mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-02 13:44:16 +09:00
da7b81d407
Add `read:commitstatus` and `write:commitstatus` token scopes, so CI and
other integrations can report commit statuses without a token that
grants full repository access.
- The commit status endpoints (`/statuses/{sha}`,
`/commits/{ref}/status` and `/commits/{ref}/statuses`) accept the new
scopes, and the repository scopes keep working as they include them
- Creating a status still requires code write permission on the
repository, the scope only narrows what the token may do
- `public-only` tokens still cannot reach private repositories
- `PathGroup` middlewares now run only for a matched path, so unrelated
methods and paths that fall back to the group are not rejected by its
scope check
Fixes: https://github.com/go-gitea/gitea/issues/32625
Ref: https://github.com/go-gitea/gitea/pull/35383
Docs: https://gitea.com/gitea/docs/pulls/622
Signed-off-by: Norbert Szulc <norbert@not7cd.net>
Co-authored-by: Aiden Scandella <git@sca.ndella.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
285 lines
13 KiB
Go
285 lines
13 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"path"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/db"
|
|
git_model "gitea.dev/models/git"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/models/unittest"
|
|
"gitea.dev/modules/commitstatus"
|
|
"gitea.dev/modules/git"
|
|
"gitea.dev/modules/json"
|
|
"gitea.dev/modules/setting"
|
|
api "gitea.dev/modules/structs"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/PuerkitoBio/goquery"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestRepoCommits(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
session := loginUser(t, "user2")
|
|
|
|
t.Run("CommitList", func(t *testing.T) {
|
|
req := NewRequest(t, "GET", "/user2/repo16/commits/branch/master")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var commits, userHrefs []string
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
doc.doc.Find("#commits-table .commit-id-short").Each(func(i int, s *goquery.Selection) {
|
|
commits = append(commits, path.Base(s.AttrOr("href", "")))
|
|
})
|
|
doc.doc.Find("#commits-table .avatar-stack-names a.muted").Each(func(i int, s *goquery.Selection) {
|
|
userHrefs = append(userHrefs, s.AttrOr("href", ""))
|
|
})
|
|
assert.Equal(t, []string{"69554a64c1e6030f051e5c3f94bfbd773cd6a324", "27566bd5738fc8b4e3fef3c5e72cce608537bd95", "5099b81332712fe655e34e8dd63574f503f61811"}, commits)
|
|
assert.Equal(t, []string{
|
|
"/user2/repo16/commits/branch/master/search?q=author%3Auser2%40example.com",
|
|
"/user2/repo16/commits/branch/master/search?q=author%3Auser21%40example.com",
|
|
"/user2/repo16/commits/branch/master/search?q=author%3Auser2%40example.com",
|
|
}, userHrefs)
|
|
})
|
|
|
|
t.Run("LastCommit", func(t *testing.T) {
|
|
req := NewRequest(t, "GET", "/user2/repo16")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
commitHref := doc.doc.Find(".latest-commit .commit-id-short").AttrOr("href", "")
|
|
authorHref := doc.doc.Find(".latest-commit .avatar-stack-names a").AttrOr("href", "")
|
|
assert.Equal(t, "/user2/repo16/commit/69554a64c1e6030f051e5c3f94bfbd773cd6a324", commitHref)
|
|
assert.Equal(t, "/user2/repo16/commits/branch/master/search?q=author%3Auser2%40example.com", authorHref)
|
|
})
|
|
|
|
t.Run("CommitListNonExistingCommiter", func(t *testing.T) {
|
|
// check the commit list for a repository with no gitea user
|
|
// * commit 985f0301dba5e7b34be866819cd15ad3d8f508ee (branch2)
|
|
