package remoteapi
import (
"context"
"errors"
"io"
"log/slog"
"testing"
remotesapi "github.com/dolthub/dolt/go/gen/proto/dolt/services/remotesapi/v1alpha1"
"github.com/vaughan0/go-ini"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
"sourcecraft.dev/bigbes/sr-ht-core/auth"
"sourcecraft.dev/bigbes/sr-ht-core/config"
"sourcecraft.dev/bigbes/sr-ht-dolt/authn"
"sourcecraft.dev/bigbes/sr-ht-dolt/core"
"sourcecraft.dev/bigbes/sr-ht-dolt/db"
"sourcecraft.dev/bigbes/sr-ht-dolt/storage"
)
// errBoom is a sentinel failure injected into createStore to exercise the
// push-to-create rollback path.
var errBoom = errors.New("boom")
const (
mRoot = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/Root"
mGetMeta = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/GetRepoMetadata"
mCommit = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/Commit"
mUpload = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/GetUploadLocations"
mDownload = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/GetDownloadLocations"
mUnknown = "/dolt.services.remotesapi.v1alpha1.ChunkStoreService/Frobnicate"
)
// fakeReq implements repoRequest with a fixed path/id so tests need not depend
// on which concrete proto message carries the repo for a given method.
type fakeReq struct {
path string
id *remotesapi.RepoId
}
func (f fakeReq) GetRepoPath() string { return f.path }
func (f fakeReq) GetRepoId() *remotesapi.RepoId { return f.id }
// stubStore is an in-memory repoStore: no Postgres. It is a pointer receiver so
// tests can inspect recorded auto-create calls after authorize runs.
type stubStore struct {
repo *core.Repo
repoErr error
acl *core.AccessMode
aclErr error
// createErr, when set, is returned by CreateRepo (e.g. db.ErrNameTaken to
// simulate losing the first-push race).
createErr error
// refetchRepo is returned by GetRepoByOwnerAndName after a CreateRepo that
// failed with ErrNameTaken (the concurrent winner's row). When nil, repo is
// returned instead.
refetchRepo *core.Repo
// Recorded calls.
created *core.Repo // the repo passed to CreateRepo
createCalls int
deletedID int
deleteCalls int
getCalls int
}
func (s *stubStore) GetRepoByOwnerAndName(_ context.Context, _, _ string) (*core.Repo, error) {
s.getCalls++
// After a CreateRepo lost the ErrNameTaken race, the re-fetch resolves the
// concurrent winner's row.
if s.createCalls > 0 && s.refetchRepo != nil {
return s.refetchRepo, nil
}
if s.repoErr != nil {
return nil, s.repoErr
}
return s.repo, nil
}
func (s *stubStore) EffectiveAccess(_ context.Context, _, _ int) (*core.AccessMode, error) {
return s.acl, s.aclErr
}
func (s *stubStore) CreateRepo(_ context.Context, r *core.Repo) (*core.Repo, error) {
s.createCalls++
s.created = r
if s.createErr != nil {
return nil, s.createErr
}
out := *r
out.ID = 999
return &out, nil
}
func (s *stubStore) DeleteRepo(_ context.Context, id int) error {
s.deleteCalls++
s.deletedID = id
return nil
}
// discardLogger is the logger these tests hand the interceptor: the paths under
// test log on their error arms, and a test asserting a gRPC status code has no
// use for the line.
func discardLogger() *slog.Logger {
return slog.New(slog.NewTextHandler(io.Discard, nil))
}
func testInterceptor(store repoStore) *interceptor {
return &interceptor{
conf: ini.File{},
service: "dolt.sr.ht",
expectedAud: "dolt.srht.bigb.es",
logger: discardLogger(),
stores: func() repoStore { return store },
reposRoot: "/tmp/repos",
createStore: func(context.Context, string) error { return nil },
}
}
func repo(id, ownerID int, vis core.Visibility) *core.Repo {
return &core.Repo{ID: id, Name: "db", OwnerID: ownerID, OwnerName: "alice", Visibility: vis}
}
func acl(m core.AccessMode) *core.AccessMode { return &m }
// patCaller builds an authenticated PAT caller with the given grant string
// (empty ⇒ universal token). config context is needed by DecodeGrants.
func patCaller(t *testing.T, userID int, grants string) *auth.AuthContext {
t.Helper()
ctx := config.Context(context.Background(), ini.File{}, "dolt.sr.ht")
g, err := auth.DecodeGrants(ctx, grants)
if err != nil {
t.Fatalf("DecodeGrants(%q): %v", grants, err)
}
return &auth.AuthContext{
UserID: userID,
Username: "alice",
UserType: auth.USER_TYPE_USER,
AuthMethod: auth.AUTH_OAUTH2,
BearerToken: &auth.BearerToken{},
Grants: g,
}
}
// cookieCaller builds an authenticated non-token caller (cookie/keypair): no
// BearerToken, so the grant gate passes trivially.
