, p, n, ups))
347 })
348
349 t.Run("a repository deleted before the default branch step is not an error", func(t *testing.T) {
350 t.Parallel()
351 f := newPushFixture(t)
352 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
353 expectPushMutation(t, f.meta, domain.Repo{}, domain.ErrNotFound)
354 f.git.EXPECT().DefaultBranch(ctx, n).Return("", false, domain.ErrNotFound)
355 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
356 require.NoError(t, f.pushes.Record(ctx, p, n, ups))
357 })
358
359 t.Run("a repository deleted before HEAD is set is not an error", func(t *testing.T) {
360 t.Parallel()
361 f := newPushFixture(t)
362 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
363 expectPushMutation(t, f.meta, domain.Repo{}, domain.ErrNotFound)
364 f.git.EXPECT().DefaultBranch(ctx, n).Return("trunk", false, nil)
365 f.git.EXPECT().SetDefaultBranch(ctx, n, "main").Return(domain.ErrNotFound)
366 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
367 require.NoError(t, f.pushes.Record(ctx, p, n, ups))
368 })
369
370 t.Run("every step runs when one fails", func(t *testing.T) {
371 t.Parallel()
372 f := newPushFixture(t)
373 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
374 boom := errors.New("boom")
375 expectPushMutation(t, f.meta, domain.Repo{}, boom)
376 f.git.EXPECT().DefaultBranch(ctx, n).Return("", false, boom)
377 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
378 err := f.pushes.Record(ctx, p, n, ups)
379 assert.ErrorIs(t, err, boom)
380 })
381}
382
383func TestPushesDefaultBranchRule(t *testing.T) {
384 t.Parallel()
385 ctx := context.Background()
386 n := name(t, "tools")
387 p := domain.Root()
388 up := func(ref string) domain.RefUpdate { return domain.RefUpdate{Old: domain.ZeroOID, New: oidA, Ref: ref} }
389 del := func(ref string) domain.RefUpdate { return domain.RefUpdate{Old: oidA, New: domain.ZeroOID, Ref: ref} }
390
391 tests := []struct {
392 name string
393 head string
394 exists bool
395 updates []domain.RefUpdate
396 want string // "" = HEAD untouched
397 }{
398 {"HEAD already valid", "main", true, []domain.RefUpdate{up("refs/heads/dev")}, ""},
399 {"main preferred", "trunk", false, []domain.RefUpdate{up("refs/heads/dev"), up("refs/heads/main")}, "main"},
400 {"first pushed branch", "main", false, []domain.RefUpdate{up("refs/tags/v1"), up("refs/heads/dev"), up("refs/heads/feature")}, "dev"},
401 {"HEAD names another missing branch", "trunk", false, []domain.RefUpdate{up("refs/heads/dev")}, "dev"},
402 {"only tags pushed", "main", false, []domain.RefUpdate{up("refs/tags/v1")}, ""},
403 {"deleted branches never become HEAD", "main", false, []domain.RefUpdate{del("refs/heads/old"), up("refs/heads/dev")}, "dev"},
404 {"only deletions", "main", false, []domain.RefUpdate{del("refs/heads/old")}, ""},
405 {"HEAD already points to the only candidate", "dev", false, []domain.RefUpdate{up("refs/heads/dev")}, ""},
406 }
407 for _, tt := range tests {
408 t.Run(tt.name, func(t *testing.T) {
409 t.Parallel()
410 f := newPushFixture(t)
411 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
412 expectPushMutation(t, f.meta, domain.Repo{Name: n, PushedAt: now, ActiveAt: now}, nil)
413 f.git.EXPECT().DefaultBranch(ctx, n).Return(tt.head, tt.exists, nil)
414 if tt.want != "" {
415 f.git.EXPECT().SetDefaultBranch(ctx, n, tt.want).Return(nil)
416 }
417 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
418 require.NoError(t, f.pushes.Record(ctx, p, n, tt.updates))
419 })
420 }
421
422 t.Run("set failure is reported", func(t *testing.T) {
423 t.Parallel()
424 f := newPushFixture(t)
425 f.sched.EXPECT().Schedule(ctx, n).Return().Once()
426 boom := errors.New("boom")
427 expectPushMutation(t, f.meta, domain.Repo{Name: n, PushedAt: now, ActiveAt: now}, nil)
428 f.git.EXPECT().DefaultBranch(ctx, n).Return("main", false, nil)
429 f.git.EXPECT().SetDefaultBranch(ctx, n, "dev").Return(boom)
430 f.bus.EXPECT().Publish(ctx, mock.Anything).Return()
431 assert.ErrorIs(t, f.pushes.Record(ctx, p, n, []domain.RefUpdate{up("refs/heads/dev")}), boom)
432 })
433}
434
435// mockAny matches any argument of a mocked call.
436var mockAny = mock.Anything
437
438// check is Pushes.Check for a push with nothing in quarantine.
