mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
063b617481
No compat with old Gitea deployments, so the wire values that were held back
for it go too.
.gitea/* WorkflowDirs is now {.hanzo, .github}/workflows. Same for the
PR-template, ISSUE_TEMPLATE and repo-template lookups, which
each carried a .gitea variant. .github stays — GitHub compat
is worth having; Gitea compat is what we just decided not to
keep.
webhook type "gitea" -> "native", constant GITEA -> NATIVE, routes
/hooks/gitea/{new,id} -> /hooks/native/{new,id}, and the enum
in both swagger documents.
actions context gitea_runtime_token -> git_runtime_token,
gitea_default_actions_url -> git_default_actions_url.
models/migrations/* is untouched on purpose. A schema migration describes what
the database held AT THAT VERSION; v1_14/v162.go rewriting its own history to
say "native" would make it wrong about the thing it exists to migrate.
Three test fixtures needed aligning rather than renaming, all the same shape as
the bugs this cleanup keeps finding: WorkflowDirs expectations ended up with a
duplicated .hanzo entry, the repo-template test built its fixture under .gitea,
and five API tests still posted Type: "gitea" (422 now, correctly).
models, modules, services, routers green; integration compile gate green.
Co-authored-by: Hanzo Dev <[email protected]>
179 lines
8.6 KiB
Go
179 lines
8.6 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "github.com/hanzoai/git/models/auth"
|
|
"github.com/hanzoai/git/models/unittest"
|
|
user_model "github.com/hanzoai/git/models/user"
|
|
api "github.com/hanzoai/git/modules/structs"
|
|
"github.com/hanzoai/git/tests"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAPIPublicOnlySelfUserRoutes(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user31"})
|
|
require.True(t, privateUser.Visibility.IsPrivate())
|
|
|
|
privateSession := loginUser(t, privateUser.Name)
|
|
privateReadUserToken := getTokenForLoggedInUser(t, privateSession,
|
|
auth_model.AccessTokenScopePublicOnly,
|
|
auth_model.AccessTokenScopeReadUser,
|
|
)
|
|
privateWriteUserToken := getTokenForLoggedInUser(t, privateSession,
|
|
auth_model.AccessTokenScopePublicOnly,
|
|
auth_model.AccessTokenScopeWriteUser,
|
|
)
|
|
|
|
t.Run("PrivateProfileForbidden", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/users/user31").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
})
|
|
|
|
t.Run("PrivateSensitiveSelfRoutesForbidden", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/settings").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
hideEmail := true
|
|
settingsReq := NewRequestWithJSON(t, "PATCH", "/v1/user/settings", &api.UserSettingsOptions{
|
|
HideEmail: &hideEmail,
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, settingsReq, http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/emails").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
emailReq := NewRequestWithJSON(t, "POST", "/v1/user/emails", &api.CreateEmailOption{
|
|
Emails: []string{"[email protected]"},
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, emailReq, http.StatusForbidden)
|
|
|
|
keyReq := NewRequestWithJSON(t, "POST", "/v1/user/keys", api.CreateKeyOption{
|
|
Title: "public-only-private-key",
|
|
Key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4cn+iXnA4KvcQYSV88vGn0Yi91vG47t1P7okprVmhNTkipNRIHWr6WdCO4VDr/cvsRkuVJAsLO2enwjGWWueOO6BodiBgyAOZ/5t5nJNMCNuLGT5UIo/RI1b0WRQwxEZTRjt6mFNw6lH14wRd8ulsr9toSWBPMOGWoYs1PDeDL0JuTjL+tr1SZi/EyxCngpYszKdXllJEHyI79KQgeD0Vt3pTrkbNVTOEcCNqZePSVmUH8X8Vhugz3bnE0/iE9Pb5fkWO9c4AnM1FgI/8Bvp27Fw2ShryIXuR6kKvUqhVMTuOSDHwu6A8jLE5Owt3GAYugDpDYuwTVNGrHLXKpPzrGGPE/jPmaLCMZcsdkec95dYeU3zKODEm8UQZFhmJmDeWVJ36nGrGZHL4J5aTTaeFUJmmXDaJYiJ+K2/ioKgXqnXvltu0A9R8/LGy4nrTJRr4JMLuJFoUXvGm1gXQ70w2LSpk6yl71RNC0hCtsBe8BP8IhYCM0EP5jh7eCMQZNvM= nocomment",
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, keyReq, http.StatusForbidden)
|
|
|
|
oauthReq := NewRequestWithJSON(t, "POST", "/v1/user/applications/oauth2", &api.CreateOAuth2ApplicationOptions{
|
|
Name: "public-only-private-oauth-app",
|
|
RedirectURIs: []string{"https://example.com/callback"},
|
|
ConfidentialClient: true,
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, oauthReq, http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/gpg_keys").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
gpgKeyReq := NewRequestWithJSON(t, "POST", "/v1/user/gpg_keys", &api.CreateGPGKeyOption{
|
|
ArmoredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\ncomment\n-----END PGP PUBLIC KEY BLOCK-----",
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, gpgKeyReq, http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/gpg_key_token").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
