THIS IS A TEST INSTANCE ONLY! REPOSITORIES CAN BE DELETED AT ANY TIME!

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

275 lines
11KB

  1. // Copyright 2019 The Gitea Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package integrations
  5. import (
  6. "encoding/base64"
  7. "fmt"
  8. "net/http"
  9. "net/url"
  10. "path/filepath"
  11. "testing"
  12. "code.gitea.io/gitea/models"
  13. "code.gitea.io/gitea/modules/context"
  14. "code.gitea.io/gitea/modules/git"
  15. "code.gitea.io/gitea/modules/setting"
  16. api "code.gitea.io/gitea/modules/structs"
  17. "github.com/stretchr/testify/assert"
  18. )
  19. func getUpdateFileOptions() *api.UpdateFileOptions {
  20. content := "This is updated text"
  21. contentEncoded := base64.StdEncoding.EncodeToString([]byte(content))
  22. return &api.UpdateFileOptions{
  23. DeleteFileOptions: api.DeleteFileOptions{
  24. FileOptions: api.FileOptions{
  25. BranchName: "master",
  26. NewBranchName: "master",
  27. Message: "My update of new/file.txt",
  28. Author: api.Identity{
  29. Name: "John Doe",
  30. Email: "johndoe@example.com",
  31. },
  32. Committer: api.Identity{
  33. Name: "Jane Doe",
  34. Email: "janedoe@example.com",
  35. },
  36. },
  37. SHA: "103ff9234cefeee5ec5361d22b49fbb04d385885",
  38. },
  39. Content: contentEncoded,
  40. }
  41. }
  42. func getExpectedFileResponseForUpdate(commitID, treePath string) *api.FileResponse {
  43. sha := "08bd14b2e2852529157324de9c226b3364e76136"
  44. encoding := "base64"
  45. content := "VGhpcyBpcyB1cGRhdGVkIHRleHQ="
  46. selfURL := setting.AppURL + "api/v1/repos/user2/repo1/contents/" + treePath + "?ref=master"
  47. htmlURL := setting.AppURL + "user2/repo1/src/branch/master/" + treePath
  48. gitURL := setting.AppURL + "api/v1/repos/user2/repo1/git/blobs/" + sha
  49. downloadURL := setting.AppURL + "user2/repo1/raw/branch/master/" + treePath
  50. return &api.FileResponse{
  51. Content: &api.ContentsResponse{
  52. Name: filepath.Base(treePath),
  53. Path: treePath,
  54. SHA: sha,
  55. Type: "file",
  56. Size: 20,
  57. Encoding: &encoding,
  58. Content: &content,
  59. URL: &selfURL,
  60. HTMLURL: &htmlURL,
  61. GitURL: &gitURL,
  62. DownloadURL: &downloadURL,
  63. Links: &api.FileLinksResponse{
  64. Self: &selfURL,
  65. GitURL: &gitURL,
  66. HTMLURL: &htmlURL,
  67. },
  68. },
  69. Commit: &api.FileCommitResponse{
  70. CommitMeta: api.CommitMeta{
  71. URL: setting.AppURL + "api/v1/repos/user2/repo1/git/commits/" + commitID,
  72. SHA: commitID,
  73. },
  74. HTMLURL: setting.AppURL + "user2/repo1/commit/" + commitID,
  75. Author: &api.CommitUser{
  76. Identity: api.Identity{
  77. Name: "Jane Doe",
  78. Email: "janedoe@example.com",
  79. },
  80. },
  81. Committer: &api.CommitUser{
  82. Identity: api.Identity{
  83. Name: "John Doe",
  84. Email: "johndoe@example.com",
  85. },
  86. },
  87. Message: "My update of README.md\n",
  88. },
  89. Verification: &api.PayloadCommitVerification{
  90. Verified: false,
  91. Reason: "gpg.error.not_signed_commit",
  92. Signature: "",
  93. Payload: "",
  94. },
  95. }
  96. }
  97. func TestAPIUpdateFile(t *testing.T) {
  98. onGiteaRun(t, func(t *testing.T, u *url.URL) {
  99. user2 := models.AssertExistsAndLoadBean(t, &models.User{ID: 2}).(*models.User) // owner of the repo1 & repo16
  100. user3 := models.AssertExistsAndLoadBean(t, &models.User{ID: 3}).(*models.User) // owner of the repo3, is an org
  101. user4 := models.AssertExistsAndLoadBean(t, &models.User{ID: 4}).(*models.User) // owner of neither repos
  102. repo1 := models.AssertExistsAndLoadBean(t, &models.Repository{ID: 1}).(*models.Repository) // public repo
  103. repo3 := models.AssertExistsAndLoadBean(t, &models.Repository{ID: 3}).(*models.Repository) // public repo
  104. repo16 := models.AssertExistsAndLoadBean(t, &models.Repository{ID: 16}).(*models.Repository) // private repo
  105. fileID := 0
  106. // Get user2's token
  107. session := loginUser(t, user2.Name)
  108. token2 := getTokenForLoggedInUser(t, session)
  109. session = emptyTestSession(t)
  110. // Get user4's token
