1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package app
4
5import (
6 "bufio"
7 "encoding/json"
8 "os/exec"
9 "slices"
10 "strings"
11 "syscall"
12 "testing"
13 "time"
14
15 "github.com/stretchr/testify/assert"
16 "github.com/stretchr/testify/require"
17
18 "bnema.dev/ermite/internal/adapters/client"
19 "bnema.dev/ermite/internal/domain"
20)
21
22// cliHarness drives the CLI against a real forge.
23type cliHarness struct {
24 *harness
25 url string
26}
27
28func newCLIHarness(t *testing.T) *cliHarness {
29 t.Helper()
30 h := newHarness(t, harnessOpts{})
31 return &cliHarness{harness: h, url: h.srv.URL}
32}
33
34// vars is the CLI environment for a token ("" is anonymous).
35func (c *cliHarness) vars(secret string) map[string]string {
36 v := map[string]string{client.EnvURL: c.url}
37 if secret != "" {
38 v[client.EnvToken] = secret
39 }
40 return v
41}
42
43// cli runs the command tree in process.
44func (c *cliHarness) cli(t *testing.T, secret string, args ...string) result {
45 t.Helper()
46 return runCLI(t, c.vars(secret), "", args...)
47}
48
49// bin runs the built binary; stdout and stderr are returned with the exit code.
50func (c *cliHarness) bin(t *testing.T, secret string, args ...string) (stdout, stderr string, code int) {
51 t.Helper()
52 var env []string
53 for k, v := range c.vars(secret) {
54 env = append(env, k+"="+v)
55 }
56 return runBinary(t, env, args...)
57}
58
59// keys returns the sorted field names of a JSON object.
60func keys(t *testing.T, raw string) []string {
61 t.Helper()
62 var m map[string]json.RawMessage
63 require.NoError(t, json.Unmarshal([]byte(raw), &m), raw)
64 var ks []string
65 for k := range m {
66 ks = append(ks, k)
67 }
68 slices.Sort(ks)
69 return ks
70}
71
72func decode[T any](t *testing.T, raw string) T {
73 t.Helper()
74 var v T
75 require.NoError(t, json.Unmarshal([]byte(raw), &v), raw)
76 return v
77}
78
79// requireOneLineError checks a failed run: exit 1, a single "ermite: …" line.
80func requireOneLineError(t *testing.T, stderr string, code int, contains ...string) {
81 t.Helper()
82 assert.Equal(t, 1, code)
83 assert.Equal(t, 1, strings.Count(stderr, "\n"), "one line: %q", stderr)
84 assert.True(t, strings.HasPrefix(stderr, "ermite: "), stderr)
85 for _, s := range contains {
86 assert.Contains(t, stderr, s)
87 }
88}
89
90// watchProc is a running `ermite watch --json`.
91type watchProc struct {
92 cmd *exec.Cmd
93 lines chan string
94 stderr *syncBuffer
95 done chan error
96}
97
98// startWatch runs the binary and waits until the server has the stream.
99func (c *cliHarness) startWatch(t *testing.T, secret string, args ...string) *watchProc {
100 t.Helper()
101 cmd := exec.Command(binary(t), append([]string{"watch", "--json"}, args...)...)
102 cmd.Env = baseEnv()
103 for k, v := range c.vars(secret) {
104 cmd.Env = append(cmd.Env, k+"="+v)
105 }
106 w := &watchProc{cmd: cmd, lines: make(chan string, 64), stderr: &syncBuffer{}, done: make(chan error, 1)}
107 cmd.Stderr = w.stderr
108 out, err := cmd.StdoutPipe()
109 require.NoError(t, err)
110 require.NoError(t, cmd.Start())
111 go func() {
112 sc := bufio.NewScanner(out)
113 for sc.Scan() {
114 w.lines <- sc.Text()
115 }
116 close(w.lines)
117 w.done <- cmd.Wait()
118 }()
119 t.Cleanup(func() { _ = cmd.Process.Kill() })
120
121 require.Eventually(t, func() bool { return c.forge.EventLog.Watchers() >= 1 }, 10*time.Second, 10*time.Millisecond,
122 "the watch never reached the server; stderr: %s", w.stderr.String())
123 return w
124}
125
126// next decodes the next event line or fails after d.
