gitea/tests/integration/feed_user_test.go

// Copyright 2022 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package integration

import (
	"encoding/xml"
	"net/http"
	"strings"
	"testing"

	auth_model "gitea.dev/models/auth"
	repo_model "gitea.dev/models/repo"
	unit_model "gitea.dev/models/unit"
	"gitea.dev/models/unittest"
	repo_service "gitea.dev/services/repository"
	"gitea.dev/tests"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// RSS is a struct to unmarshal RSS feeds test only
type RSS struct {
	Channel struct {
		Title       string `xml:"title"`
		Link        string `xml:"link"`
		Description string `xml:"description"`
		PubDate     string `xml:"pubDate"`
		Items       []struct {
			Title       string `xml:"title"`
			Link        string `xml:"link"`
			Description string `xml:"description"`
			PubDate     string `xml:"pubDate"`
		} `xml:"item"`
	} `xml:"channel"`
}

func TestFeedUser(t *testing.T) {
	defer tests.PrepareTestEnv(t)()

	resp := MakeRequest(t, NewRequest(t, "GET", "/user2.atom"), http.StatusOK)
	assert.Contains(t, resp.Body.String(), `<feed xmlns="http://www.w3.org/2005/Atom"`)

	resp = MakeRequest(t, NewRequest(t, "GET", "/user2.rss"), http.StatusOK)
	assert.Contains(t, resp.Body.String(), `<rss version="2.0"`)
	var rss RSS
	assert.NoError(t, xml.Unmarshal(resp.Body.Bytes(), &rss))
	assert.Contains(t, rss.Channel.Link, "/user2")
	assert.NotEmpty(t, rss.Channel.PubDate)

	session := loginUser(t, "user2")
	readUser := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser)
	for _, tc := range []struct {
		link, accept, token, privateMarker string
		visible                            bool
	}{
		{"/user2.rss", "", readUser, "user2/repo2", true},
		{"/user2", "application/rss+xml", readUser, "user2/repo2", true},
		{"/user2.rss", "", getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopePublicOnly), "user2/repo2", false},
		{"/org3.rss", "", getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadOrganization), "org3/repo3", true},
		{"/user2?tab=activity", "", getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeAll), "user2/repo2", false},
	} {
		req := NewRequest(t, "GET", tc.link).SetHeader("Accept", tc.accept).AddBasicAuth("user2", tc.token)
		assert.Equal(t, tc.visible, strings.Contains(MakeRequest(t, req, http.StatusOK).Body.String(), tc.privateMarker), tc.link)
	}
	readPackage := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadPackage)
	for _, link := range []string{"/user2.rss", "/org3.rss"} {
		MakeRequest(t, NewRequest(t, "GET", link).AddBasicAuth("user2", readPackage), http.StatusForbidden)
	}

	t.Run("Repo", func(t *testing.T) {
		t.Run("RSS", func(t *testing.T) {
			req := NewRequest(t, "GET", "/user2/repo1.rss")
			resp := MakeRequest(t, req, http.StatusOK)

			data := resp.Body.String()
			assert.Contains(t, data, `<rss version="2.0"`)

			var rss RSS
			err := xml.Unmarshal(resp.Body.Bytes(), &rss)
			assert.NoError(t, err)
			assert.Contains(t, rss.Channel.Link, "/user2/repo1")
			assert.NotEmpty(t, rss.Channel.PubDate)
			assert.Len(t, rss.Channel.Items, 1)
			assert.Equal(t, "issue5", rss.Channel.Items[0].Description)
			assert.NotEmpty(t, rss.Channel.Items[0].PubDate)
		})
	})

	t.Run("User", func(t *testing.T) {
		t.Run("Atom", func(t *testing.T) {
			req := NewRequest(t, "GET", "/user2.atom")
			resp := MakeRequest(t, req, http.StatusOK)

			data := resp.Body.String()
			assert.Contains(t, data, `<feed xmlns="http://www.w3.org/2005/Atom"`)
		})

		t.Run("RSS", func(t *testing.T) {
			req := NewRequest(t, "GET", "/user2.rss")
			resp := MakeRequest(t, req, http.StatusOK)

			data := resp.Body.String()
			assert.Contains(t, data, `<rss version="2.0"`)

			var rss RSS
			err := xml.Unmarshal(resp.Body.Bytes(), &rss)
			assert.NoError(t, err)
			assert.Contains(t, rss.Channel.Link, "/user2")
			assert.NotEmpty(t, rss.Channel.PubDate)
		})
	})

	// TestFeedRepoContentTokenScopes ensures repository feed endpoints enforce the
	// repository token scope, so a PAT without repository scope cannot read private
	// repository commit/activity data through RSS/Atom feeds.
	t.Run("RepoContentTokenScopes", func(t *testing.T) {
		// user2/repo2 is a private repository owned by user2
		ownerReadToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
		miscToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadMisc)

		urls := []string{
			"/user2/repo2.rss",
			"/user2/repo2.atom",
			"/user2/repo2/rss/branch/master",
			"/user2/repo2/atom/branch/master",
			"/user2/repo2/rss/branch/master/README.md",
			"/user2/repo2/tags.rss",
			"/user2/repo2/tags.atom",
			"/user2/repo2/releases.rss",
			"/user2/repo2/releases.atom",
		}

		for _, url := range urls {
			t.Run(url, func(t *testing.T) {
				// feed routes only accept basic auth, so authenticate as the advisory PoC does (user:token)
				reqDenied := NewRequest(t, "GET", url)
				reqDenied.SetBasicAuth("user2", miscToken)
				// a token without repository scope must be denied
				MakeRequest(t, reqDenied, http.StatusForbidden)

				reqAllowed := NewRequest(t, "GET", url)
				reqAllowed.SetBasicAuth("user2", ownerReadToken)
				// a token with repository read scope is allowed
				MakeRequest(t, reqAllowed, http.StatusOK)
			})
		}
	})

	t.Run("RepoTagsWithoutReleasesAccess", func(t *testing.T) {
		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
		require.NoError(t, repo_service.UpdateRepositoryUnits(t.Context(), repo, nil, []unit_model.Type{unit_model.TypeReleases}))

		resp := MakeRequest(t, NewRequest(t, "GET", "/user2/repo1/tags.rss"), http.StatusOK)
		data := resp.Body.String()
		assert.Contains(t, data, "/user2/repo1/src/tag/v1.0")
		assert.NotContains(t, data, "pre-release")
		assert.NotContains(t, data, "some text for a pre release")
	})

	t.Run("RepoBranchFeedWithoutCodeAccess", func(t *testing.T) {
		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
		require.NoError(t, repo_service.UpdateRepositoryUnits(t.Context(), repo, nil, []unit_model.Type{unit_model.TypeCode}))
		MakeRequest(t, NewRequest(t, "GET", "/user2/repo1").SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
		MakeRequest(t, NewRequest(t, "GET", "/user2/repo1").SetHeader("Accept", "application/atom+xml"), http.StatusNotFound)
		MakeRequest(t, NewRequest(t, "GET", "/user2/repo1.rss"), http.StatusOK)
	})
}