1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package app_test
4
5import (
6 "context"
7 "encoding/base64"
8 "fmt"
9 "io"
10 "strconv"
11 "strings"
12 "testing"
13
14 "github.com/stretchr/testify/assert"
15 "github.com/stretchr/testify/mock"
16 "github.com/stretchr/testify/require"
17
18 "bnema.dev/ermite/internal/app"
19 "bnema.dev/ermite/internal/domain"
20 "bnema.dev/ermite/internal/ports"
21 "bnema.dev/ermite/internal/ports/mocks"
22)
23
24type browseFixture struct {
25 meta *mocks.RepoMetaStore
26 reader *mocks.RepoReader
27 browse *app.Browse
28}
29
30func newBrowseFixture(t *testing.T) *browseFixture {
31 t.Helper()
32 f := &browseFixture{meta: mocks.NewRepoMetaStore(t), reader: mocks.NewRepoReader(t)}
33 f.browse = app.NewBrowse(f.meta, f.reader)
34 return f
35}
36
37func oid(c string) domain.ObjectID {
38 id, err := domain.ParseObjectID(strings.Repeat(c, 40))
39 if err != nil {
40 panic(err)
41 }
42 return id
43}
44
45// browseOps are the read use cases, each as a call that returns its error.
46// The reader expectation of each is what must (not) run.
47type browseOp struct {
48 name string
49 call func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error
50 // expect registers the reader call a permitted caller makes.
51 expect func(r *mocks.RepoReader)
52}
53
54func browseOps() []browseOp {
55 root := domain.TreePath{}
56 return []browseOp{
57 {"ListRefs", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
58 _, err := b.ListRefs(ctx, p, repo, app.ListRefsParams{})
59 return err
60 }, func(r *mocks.RepoReader) { r.EXPECT().ListRefs(mock.Anything, mock.Anything).Return(nil, nil) }},
61 {"ResolveRevision", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
62 _, err := b.ResolveRevision(ctx, p, repo, domain.Revision{})
63 return err
64 }, func(r *mocks.RepoReader) {
65 r.EXPECT().ResolveRevision(mock.Anything, mock.Anything, mock.Anything).Return(domain.ResolvedRevision{}, nil)
66 }},
67 {"ResolveRefPath", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
68 _, err := b.ResolveRefPath(ctx, p, repo, "main/x")
69 return err
70 }, func(r *mocks.RepoReader) {
71 r.EXPECT().ResolveRefPath(mock.Anything, mock.Anything, "main/x").Return(domain.RefPath{}, nil)
72 }},
73 {"GetTree", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
74 _, err := b.GetTree(ctx, p, repo, domain.Revision{}, root, true)
75 return err
76 }, func(r *mocks.RepoReader) {
77 r.EXPECT().GetTree(mock.Anything, mock.Anything, mock.Anything, mock.Anything, true).Return(domain.Tree{}, nil)
78 }},
79 {"ListPaths", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
80 _, err := b.ListPaths(ctx, p, repo, domain.Revision{})
81 return err
82 }, func(r *mocks.RepoReader) {
83 r.EXPECT().ListPaths(mock.Anything, mock.Anything, mock.Anything, domain.MaxPathEntries, domain.MaxPathBytes).Return(domain.PathList{}, nil)
84 }},
85 {"OpenBlob", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
86 _, rc, err := b.OpenBlob(ctx, p, repo, domain.Revision{}, root)
87 if rc != nil {
88 _ = rc.Close()
89 }
90 return err
91 }, func(r *mocks.RepoReader) {
92 r.EXPECT().OpenBlob(mock.Anything, mock.Anything, mock.Anything, mock.Anything).