127func (w *watchProc) next(t *testing.T, d time.Duration) (raw string) {
128 t.Helper()
129 select {
130 case l, ok := <-w.lines:
131 if !ok {
132 t.Fatalf("watch ended; stderr: %s", w.stderr.String())
133 }
134 return l
135 case <-time.After(d):
136 t.Fatalf("no event within %v; stderr: %s", d, w.stderr.String())
137 }
138 return ""
139}
140
141// interrupt sends SIGINT and returns the exit code.
142func (w *watchProc) interrupt(t *testing.T) int {
143 t.Helper()
144 require.NoError(t, w.cmd.Process.Signal(syscall.SIGINT))
145 select {
146 case err := <-w.done:
147 if err == nil {
148 return 0
149 }
150 var exit *exec.ExitError
151 require.ErrorAs(t, err, &exit)
152 return exit.ExitCode()
153 case <-time.After(10 * time.Second):
154 t.Fatal("watch did not stop on SIGINT")
155 }
156 return -1
157}
158
159type tokenOut struct {
160 ID string `json:"id"`
161 Label string `json:"label"`
162 Scopes []string `json:"scopes"`
163 Repos []string `json:"repos"`
164 ExpiresAt *string `json:"expires_at"`
165 CreatedAt *string `json:"created_at"`
166 LastUsedAt *string `json:"last_used_at"`
167 Secret string `json:"secret"`
168}
169
170type repoOut struct {
171 Name string `json:"name"`
172 Description string `json:"description"`
173 Visibility string `json:"visibility"`
174 DefaultBranch string `json:"default_branch"`
175 CreatedAt *string `json:"created_at"`
176 PushedAt *string `json:"pushed_at"`
177}
178
179type eventOut struct {
180 ID string `json:"id"`
181 Time *string `json:"time"`
182 Type string `json:"type"`
183 Repo string `json:"repo"`
184 Repository *repoOut
185 RefUpdates []struct {
186 Ref string `json:"ref"`
187 OldID string `json:"old_id"`
188 NewID string `json:"new_id"`
189 } `json:"ref_updates"`
190 MergeRequest *mrOut `json:"merge_request"`
191}
192
193var repoKeys = []string{"created_at", "default_branch", "description", "failing_checks_block", "merge_modes", "name", "pushed_at", "visibility"}
194
195// AC6: the CLI end to end against a real forge.
196func TestAC6CLIEndToEnd(t *testing.T) {
197 c := newCLIHarness(t)
198
199 // Root creates the daily token with the cli preset (binary: secret alone on stdout).
200 stdout, stderr, code := c.bin(t, adminToken, "token", "create", "daily", "--preset", "cli")
201 require.Equal(t, 0, code, stderr)
202 secret := strings.TrimSpace(stdout)
203 require.True(t, strings.HasPrefix(secret, "ermite_"), stdout)
204 assert.Equal(t, 1, strings.Count(stdout, "\n"), "the secret is the only thing on stdout")
205 assert.Contains(t, stderr, "created token")
206 assert.NotContains(t, stderr, secret)
207
208 // Follow events with that token, through the binary.
209 w := c.startWatch(t, secret)
210
211 // Create. Private by default; here public with a description.
212 res := c.cli(t, secret, "repo", "create", "proj", "--description", "first", "--visibility", "public", "--json").ok(t)
213 assert.Equal(t, repoKeys, keys(t, res.stdout))
214 created := decode[repoOut](t, res.stdout)
215 assert.Equal(t, "proj", created.Name)
216 assert.Equal(t, "first", created.Description)
217 assert.Equal(t, "public", created.Visibility)
218 assert.Equal(t, "main", created.DefaultBranch)
219 require.NotNil(t, created.CreatedAt)
220 _, err := time.Parse(time.RFC3339, *created.CreatedAt)
221 require.NoError(t, err)
222 assert.Nil(t, created.PushedAt, "no push yet")
223
224 ev := decode[eventOut](t, w.next(t, time.Second))
225 assert.Equal(t, "repo_created", ev.Type)
226 assert.Equal(t, "proj", ev.Repo)
227 require.NotNil(t, ev.Repository)
228 assert.Equal(t, "public", ev.Repository.Visibility)
229 assert.NotEmpty(t, ev.ID)
230 assert.Contains(t, ev.ID, "-", "ids are <boot>-<seq>, opaque to the CLI")
231 require.NotNil(t, ev.Time)
232
233 // Creating it again, or with a bad name, is a one-line friendly error.