// * Author: 6543 <6543@obermui.de>
|
|
req := NewRequest(t, "GET", "/user2/repo1/commits/branch/branch2")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
commitHref := doc.doc.Find("#commits-table tr:first-child .commit-id-short").AttrOr("href", "")
|
|
assert.Equal(t, "/user2/repo1/commit/985f0301dba5e7b34be866819cd15ad3d8f508ee", commitHref)
|
|
authorElem := doc.doc.Find("#commits-table tr:first-child .avatar-stack-names")
|
|
assert.Equal(t, "6543", strings.TrimSpace(authorElem.Text()))
|
|
})
|
|
|
|
t.Run("CommitPageUsesCommitterDate", func(t *testing.T) {
|
|
const (
|
|
commitID = "5099b81332712fe655e34e8dd63574f503f61811"
|
|
expectedCommitterTime = "2017-08-06T19:56:13+02:00"
|
|
)
|
|
|
|
req := NewRequest(t, "GET", "/user2/repo16/commits/branch/master")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
|
|
var commitListTime string
|
|
doc.doc.Find("#commits-table tbody tr").EachWithBreak(func(_ int, row *goquery.Selection) bool {
|
|
if path.Base(row.Find(".commit-id-short").AttrOr("href", "")) != commitID {
|
|
return true
|
|
}
|
|
commitListTime = row.Find("td").Eq(3).Find("relative-time").AttrOr("datetime", "")
|
|
return false
|
|
})
|
|
require.Equal(t, expectedCommitterTime, commitListTime)
|
|
})
|
|
|
|
t.Run("LastCommitNonExistingCommiter", func(t *testing.T) {
|
|
req := NewRequest(t, "GET", "/user2/repo1/src/branch/branch2")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
commitHref := doc.doc.Find(".latest-commit .commit-id-short").AttrOr("href", "")
|
|
assert.Equal(t, "/user2/repo1/commit/985f0301dba5e7b34be866819cd15ad3d8f508ee", commitHref)
|
|
authorElem := doc.doc.Find(".latest-commit .avatar-stack-names")
|
|
assert.Equal(t, "6543", strings.TrimSpace(authorElem.Text()))
|
|
})
|
|
|
|
t.Run("CommitterIsNotAuthor", func(t *testing.T) {
|
|
repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
err := git.ForceFastImport(t.Context(), repo1, []git.FastImportCommit{
|
|
{
|
|
Ref: "refs/heads/test-branch-committer",
|
|
Files: []git.FastImportFile{{Path: "dummy-file.txt", Content: "dummy-content"}},
|
|
Author: &git.Signature{Name: "real-commit-author", Email: "dummy-email1@example.com"},
|
|
Committer: &git.Signature{Name: "non-author-committer", Email: "dummy-email2@example.com"},
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
commitID, err := git.GetBranchCommitID(t.Context(), repo1, "test-branch-committer")
|
|
require.NoError(t, err)
|
|
req := NewRequest(t, "GET", "/user2/repo1/commit/"+commitID)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
assert.Contains(t, resp.Body.String(), "non-author-committer")
|
|
})
|
|
}
|
|
|
|
func TestRepoCommitsWithStatus(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user2")
|
|
ctx := NewAPITestContext(t, "user2", "repo1", auth_model.AccessTokenScopeWriteRepository)
|
|
|
|
requestCommitStatuses := func(t *testing.T, linkList, linkCombined string) (statuses []*api.CommitStatus, status api.CombinedStatus) {
|
|
assert.NoError(t, json.Unmarshal(session.MakeRequest(t, NewRequest(t, "GET", linkList), http.StatusOK).Body.Bytes(), &statuses))
|
|
assert.NoError(t, json.Unmarshal(session.MakeRequest(t, NewRequest(t, "GET", linkCombined), http.StatusOK).Body.Bytes(), &status))
|
|
return statuses, status
|
|
}
|
|
|
|
testRefMaster := func(t *testing.T, state commitstatus.CommitStatusState, classes ...string) {
|
|
_ = db.TruncateBeans(t.Context(), &git_model.CommitStatus{})
|
|
|
|
// Request repository commits page
|
|
req := NewRequest(t, "GET", "/user2/repo1/commits/branch/master")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