93 Return(domain.BlobInfo{}, io.NopCloser(strings.NewReader("")), nil)
94 }},
95 {"ListCommits", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
96 _, err := b.ListCommits(ctx, p, repo, app.ListCommitsParams{})
97 return err
98 }, func(r *mocks.RepoReader) {
99 r.EXPECT().ListCommits(mock.Anything, mock.Anything, mock.Anything).Return(ports.CommitPage{}, nil)
100 }},
101 {"GetCommit", func(b *app.Browse, ctx context.Context, p domain.Principal, repo domain.RepoName) error {
102 _, err := b.GetCommit(ctx, p, repo, domain.Revision{})
103 return err
104 }, func(r *mocks.RepoReader) {
105 r.EXPECT().GetCommit(mock.Anything, mock.Anything, mock.Anything, domain.DefaultDiffLimits()).Return(domain.CommitDetail{}, nil)
106 }},
107 }
108}
109
110// TestBrowseAccess is the access rule over every read use case and every
111// principal: anonymous sees public repositories only, a private one answers
112// not found; stored tokens need repo:read on the repository; and the Git
113// reader is never reached when access is refused.
114func TestBrowseAccess(t *testing.T) {
115 ctx := context.Background()
116 pub := domain.Repo{Name: name(t, "pub"), Visibility: domain.VisibilityPublic}
117 priv := domain.Repo{Name: name(t, "priv"), Visibility: domain.VisibilityPrivate}
118
119 principals := []struct {
120 name string
121 p domain.Principal
122 // who may read which repository
123 pub, priv bool
124 }{
125 {"anonymous", domain.Anonymous(), true, false},
126 {"root", domain.Root(), true, true},
127 {"token repo:read", tokenPrincipal(domain.ScopeRepoRead), true, true},
128 {"token repo:read on priv", tokenPrincipal(domain.ScopeRepoRead, "priv"), true, true},
129 {"token repo:read on another repo", tokenPrincipal(domain.ScopeRepoRead, "other"), true, false},
130 {"token repo:write only", tokenPrincipal(domain.ScopeRepoWrite), true, false},
131 {"token repo:admin only", tokenPrincipal(domain.ScopeRepoAdmin, "priv"), true, false},
132 {"token token:admin only", tokenPrincipal(domain.ScopeTokenAdmin), true, false},
133 }
134 for _, op := range browseOps() {
135 for _, pr := range principals {
136 for _, repo := range []domain.Repo{pub, priv} {
137 t.Run(op.name+"/"+pr.name+"/"+repo.Name.String(), func(t *testing.T) {
138 f := newBrowseFixture(t)
139 f.meta.EXPECT().Get(ctx, repo.Name).Return(repo, nil)
140 allowed := pr.pub
141 if repo.Visibility == domain.VisibilityPrivate {
142 allowed = pr.priv
143 }
144 if allowed {
145 op.expect(f.reader)
146 }
147 err := op.call(f.browse, ctx, pr.p, repo.Name)
148 if allowed {
149 assert.NoError(t, err)
150 } else {
151 assert.ErrorIs(t, err, domain.ErrNotFound)
152 assert.NotErrorIs(t, err, domain.ErrForbidden)
153 }
154 })
155 }
156 }
157 t.Run(op.name+"/missing repository", func(t *testing.T) {
158 f := newBrowseFixture(t)
159 f.meta.EXPECT().Get(ctx, name(t, "nope")).Return(domain.Repo{}, domain.ErrNotFound)
160 err := op.call(f.browse, ctx, domain.Root(), name(t, "nope"))
161 assert.ErrorIs(t, err, domain.ErrNotFound)
162 })
163 t.Run(op.name+"/zero name", func(t *testing.T) {
164 f := newBrowseFixture(t)
165 err := op.call(f.browse, ctx, domain.Root(), domain.RepoName{})
166 assert.ErrorIs(t, err, domain.ErrInvalidName)
167 })
168 }
169}
170
171func TestBrowseHidesPrivateOnReaderErrors(t *testing.T) {
172 // A reader error is passed through for a caller who may read.
