1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

package auth

import (
	"os"
	"path/filepath"
	"testing"

	"gitweb/internal/store"
)

// writeTree writes files (path -> content) under a fresh temp root and returns a
// LocalStore over it.
func writeTree(t *testing.T, files map[string]string) *store.LocalStore {
	t.Helper()
	root := t.TempDir()
	for p, content := range files {
		full := filepath.Join(root, filepath.FromSlash(p))
		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(full, []byte(content), 0o644); err != nil {
			t.Fatal(err)
		}
	}
	return store.NewLocalStore(root)
}

// checker reduces the boilerplate of asserting CanRead/CanWrite outcomes.
type checker struct {
	t *testing.T
	a *Authorizer
}

func (c checker) read(name, user, p string, want bool) {
	c.t.Helper()
	got, err := c.a.CanRead(user, p)
	if err != nil {
		c.t.Fatalf("%s: CanRead error: %v", name, err)
	}
	if got != want {
		c.t.Errorf("%s: CanRead(%q) = %v, want %v", name, user, got, want)
	}
}

func (c checker) write(name, user, p string, want bool) {
	c.t.Helper()
	got, err := c.a.CanWrite(user, p)
	if err != nil {
		c.t.Fatalf("%s: CanWrite error: %v", name, err)
	}
	if got != want {
		c.t.Errorf("%s: CanWrite(%q) = %v, want %v", name, user, got, want)
	}
}

func TestAuthorizerPublicRepo(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/public.git"
	st := writeTree(t, map[string]string{
		repo + "/HEAD":   "ref: refs/heads/main\n",
		repo + "/Access": "read,list: all\n*: " + owner + "\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("anon", "", repo, true)
	c.read("stranger", "x@other.com", repo, true)
	c.read("owner", owner, repo, true)
	c.write("anon", "", repo, false)
	c.write("owner", owner, repo, true)
	c.write("stranger", "x@other.com", repo, false)
}

func TestAuthorizerPrivateRepo(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/private.git"
	st := writeTree(t, map[string]string{
		repo + "/HEAD":   "ref: refs/heads/main\n",
		repo + "/Access": "*: " + owner + "\nread,write: w@d.com\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("anon", "", repo, false)
	c.read("collaborator", "w@d.com", repo, true)
	c.read("stranger", "x@other.com", repo, false)
	c.write("collaborator", "w@d.com", repo, true)
	c.write("stranger", "x@other.com", repo, false)
	c.write("owner", owner, repo, true)
}

// A private Access file inside the repo overrides a public one on the parent
// directory (nearest ancestor wins).
func TestAuthorizerNearestAccessWins(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/proj/secret.git"
	st := writeTree(t, map[string]string{
		owner + "/proj/Access": "read,list: all\n*: " + owner + "\n",
		repo + "/HEAD":         "ref: refs/heads/main\n",
		repo + "/Access":       "*: " + owner + "\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("anon", "", repo, false)
	c.read("owner", owner, repo, true)
}

// With no Access file anywhere, only the owner has any rights.
func TestAuthorizerNoAccessOwnerOnly(t *testing.T) {
	const owner = "u@d.com"
	repo := owner + "/bare.git"
	st := writeTree(t, map[string]string{
		repo + "/HEAD": "ref: refs/heads/main\n",
	})
	c := checker{t, NewAuthorizer(st)}

	c.read("owner", owner, repo, true)
	c.read("anon", "", repo, false)
	c.read("stranger", "x@other.com", repo, false)
	c.write("owner", owner, repo, true)
}