1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package domain_test
4
5import (
6 "strings"
7 "testing"
8 "time"
9
10 "github.com/stretchr/testify/assert"
11 "github.com/stretchr/testify/require"
12
13 "bnema.dev/ermite/internal/domain"
14)
15
16func TestScopes(t *testing.T) {
17 t.Parallel()
18 all := domain.AllScopes()
19 assert.Len(t, all, 9)
20 for _, s := range all {
21 got, err := domain.ParseScope(s.String())
22 require.NoError(t, err)
23 assert.Equal(t, s, got)
24 }
25 for _, in := range []string{"", "repo", "repo:READ", "admin", "repo:read "} {
26 _, err := domain.ParseScope(in)
27 assert.ErrorIs(t, err, domain.ErrInvalidScope, in)
28 }
29}
30
31func TestHashTokenSecret(t *testing.T) {
32 t.Parallel()
33 h := domain.HashTokenSecret("ermite_abc")
34 assert.Equal(t, h, domain.HashTokenSecret("ermite_abc"))
35 assert.NotEqual(t, h, domain.HashTokenSecret("ermite_abd"))
36 assert.Len(t, h.String(), 64)
37 // SHA-256("") known value.
38 assert.Equal(t, "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", domain.HashTokenSecret("").String())
39}
40
41func TestTokenExpired(t *testing.T) {
42 t.Parallel()
43 now := time.Date(2026, 10, 10, 8, 0, 0, 0, time.UTC)
44 assert.False(t, domain.Token{}.Expired(now), "no expiry never expires")
45 assert.False(t, domain.Token{ExpiresAt: now.Add(time.Second)}.Expired(now))
46 assert.True(t, domain.Token{ExpiresAt: now}.Expired(now), "expires at the instant")
47 assert.True(t, domain.Token{ExpiresAt: now.Add(-time.Second)}.Expired(now))
48}
49
50func TestPrincipalScopes(t *testing.T) {
51 t.Parallel()
52 a, b := mustName(t, "a"), mustName(t, "b")
53 tok := domain.Token{ID: "t1", Scopes: []domain.Scope{domain.ScopeRepoRead, domain.ScopeRepoWrite}, Repos: []domain.RepoName{a}}
54 p := domain.TokenPrincipal(tok)
55
56 assert.Equal(t, "token", p.Label())
57 assert.Equal(t, "t1", p.TokenID())
58 assert.False(t, p.IsRoot())
59 assert.False(t, p.IsAnonymous())
60 assert.True(t, p.HasScope(domain.ScopeRepoWrite))
61 assert.False(t, p.HasScope(domain.ScopeTokenAdmin))
62 assert.True(t, p.Allows(domain.ScopeRepoWrite, a))
63 assert.False(t, p.Allows(domain.ScopeRepoWrite, b), "outside the repository list")
64 assert.False(t, p.Allows(domain.ScopeRepoAdmin, a), "scope not held")
65
66 // Without a list, every repository.
67 all := domain.TokenPrincipal(domain.Token{Scopes: []domain.Scope{domain.ScopeRepoRead}})
68 assert.True(t, all.Allows(domain.ScopeRepoRead, a))
69 assert.True(t, all.Allows(domain.ScopeRepoRead, b))
70
71 // The principal owns copies.