234 stdout, stderr, code = c.bin(t, secret, "repo", "create", "proj")
235 assert.Empty(t, stdout)
236 requireOneLineError(t, stderr, code, "already exists")
237 stdout, stderr, code = c.bin(t, secret, "repo", "create", "Bad_Name")
238 assert.Empty(t, stdout)
239 requireOneLineError(t, stderr, code, "invalid request")
240
241 // Editing the default branch to one that does not exist fails and changes nothing.
242 _, stderr, code = c.bin(t, secret, "repo", "edit", "proj", "--default-branch", "dev", "--description", "never")
243 requireOneLineError(t, stderr, code, "precondition failed")
244 res = c.cli(t, secret, "repo", "show", "proj", "--json").ok(t)
245 assert.Equal(t, "first", decode[repoOut](t, res.stdout).Description)
246
247 // Push two branches with git, using the same token.
248 wt := c.workTree("main", "README.md")
249 c.mustGit(wt, "checkout", "-q", "-b", "dev")
250 c.writeFile(wt, "dev.txt", []byte("dev\n"))
251 c.mustGit(wt, "push", "-q", c.urlAuth(secret, "/proj.git"), "main", "dev")
252
253 ev = decode[eventOut](t, w.next(t, time.Second))
254 assert.Equal(t, "pushed", ev.Type)
255 assert.Equal(t, "proj", ev.Repo)
256 var refs []string
257 for _, u := range ev.RefUpdates {
258 refs = append(refs, u.Ref)
259 assert.Empty(t, u.OldID)
260 assert.Len(t, u.NewID, 40)
261 }
262 assert.ElementsMatch(t, []string{"refs/heads/main", "refs/heads/dev"}, refs)
263
264 // Edit description, visibility and default branch in one call.
265 res = c.cli(t, secret, "repo", "edit", "proj", "--description", "the project", "--visibility", "private", "--default-branch", "dev", "--json").ok(t)
266 assert.Equal(t, repoKeys, keys(t, res.stdout))
267 edited := decode[repoOut](t, res.stdout)
268 assert.Equal(t, "the project", edited.Description)
269 assert.Equal(t, "private", edited.Visibility)
270 assert.Equal(t, "dev", edited.DefaultBranch)
271 require.NotNil(t, edited.PushedAt, "set by the push")
272 assert.Equal(t, "refs/heads/dev", c.bareGit("proj", "symbolic-ref", "HEAD"))
273
274 ev = decode[eventOut](t, w.next(t, time.Second))
275 assert.Equal(t, "repo_updated", ev.Type)
276 require.NotNil(t, ev.Repository)
277 assert.Equal(t, "dev", ev.Repository.DefaultBranch)
278 assert.Equal(t, "private", ev.Repository.Visibility)
279
280 // Clearing the description takes an explicit empty value.
281 res = c.cli(t, secret, "repo", "edit", "proj", "--description", "", "--json").ok(t)
282 assert.Empty(t, decode[repoOut](t, res.stdout).Description)
283 assert.Equal(t, "repo_updated", decode[eventOut](t, w.next(t, time.Second)).Type)
284
285 // list and show: same shape, human tables too.