gpgVerifyReq := NewRequestWithJSON(t, "POST", "/v1/user/gpg_key_verify", &api.VerifyGPGKeyOption{
|
|
KeyID: "deadbeef",
|
|
Signature: "invalid-signature",
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, gpgVerifyReq, http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/actions/variables").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "DELETE", "/v1/user/actions/secrets/PRIVATE_SECRET").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
|
|
variableReq := NewRequestWithJSON(t, "POST", "/v1/user/actions/variables/PRIVATE_VAR", api.CreateVariableOption{
|
|
Value: "private-value",
|
|
Description: "must stay private",
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, variableReq, http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "POST", "/v1/user/actions/runners/registration-token").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/hooks").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
hookReq := NewRequestWithJSON(t, "POST", "/v1/user/hooks", api.CreateHookOption{
|
|
Type: "native",
|
|
Config: api.CreateHookOptionConfig{
|
|
"content_type": "json",
|
|
"url": "http://example.com/",
|
|
},
|
|
Name: "public-only-private-hook",
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, hookReq, http.StatusForbidden)
|
|
|
|
avatarReq := NewRequestWithJSON(t, "POST", "/v1/user/avatar", &api.UpdateUserAvatarOption{
|
|
Image: "aGVsbG8=",
|
|
}).AddTokenAuth(privateWriteUserToken)
|
|
MakeRequest(t, avatarReq, http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "DELETE", "/v1/user/avatar").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/times").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/stopwatches").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/subscriptions").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/teams").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/user/blocks").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "PUT", "/v1/user/blocks/user2").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
|
|
|
|
MakeRequest(t, NewRequest(t, "PUT", "/v1/user/following/user2").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
|
|
MakeRequest(t, NewRequest(t, "DELETE", "/v1/user/following/user2").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
|
|
})
|
|
|
|
t.Run("PublicRepoRoutesFilterAndRejectMutations", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
publicSession := loginUser(t, "user2")
|
|
fullWriteRepoToken := getTokenForLoggedInUser(t, publicSession,
|
|
auth_model.AccessTokenScopeWriteUser,
|
|
auth_model.AccessTokenScopeWriteRepository,
|
|
)
|
|
publicOnlyReadRepoToken := getTokenForLoggedInUser(t, publicSession,
|
|
auth_model.AccessTokenScopePublicOnly,
|
|
auth_model.AccessTokenScopeReadUser,
|
|
auth_model.AccessTokenScopeReadRepository,
|
|
)
|
|
publicOnlyWriteRepoToken := getTokenForLoggedInUser(t, publicSession,
|
|
auth_model.AccessTokenScopePublicOnly,
|
|
auth_model.AccessTokenScopeWriteUser,
|
|
auth_model.AccessTokenScopeWriteRepository,
|
|
)
|
|
|
|
publicRepoName := "public-only-visible-self-repo"
|
|
privateRepoName := "public-only-hidden-self-repo"
|
|
|
|
resp := MakeRequest(t, NewRequestWithJSON(t, "POST", "/v1/user/repos", &api.CreateRepoOption{
|
|
Name: publicRepoName,
|
|
Private: false,
|
|
}).AddTokenAuth(fullWriteRepoToken), http.StatusCreated)
|
|
publicRepo := DecodeJSON(t, resp, &api.Repository{})
|
|
require.Equal(t, "user2/"+publicRepoName, publicRepo.FullName)
|
|
|
|
resp = MakeRequest(t, NewRequestWithJSON(t, "POST", "/v1/user/repos", &api.CreateRepoOption{
|
|
Name: privateRepoName,
|
|
Private: true,
|
|
}).AddTokenAuth(fullWriteRepoToken), http.StatusCreated)
|
|
privateRepo := DecodeJSON(t, resp, &api.Repository{})
|
|
require.Equal(t, "user2/"+privateRepoName, privateRepo.FullName)
|
|
|
|
MakeRequest(t, NewRequest(t, "GET", "/v1/repos/user2/"+privateRepoName).AddTokenAuth(publicOnlyReadRepoToken), http.StatusNotFound)
|
|
|
|
resp = MakeRequest(t, NewRequest(t, "GET", "/v1/user/repos").AddTokenAuth(publicOnlyReadRepoToken), http.StatusOK)
|
|
repos := DecodeJSON(t, resp, []api.Repository{})
|
|
|
|
foundPublicRepo := false
|
|
for _, repo := range repos {
|
|
require.NotEqual(t, privateRepo.FullName, repo.FullName)
|
|
if repo.FullName == publicRepo.FullName {
|
|
foundPublicRepo = true
|
|
}
|
|
}
|
|
require.True(t, foundPublicRepo)
|
|
|
|
MakeRequest(t, NewRequestWithJSON(t, "POST", "/v1/user/repos", &api.CreateRepoOption{
|
|
Name: "public-only-rejected-self-repo",
|
|
Private: false,
|
|
}).AddTokenAuth(publicOnlyWriteRepoToken), http.StatusForbidden)
|
|
})
|
|
}
|