439func (f *pushFixture) check(ctx context.Context, p domain.Principal, n domain.RepoName, ups []domain.RefUpdate) error {
440 return f.pushes.Check(ctx, p, n, ups, ports.PushObjects{})
441}
442
443type fakeGuard struct {
444 path string
445 err error
446 got []domain.RefUpdate
447 objs ports.PushObjects
448}
449
450func (g *fakeGuard) ChangedWorkflow(_ context.Context, _ domain.RepoName, ups []domain.RefUpdate, o ports.PushObjects) (string, error) {
451 g.got, g.objs = ups, o
452 return g.path, g.err
453}
454
455// A push by the token of a job is judged on the workflows it changes, and by it
456// alone: every other principal is not asked.
457func TestPushesCheckRefusesWorkflowChangesOfJobTokens(t *testing.T) {
458 t.Parallel()
459 ctx := context.Background()
460 n := name(t, "tools")
461 ups := []domain.RefUpdate{{Old: oidA, New: oidB, Ref: "refs/heads/main"}, {Old: domain.ZeroOID, New: oidB, Ref: "refs/tags/v1"}}
462 objs := ports.PushObjects{Dir: "/d/repos/tools.git/objects/incoming-1"}
463 exp := now.Add(time.Hour)
464 job := domain.RepoTokenPrincipal(domain.CIRepoToken{ID: "j1", Repo: n, ExpiresAt: exp, Permissions: map[string]string{"contents": "write"}})
465 readOnlyJob := domain.RepoTokenPrincipal(domain.CIRepoToken{ID: "j2", Repo: n, ExpiresAt: exp})
466
467 build := func(t *testing.T, g *fakeGuard) *pushFixture {
468 f := newPushFixture(t)
469 if g != nil {
470 f.pushes.WithWorkflowGuard(g)
471 }
472 f.cirepo.EXPECT().GetRepoToken(ctx, mock.Anything).Return(domain.CIRepoToken{ID: "j1", ExpiresAt: exp}, nil).Maybe()
473 return f
474 }
475
476 t.Run("no workflow touched", func(t *testing.T) {
477 t.Parallel()
478 g := &fakeGuard{}
479 f := build(t, g)
480 require.NoError(t, f.pushes.Check(ctx, job, n, ups, objs))
481 assert.Equal(t, ups, g.got, "every ref is judged")
482 assert.Equal(t, objs, g.objs, "from the objects of the push in quarantine")
483 })
484 t.Run("a workflow touched refuses the whole push with GitHub's text", func(t *testing.T) {
485 t.Parallel()
486 f := build(t, &fakeGuard{path: ".github/workflows/ci.yml"})
487 err := f.pushes.Check(ctx, job, n, ups, objs)
488 require.ErrorIs(t, err, domain.ErrRejected)
489 assert.Contains(t, err.Error(), "refusing to allow a GitHub App to create or update workflow `.github/workflows/ci.yml` without `workflows` permission")
490 })
491 t.Run("a failure to tell refuses it, not as a policy", func(t *testing.T) {
492 t.Parallel()
493 f := build(t, &fakeGuard{err: errors.New("git broke")})
494 err := f.pushes.Check(ctx, job, n, ups, objs)
495 require.Error(t, err)
496 assert.NotErrorIs(t, err, domain.ErrRejected)
497 })
498 t.Run("a push beyond the guard's bounds is refused as a policy, with the reason", func(t *testing.T) {
499 t.Parallel()
500 f := build(t, &fakeGuard{err: fmt.Errorf("%w: the push brings more than 10000 commits", domain.ErrInvalid)})
501 err := f.pushes.Check(ctx, job, n, ups, objs)
502 require.ErrorIs(t, err, domain.ErrRejected)
503 assert.Contains(t, err.Error(), "more than 10000 commits")
504 })
505 t.Run("without a guard a job token cannot be judged: refused", func(t *testing.T) {
506 t.Parallel()
507 f := build(t, nil)
508 assert.ErrorIs(t, f.pushes.Check(ctx, job, n, ups, objs), domain.ErrRejected)
509 })
510 t.Run("a job token without contents: write cannot push at all", func(t *testing.T) {
511 t.Parallel()
512 f := build(t, &fakeGuard{})
513 assert.ErrorIs(t, f.pushes.Check(ctx, readOnlyJob, n, ups, objs), domain.ErrRejected)
514 })
515 t.Run("the owner is not asked", func(t *testing.T) {
516 t.Parallel()
517 g := &fakeGuard{path: ".github/workflows/ci.yml"}
518 f := build(t, g)
519 require.NoError(t, f.pushes.Check(ctx, domain.Root(), n, ups, objs))
520 assert.Nil(t, g.got)
521 })
522 t.Run("a job token never creates a repository on push", func(t *testing.T) {
523 t.Parallel()
524 f := build(t, &fakeGuard{})
525 f.meta.EXPECT().Get(ctx, n).Return(domain.Repo{}, domain.ErrNotFound)
526 assert.ErrorIs(t, f.pushes.Open(ctx, job, n, true), domain.ErrNotFound)
527 })
528}