// Get first commit URL
|
|
commitURL, _ := doc.doc.Find("#commits-table .commit-id-short").Attr("href")
|
|
require.NotEmpty(t, commitURL)
|
|
commitID := path.Base(commitURL)
|
|
|
|
// Call API to add status for commit
|
|
doAPICreateCommitStatusTest(ctx, path.Base(commitURL), state, "testci")(t)
|
|
|
|
req = NewRequest(t, "GET", "/user2/repo1/commits/branch/master")
|
|
resp = session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
doc = NewHTMLParser(t, resp.Body)
|
|
// Check if commit status is displayed in message column (.tippy-target to ignore the tippy trigger)
|
|
sel := doc.doc.Find("#commits-table .message .tippy-target .commit-status")
|
|
assert.Equal(t, 1, sel.Length())
|
|
for _, class := range classes {
|
|
assert.True(t, sel.HasClass(class))
|
|
}
|
|
|
|
for _, ref := range []string{
|
|
commitID, // By SHA
|
|
commitID[:7], // By short SHA
|
|
"master", // By Ref
|
|
"v1.1", // Tag "v1.1" points to master
|
|
} {
|
|
statuses, status := requestCommitStatuses(t, "/api/v1/repos/user2/repo1/commits/"+ref+"/statuses", "/api/v1/repos/user2/repo1/commits/"+ref+"/status")
|
|
require.Len(t, statuses, 1)
|
|
require.NotNil(t, status)
|
|
|
|
assert.Equal(t, state, statuses[0].State)
|
|
assert.Equal(t, setting.AppURL+"api/v1/repos/user2/repo1/statuses/"+commitID, statuses[0].URL)
|
|
assert.Equal(t, "http://test.ci/", statuses[0].TargetURL)
|
|
assert.Empty(t, statuses[0].Description)
|
|
assert.Equal(t, "testci", statuses[0].Context)
|
|
|
|
assert.Len(t, status.Statuses, 1)
|
|
assert.Equal(t, statuses[0], status.Statuses[0])
|
|
assert.Equal(t, commitID, status.SHA)
|
|
}
|
|
}
|
|
|
|
t.Run("pending", func(t *testing.T) { testRefMaster(t, "pending", "octicon-dot-fill", "tw-text-yellow") })
|
|
t.Run("success", func(t *testing.T) { testRefMaster(t, "success", "octicon-check", "tw-text-green") })
|
|
t.Run("error", func(t *testing.T) { testRefMaster(t, "error", "gitea-exclamation", "tw-text-red") })
|
|
t.Run("failure", func(t *testing.T) { testRefMaster(t, "failure", "octicon-x", "tw-text-red") })
|
|
t.Run("warning", func(t *testing.T) { testRefMaster(t, "warning", "gitea-exclamation", "tw-text-yellow") })
|
|
t.Run("BranchWithSlash", func(t *testing.T) {
|
|
_ = db.TruncateBeans(t.Context(), &git_model.CommitStatus{})
|
|
|
|
linkList, linkCombined := "/api/v1/repos/user2/repo1/commits/feature%2F1/statuses", "/api/v1/repos/user2/repo1/commits/feature/1/status"
|
|
statuses, status := requestCommitStatuses(t, linkList, linkCombined)
|
|
assert.Empty(t, statuses)
|
|
assert.Empty(t, status.Statuses)
|
|
doAPICreateCommitStatusTest(ctx, "feature/1", commitstatus.CommitStatusSuccess, "testci")(t)
|
|
statuses, status = requestCommitStatuses(t, linkList, linkCombined)
|
|
assert.NotEmpty(t, statuses)
|
|
assert.NotEmpty(t, status.Statuses)
|
|
})
|
|
t.Run("TokenScopes", func(t *testing.T) {
|
|
commitIDs := map[string]string{"repo1": "65f1bf27bc3bf70f64657658635e66094edbcb4d", "repo2": "1032bbf17fbc0d9c95bb5418dabe8f8c99278700"}
|
|
for _, test := range []struct {
|
|
name string
|
|
userID int64
|
|
reponame string
|
|
scope auth_model.AccessTokenScope
|
|
getCode, postCode int
|
|
}{
|
|
{"WriteCommitStatus", 2, "repo1", auth_model.AccessTokenScopeWriteCommitStatus, http.StatusOK, http.StatusCreated},
|
|
{"ReadCommitStatus", 2, "repo1", auth_model.AccessTokenScopeReadCommitStatus, http.StatusOK, http.StatusForbidden},
|
|
{"WriteRepository", 2, "repo1", auth_model.AccessTokenScopeWriteRepository, http.StatusOK, http.StatusCreated},