  111. session = loginUser(t, user4.Name)
  112. token4 := getTokenForLoggedInUser(t, session)
  113. session = emptyTestSession(t)
  114. // Test updating a file in repo1 which user2 owns, try both with branch and empty branch
  115. for _, branch := range [...]string{
  116. "master", // Branch
  117. "", // Empty branch
  118. } {
  119. fileID++
  120. treePath := fmt.Sprintf("update/file%d.txt", fileID)
  121. createFile(user2, repo1, treePath)
  122. updateFileOptions := getUpdateFileOptions()
  123. updateFileOptions.BranchName = branch
  124. url := fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo1.Name, treePath, token2)
  125. req := NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  126. resp := session.MakeRequest(t, req, http.StatusOK)
  127. gitRepo, _ := git.OpenRepository(repo1.RepoPath())
  128. commitID, _ := gitRepo.GetBranchCommitID(updateFileOptions.NewBranchName)
  129. expectedFileResponse := getExpectedFileResponseForUpdate(commitID, treePath)
  130. var fileResponse api.FileResponse
  131. DecodeJSON(t, resp, &fileResponse)
  132. assert.EqualValues(t, expectedFileResponse.Content, fileResponse.Content)
  133. assert.EqualValues(t, expectedFileResponse.Commit.SHA, fileResponse.Commit.SHA)
  134. assert.EqualValues(t, expectedFileResponse.Commit.HTMLURL, fileResponse.Commit.HTMLURL)
  135. assert.EqualValues(t, expectedFileResponse.Commit.Author.Email, fileResponse.Commit.Author.Email)
  136. assert.EqualValues(t, expectedFileResponse.Commit.Author.Name, fileResponse.Commit.Author.Name)
  137. gitRepo.Close()
  138. }
  139. // Test updating a file in a new branch
  140. updateFileOptions := getUpdateFileOptions()
  141. updateFileOptions.BranchName = repo1.DefaultBranch
  142. updateFileOptions.NewBranchName = "new_branch"
  143. fileID++
  144. treePath := fmt.Sprintf("update/file%d.txt", fileID)
  145. createFile(user2, repo1, treePath)
  146. url := fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo1.Name, treePath, token2)
  147. req := NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  148. resp := session.MakeRequest(t, req, http.StatusOK)
  149. var fileResponse api.FileResponse
  150. DecodeJSON(t, resp, &fileResponse)
  151. expectedSHA := "08bd14b2e2852529157324de9c226b3364e76136"
  152. expectedHTMLURL := fmt.Sprintf(setting.AppURL+"user2/repo1/src/branch/new_branch/update/file%d.txt", fileID)
  153. expectedDownloadURL := fmt.Sprintf(setting.AppURL+"user2/repo1/raw/branch/new_branch/update/file%d.txt", fileID)
  154. assert.EqualValues(t, expectedSHA, fileResponse.Content.SHA)
  155. assert.EqualValues(t, expectedHTMLURL, *fileResponse.Content.HTMLURL)
  156. assert.EqualValues(t, expectedDownloadURL, *fileResponse.Content.DownloadURL)
  157. assert.EqualValues(t, updateFileOptions.Message+"\n", fileResponse.Commit.Message)
  158. // Test updating a file and renaming it
  159. updateFileOptions = getUpdateFileOptions()
  160. updateFileOptions.BranchName = repo1.DefaultBranch
  161. fileID++
  162. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  163. createFile(user2, repo1, treePath)
  164. updateFileOptions.FromPath = treePath
  165. treePath = "rename/" + treePath
  166. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo1.Name, treePath, token2)
  167. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  168. resp = session.MakeRequest(t, req, http.StatusOK)
  169. DecodeJSON(t, resp, &fileResponse)
  170. expectedSHA = "08bd14b2e2852529157324de9c226b3364e76136"
  171. expectedHTMLURL = fmt.Sprintf(setting.AppURL+"user2/repo1/src/branch/master/rename/update/file%d.txt", fileID)
  172. expectedDownloadURL = fmt.Sprintf(setting.AppURL+"user2/repo1/raw/branch/master/rename/update/file%d.txt", fileID)
  173. assert.EqualValues(t, expectedSHA, fileResponse.Content.SHA)
  174. assert.EqualValues(t, expectedHTMLURL, *fileResponse.Content.HTMLURL)
  175. assert.EqualValues(t, expectedDownloadURL, *fileResponse.Content.DownloadURL)
  176. // Test updating a file without a message
  177. updateFileOptions = getUpdateFileOptions()
  178. updateFileOptions.Message = ""
