fix(git-tools): bind PR edits to acting identity (#1080)
ci/woodpecker/pr/ci Pipeline was successful
ci/woodpecker/pr/ci Pipeline was successful
This commit is contained in:
coder3
@@ -1,112 +1,123 @@
|
||||
#!/usr/bin/env bash
|
||||
# Regression harness for PR editing, including Gitea draft/ready and login binding.
|
||||
# Regression harness for secret-safe, identity-bound PR editing and explicit targets.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-edit}"
|
||||
REPO_DIR="$WORK_DIR/repo"
|
||||
BIN_DIR="$WORK_DIR/bin"
|
||||
HOME_DIR="$WORK_DIR/home"
|
||||
XDG_DIR="$WORK_DIR/xdg"
|
||||
LOG_FILE="$WORK_DIR/calls.log"
|
||||
|
||||
rm -rf "$WORK_DIR"
|
||||
mkdir -p "$REPO_DIR" "$BIN_DIR" "$HOME_DIR" "$XDG_DIR/tea"
|
||||
REPO_DIR="$WORK_DIR/repo"; BIN_DIR="$WORK_DIR/bin"; HOME_DIR="$WORK_DIR/home"
|
||||
XDG_DIR="$WORK_DIR/xdg"; LOG_FILE="$WORK_DIR/calls.log"
|
||||
rm -rf "$WORK_DIR"; mkdir -p "$REPO_DIR" "$BIN_DIR" "$HOME_DIR" "$XDG_DIR/tea"
|
||||
git -C "$REPO_DIR" init -q
|
||||
git -C "$REPO_DIR" remote add origin https://git.uscllc.com/USC/uconnect.git
|
||||
git -C "$REPO_DIR" remote add origin https://git.uscllc.com/other/wrong-checkout.git
|
||||
git -C "$REPO_DIR" config mosaic.gitIdentity ""
|
||||
|
||||
cat > "$XDG_DIR/tea/config.yml" <<'YAML'
|
||||
logins:
|
||||
- name: usc
|
||||
- name: usc-coder3
|
||||
url: https://git.uscllc.com
|
||||
token: fixture-usc-token
|
||||
- name: mosaicstack
|
||||
- name: same-host-other
|
||||
url: https://git.uscllc.com
|
||||
token: fixture-other-token
|
||||
- name: mosaic-coder3
|
||||
url: https://git.mosaicstack.dev
|
||||
token: fixture-mosaic-token
|
||||
YAML
|
||||
|
||||
cat > "$BIN_DIR/tea" <<'SH'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
[[ "$*" == "api --login usc-coder3 /user" ]] && { printf '{"login":"coder3"}\n'; exit 0; }
|
||||
[[ "$*" == "api --login same-host-other /user" ]] && { printf '{"login":"other"}\n'; exit 0; }
|
||||
[[ "$*" == "api --login mosaic-coder3 /user" ]] && { printf '{"login":"coder3"}\n'; exit 0; }
|
||||
exit 1
|
||||
SH
|
||||
cat > "$BIN_DIR/curl" <<'SH'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
printf 'curl' >> "$MOSAIC_TEST_LOG"
|
||||
printf ' <%s>' "$@" >> "$MOSAIC_TEST_LOG"
|
||||
printf '\n' >> "$MOSAIC_TEST_LOG"
|
||||
printf '{"number":42,"draft":false}\n'
|
||||
printf 'curl' >> "$MOSAIC_TEST_LOG"; printf ' <%s>' "$@" >> "$MOSAIC_TEST_LOG"; printf '\n' >> "$MOSAIC_TEST_LOG"
|
||||
[[ " $* " == *" -X PATCH "* ]] && printf '{"number":42,"draft":false}\n' || printf '{"name":"repo"}\n'
|
||||
SH
|
||||
|
||||
cat > "$BIN_DIR/gh" <<'SH'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
printf 'gh' >> "$MOSAIC_TEST_LOG"
|
||||
printf ' <%s>' "$@" >> "$MOSAIC_TEST_LOG"
|
||||
printf '\n' >> "$MOSAIC_TEST_LOG"
|
||||
printf 'gh' >> "$MOSAIC_TEST_LOG"; printf ' <%s>' "$@" >> "$MOSAIC_TEST_LOG"; printf '\n' >> "$MOSAIC_TEST_LOG"
|
||||
SH
