mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
71 lines
2.8 KiB
Go
71 lines
2.8 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package private
|
|
|
|
import (
|
|
"testing"
|
|
|
|
issues_model "github.com/hanzoai/git/models/issues"
|
|
"github.com/hanzoai/git/models/perm/access"
|
|
repo_model "github.com/hanzoai/git/models/repo"
|
|
"github.com/hanzoai/git/models/unittest"
|
|
"github.com/hanzoai/git/modules/git"
|
|
"github.com/hanzoai/git/services/contexttest"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestPreReceiveCanWriteCodePerBranch ensures the maintainer-edit write grant is evaluated against
|
|
// the exact ref being pushed on every call, derived from that ref rather than shared mutable state.
|
|
// Otherwise a per-branch grant (an open PR with "allow edits from maintainers") could be batched
|
|
// together with a protected branch or a tag to escalate into full repository write.
|
|
func TestPreReceiveCanWriteCodePerBranch(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
baseRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 10})
|
|
headRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 11})
|
|
require.NoError(t, baseRepo.LoadOwner(t.Context()))
|
|
require.NoError(t, headRepo.LoadOwner(t.Context()))
|
|
|
|
// An open PR from the head repo owner, with maintainer edits allowed: this grants the base
|
|
// repo owner write access to exactly this head branch and nothing else.
|
|
pr := &issues_model.PullRequest{
|
|
Issue: &issues_model.Issue{
|
|
RepoID: baseRepo.ID,
|
|
PosterID: headRepo.OwnerID,
|
|
},
|
|
HeadRepoID: headRepo.ID,
|
|
BaseRepoID: baseRepo.ID,
|
|
HeadBranch: "granted-branch",
|
|
BaseBranch: "master",
|
|
AllowMaintainerEdit: true,
|
|
}
|
|
require.NoError(t, issues_model.NewPullRequest(t.Context(), baseRepo, pr.Issue, nil, nil, pr))
|
|
|
|
// The pusher is the base repo owner (the maintainer) with only read access on the head repo.
|
|
maintainer := baseRepo.Owner
|
|
headPerm, err := access.GetIndividualUserRepoPermission(t.Context(), headRepo, maintainer)
|
|
require.NoError(t, err)
|
|
|
|
mockCtx, _ := contexttest.MockPrivateContext(t, "/")
|
|
ctx := &preReceiveContext{
|
|
PrivateContext: mockCtx,
|
|
user: maintainer,
|
|
userPerm: headPerm,
|
|
}
|
|
|
|
// The granted branch must be writable...
|
|
assert.True(t, ctx.canWriteCodeRef(git.RefNameFromBranch("granted-branch")))
|
|
|
|
// ...but another branch in the same push must NOT inherit that grant.
|
|
assert.False(t, ctx.canWriteCodeRef(git.RefNameFromBranch("master")))
|
|
|
|
// ...and a tag sharing the granted branch's name must NOT inherit it either: the grant is
|
|
// scoped to PR head branches, so a non-branch ref can never match it. (A tag ref already
|
|
// yields an empty branch name, so this guards the per-ref evaluation, not the IsBranch check.)
|
|
assert.False(t, ctx.canWriteCodeRef(git.RefNameFromTag("granted-branch")))
|
|
}
|