mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
199 lines
8.0 KiB
Go
199 lines
8.0 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2024 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"strconv"
|
|
"testing"
|
|
|
|
auth_model "github.com/hanzoai/git/models/auth"
|
|
"github.com/hanzoai/git/models/db"
|
|
issues_model "github.com/hanzoai/git/models/issues"
|
|
"github.com/hanzoai/git/models/perm"
|
|
access_model "github.com/hanzoai/git/models/perm/access"
|
|
repo_model "github.com/hanzoai/git/models/repo"
|
|
"github.com/hanzoai/git/models/unit"
|
|
"github.com/hanzoai/git/models/unittest"
|
|
user_model "github.com/hanzoai/git/models/user"
|
|
api "github.com/hanzoai/git/modules/structs"
|
|
repo_service "github.com/hanzoai/git/services/repository"
|
|
"github.com/hanzoai/git/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func enableRepoDependencies(t *testing.T, repoID int64) {
|
|
t.Helper()
|
|
|
|
repoUnit := unittest.AssertExistsAndLoadBean(t, &repo_model.RepoUnit{RepoID: repoID, Type: unit.TypeIssues})
|
|
repoUnit.IssuesConfig().EnableDependencies = true
|
|
assert.NoError(t, repo_model.UpdateRepoUnitConfig(t.Context(), repoUnit))
|
|
}
|
|
|
|
func TestAPICreateIssueDependencyCrossRepoPermission(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
targetRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
targetIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: targetRepo.ID, Index: 1})
|
|
dependencyRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
|
|
assert.True(t, dependencyRepo.IsPrivate)
|
|
dependencyIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: dependencyRepo.ID, Index: 1})
|
|
|
|
enableRepoDependencies(t, targetIssue.RepoID)
|
|
enableRepoDependencies(t, dependencyRepo.ID)
|
|
|
|
// remove user 40 access from target repository
|
|
_, err := db.DeleteByID[access_model.Access](t.Context(), 30)
|
|
assert.NoError(t, err)
|
|
|
|
url := fmt.Sprintf("/v1/repos/%s/%s/issues/%d/dependencies", "user2", "repo1", targetIssue.Index)
|
|
dependencyMeta := &api.IssueMeta{
|
|
Owner: "org3",
|
|
Name: "repo3",
|
|
Index: dependencyIssue.Index,
|
|
}
|
|
|
|
user40 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 40})
|
|
// user40 has no access to both target issue and dependency issue
|
|
writerToken := getUserToken(t, "user40", auth_model.AccessTokenScopeWriteIssue)
|
|
req := NewRequestWithJSON(t, "POST", url, dependencyMeta).
|
|
AddTokenAuth(writerToken)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
unittest.AssertNotExistsBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
|
|
// add user40 as a collaborator to dependency repository with read permission
|
|
assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), dependencyRepo, user40, perm.AccessModeRead))
|
|
|
|
// try again after getting read permission to dependency repository
|
|
req = NewRequestWithJSON(t, "POST", url, dependencyMeta).
|
|
AddTokenAuth(writerToken)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
unittest.AssertNotExistsBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
|
|
// add user40 as a collaborator to target repository with write permission
|
|
assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), targetRepo, user40, perm.AccessModeWrite))
|
|
|
|
req = NewRequestWithJSON(t, "POST", url, dependencyMeta).
|
|
AddTokenAuth(writerToken)
|
|
MakeRequest(t, req, http.StatusCreated)
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
}
|
|
|
|
func TestAPIDeleteIssueDependencyCrossRepoPermission(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
targetRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
targetIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: targetRepo.ID, Index: 1})
|
|
dependencyRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
|
|
assert.True(t, dependencyRepo.IsPrivate)
|
|
dependencyIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: dependencyRepo.ID, Index: 1})
|
|
|
|
enableRepoDependencies(t, targetIssue.RepoID)
|
|
enableRepoDependencies(t, dependencyRepo.ID)
|
|
|
|
user1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
|
|
assert.NoError(t, issues_model.CreateIssueDependency(t.Context(), user1, targetIssue, dependencyIssue))
|
|
|
|
// remove user 40 access from target repository
|
|
_, err := db.DeleteByID[access_model.Access](t.Context(), 30)
|
|
assert.NoError(t, err)
|
|
|
|
url := fmt.Sprintf("/v1/repos/%s/%s/issues/%d/dependencies", "user2", "repo1", targetIssue.Index)
|
|
dependencyMeta := &api.IssueMeta{
|
|
Owner: "org3",
|
|
Name: "repo3",
|
|
Index: dependencyIssue.Index,
|
|
}
|
|
|
|
user40 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 40})
|
|
// user40 has no access to both target issue and dependency issue
|
|
writerToken := getUserToken(t, "user40", auth_model.AccessTokenScopeWriteIssue)
|
|
req := NewRequestWithJSON(t, "DELETE", url, dependencyMeta).
|
|
AddTokenAuth(writerToken)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
|
|
// add user40 as a collaborator to dependency repository with read permission
|
|
assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), dependencyRepo, user40, perm.AccessModeRead))
|
|
|
|
// try again after getting read permission to dependency repository
|
|
req = NewRequestWithJSON(t, "DELETE", url, dependencyMeta).
|
|
AddTokenAuth(writerToken)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
|
|
// add user40 as a collaborator to target repository with write permission
|
|
assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), targetRepo, user40, perm.AccessModeWrite))
|
|
|
|
req = NewRequestWithJSON(t, "DELETE", url, dependencyMeta).
|
|
AddTokenAuth(writerToken)
|
|
MakeRequest(t, req, http.StatusCreated)
|
|
unittest.AssertNotExistsBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
}
|
|
|
|
func TestWebDeleteIssueDependencyCrossRepoPermission(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
targetRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
targetIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: targetRepo.ID, Index: 1})
|
|
dependencyRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
|
|
assert.True(t, dependencyRepo.IsPrivate)
|
|
dependencyIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: dependencyRepo.ID, Index: 1})
|
|
|
|
enableRepoDependencies(t, targetIssue.RepoID)
|
|
enableRepoDependencies(t, dependencyRepo.ID)
|
|
|
|
user1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
|
|
assert.NoError(t, issues_model.CreateIssueDependency(t.Context(), user1, targetIssue, dependencyIssue))
|
|
|
|
user40 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 40})
|
|
assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), targetRepo, user40, perm.AccessModeWrite))
|
|
|
|
session := loginUser(t, user40.Name)
|
|
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/user2/repo1/issues/%d/dependency/delete", targetIssue.Index), map[string]string{
|
|
"removeDependencyID": strconv.FormatInt(dependencyIssue.ID, 10),
|
|
"dependencyType": "blockedBy",
|
|
})
|
|
session.MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
|
|
assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), dependencyRepo, user40, perm.AccessModeRead))
|
|
|
|
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/user2/repo1/issues/%d/dependency/delete", targetIssue.Index), map[string]string{
|
|
"removeDependencyID": strconv.FormatInt(dependencyIssue.ID, 10),
|
|
"dependencyType": "blockedBy",
|
|
})
|
|
session.MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
unittest.AssertNotExistsBean(t, &issues_model.IssueDependency{
|
|
IssueID: targetIssue.ID,
|
|
DependencyID: dependencyIssue.ID,
|
|
})
|
|
}
|