gitea/tests/integration/actions_variables_test.go

// Copyright 2024 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package integration

import (
	"fmt"
	"net/http"
	"testing"

	actions_model "gitea.dev/models/actions"
	"gitea.dev/models/db"
	repo_model "gitea.dev/models/repo"
	"gitea.dev/models/unittest"
	user_model "gitea.dev/models/user"
	"gitea.dev/tests"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestActionsVariables(t *testing.T) {
	defer tests.PrepareTestEnv(t)()

	ctx := t.Context()

	require.NoError(t, db.DeleteAllRecords("action_variable"))

	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
	_, _ = actions_model.InsertVariable(ctx, actions_model.BelongingScopeOwner(user2.ID), "VAR", "user2-var", "user2-var-description")
	user2Var := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{OwnerID: user2.ID, Name: "VAR"})
	userWebURL := "/user/settings/actions/variables"

	org3 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3, Type: user_model.UserTypeOrganization})
	_, _ = actions_model.InsertVariable(ctx, actions_model.BelongingScopeOwner(org3.ID), "VAR", "org3-var", "org3-var-description")
	org3Var := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{OwnerID: org3.ID, Name: "VAR"})
	orgWebURL := "/org/org3/settings/actions/variables"

	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
	_, _ = actions_model.InsertVariable(ctx, actions_model.BelongingScopeRepo(repo1.ID), "VAR", "repo1-var", "repo1-var-description")
	repo1Var := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{RepoID: repo1.ID, Name: "VAR"})
	repoWebURL := "/user2/repo1/settings/actions/variables"

	_, _ = actions_model.InsertVariable(ctx, actions_model.BelongingScope{}, "VAR", "global-var", "global-var-description")
	globalVar := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{Name: "VAR", Data: "global-var"})
	adminWebURL := "/-/admin/actions/variables"

	sessionAdmin := loginUser(t, "user1")
	sessionUser2 := loginUser(t, user2.Name)

	doUpdate := func(t *testing.T, sess *TestSession, baseURL string, id int64, data string, expectedStatus int) {
		req := NewRequestWithValues(t, "POST", fmt.Sprintf("%s/%d/edit", baseURL, id), map[string]string{
			"name": "VAR",
			"data": data,
		})
		sess.MakeRequest(t, req, expectedStatus)
	}

	doDelete := func(t *testing.T, sess *TestSession, baseURL string, id int64, expectedStatus int) {
		req := NewRequest(t, "POST", fmt.Sprintf("%s/%d/delete", baseURL, id))
		sess.MakeRequest(t, req, expectedStatus)
	}

	assertDenied := func(t *testing.T, sess *TestSession, baseURL string, id int64) {
		doUpdate(t, sess, baseURL, id, "ChangedData", http.StatusNotFound)
		doDelete(t, sess, baseURL, id, http.StatusNotFound)
		v := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{ID: id})
		assert.Contains(t, v.Data, "-var")
	}

	assertSuccess := func(t *testing.T, sess *TestSession, baseURL string, id int64) {
		doUpdate(t, sess, baseURL, id, "ChangedData", http.StatusOK)
		v := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{ID: id})
		assert.Equal(t, "ChangedData", v.Data)
		doDelete(t, sess, baseURL, id, http.StatusOK)
		unittest.AssertNotExistsBean(t, &actions_model.ActionVariable{ID: id})
	}

	originURLs := map[string]string{
		"User":  userWebURL,
		"Org":   orgWebURL,
		"Repo":  repoWebURL,
		"Admin": adminWebURL,
	}
	for _, variable := range []struct {
		name    string
		id      int64
		origins []string
	}{
		{"User", user2Var.ID, []string{"Org", "Repo", "Admin"}},
		{"Org", org3Var.ID, []string{"Repo", "User", "Admin"}},
		{"Repo", repo1Var.ID, []string{"Org", "User", "Admin"}},
		{"Global", globalVar.ID, []string{"Org", "User", "Repo"}},
	} {
		t.Run("Update"+variable.name+"Var", func(t *testing.T) {
			for _, origin := range variable.origins {
				t.Run("From"+origin, func(t *testing.T) {
					assertDenied(t, sessionAdmin, originURLs[origin], variable.id)
				})
			}
		})
	}

	t.Run("UpdateSuccess", func(t *testing.T) {
		t.Run("User", func(t *testing.T) {
			assertSuccess(t, sessionUser2, userWebURL, user2Var.ID)
		})
		t.Run("Org", func(t *testing.T) {
			assertSuccess(t, sessionAdmin, orgWebURL, org3Var.ID)
		})
		t.Run("Repo", func(t *testing.T) {
			assertSuccess(t, sessionUser2, repoWebURL, repo1Var.ID)
		})
		t.Run("Admin", func(t *testing.T) {
			assertSuccess(t, sessionAdmin, adminWebURL, globalVar.ID)
		})
	})
}