173 ctx := context.Background()
174 f := newBrowseFixture(t)
175 pub := domain.Repo{Name: name(t, "pub"), Visibility: domain.VisibilityPublic}
176 f.meta.EXPECT().Get(ctx, pub.Name).Return(pub, nil)
177 f.reader.EXPECT().GetTree(ctx, pub.Name, domain.Revision{}, domain.TreePath{}, false).Return(domain.Tree{}, domain.ErrNotDirectory)
178 _, err := f.browse.GetTree(ctx, domain.Anonymous(), pub.Name, domain.Revision{}, domain.TreePath{}, false)
179 assert.ErrorIs(t, err, domain.ErrNotDirectory)
180}
181
182func ref(kind domain.RefKind, name string) domain.Ref {
183 return domain.Ref{Name: name, Kind: kind, ShortName: name}
184}
185
186func TestListRefsPagingAndKinds(t *testing.T) {
187 ctx := context.Background()
188 pub := domain.Repo{Name: name(t, "pub"), Visibility: domain.VisibilityPublic}
189 all := []domain.Ref{
190 ref(domain.RefKindHead, "HEAD"),
191 ref(domain.RefKindBranch, "refs/heads/a"),
192 ref(domain.RefKindBranch, "refs/heads/b"),
193 ref(domain.RefKindBranch, "refs/heads/c"),
194 ref(domain.RefKindTag, "refs/tags/v1"),
195 ref(domain.RefKindTag, "refs/tags/v2"),
196 }
197 names := func(refs []domain.Ref) []string {
198 var out []string
199 for _, r := range refs {
200 out = append(out, r.Name)
201 }
202 return out
203 }
204 setup := func(t *testing.T, refs []domain.Ref) *app.Browse {
205 f := newBrowseFixture(t)
206 f.meta.EXPECT().Get(mock.Anything, pub.Name).Return(pub, nil)
207 f.reader.EXPECT().ListRefs(mock.Anything, pub.Name).Return(refs, nil)
208 return f.browse
209 }
210
211 t.Run("pages follow each other without gap or repeat", func(t *testing.T) {
212 b := setup(t, all)
213 var got []string
214 tok := ""
215 for pages := 0; ; pages++ {
216 require.Less(t, pages, 10)
217 page, err := b.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{PageSize: 2, PageToken: tok})
218 require.NoError(t, err)
219 got = append(got, names(page.Refs)...)
220 if tok = page.NextPageToken; tok == "" {
221 break
222 }
223 }
224 assert.Equal(t, names(all), got)
225 })
226
227 t.Run("a ref that appears between pages does not shift the others", func(t *testing.T) {
228 b := setup(t, all[:4])
229 page, err := b.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{PageSize: 2})
230 require.NoError(t, err)
231 require.Equal(t, []string{"HEAD", "refs/heads/a"}, names(page.Refs))
232
233 b2 := setup(t, append([]domain.Ref{all[0], ref(domain.RefKindBranch, "refs/heads/0new")}, all[1:4]...))
234 next, err := b2.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{PageSize: 2, PageToken: page.NextPageToken})
235 require.NoError(t, err)
236 assert.Equal(t, []string{"refs/heads/b", "refs/heads/c"}, names(next.Refs))
237 })
238
239 t.Run("kinds filter", func(t *testing.T) {
240 b := setup(t, all)
241 page, err := b.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{Kinds: []domain.RefKind{domain.RefKindTag}})
242 require.NoError(t, err)
243 assert.Equal(t, []string{"refs/tags/v1", "refs/tags/v2"}, names(page.Refs))
244 assert.Empty(t, page.NextPageToken)
245 })
246
247 t.Run("default and maximum page size", func(t *testing.T) {
248 var many []domain.Ref
249 many = append(many, ref(domain.RefKindHead, "HEAD"))
250 for i := range 250 {
251 many = append(many, ref(domain.RefKindTag, fmt.Sprintf("refs/tags/t%03d", i)))
252 }
253 b := setup(t, many)
254 page, err := b.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{})
255 require.NoError(t, err)
256 assert.Len(t, page.Refs, app.DefaultPageSize)
257 assert.NotEmpty(t, page.NextPageToken)
258
259 b = setup(t, many)
260 page, err = b.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{PageSize: 100000})
261 require.NoError(t, err)
262 assert.Len(t, page.Refs, app.MaxPageSize)