|
||||
chmod +x "$BIN_DIR/curl" "$BIN_DIR/gh" "$SCRIPT_DIR/pr-edit.sh"
|
||||
chmod +x "$BIN_DIR/tea" "$BIN_DIR/curl" "$BIN_DIR/gh" "$SCRIPT_DIR/pr-edit.sh"
|
||||
|
||||
run_wrapper() {
|
||||
(
|
||||
cd "$REPO_DIR"
|
||||
PATH="$BIN_DIR:$PATH" \
|
||||
HOME="$HOME_DIR" \
|
||||
XDG_CONFIG_HOME="$XDG_DIR" \
|
||||
MOSAIC_TEST_LOG="$LOG_FILE" \
|
||||
"$SCRIPT_DIR/pr-edit.sh" "$@"
|
||||
)
|
||||
(cd "$REPO_DIR"; PATH="$BIN_DIR:$PATH" HOME="$HOME_DIR" XDG_CONFIG_HOME="$XDG_DIR" \
|
||||
MOSAIC_TEST_LOG="$LOG_FILE" "$SCRIPT_DIR/pr-edit.sh" "$@")
|
||||
}
|
||||
assert_no_secret() {
|
||||
! grep -q 'fixture-.*-token' "$LOG_FILE" || { echo "Credential leaked into curl argv/log" >&2; exit 1; }
|
||||
}
|
||||
|
||||
# The explicit target differs from CWD origin and must govern BOTH host and slug.
|
||||
: > "$LOG_FILE"
|
||||
# shellcheck disable=SC2016 # literal backticks prove argument-array body safety.
|
||||
run_wrapper -n 42 --login usc --title 'New title' --body 'Body with `literal` bytes' --base develop --draft >/dev/null
|
||||
MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 --login mosaic-coder3 -r mosaicstack/stack \
|
||||
-H git.mosaicstack.dev --title 'New title' --body 'Body with `literal` bytes' --base develop --draft >/dev/null
|
||||
python3 - "$LOG_FILE" <<'PY'
|
||||
import json
|
||||
import pathlib
|
||||
import sys
|
||||
|
||||
line = pathlib.Path(sys.argv[1]).read_text()
|
||||
assert "-X> <PATCH>" in line, line
|
||||
assert "Authorization: token fixture-usc-token" in line, line
|
||||
assert "https://git.uscllc.com/api/v1/repos/USC/uconnect/pulls/42" in line, line
|
||||
payload = line.split(" <-d> <", 1)[1].split("> <https://", 1)[0]
|
||||
data = json.loads(payload)
|
||||
assert data == {
|
||||
"title": "New title",
|
||||
"body": "Body with `literal` bytes",
|
||||
"base": "develop",
|
||||
"draft": True,
|
||||
}, data
|
||||
import json, pathlib, sys
|
||||
lines = pathlib.Path(sys.argv[1]).read_text().splitlines()
|
||||
assert len(lines) == 2, lines
|
||||
assert "https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack" in lines[0], lines
|
||||
assert "https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/pulls/42" in lines[1], lines
|
||||
assert "--config" in lines[0] and "--config" in lines[1], lines
|
||||
assert "Authorization:" not in "\n".join(lines), lines
|
||||
payload = lines[1].split(" <-d> <", 1)[1].split("> <https://", 1)[0]
|
||||
assert json.loads(payload) == {"title":"New title","body":"Body with `literal` bytes","base":"develop","draft":True}
|
||||
PY
|
||||
assert_no_secret
|
||||
|
||||
# Ready maps to false and still preflights before the write.
|
||||
: > "$LOG_FILE"
|
||||
run_wrapper -n 42 --login usc --ready >/dev/null
|
||||
grep -q '"draft": false' "$LOG_FILE"
|
||||
MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 --login usc-coder3 -r USC/uconnect -H git.uscllc.com --ready >/dev/null
