Artifact [e0553e3981]

Artifact e0553e3981b98f82f74e5edc0381c1e233f7a73876071b7665b1c21d8029d798:

• File internal/xfer/xfer_test.go — part of check-in [d7528db81f] at 2026-08-16 23:49:24 on branch trunk — xfer: read the project code with zit stat -R; serve bare stores

  zit#85 landed, so the identity of a store is readable without a checkout. ProjectCode drops the clone handshake — free port, spawn zit serve, poll for readiness, POST a container, scrape the push card — for one subprocess that answers directly.

  That handshake was the last thing keeping quarry from serving a BARE store: the read plane was already -R-only with no cmd.Dir anywhere, but zit serve is checkout-only. Verified by serving a directory holding nothing but libfossil's .zit — 3,835 check-ins, and timeline, wiki, ticket, forum and technote all answer 200.

  Startup also loses a per-repository 5-second worst case. (user: dmestas, size: 8488) [annotate] [blame] [check-ins using]

package xfer

import (
	"net/http"
	"net/http/httptest"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

func zrun(t *testing.T, dir string, args ...string) string {
	t.Helper()
	cmd := exec.Command("zit", args...)
	cmd.Dir = dir
	out, err := cmd.CombinedOutput()
	if err != nil {
		t.Fatalf("zit %v: %v\n%s", args, err, out)
	}
	return string(out)
}

// TestCloneAndPushThroughFronter is the 0001 §7 acceptance: `zit clone
// <quarry>/r/<repo>` works, and a push through the same URL lands
// artifacts in the fronted store.
func TestCloneAndPushThroughFronter(t *testing.T) {
	if _, err := exec.LookPath("zit"); err != nil {
		t.Skip("zit not on PATH")
	}
	origin := t.TempDir()
	zrun(t, origin, "init")
	if err := os.WriteFile(filepath.Join(origin, "README.md"), []byte("# fronted\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	zrun(t, origin, "add", "README.md")
	zrun(t, origin, "commit", "-m", "first")

	f := New()
	defer f.Close()
	f.Register("alpha", origin)
	mux := http.NewServeMux()
	mux.Handle("POST /r/{repo}", f)
	mux.Handle("POST /r/{repo}/xfer", f)
	srv := httptest.NewServer(mux)
	defer srv.Close()

	// Clone through quarry: the repo URL is used verbatim by zit.
	work := t.TempDir()
	clone := filepath.Join(work, "clone")
	zrun(t, work, "clone", srv.URL+"/r/alpha", clone)
	if tl := zrun(t, clone, "timeline", "-n", "3"); !strings.Contains(tl, "first") {
		t.Fatalf("clone missing history:\n%s", tl)
	}

	// Push back through the same URL (saved as the clone's remote).
	if err := os.WriteFile(filepath.Join(clone, "NOTES.md"), []byte("pushed\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	zrun(t, clone, "add", "NOTES.md")
	zrun(t, clone, "commit", "-m", "pushed through quarry")
	zrun(t, clone, "push")
	if tl := zrun(t, origin, "timeline", "-n", "3"); !strings.Contains(tl, "pushed through quarry") {
		t.Fatalf("push did not land in origin:\n%s", tl)
	}

	// The /xfer alias answers too.
	zrun(t, work, "clone", srv.URL+"/r/alpha/xfer", filepath.Join(work, "clone2"))

	// Unknown repos 404 rather than 502.
	resp, err := http.Post(srv.URL+"/r/nope", "application/x-fossil", strings.NewReader(""))
	if err != nil {
		t.Fatal(err)
	}
	resp.Body.Close()
	if resp.StatusCode != http.StatusNotFound {
		t.Fatalf("unknown repo: status %d", resp.StatusCode)
	}
}

// TestBackendRestartAfterDeath: a dead child is restarted on the next
// request instead of 502ing forever.
func TestBackendRestartAfterDeath(t *testing.T) {
	if _, err := exec.LookPath("zit"); err != nil {
		t.Skip("zit not on PATH")
	}
	origin := t.TempDir()
	zrun(t, origin, "init")

	f := New()
	defer f.Close()
	f.Register("alpha", origin)
	mux := http.NewServeMux()
	mux.Handle("POST /r/{repo}", f)
	srv := httptest.NewServer(mux)
	defer srv.Close()

	work := t.TempDir()
	zrun(t, work, "clone", srv.URL+"/r/alpha", filepath.Join(work, "c1"))

	// Kill the child behind its back.
	f.mu.Lock()
	b := f.repos["alpha"]
	b.cmd.Process.Kill()
	f.mu.Unlock()

	zrun(t, work, "clone", srv.URL+"/r/alpha", filepath.Join(work, "c2"))
}

type mapAuth struct{ users map[string]string } // user -> secret, one repo

func (m *mapAuth) Gated(string) bool { return len(m.users) > 0 }
func (m *mapAuth) Secret(_, user string) (string, bool) {
	s, ok := m.users[user]
	return s, ok
}