func cookieCaller(userID int) *auth.AuthContext {
return &auth.AuthContext{
UserID: userID,
Username: "alice",
UserType: auth.USER_TYPE_USER,
AuthMethod: auth.AUTH_COOKIE,
}
}
func wantCode(t *testing.T, err error, code codes.Code) {
t.Helper()
if status.Code(err) != code {
t.Fatalf("want gRPC code %s, got %s (err=%v)", code, status.Code(err), err)
}
}
func TestClassify(t *testing.T) {
cases := []struct {
method string
op core.Op
mode core.AccessMode
ok bool
}{
{mCommit, core.OpPush, core.AccessRW, true},
{mUpload, core.OpPush, core.AccessRW, true},
{mRoot, core.OpCloneRead, core.AccessRO, true},
{mGetMeta, core.OpCloneRead, core.AccessRO, true},
{mDownload, core.OpCloneRead, core.AccessRO, true},
{mUnknown, 0, "", false},
}
for _, c := range cases {
op, mode, ok := classify(c.method)
if ok != c.ok || (ok && (op != c.op || mode != c.mode)) {
t.Errorf("classify(%s) = (%v,%v,%v), want (%v,%v,%v)",
c.method, op, mode, ok, c.op, c.mode, c.ok)
}
}
}
func TestAuthorize(t *testing.T) {
ctx := context.Background()
req := fakeReq{path: "~alice/db"}
t.Run("anonymous public read allowed", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 100, core.VisibilityPublic)})
if _, err := i.authorize(ctx, nil, mGetMeta, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("anonymous public push denied (visible)", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 100, core.VisibilityPublic)})
_, err := i.authorize(ctx, nil, mCommit, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("anonymous private read is not found", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 100, core.VisibilityPrivate)})
_, err := i.authorize(ctx, nil, mGetMeta, req)
wantCode(t, err, codes.NotFound)
})
t.Run("owner push allowed", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPrivate)})
if _, err := i.authorize(ctx, cookieCaller(42), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("non-owner private read no acl is not found", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPrivate)})
_, err := i.authorize(ctx, cookieCaller(7), mGetMeta, req)
wantCode(t, err, codes.NotFound)
})
t.Run("acl RO reads private", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPrivate), acl: acl(core.AccessRO)})
if _, err := i.authorize(ctx, cookieCaller(7), mGetMeta, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("acl RO cannot push private (visible ⇒ PermissionDenied)", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPrivate), acl: acl(core.AccessRO)})
_, err := i.authorize(ctx, cookieCaller(7), mCommit, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("acl RW pushes private", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPrivate), acl: acl(core.AccessRW)})
if _, err := i.authorize(ctx, cookieCaller(7), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("unknown method denied", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 100, core.VisibilityPublic)})
_, err := i.authorize(ctx, nil, mUnknown, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("malformed path is invalid argument", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 100, core.VisibilityPublic)})
_, err := i.authorize(ctx, nil, mGetMeta, fakeReq{path: "no-slash"})
wantCode(t, err, codes.InvalidArgument)
})
t.Run("missing repo row is not found", func(t *testing.T) {
i := testInterceptor(&stubStore{repoErr: db.ErrNotFound})
_, err := i.authorize(ctx, nil, mGetMeta, req)
wantCode(t, err, codes.NotFound)
})
t.Run("root ping with no path is allowed", func(t *testing.T) {
i := testInterceptor(&stubStore{})
got, err := i.authorize(ctx, nil, mRoot, fakeReq{})
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if got == nil {
t.Fatal("expected a caller context")
}
})
t.Run("non-root with no path is invalid argument", func(t *testing.T) {
i := testInterceptor(&stubStore{})
_, err := i.authorize(ctx, nil, mGetMeta, fakeReq{})
wantCode(t, err, codes.InvalidArgument)
})
t.Run("repo id shape resolves path", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 100, core.VisibilityPublic)})
r := fakeReq{id: &remotesapi.RepoId{Org: "alice", RepoName: "db"}}
if _, err := i.authorize(ctx, nil, mGetMeta, r); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
}
func TestAuthorizeGrantGate(t *testing.T) {
ctx := context.Background()
req := fakeReq{path: "~alice/db"}
t.Run("PAT without RO grant denied on read", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPublic)})
_, err := i.authorize(ctx, patCaller(t, 42, "meta.sr.ht/profile:RO"), mGetMeta, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("PAT with RO grant allowed on read of own repo", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPublic)})
if _, err := i.authorize(ctx, patCaller(t, 42, "dolt.sr.ht/repos:RO"), mGetMeta, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("PAT with RO grant cannot push", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPublic)})
_, err := i.authorize(ctx, patCaller(t, 42, "dolt.sr.ht/repos:RO"), mCommit, req)
wantCode(t, err, codes.PermissionDenied)
})
t.Run("PAT with RW grant pushes own repo", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPublic)})
if _, err := i.authorize(ctx, patCaller(t, 42, "dolt.sr.ht/repos:RW"), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
t.Run("universal PAT (empty grants) passes gate", func(t *testing.T) {
i := testInterceptor(&stubStore{repo: repo(1, 42, core.VisibilityPublic)})
if _, err := i.authorize(ctx, patCaller(t, 42, ""), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
})
}
// TestAuthorizePushToCreate covers the push-to-create branch of authorize: an
// authenticated owner touching a not-yet-existing repo in their own namespace
// transparently creates it (PRIVATE row + empty on-disk store), while every
// other case keeps returning NotFound and creates nothing.