263 })
264
265 t.Run("bad input never reaches the reader", func(t *testing.T) {
266 f := newBrowseFixture(t)
267 for _, params := range []app.ListRefsParams{
268 {PageSize: -1},
269 {Kinds: []domain.RefKind{"nope"}},
270 {PageToken: "!!!"},
271 {PageToken: "Y2E6eA"}, // a token of another kind of listing
272 } {
273 _, err := f.browse.ListRefs(ctx, domain.Anonymous(), pub.Name, params)
274 assert.Error(t, err, "%+v", params)
275 }
276 _, err := f.browse.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{PageSize: -1})
277 assert.ErrorIs(t, err, domain.ErrInvalidPageSize)
278 _, err = f.browse.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{Kinds: []domain.RefKind{"x"}})
279 assert.ErrorIs(t, err, domain.ErrInvalidRefKind)
280 _, err = f.browse.ListRefs(ctx, domain.Anonymous(), pub.Name, app.ListRefsParams{PageToken: "!!!"})
281 assert.ErrorIs(t, err, domain.ErrInvalidPageToken)
282 })
283}
284
285func TestListCommitsPaging(t *testing.T) {
286 ctx := context.Background()
287 pub := domain.Repo{Name: name(t, "pub"), Visibility: domain.VisibilityPublic}
288 p := mustPath(t, "d/f")
289
290 t.Run("first page asks for one more than the page and returns a token", func(t *testing.T) {
291 f := newBrowseFixture(t)
292 f.meta.EXPECT().Get(ctx, pub.Name).Return(pub, nil)
293 f.reader.EXPECT().ListCommits(ctx, pub.Name, ports.CommitQuery{Path: p, Limit: 10}).
294 Return(ports.CommitPage{Head: oid("a"), Commits: []domain.Commit{{ID: oid("b")}}, HasMore: true}, nil)
295 page, err := f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{Path: p, PageSize: 10})
296 require.NoError(t, err)
297 require.Len(t, page.Commits, 1)
298 require.NotEmpty(t, page.NextPageToken)
299
300 // The next page starts from the pinned head, after the commits read.
301 f.reader.EXPECT().ListCommits(ctx, pub.Name, ports.CommitQuery{
302 Revision: domain.RevisionOf(oid("a")), Path: p, Skip: 1, Limit: 10,
303 }).Return(ports.CommitPage{Head: oid("a"), Commits: []domain.Commit{{ID: oid("c")}}}, nil)
304 f.meta.EXPECT().Get(ctx, pub.Name).Return(pub, nil)
305 // The revision of the request is ignored once there is a token.
306 rev, _ := domain.ParseRevision("moved")
307 next, err := f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{
308 Revision: rev, Path: p, PageSize: 10, PageToken: page.NextPageToken,
309 })
310 require.NoError(t, err)
311 assert.Equal(t, oid("c"), next.Commits[0].ID)
312 assert.Empty(t, next.NextPageToken)
313 })
314
315 t.Run("a token is bound to its path and must be well formed", func(t *testing.T) {
316 f := newBrowseFixture(t)
317 f.meta.EXPECT().Get(ctx, pub.Name).Return(pub, nil)
318 f.reader.EXPECT().ListCommits(ctx, pub.Name, mock.Anything).
319 Return(ports.CommitPage{Head: oid("a"), Commits: []domain.Commit{{ID: oid("b")}}, HasMore: true}, nil)
320 page, err := f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{Path: p})
321 require.NoError(t, err)
322
323 for _, params := range []app.ListCommitsParams{
324 {PageToken: page.NextPageToken}, // no path
325 {Path: mustPath(t, "other"), PageToken: page.NextPageToken}, // another path
326 {Path: p, PageToken: "garbage"},
327 {Path: p, PageToken: "cjE6eDp5OnQ"}, // c1:x:y:t is not a token
328 {Path: p, PageToken: strings.Repeat("A", 2000)},
329 } {
330 _, err := f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, params)
331 assert.ErrorIs(t, err, domain.ErrInvalidPageToken, "%+v", params)
332 }
333 })
334
335 t.Run("a token cannot skip deeper than the cap", func(t *testing.T) {
336 f := newBrowseFixture(t)
337 f.meta.EXPECT().Get(ctx, pub.Name).Return(pub, nil).Maybe()
338 f.reader.EXPECT().ListCommits(ctx, pub.Name, mock.Anything).