  179. updateFileOptions.BranchName = repo1.DefaultBranch
  180. fileID++
  181. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  182. createFile(user2, repo1, treePath)
  183. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo1.Name, treePath, token2)
  184. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  185. resp = session.MakeRequest(t, req, http.StatusOK)
  186. DecodeJSON(t, resp, &fileResponse)
  187. expectedMessage := "Update '" + treePath + "'\n"
  188. assert.EqualValues(t, expectedMessage, fileResponse.Commit.Message)
  189. // Test updating a file with the wrong SHA
  190. fileID++
  191. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  192. createFile(user2, repo1, treePath)
  193. updateFileOptions = getUpdateFileOptions()
  194. correctSHA := updateFileOptions.SHA
  195. updateFileOptions.SHA = "badsha"
  196. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo1.Name, treePath, token2)
  197. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  198. resp = session.MakeRequest(t, req, http.StatusInternalServerError)
  199. expectedAPIError := context.APIError{
  200. Message: "sha does not match [given: " + updateFileOptions.SHA + ", expected: " + correctSHA + "]",
  201. URL: setting.API.SwaggerURL,
  202. }
  203. var apiError context.APIError
  204. DecodeJSON(t, resp, &apiError)
  205. assert.Equal(t, expectedAPIError, apiError)
  206. // Test creating a file in repo1 by user4 who does not have write access
  207. fileID++
  208. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  209. createFile(user2, repo16, treePath)
  210. updateFileOptions = getUpdateFileOptions()
  211. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo16.Name, treePath, token4)
  212. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  213. session.MakeRequest(t, req, http.StatusNotFound)
  214. // Tests a repo with no token given so will fail
  215. fileID++
  216. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  217. createFile(user2, repo16, treePath)
  218. updateFileOptions = getUpdateFileOptions()
  219. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s", user2.Name, repo16.Name, treePath)
  220. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  221. session.MakeRequest(t, req, http.StatusNotFound)
  222. // Test using access token for a private repo that the user of the token owns
  223. fileID++
  224. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  225. createFile(user2, repo16, treePath)
  226. updateFileOptions = getUpdateFileOptions()
  227. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo16.Name, treePath, token2)
  228. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  229. session.MakeRequest(t, req, http.StatusOK)
  230. // Test using org repo "user3/repo3" where user2 is a collaborator
  231. fileID++
  232. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  233. createFile(user3, repo3, treePath)
  234. updateFileOptions = getUpdateFileOptions()
  235. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user3.Name, repo3.Name, treePath, token2)
  236. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  237. session.MakeRequest(t, req, http.StatusOK)
  238. // Test using org repo "user3/repo3" with no user token
  239. fileID++
  240. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  241. createFile(user3, repo3, treePath)
  242. updateFileOptions = getUpdateFileOptions()
  243. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s", user3.Name, repo3.Name, treePath)
  244. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  245. session.MakeRequest(t, req, http.StatusNotFound)
  246. // Test using repo "user2/repo1" where user4 is a NOT collaborator
  247. fileID++
  248. treePath = fmt.Sprintf("update/file%d.txt", fileID)
  249. createFile(user2, repo1, treePath)
  250. updateFileOptions = getUpdateFileOptions()
  251. url = fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s?token=%s", user2.Name, repo1.Name, treePath, token4)
  252. req = NewRequestWithJSON(t, "PUT", url, &updateFileOptions)
  253. session.MakeRequest(t, req, http.StatusForbidden)
  254. })
  255. }