package web
import (
"io"
"net/http"
"net/url"
"strings"
"testing"
"craftdesign.group/quarry/internal/ci"
)
// refusedAsNotFound holds a refusal to what a reader is owed: the
// not-found status and the not-found page inside the repository's own
// chrome. A recovered panic answers 500 with neither, which is how these
// tests once passed without ever seeing the refusal they are about.
func refusedAsNotFound(t *testing.T, resp *http.Response, what string) {
t.Helper()
body, _ := io.ReadAll(resp.Body)
if resp.StatusCode != http.StatusNotFound {
t.Errorf("FAIL: %s answered %d, want %d", what, resp.StatusCode, http.StatusNotFound)
}
for _, hook := range []string{`class="status"`, `class="repobar"`} {
if !strings.Contains(string(body), hook) {
t.Errorf("FAIL: %s: the not-found page lacks %s", what, hook)
}
}
}
func tokensFixture() []ci.WorkerToken {
return []ci.WorkerToken{
{ID: "own-token-1", Label: "alpha's runner", WorkerGroups: []string{ci.GroupFor("alpha")}},
{ID: "beta-token-1", Label: "beta's runner", WorkerGroups: []string{ci.GroupFor("beta")}},
{ID: "fleet-token-1", Label: "forge-host worker", TaskTypePrefixes: []string{"dantest-html"}},
}
}
// Which tokens a repository's settings may show: its own group's, and a
// fleet-wide one only to a site admin. Every repository's page used to
// list every token in the engine.
func TestWhichWorkerTokensARepositoryShows(t *testing.T) {
ts := tokensFixture()
for _, c := range []struct {
i int
site bool
want bool
}{
{0, false, true}, {0, true, true}, // alpha's own
{1, false, false}, {1, true, false}, // beta's: never alpha's
{2, false, false}, {2, true, true}, // fleet: site admins only
} {
if got := workerTokenOf(ts[c.i], "alpha", c.site); got != c.want {
t.Errorf("FAIL: %s on alpha, site admin %v: shown=%v, want %v", ts[c.i].ID, c.site, got, c.want)
}
}
}
// A REPOSITORY'S SETTINGS REVOKE ONLY ITS OWN WORKER TOKENS.
//
// The revoke beside each token worked from any repository the account
// administered, and every repository's page listed every token, so one
// repository's admin could revoke another repository's runners and the
// forge's own. Seven tokens that were not runner-probe's were revoked
// from runner-probe's page that way. Now a token that is not the
// repository's own answers not found and never reaches the engine.
func TestARepositoryRevokesOnlyItsOwnWorkerTokens(t *testing.T) {
eng := &mintRecorder{tokens: tokensFixture()}
srv := scopeServer(t, eng, "a8i")
for _, foreign := range []string{"beta-token-1", "fleet-token-1", "no-such-token"} {
resp := postAsDan(t, srv, "/r/alpha/settings/worker-tokens", url.Values{"revoke": {foreign}})
refusedAsNotFound(t, resp, "revoking "+foreign+" from alpha")
}
resp := postAsDan(t, srv, "/r/alpha/settings/worker-tokens", url.Values{"revoke": {"own-token-1"}})
if resp.StatusCode != http.StatusSeeOther {
t.Errorf("FAIL: revoking alpha's own token answered %d", resp.StatusCode)
}
eng.mu.Lock()
defer eng.mu.Unlock()
if len(eng.revoked) != 1 || eng.revoked[0] != "own-token-1" {
t.Errorf("FAIL: the engine was asked to revoke %v, want only alpha's own token", eng.revoked)
}
}
// A site admin also revokes fleet-wide tokens, which belong to no
// repository, but still not another repository's.
func TestASiteAdminRevokesFleetTokensButNotAnotherRepositorys(t *testing.T) {
eng := &mintRecorder{tokens: tokensFixture()}
srv := scopeServer(t, eng, "as")
refusedAsNotFound(t, postAsDan(t, srv, "/r/alpha/settings/worker-tokens", url.Values{"revoke": {"beta-token-1"}}),
"a site admin revoking beta's token from alpha's page")
if resp := postAsDan(t, srv, "/r/alpha/settings/worker-tokens", url.Values{"revoke": {"fleet-token-1"}}); resp.StatusCode != http.StatusSeeOther {
t.Errorf("FAIL: a site admin could not revoke a fleet token: %d", resp.StatusCode)
}
eng.mu.Lock()
defer eng.mu.Unlock()
if len(eng.revoked) != 1 || eng.revoked[0] != "fleet-token-1" {
t.Errorf("FAIL: the engine was asked to revoke %v, want only the fleet token", eng.revoked)
}
}