package remoteapi
import (
"context"
"testing"
"git.sr.ht/~sircmpwn/core-go/auth"
"git.sr.ht/~sircmpwn/core-go/config"
remotesapi "github.com/dolthub/dolt/go/gen/proto/dolt/services/remotesapi/v1alpha1"
"github.com/sirupsen/logrus"
"github.com/vaughan0/go-ini"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
"go.bigb.es/sourcehut-dolt/authn"
"go.bigb.es/sourcehut-dolt/core"
"go.bigb.es/sourcehut-dolt/db"
)
const (
mRoot = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/Root"
mGetMeta = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/GetRepoMetadata"
mCommit = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/Commit"
mUpload = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/GetUploadLocations"
mDownload = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/GetDownloadLocations"
mUnknown = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/Frobnicate"
)
// fakeReq implements repoRequest with a fixed path/id so tests need not depend
// on which concrete proto message carries the repo for a given method.
type fakeReq struct {
path string
id *remotesapi.RepoId
}
func (f fakeReq) GetRepoPath() string { return f.path }
func (f fakeReq) GetRepoId() *remotesapi.RepoId { return f.id }
// stubStore is an in-memory repoStore: no Postgres.
type stubStore struct {
repo *core.Repo
repoErr error
acl *core.AccessMode
aclErr error
}
func (s stubStore) GetRepoByOwnerAndName(_ context.Context, _, _ string) (*core.Repo, error) {
if s.repoErr != nil {
return nil, s.repoErr
}
return s.repo, nil
}
func (s stubStore) EffectiveAccess(_ context.Context, _, _ int) (*core.AccessMode, error) {
return s.acl, s.aclErr
}
func testInterceptor(store repoStore) *interceptor {
return &interceptor{
conf: ini.File{},
service: "dolt.sr.ht",
expectedAud: "dolt.srht.bigb.es",
logger: logrus.NewEntry(logrus.New()),
stores: func() repoStore { return store },
}
}
func repo(id, ownerID int, vis core.Visibility) *core.Repo {
return &core.Repo{ID: id, Name: "db", OwnerID: ownerID, OwnerName: "alice", Visibility: vis}
}
func acl(m core.AccessMode) *core.AccessMode { return &m }
// patCaller builds an authenticated PAT caller with the given grant string
// (empty ⇒ universal token). config context is needed by DecodeGrants.
func patCaller(t *testing.T, userID int, grants string) *auth.AuthContext {
t.Helper()
ctx := config.Context(context.Background(), ini.File{}, "dolt.sr.ht")
g, err := auth.DecodeGrants(ctx, grants)
if err != nil {
t.Fatalf("DecodeGrants(%q): %v", grants, err)
}
return &auth.AuthContext{
UserID: userID,
Username: "alice",
UserType: auth.USER_TYPE_USER,
AuthMethod: auth.AUTH_OAUTH2,
BearerToken: &auth.BearerToken{},
Grants: g,
}
}
// cookieCaller builds an authenticated non-token caller (cookie/keypair): no
// BearerToken, so the grant gate passes trivially.
func cookieCaller(userID int) *auth.AuthContext {
return &auth.AuthContext{
UserID: userID,
Username: "alice",
UserType: auth.USER_TYPE_USER,
AuthMethod: auth.AUTH_COOKIE,
}
}
func wantCode(t *testing.T, err error, code codes.Code) {
t.Helper()
if status.Code(err) != code {
t.Fatalf("want gRPC code %s, got %s (err=%v)", code, status.Code(err), err)
}
}
func TestClassify(t *testing.T) {
cases := []struct {
method string
op core.Op
mode core.AccessMode
ok bool
}{
{mCommit, core.OpPush, core.AccessRW, true},
{mUpload, core.OpPush, core.AccessRW, true},
{mRoot, core.OpCloneRead, core.AccessRO, true},
{mGetMeta, core.OpCloneRead, core.AccessRO, true},
{mDownload, core.OpCloneRead, core.AccessRO, true},
{mUnknown, 0, "", false},
}
for _, c := range cases {
op, mode, ok := classify(c.method)
if ok != c.ok || (ok && (op != c.op || mode != c.mode)) {
t.Errorf("classify(%s) = (%v,%v,%v), want (%v,%v,%v)",
c.method, op, mode, ok, c.op, c.mode, c.ok)
}
}
}
func TestAuthorize(t *testing.T) {
ctx := context.Background()
req := fakeReq{path: "~alice/db"}
t.Run("anonymous public read allowed", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 100, core.VisibilityPublic)})
if _, err := i.authorize(ctx, nil, mGetMeta, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("anonymous public push denied (visible)", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 100, core.VisibilityPublic)})
_, err := i.authorize(ctx, nil, mCommit, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("anonymous private read is not found", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 100, core.VisibilityPrivate)})
_, err := i.authorize(ctx, nil, mGetMeta, req)
wantCode(t, err, codes.NotFound)
})
t.Run("owner push allowed", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPrivate)})
if _, err := i.authorize(ctx, cookieCaller(42), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("non-owner private read no acl is not found", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPrivate)})