72 tok.Scopes[0] = domain.ScopeTokenAdmin
73 assert.True(t, p.HasScope(domain.ScopeRepoRead))
74 p.Scopes()[0] = domain.ScopeTokenAdmin
75 assert.True(t, p.HasScope(domain.ScopeRepoRead))
76
77 assert.True(t, domain.Root().Allows(domain.ScopeTokenAdmin, a))
78 assert.False(t, domain.Anonymous().HasScope(domain.ScopeRepoRead))
79 assert.False(t, domain.Anonymous().Allows(domain.ScopeRepoRead, a))
80 assert.Equal(t, "root", domain.Root().Label())
81 assert.Equal(t, "anonymous", domain.Anonymous().Label())
82}
83
84func mustName(t *testing.T, s string) domain.RepoName {
85 t.Helper()
86 n, err := domain.ParseRepoName(s)
87 require.NoError(t, err)
88 return n
89}
90
91func TestOwnerPrincipal(t *testing.T) {
92 t.Parallel()
93 o := domain.Owner()
94 assert.Equal(t, "owner", o.Label())
95 assert.True(t, o.IsOwner())
96 assert.False(t, domain.Root().IsOwner())
97 assert.True(t, o.IsRoot(), "the owner has the rights of root")
98 assert.True(t, o.HasScope(domain.ScopeMRMerge))
99 assert.True(t, o.Allows(domain.ScopeRepoRead, mustName(t, "any")))
100 assert.False(t, o.IsAnonymous())
101 assert.Empty(t, o.TokenID())
102}
103
104func TestHasOwnerRights(t *testing.T) {
105 t.Parallel()
106 a := mustName(t, "a")
107 all := domain.AllScopes()
108 assert.True(t, domain.Root().HasOwnerRights())
109 assert.True(t, domain.Owner().HasOwnerRights())
110 assert.False(t, domain.Anonymous().HasOwnerRights())
111 assert.True(t, domain.TokenPrincipal(domain.Token{Scopes: all}).HasOwnerRights())
112 assert.False(t, domain.TokenPrincipal(domain.Token{Scopes: all[1:]}).HasOwnerRights(), "a scope short")
113 assert.False(t, domain.TokenPrincipal(domain.Token{Scopes: all, Repos: []domain.RepoName{a}}).HasOwnerRights(), "limited to a repository")
114}
115
116func TestParseBranchPrefix(t *testing.T) {
117 t.Parallel()
118 for _, ok := range []string{"agent/", "agent/claude/", "a/b/c/", "feat-1/", strings.Repeat("a", 99) + "/"} {
119 got, err := domain.ParseBranchPrefix(ok)
120 require.NoError(t, err, ok)
121 assert.Equal(t, ok, got)
122 }
123 for _, bad := range []string{
124 "", "/", "agent", "agent/claude", "//", "agent//", "/agent/", "-x/", ".x/", "a/.b/", "a..b/",
125 "a b/", "a~/", "a:/", "a?/", "a*/", "a[/", "a\\/", "a@{/", "x.lock/", "a\x00/", "a\n/", "\xff/",
126 "refs/heads/agent/", "agent.//", strings.Repeat("a", 100) + "/",
127 } {
128 _, err := domain.ParseBranchPrefix(bad)
129 assert.ErrorIs(t, err, domain.ErrInvalidToken, "%q", bad)
130 }
131}
132
133func TestParseBranchPrefixes(t *testing.T) {
134 t.Parallel()
135 got, err := domain.ParseBranchPrefixes(nil)
136 require.NoError(t, err)
137 assert.Empty(t, got)
138
139 got, err = domain.ParseBranchPrefixes([]string{"b/", "a/", "b/"})
140 require.NoError(t, err)
141 assert.Equal(t, []string{"b/", "a/"}, got, "duplicates removed, order kept")
142
143 eight := []string{"a/", "b/", "c/", "d/", "e/", "f/", "g/", "h/"}
144 got, err = domain.ParseBranchPrefixes(eight)
145 require.NoError(t, err)
146 assert.Len(t, got, 8)
147 _, err = domain.ParseBranchPrefixes(append(eight, "i/"))
148 assert.ErrorIs(t, err, domain.ErrInvalidToken)
149 got, err = domain.ParseBranchPrefixes(append(eight, "a/"))
150 require.NoError(t, err, "duplicates do not count")
151 assert.Len(t, got, 8)
152
153 _, err = domain.ParseBranchPrefixes([]string{"a/", "bad"})
154 assert.ErrorIs(t, err, domain.ErrInvalidToken)
155}
156
157func TestAllowsRef(t *testing.T) {
158 t.Parallel()
159 limited := domain.TokenPrincipal(domain.Token{
160 Scopes: []domain.Scope{domain.ScopeRepoWrite}, BranchPrefixes: []string{"agent/claude/", "bot/"},
161 })
162 for ref, want := range map[string]bool{
163 "refs/heads/agent/claude/x": true,
164 "refs/heads/agent/claude/a/b": true,
165 "refs/heads/bot/y": true,
166 "refs/heads/agent/claude": false,
167 "refs/heads/agent/claude/": false,
168 "refs/heads/agent/claudex/y": false,
169 "refs/heads/main": false,
170 "refs/heads/agent/other/x": false,
171 "refs/heads/other/agent/claude/x": false,
172 "refs/tags/v1": false,
173 "refs/tags/agent/claude/x": false,
174 "refs/notes/commits": false,
175 "refs/remotes/agent/claude/x": false,
176 "refs/changes/agent/claude/x": false,
177 "agent/claude/x": false,
178 "heads/agent/claude/x": false,
179 "HEAD": false,
180 "": false,
181 "refs/heads/agent/claude/../main": false,
182 "refs/heads/agent/claude/x.lock": false,
183 "refs/heads/agent/claude/a b": false,
184 "refs/heads//agent/claude/x": false,
185 } {
186 assert.Equal(t, want, limited.AllowsRef(ref), "%q", ref)
187 }
188
189 // A corrupt empty prefix still limits the token and allows nothing.
