mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
116 lines
3.8 KiB
Go
116 lines
3.8 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
type scopeTestNormalize struct {
|
|
in AccessTokenScope
|
|
out AccessTokenScope
|
|
err error
|
|
}
|
|
|
|
func TestAccessTokenScope_Normalize(t *testing.T) {
|
|
assert.Equal(t, []string{"activitypub", "admin", "issue", "misc", "notification", "organization", "package", "repository", "user"}, GetAccessTokenCategories())
|
|
tests := []scopeTestNormalize{
|
|
{"", "", nil},
|
|
{"write:misc,write:notification,read:package,write:notification,public-only", "public-only,write:misc,write:notification,read:package", nil},
|
|
{"all", "all", nil},
|
|
{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user", "all", nil},
|
|
{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user,public-only", "public-only,all", nil},
|
|
}
|
|
|
|
for _, scope := range GetAccessTokenCategories() {
|
|
tests = append(tests,
|
|
scopeTestNormalize{AccessTokenScope("read:" + scope), AccessTokenScope("read:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope("write:" + scope), AccessTokenScope("write:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope(fmt.Sprintf("write:%[1]s,read:%[1]s", scope)), AccessTokenScope("write:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope(fmt.Sprintf("read:%[1]s,write:%[1]s", scope)), AccessTokenScope("write:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope(fmt.Sprintf("read:%[1]s,write:%[1]s,write:%[1]s", scope)), AccessTokenScope("write:" + scope), nil},
|
|
)
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(string(test.in), func(t *testing.T) {
|
|
scope, err := test.in.Normalize()
|
|
assert.Equal(t, test.out, scope)
|
|
assert.Equal(t, test.err, err)
|
|
})
|
|
}
|
|
}
|
|
|
|
type scopeTestHasScope struct {
|
|
in AccessTokenScope
|
|
scope AccessTokenScope
|
|
out bool
|
|
err error
|
|
}
|
|
|
|
func TestAccessTokenScope_HasScope(t *testing.T) {
|
|
tests := []scopeTestHasScope{
|
|
{"read:admin", "write:package", false, nil},
|
|
{"all", "write:package", true, nil},
|
|
{"write:package", "all", false, nil},
|
|
{"public-only", "read:issue", false, nil},
|
|
}
|
|
|
|
for _, scope := range GetAccessTokenCategories() {
|
|
tests = append(tests,
|
|
scopeTestHasScope{
|
|
AccessTokenScope("read:" + scope),
|
|
AccessTokenScope("read:" + scope), true, nil,
|
|
},
|
|
scopeTestHasScope{
|
|
AccessTokenScope("write:" + scope),
|
|
AccessTokenScope("write:" + scope), true, nil,
|
|
},
|
|
scopeTestHasScope{
|
|
AccessTokenScope("write:" + scope),
|
|
AccessTokenScope("read:" + scope), true, nil,
|
|
},
|
|
scopeTestHasScope{
|
|
AccessTokenScope("read:" + scope),
|
|
AccessTokenScope("write:" + scope), false, nil,
|
|
},
|
|
)
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(string(test.in), func(t *testing.T) {
|
|
hasScope, err := test.in.HasScope(test.scope)
|
|
assert.Equal(t, test.out, hasScope)
|
|
assert.Equal(t, test.err, err)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAccessTokenScope_EnforcePublicOnlyFrom(t *testing.T) {
|
|
tests := []struct {
|
|
in AccessTokenScope
|
|
parent AccessTokenScope
|
|
out AccessTokenScope
|
|
}{
|
|
// public-only parent forces the restriction onto the minted scope
|
|
{"write:user", "write:user,public-only", "public-only,write:user"},
|
|
// already public-only stays public-only
|
|
{"public-only,read:user", "public-only", "public-only,read:user"},
|
|
// non-public-only parent leaves the scope untouched
|
|
{"write:user", "write:user", "write:user"},
|
|
{"all", "all", "all"},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(string(test.parent)+"->"+string(test.in), func(t *testing.T) {
|
|
got, err := test.in.EnforcePublicOnlyFrom(test.parent)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, test.out, got)
|
|
})
|
|
}
|
|
}
|