52ae0c5802
Some checks failed
cache-seeder / prune (push) Has been skipped
cache-seeder / frontend (push) Failing after 3s
cache-seeder / python (push) Failing after 3s
cache-seeder / gobuild (push) Failing after 4s
cache-seeder / lint (bindata, lint-backend) (push) Failing after 3s
giteabot backport / giteabot (push) Has been skipped
giteabot / giteabot (push) Has been skipped
cache-prune / prune (push) Has been skipped
release-nightly-snapcraft / build-and-publish (ubuntu-24.04) (push) Has been cancelled
release-nightly-snapcraft / build-and-publish (ubuntu-24.04-arm) (push) Has been cancelled
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-renovate / cron-renovate (push) Has been skipped
77 lines
3.1 KiB
Go
77 lines
3.1 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
deploykey_model "gitea.dev/models/deploykey"
|
|
"gitea.dev/models/perm"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/models/unittest"
|
|
"gitea.dev/modules/git"
|
|
lfs_module "gitea.dev/modules/lfs"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestDeployTokenGitHTTP(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
// need to disable agit, otherwise the "write" permission check is skipped at pre-receive (git-receive-pack) step
|
|
defer test.MockVariableValue(&git.DefaultFeatures().SupportProcReceive, false)()
|
|
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
otherRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
|
|
readKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "read", perm.AccessModeRead)
|
|
require.NoError(t, err)
|
|
writeKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "write", perm.AccessModeWrite)
|
|
require.NoError(t, err)
|
|
|
|
requestAs := func(t *testing.T, token, path string, expected int) {
|
|
MakeRequest(t, NewRequest(t, "GET", path).AddBasicAuth("deploy-token", token), expected)
|
|
}
|
|
|
|
t.Run("Clone", func(t *testing.T) {
|
|
requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusOK)
|
|
})
|
|
t.Run("PushWithReadToken", func(t *testing.T) {
|
|
requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusNotFound)
|
|
})
|
|
t.Run("PushWithWriteToken", func(t *testing.T) {
|
|
requestAs(t, writeKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusOK)
|
|
})
|
|
t.Run("OtherRepo", func(t *testing.T) {
|
|
requestAs(t, readKey.Token, "/"+otherRepo.FullName()+"/info/refs?service=git-upload-pack", http.StatusNotFound)
|
|
})
|
|
t.Run("UnknownToken", func(t *testing.T) {
|
|
requestAs(t, deploykey_model.DeployTokenPrefix+"0123456789abcdef", "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusUnauthorized)
|
|
})
|
|
t.Run("RejectedOutsideGitHTTP", func(t *testing.T) {
|
|
// the owner of the repo would be able to read it, the token must not act as that owner
|
|
requestAs(t, readKey.Token, "/api/v1/repos/"+repo.FullName(), http.StatusUnauthorized)
|
|
})
|
|
|
|
t.Run("LFS", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.LFS.StartServer, true)()
|
|
|
|
batchAs := func(t *testing.T, token, repoName, operation string, expected int) {
|
|
req := NewRequestWithJSON(t, "POST", "/"+repoName+"/info/lfs/objects/batch", lfs_module.BatchRequest{Operation: operation}).
|
|
AddBasicAuth("deploy-token", token).
|
|
SetHeader("Accept", lfs_module.AcceptHeader).
|
|
SetHeader("Content-Type", lfs_module.MediaType)
|
|
MakeRequest(t, req, expected)
|
|
}
|
|
|
|
batchAs(t, readKey.Token, repo.FullName(), "download", http.StatusOK)
|
|
batchAs(t, readKey.Token, repo.FullName(), "upload", http.StatusUnauthorized)
|
|
batchAs(t, writeKey.Token, repo.FullName(), "upload", http.StatusOK)
|
|
batchAs(t, readKey.Token, otherRepo.FullName(), "download", http.StatusUnauthorized)
|
|
})
|
|
}
|