snapshot of https://github.com/go-gitea/gitea.git (main, 2026-09-15; blobs > 131072B omitted)

tests/integration/deploy_token_test.go

@@ -0,0 +1,76 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	deploykey_model "gitea.dev/models/deploykey"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	lfs_module "gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDeployTokenGitHTTP(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// need to disable agit, otherwise the "write" permission check is skipped at pre-receive (git-receive-pack) step
+	defer test.MockVariableValue(&git.DefaultFeatures().SupportProcReceive, false)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+	otherRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+	readKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "read", perm.AccessModeRead)
+	require.NoError(t, err)
+	writeKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "write", perm.AccessModeWrite)
+	require.NoError(t, err)
+
+	requestAs := func(t *testing.T, token, path string, expected int) {
+		MakeRequest(t, NewRequest(t, "GET", path).AddBasicAuth("deploy-token", token), expected)
+	}
+
+	t.Run("Clone", func(t *testing.T) {
+		requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusOK)
+	})
+	t.Run("PushWithReadToken", func(t *testing.T) {
+		requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusNotFound)
+	})
+	t.Run("PushWithWriteToken", func(t *testing.T) {
+		requestAs(t, writeKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusOK)
+	})
+	t.Run("OtherRepo", func(t *testing.T) {
+		requestAs(t, readKey.Token, "/"+otherRepo.FullName()+"/info/refs?service=git-upload-pack", http.StatusNotFound)
+	})
+	t.Run("UnknownToken", func(t *testing.T) {
+		requestAs(t, deploykey_model.DeployTokenPrefix+"0123456789abcdef", "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusUnauthorized)
+	})
+	t.Run("RejectedOutsideGitHTTP", func(t *testing.T) {
+		// the owner of the repo would be able to read it, the token must not act as that owner
+		requestAs(t, readKey.Token, "/api/v1/repos/"+repo.FullName(), http.StatusUnauthorized)
+	})
+
+	t.Run("LFS", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.LFS.StartServer, true)()
+
+		batchAs := func(t *testing.T, token, repoName, operation string, expected int) {
+			req := NewRequestWithJSON(t, "POST", "/"+repoName+"/info/lfs/objects/batch", lfs_module.BatchRequest{Operation: operation}).
+				AddBasicAuth("deploy-token", token).
+				SetHeader("Accept", lfs_module.AcceptHeader).
+				SetHeader("Content-Type", lfs_module.MediaType)
+			MakeRequest(t, req, expected)
+		}
+
+		batchAs(t, readKey.Token, repo.FullName(), "download", http.StatusOK)
+		batchAs(t, readKey.Token, repo.FullName(), "upload", http.StatusUnauthorized)
+		batchAs(t, writeKey.Token, repo.FullName(), "upload", http.StatusOK)
+		batchAs(t, readKey.Token, otherRepo.FullName(), "download", http.StatusUnauthorized)
+	})
+}