|
||||
grep -q '"draft": false' "$LOG_FILE"; assert_no_secret
|
||||
|
||||
# Identity is mandatory; no ambient/first-host login can write.
|
||||
: > "$LOG_FILE"
|
||||
if run_wrapper -n 42 --login mosaicstack --draft >/dev/null 2>&1; then
|
||||
echo "Expected a login bound to another host to fail closed" >&2
|
||||
exit 1
|
||||
fi
|
||||
[[ ! -s "$LOG_FILE" ]] || { echo "Mismatched login unexpectedly reached curl" >&2; exit 1; }
|
||||
if run_wrapper -n 42 --login usc-coder3 --draft >/dev/null 2>&1; then echo "Unset identity wrote" >&2; exit 1; fi
|
||||
[[ ! -s "$LOG_FILE" ]] || { echo "Unset identity reached curl" >&2; exit 1; }
|
||||
|
||||
if run_wrapper -n 42 --draft --ready >/dev/null 2>&1; then
|
||||
echo "Expected --draft and --ready to be mutually exclusive" >&2
|
||||
exit 1
|
||||
fi
|
||||
if run_wrapper -n 42 >/dev/null 2>&1; then
|
||||
echo "Expected a no-op edit to fail" >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! run_wrapper --help 2>&1 | grep -q '^Usage:'; then
|
||||
echo "Expected --help to exit zero and print usage" >&2
|
||||
exit 1
|
||||
fi
|
||||
# Explicit and ambient same-host wrong principals both refuse before preflight/write.
|
||||
for mode in explicit ambient; do
|
||||
: > "$LOG_FILE"
|
||||
if [[ "$mode" == explicit ]]; then
|
||||
cmd=(--login same-host-other)
|
||||
else
|
||||
cmd=(); export GITEA_LOGIN=same-host-other
|
||||
fi
|
||||
if MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 "${cmd[@]}" -r USC/uconnect -H git.uscllc.com --draft >/dev/null 2>&1; then
|
||||
echo "$mode wrong identity wrote" >&2; exit 1
|
||||
fi
|
||||
unset GITEA_LOGIN
|
||||
[[ ! -s "$LOG_FILE" ]] || { echo "$mode wrong identity reached curl" >&2; exit 1; }
|
||||
done
|
||||
|
||||
# GitHub uses gh's supported edit and ready/undo commands rather than raw defaults.
|
||||
# Set identity with no explicit/ambient login refuses rather than selecting first host login.
|
||||
: > "$LOG_FILE"
|
||||
if MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 -r USC/uconnect -H git.uscllc.com --draft >/dev/null 2>&1; then
|
||||
echo "Missing login selected a principal" >&2; exit 1
|
||||
fi
|
||||
[[ ! -s "$LOG_FILE" ]] || { echo "Missing login reached curl" >&2; exit 1; }
|
||||
|
||||
# Cross-host credential fails before curl; explicit target preflight failure blocks PATCH.
|
||||
: > "$LOG_FILE"
|
||||
if MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 --login mosaic-coder3 -r USC/uconnect -H git.uscllc.com --draft >/dev/null 2>&1; then
|
||||
echo "Cross-host login wrote" >&2; exit 1
|
||||
fi
|
||||
[[ ! -s "$LOG_FILE" ]] || { echo "Cross-host login reached curl" >&2; exit 1; }
|
||||
|
||||
if run_wrapper -n 42 --draft --ready >/dev/null 2>&1; then echo "Accepted conflicting modes" >&2; exit 1; fi
|
||||
if run_wrapper -n 42 >/dev/null 2>&1; then echo "Accepted no-op edit" >&2; exit 1; fi
|
||||
run_wrapper --help 2>&1 | grep -q '^Usage:'
|
||||
|
||||
# GitHub retains provider-native edit/readiness behavior.
|
||||
git -C "$REPO_DIR" remote set-url origin https://github.com/acme/widgets.git
|
||||
: > "$LOG_FILE"
|
||||
run_wrapper -n 7 --title 'GitHub title' --draft >/dev/null
|
||||
: > "$LOG_FILE"; run_wrapper -n 7 --title 'GitHub title' --draft >/dev/null
|
||||
grep -q 'gh <pr> <edit> <7> <--title> <GitHub title>' "$LOG_FILE"
|
||||
grep -q 'gh <pr> <ready> <7> <--undo>' "$LOG_FILE"
|
||||
|
||||
echo "PR edit regression harness passed"
|
||||
|
||||
Reference in New Issue
Block a user