// TestPushGating is 0001 §7 v1 auth: with a sync user configured,
// anonymous pushes bounce with an error card and pulls stay anonymous.
// The authenticated-push leg drives the fossil client: it sends a
// credential on every round per sync RFC §6.5, where the zit client
// stops after round 1 (zit#74) — until that lands, zit pushes to a
// gated repo fail closed.
func TestPushGating(t *testing.T) {
	if _, err := exec.LookPath("zit"); err != nil {
		t.Skip("zit not on PATH")
	}
	origin := t.TempDir()
	zrun(t, origin, "init")
	if err := os.WriteFile(filepath.Join(origin, "README.md"), []byte("# gated\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	zrun(t, origin, "add", "README.md")
	zrun(t, origin, "commit", "-m", "first")

	code, err := ProjectCode(origin)
	if err != nil {
		t.Fatal(err)
	}
	if len(code) < 40 {
		t.Fatalf("suspicious project code %q", code)
	}

	f := New()
	defer f.Close()
	f.Register("alpha", origin)
	f.SetAuth(&mapAuth{users: map[string]string{
		"dan": SharedSecret(code, "dan", "hunter2"),
	}})
	mux := http.NewServeMux()
	mux.Handle("POST /r/{repo}", f)
	srv := httptest.NewServer(mux)
	defer srv.Close()

	// Pull stays anonymous (--once so the commit below cannot autosync).
	work := t.TempDir()
	clone := filepath.Join(work, "clone")
	zrun(t, work, "clone", srv.URL+"/r/alpha", clone, "--once")
	if err := os.WriteFile(filepath.Join(clone, "NOTES.md"), []byte("gated push\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	zrun(t, clone, "add", "NOTES.md")
	zrun(t, clone, "commit", "-m", "wants in")

	// Anonymous push: refused, and nothing lands.
	cmd := exec.Command("zit", "push", srv.URL+"/r/alpha")
	cmd.Dir = clone
	if out, err := cmd.CombinedOutput(); err == nil {
		t.Fatalf("anonymous push succeeded against a gated repo:\n%s", out)
	}
	if tl := zrun(t, origin, "timeline", "-n", "2"); strings.Contains(tl, "wants in") {
		t.Fatalf("refused push still landed:\n%s", tl)
	}

	if _, err := exec.LookPath("fossil"); err != nil {
		t.Skip("fossil not on PATH for the authenticated-push leg")
	}
	frun := func(dir string, args ...string) (string, error) {
		cmd := exec.Command("fossil", args...)
		cmd.Dir = dir
		out, err := cmd.CombinedOutput()
		return string(out), err
	}

	// Wrong password: refused.
	fwork := t.TempDir()
	if out, err := frun(fwork, "clone", srv.URL+"/r/alpha", "bad.fossil"); err != nil {
		t.Fatalf("fossil clone (pull is anonymous) should succeed: %v\n%s", err, out)
	}
	co := filepath.Join(fwork, "co")
	if err := os.MkdirAll(co, 0o755); err != nil {
		t.Fatal(err)
	}
	if out, err := frun(co, "open", filepath.Join(fwork, "bad.fossil")); err != nil {
		t.Fatalf("fossil open: %v\n%s", err, out)
	}
	if err := os.WriteFile(filepath.Join(co, "F.md"), []byte("fossil push\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	frun(co, "add", "F.md")
	if out, err := frun(co, "commit", "-m", "fossil wants in", "--no-warnings"); err != nil && !strings.Contains(out, "not authorized") {
		t.Fatalf("fossil commit: %v\n%s", err, out)
	}
	if out, _ := frun(co, "push", strings.Replace(srv.URL, "http://", "http://dan:wrong@", 1)+"/r/alpha", "--once"); !strings.Contains(strings.ToLower(out), "not authorized") {
		t.Fatalf("wrong-password fossil push not refused:\n%s", out)
	}
	if tl := zrun(t, origin, "timeline", "-n", "2"); strings.Contains(tl, "fossil wants in") {
		t.Fatalf("refused fossil push landed:\n%s", tl)
	}

	// Right credentials: lands.
	if out, err := frun(co, "push", strings.Replace(srv.URL, "http://", "http://dan:hunter2@", 1)+"/r/alpha", "--once"); err != nil {
		t.Fatalf("authenticated fossil push failed: %v\n%s", err, out)
	}
	if tl := zrun(t, origin, "timeline", "-n", "2"); !strings.Contains(tl, "fossil wants in") {
		t.Fatalf("authenticated fossil push missing from origin:\n%s", tl)
	}
}

// ProjectCode must work on a BARE store — a directory holding only the
// .zit file, with no checkout. That is the whole point of reading it
// through `zit stat -R` (zit#85) instead of handshaking against a
// transient `zit serve`, which is checkout-only. quarry's read plane is
// already -R-only, so this is the last thing that stood between it and
// serving a bare store.
func TestProjectCodeOnBareStore(t *testing.T) {
	if _, err := exec.LookPath("zit"); err != nil {
		t.Skip("zit not on PATH")
	}
	origin := t.TempDir()
	zrun(t, origin, "init")
	if err := os.WriteFile(filepath.Join(origin, "a.txt"), []byte("a\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	zrun(t, origin, "add", "a.txt")
	zrun(t, origin, "commit", "-m", "first")

	want, err := ProjectCode(origin)
	if err != nil {
		t.Fatal(err)
	}

	// Copy ONLY the store: no .zit-checkout, no .zit-cache, no files.
	bare := t.TempDir()
	blob, err := os.ReadFile(filepath.Join(origin, ".zit"))
	if err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(bare, ".zit"), blob, 0o644); err != nil {
		t.Fatal(err)
	}
	entries, err := os.ReadDir(bare)
	if err != nil {
		t.Fatal(err)
	}
	if len(entries) != 1 || entries[0].Name() != ".zit" {
		t.Fatalf("bare store is not bare: %v", entries)
	}

	got, err := ProjectCode(bare)
	if err != nil {
		t.Fatalf("bare store: %v", err)
	}
	if got != want {
		t.Fatalf("bare store reports %q, checkout reports %q", got, want)
	}
}