_, err := i.authorize(ctx, cookieCaller(7), mGetMeta, req)
wantCode(t, err, codes.NotFound)
})
t.Run("acl RO reads private", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPrivate), acl: acl(core.AccessRO)})
if _, err := i.authorize(ctx, cookieCaller(7), mGetMeta, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("acl RO cannot push private (visible ⇒ PermissionDenied)", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPrivate), acl: acl(core.AccessRO)})
_, err := i.authorize(ctx, cookieCaller(7), mCommit, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("acl RW pushes private", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPrivate), acl: acl(core.AccessRW)})
if _, err := i.authorize(ctx, cookieCaller(7), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("unknown method denied", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 100, core.VisibilityPublic)})
_, err := i.authorize(ctx, nil, mUnknown, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("malformed path is invalid argument", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 100, core.VisibilityPublic)})
_, err := i.authorize(ctx, nil, mGetMeta, fakeReq{path: "no-slash"})
wantCode(t, err, codes.InvalidArgument)
})
t.Run("missing repo row is not found", func(t *testing.T) {
i := testInterceptor(stubStore{repoErr: db.ErrNotFound})
_, err := i.authorize(ctx, nil, mGetMeta, req)
wantCode(t, err, codes.NotFound)
})
t.Run("root ping with no path is allowed", func(t *testing.T) {
i := testInterceptor(stubStore{})
got, err := i.authorize(ctx, nil, mRoot, fakeReq{})
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if got == nil {
t.Fatal("expected a caller context")
}
})
t.Run("non-root with no path is invalid argument", func(t *testing.T) {
i := testInterceptor(stubStore{})
_, err := i.authorize(ctx, nil, mGetMeta, fakeReq{})
wantCode(t, err, codes.InvalidArgument)
})
t.Run("repo id shape resolves path", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 100, core.VisibilityPublic)})
r := fakeReq{id: &remotesapi.RepoId{Org: "alice", RepoName: "db"}}
if _, err := i.authorize(ctx, nil, mGetMeta, r); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
}
func TestAuthorizeGrantGate(t *testing.T) {
ctx := context.Background()
req := fakeReq{path: "~alice/db"}
t.Run("PAT without RO grant denied on read", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPublic)})
_, err := i.authorize(ctx, patCaller(t, 42, "meta.sr.ht/profile:RO"), mGetMeta, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("PAT with RO grant allowed on read of own repo", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPublic)})
if _, err := i.authorize(ctx, patCaller(t, 42, "dolt.sr.ht/repos:RO"), mGetMeta, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("PAT with RO grant cannot push", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPublic)})
_, err := i.authorize(ctx, patCaller(t, 42, "dolt.sr.ht/repos:RO"), mCommit, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("PAT with RW grant pushes own repo", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPublic)})
if _, err := i.authorize(ctx, patCaller(t, 42, "dolt.sr.ht/repos:RW"), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("universal PAT (empty grants) passes gate", func(t *testing.T) {
i := testInterceptor(stubStore{repo: repo(1, 42, core.VisibilityPublic)})
if _, err := i.authorize(ctx, patCaller(t, 42, ""), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
}
// TestUnaryAnonymous exercises the full unary path (authenticate + authorize)
// for an anonymous request: no metadata ⇒ anonymous caller, no crypto/PG.
func TestUnaryAnonymous(t *testing.T) {
i := &interceptor{
conf: ini.File{},
service: "dolt.sr.ht",
logger: logrus.NewEntry(logrus.New()),
stores: func() repoStore { return stubStore{repo: repo(1, 100, core.VisibilityPublic)} },
}
var gotCaller bool
handler := func(ctx context.Context, _ any) (any, error) {
// The handler must see a caller-carrying context (anonymous ⇒ nil ac).
gotCaller = authn.CallerFromContext(ctx) == nil
return "ok", nil
}
info := &grpc.UnaryServerInfo{FullMethod: mGetMeta}
resp, err := i.unary()(context.Background(), fakeReq{path: "~alice/db"}, info, handler)
if err != nil {
t.Fatalf("unary: %v", err)
}
if resp != "ok" || !gotCaller {
t.Fatalf("handler not invoked with anonymous caller context (resp=%v)", resp)
}
}
func TestNormalizeAud(t *testing.T) {
cases := map[string]string{
"dolt.srht.bigb.es": "dolt.srht.bigb.es",
"dolt.srht.bigb.es:443": "dolt.srht.bigb.es",
"127.0.0.1:5306": "127.0.0.1",
"": "",
}
for in, want := range cases {
if got := normalizeAud(in); got != want {
t.Errorf("normalizeAud(%q) = %q, want %q", in, got, want)
}
}
}