package api
import (
"context"
"errors"
"os/exec"
"strings"
"testing"
"craftdesign.group/quarry/internal/oltp"
"craftdesign.group/quarry/internal/ops"
"craftdesign.group/quarry/internal/zitcli"
)
// Retargeting decides where the next merge is written, so it takes
// accept's letter rather than the forum one. With the forum letter,
// anyone who may post in a record's thread could aim somebody else's
// work at a branch they never chose.
func TestRetargetSurfaceTakesTheCheckinLetter(t *testing.T) {
r := ops.NewRegistry()
if err := registerLandingRetarget(r, Deps{}); err != nil {
t.Fatal(err)
}
op, ok := r.Lookup("landing.retarget")
if !ok {
t.Fatal("landing.retarget is not registered")
}
if op.Caps != "i" {
t.Fatalf("caps = %q, want i — the letter that writing a merge takes", op.Caps)
}
if op.Auth != ops.Token {
t.Fatalf("auth = %v, want Token", op.Auth)
}
if op.Method != "POST" || op.Pattern != "/api/v1/r/{repo}/landing/{id}/retarget" {
t.Fatalf("route = %s %s", op.Method, op.Pattern)
}
}
// An unknown record is not found rather than a fault, so the page can
// say so instead of apologising.
func TestRetargetOfAnUnknownRecordIsNotFound(t *testing.T) {
r := ops.NewRegistry()
ix := wikiIndex(t)
stub := &Repo{Index: ix}
if err := registerLandingRetarget(r, Deps{Repos: NewRepos(map[string]*Repo{"test": stub})}); err != nil {
t.Fatal(err)
}
_, err := r.Invoke(t.Context(), "landing.retarget",
landingRetargetIn{Repo: "test", ID: "nosuchrecord", To: "trunk"})
if !errors.Is(err, ops.ErrNotFound) {
t.Fatalf("err = %v, want ErrNotFound", err)
}
}
// A record's target is the author's to move, or a maintainer's — never
// any passing developer's.
//
// The letters cannot answer this alone, which is the lesson G-147 left:
// `i` says the caller may check in here, and retargeting your OWN
// record is part of proposing while moving somebody else's is a
// maintainer's act. A record's target decides which branch an accept
// merges into, so a developer who moved another person's record could
// aim a merge at a branch its author never proposed — and the acceptor
// would be reading the moved record rather than the one reviewed.
func TestRetargetIsTheAuthorsOrAMaintainers(t *testing.T) {
if _, err := exec.LookPath("zit"); err != nil {
t.Skip("zit not on PATH")
}
ix := landingIndex(t, "ada", "feat/x", "trunk", "")
// A real (empty) store, so the calls that PASS the gate fail in the
// write for want of the record rather than panicking on a nil
// client — the gate is what this test is about, and it must be
// possible to tell "refused" from "reached the write".
dir := t.TempDir()
if err := zitcli.Init(context.Background(), dir); err != nil {
t.Fatal(err)
}
deps := Deps{Repos: NewRepos(map[string]*Repo{"test": {Index: ix, Zit: zitcli.New(dir)}})}
r := ops.NewRegistry()
if err := registerLandingRetarget(r, deps); err != nil {
t.Fatal(err)
}
move := func(ctx context.Context) error {
_, err := r.Invoke(ctx, "landing.retarget",
landingRetargetIn{Repo: "test", ID: landingHash[:12], To: "release"})
return err
}
// A developer who did not open it: refused, and told whose it is.
err := move(as("bob", "i"))
if !errors.Is(err, ops.ErrForbidden) {
t.Errorf("FAIL: a passing developer moved somebody else's record: %v", err)
} else if !strings.Contains(err.Error(), "ada") {
t.Errorf("FAIL: the refusal does not name the author: %v", err)
}
// Anonymous is nobody, not everybody — an empty author must not
// match an empty record author.
if err := move(ops.WithCaps(context.Background(), oltp.CapSet("i"))); !errors.Is(err, ops.ErrForbidden) {
t.Errorf("FAIL: an anonymous caller moved a record: %v", err)
}
// The author, and a maintainer, reach the write — which fails here
// for want of a store, and that is past the gate this test is about.
for _, ctx := range []context.Context{as("ada", "i"), as("mai", "i4")} {
if err := move(ctx); errors.Is(err, ops.ErrForbidden) {
t.Errorf("FAIL: %s was refused the gate: %v", ops.User(ctx), err)
}
}
t.Log("ok: the author or a maintainer moves a record, nobody else")
}