286 res = c.cli(t, secret, "repo", "list", "--json").ok(t)
287 list := decode[[]json.RawMessage](t, res.stdout)
288 require.Len(t, list, 1)
289 assert.Equal(t, repoKeys, keys(t, string(list[0])))
290 assert.Equal(t, "proj", decode[repoOut](t, string(list[0])).Name)
291
292 res = c.cli(t, secret, "repo", "show", "proj", "--json").ok(t)
293 assert.Equal(t, repoKeys, keys(t, res.stdout))
294 shown := decode[repoOut](t, res.stdout)
295 assert.Equal(t, "dev", shown.DefaultBranch)
296 assert.Equal(t, "private", shown.Visibility)
297
298 res = c.cli(t, secret, "repo", "list").ok(t)
299 lines := strings.Split(strings.TrimSpace(res.stdout), "\n")
300 require.Len(t, lines, 2)
301 assert.Regexp(t, `^NAME\s+VISIBILITY\s+BRANCH\s+LAST PUSH\s+DESCRIPTION$`, lines[0])
302 assert.Regexp(t, `^proj\s+private\s+dev\s+\d{4}-\d{2}-\d{2} \d{2}:\d{2}`, lines[1])
303 res = c.cli(t, secret, "repo", "show", "proj").ok(t)
304 assert.Regexp(t, `(?m)^default branch\s+dev$`, res.stdout)
305
306 // Private now: invisible to anonymous callers (not_found, never forbidden).
307 _, stderr, code = c.bin(t, "", "repo", "show", "proj")
308 requireOneLineError(t, stderr, code, "not found")
309 res = c.cli(t, "", "repo", "list", "--json").ok(t)
310 assert.JSONEq(t, `[]`, res.stdout)
311
312 // version: no token needed. This server runs on http://127.0.0.1, where
313 // passkeys are not available: they are the only feature missing.
314 res = c.cli(t, "", "version", "--json").ok(t)
315 assert.Equal(t, 1, strings.Count(res.stderr, "warning:"), res.stderr)
316 assert.Contains(t, res.stderr, "the server does not support passkeys")
317 type versionOut struct {
318 Client struct{ Version string }
319 Server struct {
320 URL string
321 Version string
322 Features []string
323 MissingFeatures []string `json:"missing_features"`
324 }
325 }
326 ver := decode[versionOut](t, res.stdout)
327 assert.Equal(t, c.url, ver.Server.URL)
328 assert.NotEmpty(t, ver.Server.Version)
329 assert.ElementsMatch(t, []string{"repo.update", "events.resume", "merge_requests", "merge_requests.delete_branch", "signing_key", "session", "git.list_paths", "token.branch_prefixes", "ci.runs", "ci.runs.filters", "ci.runners"}, ver.Server.Features)
330 assert.Equal(t, []string{"passkeys"}, ver.Server.MissingFeatures)
331 stdout, stderr, code = c.bin(t, secret, "version")
332 require.Equal(t, 0, code, stderr)
333 assert.Contains(t, stdout, "server")
334 assert.Equal(t, 1, strings.Count(stderr, "warning:"), stderr)
335 assert.Contains(t, stderr, "the server does not support passkeys")
336
337 // Tokens: create a second one, list, revoke it, see it stop working.
338 // (through the binary: the in-process runs use a fixed clock)
339 stdout, stderr, code = c.bin(t, secret, "token", "create", "tmp", "--preset", "ci", "--repo", "proj", "--expires", "7d", "--json")
340 require.Equal(t, 0, code, stderr)
341 res = result{stdout: stdout}
342 assert.Equal(t, []string{"branch_prefixes", "created_at", "expires_at", "id", "label", "last_used_at", "repos", "scopes", "secret"}, keys(t, res.stdout))
343 tmp := decode[tokenOut](t, res.stdout)
344 assert.Equal(t, []string{"repo:read"}, tmp.Scopes)
345 assert.Equal(t, []string{"proj"}, tmp.Repos)
346 require.NotNil(t, tmp.ExpiresAt)
347 exp, err := time.Parse(time.RFC3339, *tmp.ExpiresAt)
348 require.NoError(t, err)
349 assert.WithinDuration(t, time.Now().Add(7*24*time.Hour), exp, time.Minute)
350 assert.True(t, strings.HasPrefix(tmp.Secret, "ermite_"))
351
352 // The ci token reads the private repo it is limited to, and cannot write or manage tokens.