|
|
{"ReadRepository", 2, "repo1", auth_model.AccessTokenScopeReadRepository, http.StatusOK, http.StatusForbidden},
|
|
{"UnrelatedScope", 2, "repo1", auth_model.AccessTokenScopeWriteIssue, http.StatusForbidden, http.StatusForbidden},
|
|
{"NonWriter", 4, "repo1", auth_model.AccessTokenScopeWriteCommitStatus, http.StatusOK, http.StatusForbidden},
|
|
{"PublicOnlyPrivateRepo", 2, "repo2", "public-only,write:commitstatus", http.StatusNotFound, http.StatusNotFound},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
token := &auth_model.AccessToken{UID: test.userID, Name: test.name, Scope: test.scope}
|
|
require.NoError(t, auth_model.NewAccessToken(t.Context(), token))
|
|
repoLink, commitID := "/api/v1/repos/user2/"+test.reponame, commitIDs[test.reponame]
|
|
for _, link := range []string{"/statuses/" + commitID, "/commits/master/status", "/commits/master/statuses"} {
|
|
MakeRequest(t, NewRequest(t, "GET", repoLink+link).AddTokenAuth(token.Token), test.getCode)
|
|
}
|
|
MakeRequest(t, NewRequestWithJSON(t, "POST", repoLink+"/statuses/"+commitID, api.CreateStatusOption{State: commitstatus.CommitStatusSuccess}).AddTokenAuth(token.Token), test.postCode)
|
|
})
|
|
}
|
|
t.Run("UnmatchedCommitPathSkipsCommitStatusScope", func(t *testing.T) {
|
|
token := &auth_model.AccessToken{UID: 2, Name: "UnmatchedCommitPath", Scope: auth_model.AccessTokenScopeWriteIssue}
|
|
require.NoError(t, auth_model.NewAccessToken(t.Context(), token))
|
|
MakeRequest(t, NewRequest(t, "POST", "/api/v1/repos/user2/repo1/commits/"+commitIDs["repo1"]+"/pull").AddTokenAuth(token.Token), http.StatusNotFound)
|
|
})
|
|
})
|
|
}
|
|
|
|
func TestRepoCommitsStatus(t *testing.T) {
|
|
for _, name := range []string{"Parallel", "Multiple"} {
|
|
t.Run(name, func(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
session := loginUser(t, "user2")
|
|
|
|
// Request repository commits page
|
|
req := NewRequest(t, "GET", "/user2/repo1/commits/branch/master")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
doc := NewHTMLParser(t, resp.Body)
|
|
// Get first commit URL
|
|
commitURL, exists := doc.doc.Find("#commits-table .commit-id-short").Attr("href")
|
|
assert.True(t, exists)
|
|
assert.NotEmpty(t, commitURL)
|
|
|
|
if name == "Parallel" {
|
|
var wg sync.WaitGroup
|
|
for i := range 10 {
|
|
wg.Go(func() {
|
|
t.Run(fmt.Sprintf("ParallelCreateStatus_%d", i), func(t *testing.T) {
|
|
ctx := NewAPITestContext(t, "user2", "repo1", auth_model.AccessTokenScopeWriteRepository)
|
|
doAPICreateCommitStatusTest(ctx, path.Base(commitURL), commitstatus.CommitStatusPending, "testci")(t)
|
|
})
|
|
})
|
|
}
|
|
wg.Wait()
|
|
} else {
|
|
// Call API to add status for commit
|
|
ctx := NewAPITestContext(t, "user2", "repo1", auth_model.AccessTokenScopeWriteRepository)
|
|
t.Run("CreateStatus", doAPICreateCommitStatusTest(ctx, path.Base(commitURL), commitstatus.CommitStatusSuccess, "testci"))
|
|
t.Run("CreateStatus", doAPICreateCommitStatusTest(ctx, path.Base(commitURL), commitstatus.CommitStatusSuccess, "other_context"))
|
|
req = NewRequest(t, "GET", "/user2/repo1/commits/branch/master")
|
|
resp = session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
doc = NewHTMLParser(t, resp.Body)
|
|
// Check that the data-global-init="initCommitStatuses" (for trigger) and commit-status (svg) are present
|
|
sel := doc.doc.Find(`#commits-table .message [data-global-init="initCommitStatuses"] .commit-status`)
|
|
assert.Equal(t, 1, sel.Length())
|
|
}
|
|
})
|
|
}
|
|
}
|