339 Return(ports.CommitPage{Head: oid("a"), Commits: []domain.Commit{{ID: oid("b")}}, HasMore: true}, nil).Once()
340 page, err := f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{Path: p})
341 require.NoError(t, err)
342 raw, err := base64.RawURLEncoding.DecodeString(page.NextPageToken)
343 require.NoError(t, err)
344 parts := strings.Split(string(raw), ":") // c1:<head>:<skip>:<path digest>
345 require.Len(t, parts, 4)
346 withSkip := func(n int) string {
347 parts[2] = strconv.Itoa(n)
348 return base64.RawURLEncoding.EncodeToString([]byte(strings.Join(parts, ":")))
349 }
350
351 f.reader.EXPECT().ListCommits(ctx, pub.Name, mock.MatchedBy(func(q ports.CommitQuery) bool { return q.Skip == app.MaxCommitSkip })).
352 Return(ports.CommitPage{Head: oid("a")}, nil).Once()
353 _, err = f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{Path: p, PageToken: withSkip(app.MaxCommitSkip)})
354 require.NoError(t, err, "the cap itself is allowed")
355 _, err = f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{Path: p, PageToken: withSkip(app.MaxCommitSkip + 1)})
356 assert.ErrorIs(t, err, domain.ErrInvalidPageToken)
357 })
358
359 t.Run("page size", func(t *testing.T) {
360 f := newBrowseFixture(t)
361 f.meta.EXPECT().Get(ctx, pub.Name).Return(pub, nil).Times(2)
362 f.reader.EXPECT().ListCommits(ctx, pub.Name, ports.CommitQuery{Limit: app.DefaultPageSize}).Return(ports.CommitPage{}, nil)
363 f.reader.EXPECT().ListCommits(ctx, pub.Name, ports.CommitQuery{Limit: 100}).Return(ports.CommitPage{}, nil)
364 _, err := f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{})
365 require.NoError(t, err)
366 _, err = f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{PageSize: 5000})
367 require.NoError(t, err)
368 _, err = f.browse.ListCommits(ctx, domain.Anonymous(), pub.Name, app.ListCommitsParams{PageSize: -3})
369 assert.ErrorIs(t, err, domain.ErrInvalidPageSize)
370 })
371
372 t.Run("the token of a private repository does not open it", func(t *testing.T) {
373 priv := domain.Repo{Name: name(t, "priv"), Visibility: domain.VisibilityPrivate}
374 f := newBrowseFixture(t)
375 f.meta.EXPECT().Get(ctx, priv.Name).Return(priv, nil)
376 f.reader.EXPECT().ListCommits(ctx, priv.Name, mock.Anything).
377 Return(ports.CommitPage{Head: oid("a"), Commits: []domain.Commit{{ID: oid("b")}}, HasMore: true}, nil)
378 page, err := f.browse.ListCommits(ctx, domain.Root(), priv.Name, app.ListCommitsParams{})
379 require.NoError(t, err)
380 f.meta.EXPECT().Get(ctx, priv.Name).Return(priv, nil)
381 _, err = f.browse.ListCommits(ctx, domain.Anonymous(), priv.Name, app.ListCommitsParams{PageToken: page.NextPageToken})
382 assert.ErrorIs(t, err, domain.ErrNotFound)
383 })
384}
385
386func mustPath(t *testing.T, s string) domain.TreePath {
387 t.Helper()
388 p, err := domain.ParseTreePath(s)
389 require.NoError(t, err)
390 return p
391}