353 res = c.cli(t, tmp.Secret, "repo", "show", "proj", "--json").ok(t)
354 assert.Equal(t, "proj", decode[repoOut](t, res.stdout).Name)
355 _, stderr, code = c.bin(t, tmp.Secret, "repo", "create", "nope")
356 requireOneLineError(t, stderr, code, "permission denied")
357 _, stderr, code = c.bin(t, tmp.Secret, "token", "list")
358 requireOneLineError(t, stderr, code, "permission denied")
359
360 res = c.cli(t, secret, "token", "list", "--json").ok(t)
361 tokens := decode[[]tokenOut](t, res.stdout)
362 require.Len(t, tokens, 2)
363 byLabel := map[string]tokenOut{}
364 for _, tk := range tokens {
365 assert.Empty(t, tk.Secret, "list never shows secrets")
366 byLabel[tk.Label] = tk
367 }
368 assert.Len(t, byLabel["daily"].Scopes, len(client.AllScopes()), "the cli preset grants every scope")
369 assert.Equal(t, tmp.ID, byLabel["tmp"].ID)
370 assert.NotContains(t, res.stdout, `"secret"`)
371 res = c.cli(t, secret, "token", "list").ok(t)
372 assert.Regexp(t, `(?m)^ID\s+LABEL\s+SCOPES\s+REPOS\s+BRANCHES\s+EXPIRES\s+LAST USED$`, res.stdout)
373 assert.Contains(t, res.stdout, tmp.ID)
374
375 stdout, stderr, code = c.bin(t, secret, "token", "revoke", tmp.ID)
376 require.Equal(t, 0, code, stderr)
377 assert.Equal(t, "revoked "+tmp.ID+"\n", stdout)
378 _, stderr, code = c.bin(t, secret, "token", "revoke", tmp.ID)
379 requireOneLineError(t, stderr, code, "not found")
380 _, stderr, code = c.bin(t, tmp.Secret, "repo", "list")
381 requireOneLineError(t, stderr, code, "not authenticated", "ERMITE_TOKEN")
382 res = c.cli(t, secret, "token", "list", "--json").ok(t)
383 assert.Len(t, decode[[]tokenOut](t, res.stdout), 1)
384
385 // Delete: refuses without confirmation, then --yes; the repo is gone and the name free.
386 stdout, stderr, code = c.bin(t, secret, "repo", "delete", "proj")
387 assert.Empty(t, stdout)
388 assert.Equal(t, 1, code)
389 assert.Contains(t, stderr, "ermite: aborted")
390 c.cli(t, secret, "repo", "show", "proj").ok(t)
391
392 stdout, stderr, code = c.bin(t, secret, "repo", "delete", "proj", "--yes")
393 require.Equal(t, 0, code, stderr)
394 assert.Equal(t, "deleted proj\n", stdout)
395 ev = decode[eventOut](t, w.next(t, time.Second))
396 assert.Equal(t, "repo_deleted", ev.Type)
397 assert.Equal(t, "proj", ev.Repo)
398
399 stdout, stderr, code = c.bin(t, secret, "repo", "show", "proj")
400 assert.Empty(t, stdout)
401 requireOneLineError(t, stderr, code, "not found")
402 res = c.cli(t, secret, "repo", "list", "--json").ok(t)
403 assert.JSONEq(t, `[]`, res.stdout)
404
405 // Ctrl-C ends the watch cleanly.
406 assert.Equal(t, 0, w.interrupt(t))
407 assert.NotContains(t, w.stderr.String(), "connection lost")
408
409 // No secret reached the server's logs.
410 assert.NotContains(t, c.logs.String(), secret)
411 assert.NotContains(t, c.logs.String(), tmp.Secret)
412}
413
414// A bad or missing token gets the hint about ERMITE_TOKEN; the real server
415// answers on the Connect protocol, so the CLI sees `unauthenticated`.
416func TestAC6CLIUnauthenticatedHint(t *testing.T) {
417 c := newCLIHarness(t)
418 c.seed("pub", domain.VisibilityPublic)
419
420 bad := "ermite_" + strings.Repeat("x", 43)
421 stdout, stderr, code := c.bin(t, bad, "repo", "list")
422 assert.Empty(t, stdout)
423 requireOneLineError(t, stderr, code, "not authenticated", "ERMITE_TOKEN")
424 assert.NotContains(t, stderr, bad)
425
426 // Anonymous reads of public repositories work, and anonymous writes ask for a token.
