jmiller
49f6380fa4
Universal: Auto Version Bump / Version Bump (push) Successful in 17s
PR RC Release / Build RC Release (pull_request) Successful in 3s
Universal: PR Check / Branch Policy (pull_request) Failing after 2s
Universal: PR Check / Validate PR (pull_request) Failing after 11s
Universal: PR Check / Secret Scan (pull_request) Successful in 43s
Universal: Build & Release / Promote to RC (pull_request) Has been skipped
RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped
Branch Cleanup / Delete merged branch (pull_request) Successful in 3s
Universal: Build & Release / Build & Release Pipeline (pull_request) Failing after 1m13s
Universal: Workflow Sync Trigger / Sync workflows to live repos (pull_request) Failing after 4m6s
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Add read:licensing / write:licensing token scope category so licensing endpoints are guarded by the same permission system as all other API endpoints. Public-only tokens are rejected for licensing endpoints.
92 lines
3.0 KiB
Go
92 lines
3.0 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
type scopeTestNormalize struct {
|
|
in AccessTokenScope
|
|
out AccessTokenScope
|
|
err error
|
|
}
|
|
|
|
func TestAccessTokenScope_Normalize(t *testing.T) {
|
|
assert.Equal(t, []string{"activitypub", "admin", "issue", "licensing", "misc", "notification", "organization", "package", "repository", "user"}, GetAccessTokenCategories())
|
|
tests := []scopeTestNormalize{
|
|
{"", "", nil},
|
|
{"write:misc,write:notification,read:package,write:notification,public-only", "public-only,write:misc,write:notification,read:package", nil},
|
|
{"all", "all", nil},
|
|
{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user,write:licensing", "all", nil},
|
|
{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user,write:licensing,public-only", "public-only,all", nil},
|
|
}
|
|
|
|
for _, scope := range GetAccessTokenCategories() {
|
|
tests = append(tests,
|
|
scopeTestNormalize{AccessTokenScope("read:" + scope), AccessTokenScope("read:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope("write:" + scope), AccessTokenScope("write:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope(fmt.Sprintf("write:%[1]s,read:%[1]s", scope)), AccessTokenScope("write:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope(fmt.Sprintf("read:%[1]s,write:%[1]s", scope)), AccessTokenScope("write:" + scope), nil},
|
|
scopeTestNormalize{AccessTokenScope(fmt.Sprintf("read:%[1]s,write:%[1]s,write:%[1]s", scope)), AccessTokenScope("write:" + scope), nil},
|
|
)
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(string(test.in), func(t *testing.T) {
|
|
scope, err := test.in.Normalize()
|
|
assert.Equal(t, test.out, scope)
|
|
assert.Equal(t, test.err, err)
|
|
})
|
|
}
|
|
}
|
|
|
|
type scopeTestHasScope struct {
|
|
in AccessTokenScope
|
|
scope AccessTokenScope
|
|
out bool
|
|
err error
|
|
}
|
|
|
|
func TestAccessTokenScope_HasScope(t *testing.T) {
|
|
tests := []scopeTestHasScope{
|
|
{"read:admin", "write:package", false, nil},
|
|
{"all", "write:package", true, nil},
|
|
{"write:package", "all", false, nil},
|
|
{"public-only", "read:issue", false, nil},
|
|
}
|
|
|
|
for _, scope := range GetAccessTokenCategories() {
|
|
tests = append(tests,
|
|
scopeTestHasScope{
|
|
AccessTokenScope("read:" + scope),
|
|
AccessTokenScope("read:" + scope), true, nil,
|
|
},
|
|
scopeTestHasScope{
|
|
AccessTokenScope("write:" + scope),
|
|
AccessTokenScope("write:" + scope), true, nil,
|
|
},
|
|
scopeTestHasScope{
|
|
AccessTokenScope("write:" + scope),
|
|
AccessTokenScope("read:" + scope), true, nil,
|
|
},
|
|
scopeTestHasScope{
|
|
AccessTokenScope("read:" + scope),
|
|
AccessTokenScope("write:" + scope), false, nil,
|
|
},
|
|
)
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(string(test.in), func(t *testing.T) {
|
|
hasScope, err := test.in.HasScope(test.scope)
|
|
assert.Equal(t, test.out, hasScope)
|
|
assert.Equal(t, test.err, err)
|
|
})
|
|
}
|
|
}
|