190 corrupt := domain.TokenPrincipal(domain.Token{Scopes: []domain.Scope{domain.ScopeRepoWrite}, BranchPrefixes: []string{""}})
191 assert.False(t, corrupt.AllowsRef("refs/heads/main"))
192
193 // Without prefixes every ref is allowed.
194 unlimited := domain.TokenPrincipal(domain.Token{Scopes: []domain.Scope{domain.ScopeRepoWrite}})
195 assert.True(t, unlimited.AllowsRef("refs/tags/v1"))
196 assert.True(t, unlimited.AllowsRef("refs/heads/main"))
197 assert.True(t, domain.Root().AllowsRef("refs/tags/v1"))
198 assert.True(t, domain.Owner().AllowsRef("refs/heads/main"))
199}
200
201func TestBranchPrefixesOfPrincipal(t *testing.T) {
202 t.Parallel()
203 tok := domain.Token{Scopes: domain.AllScopes(), BranchPrefixes: []string{"a/"}}
204 p := domain.TokenPrincipal(tok)
205 assert.Equal(t, []string{"a/"}, p.BranchPrefixes())
206 assert.False(t, p.HasOwnerRights(), "a token with every scope but limited branches is not the owner")
207 assert.True(t, domain.TokenPrincipal(domain.Token{Scopes: domain.AllScopes()}).HasOwnerRights())
208
209 // The principal owns copies.
210 tok.BranchPrefixes[0] = "b/"
211 assert.Equal(t, []string{"a/"}, p.BranchPrefixes())
212 p.BranchPrefixes()[0] = "c/"
213 assert.Equal(t, []string{"a/"}, p.BranchPrefixes())
214 assert.Empty(t, domain.Root().BranchPrefixes())
215}
216
217func TestBranchLimitedAndCoversBranchPrefix(t *testing.T) {
218 t.Parallel()
219 free := domain.TokenPrincipal(domain.Token{Scopes: domain.AllScopes()})
220 assert.False(t, free.IsBranchLimited())
221 assert.False(t, free.CoversBranchPrefix("agent/x"), "no prefixes cover nothing: callers test IsBranchLimited first")
222 assert.False(t, domain.Root().IsBranchLimited())
223 assert.False(t, domain.Owner().IsBranchLimited())
224 assert.False(t, domain.Anonymous().IsBranchLimited())
225
226 limited := domain.TokenPrincipal(domain.Token{Scopes: domain.AllScopes(), BranchPrefixes: []string{"agent/claude/", "bot/"}})
227 assert.True(t, limited.IsBranchLimited())
228 for s, want := range map[string]bool{
229 "agent/claude/x": true, "agent/claude/": true, "bot/y": true,
230 "agent/claude": false, "agent/claudex/y": false, "main": false, "": false, "xbot/y": false,
231 } {
232 assert.Equal(t, want, limited.CoversBranchPrefix(s), "%q", s)
233 }
234
235 // A corrupt empty prefix still limits, and covers nothing.
236 corrupt := domain.TokenPrincipal(domain.Token{Scopes: domain.AllScopes(), BranchPrefixes: []string{""}})
237 assert.True(t, corrupt.IsBranchLimited())
238 assert.False(t, corrupt.CoversBranchPrefix("main"))
239 assert.False(t, corrupt.CoversBranchPrefix(""))
240}