427 res := c.cli(t, "", "repo", "show", "pub", "--json").ok(t)
428 assert.Equal(t, "pub", decode[repoOut](t, res.stdout).Name)
429 _, stderr, code = c.bin(t, "", "repo", "create", "x")
430 requireOneLineError(t, stderr, code, "ERMITE_TOKEN")
431 _, stderr, code = c.bin(t, "", "token", "list")
432 requireOneLineError(t, stderr, code, "ERMITE_TOKEN")
433}
434
435// Once the server blocks a client for failed authentications, the CLI says so
436// in one line instead of showing a raw error.
437func TestAC6CLIBlockedClient(t *testing.T) {
438 c := newCLIHarness(t)
439 bad := "ermite_" + strings.Repeat("y", 43)
440 var last result
441 for range 50 {
442 last = c.cli(t, bad, "repo", "list")
443 require.Error(t, last.err)
444 if strings.Contains(last.err.Error(), "too many") {
445 break
446 }
447 assert.Contains(t, last.err.Error(), "not authenticated")
448 }
449 require.Contains(t, last.err.Error(), "too many requests", "the limiter never blocked")
450 assert.NotContains(t, last.err.Error(), "\n")
451
452 _, stderr, code := c.bin(t, adminToken, "repo", "list")
453 requireOneLineError(t, stderr, code, "too many requests")
454}
455
456// The client survives a dropped connection: it reconnects with backoff and
457// resumes after the last event it printed, without losing or repeating events.
458func TestAC6CLIWatchResumesAfterDrop(t *testing.T) {
459 c := newCLIHarness(t)
460 w := c.startWatch(t, adminToken)
461
462 c.cli(t, adminToken, "repo", "create", "one").ok(t)
463 first := decode[eventOut](t, w.next(t, time.Second))
464 assert.Equal(t, "one", first.Repo)
465
466 // Cut every connection, then make an event happen while the CLI is away.
467 c.srv.CloseClientConnections()
468 c.cli(t, adminToken, "repo", "create", "two").ok(t)
469 c.cli(t, adminToken, "repo", "create", "three").ok(t)
470
471 second := decode[eventOut](t, w.next(t, 10*time.Second))
472 third := decode[eventOut](t, w.next(t, 2*time.Second))
473 assert.Equal(t, []string{"two", "three"}, []string{second.Repo, third.Repo}, "replayed in order, none repeated")
474 assert.Equal(t, "repo_created", second.Type)
475 assert.NotEqual(t, first.ID, second.ID)
476
477 // Live again after the replay.
478 c.cli(t, adminToken, "repo", "create", "four").ok(t)
479 assert.Equal(t, "four", decode[eventOut](t, w.next(t, time.Second)).Repo)
480
481 assert.Equal(t, 0, w.interrupt(t))
482 assert.Contains(t, w.stderr.String(), "ermite: connection lost")
483 assert.Contains(t, w.stderr.String(), "ermite: reconnected")
484 assert.NotContains(t, w.stderr.String(), "no resume point", "the first event gave a resume point")
485}
486
487// A watch on one repository only sees that repository, and an unknown one is
488// a one-line not_found without any retry.
489func TestAC6CLIWatchOneRepo(t *testing.T) {
490 c := newCLIHarness(t)
491 c.seed("a", domain.VisibilityPublic)
492 c.seed("b", domain.VisibilityPublic)
493
494 stdout, stderr, code := c.bin(t, adminToken, "watch", "missing")
495 assert.Empty(t, stdout)
496 requireOneLineError(t, stderr, code, "not found")
497
498 w := c.startWatch(t, adminToken, "a")
499 wt := c.workTree("main", "f")
500 c.mustGit(wt, "push", "-q", c.urlAuth(adminToken, "/b.git"), "main")
501 c.mustGit(wt, "push", "-q", c.urlAuth(adminToken, "/a.git"), "main")
502 ev := decode[eventOut](t, w.next(t, time.Second))
503 assert.Equal(t, "pushed", ev.Type)
504 assert.Equal(t, "a", ev.Repo)
505 assert.Equal(t, 0, w.interrupt(t))
506}