func TestAuthorizePushToCreate(t *testing.T) {
ctx := context.Background()
req := fakeReq{path: "~alice/newdb"}
t.Run("owner create on GetRepoMetadata read", func(t *testing.T) {
st := &stubStore{repoErr: db.ErrNotFound}
var gotPath string
i := testInterceptor(st)
i.createStore = func(_ context.Context, p string) error { gotPath = p; return nil }
// The first RPC of a push is GetRepoMetadata (a read); auto-create fires.
if _, err := i.authorize(ctx, cookieCaller(42), mGetMeta, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
if st.createCalls != 1 {
t.Fatalf("CreateRepo calls = %d, want 1", st.createCalls)
}
if st.created == nil || st.created.Visibility != core.VisibilityPrivate {
t.Fatalf("created repo visibility = %v, want PRIVATE", st.created)
}
if st.created.OwnerID != 42 || st.created.Name != "newdb" || st.created.OwnerName != "alice" {
t.Fatalf("created repo = %+v, want owner 42 alice/newdb", st.created)
}
wantPath := storage.RepoDiskPath("/tmp/repos", "alice", "newdb")
if st.created.Path != wantPath || gotPath != wantPath {
t.Fatalf("store path: created=%q createStore=%q, want %q", st.created.Path, gotPath, wantPath)
}
if st.deleteCalls != 0 {
t.Fatalf("DeleteRepo calls = %d, want 0", st.deleteCalls)
}
})
t.Run("owner create then push allowed", func(t *testing.T) {
st := &stubStore{repoErr: db.ErrNotFound}
i := testInterceptor(st)
if _, err := i.authorize(ctx, cookieCaller(42), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
if st.createCalls != 1 {
t.Fatalf("CreateRepo calls = %d, want 1", st.createCalls)
}
})
t.Run("name-taken race re-fetches, no store creation", func(t *testing.T) {
winner := &core.Repo{ID: 7, Name: "newdb", OwnerID: 42, OwnerName: "alice", Visibility: core.VisibilityPrivate}
st := &stubStore{repoErr: db.ErrNotFound, createErr: db.ErrNameTaken, refetchRepo: winner}
var storeCreated bool
i := testInterceptor(st)
i.createStore = func(context.Context, string) error { storeCreated = true; return nil }
if _, err := i.authorize(ctx, cookieCaller(42), mCommit, req); err != nil {
t.Fatalf("unexpected error: %v", err)
}
if st.createCalls != 1 {
t.Fatalf("CreateRepo calls = %d, want 1", st.createCalls)
}
if storeCreated {
t.Fatal("createStore must not be called when the row already exists")
}
if st.deleteCalls != 0 {
t.Fatalf("DeleteRepo calls = %d, want 0", st.deleteCalls)
}
})
t.Run("store creation failure rolls back row", func(t *testing.T) {
st := &stubStore{repoErr: db.ErrNotFound}
i := testInterceptor(st)
i.createStore = func(context.Context, string) error { return errBoom }
_, err := i.authorize(ctx, cookieCaller(42), mCommit, req)
wantCode(t, err, codes.Unavailable)
if st.deleteCalls != 1 || st.deletedID != 999 {
t.Fatalf("rollback: deleteCalls=%d deletedID=%d, want 1 and 999", st.deleteCalls, st.deletedID)
}
})
t.Run("non-owner namespace is not found, no create", func(t *testing.T) {
st := &stubStore{repoErr: db.ErrNotFound}
i := testInterceptor(st)
// caller bob touching ~alice/newdb.
bob := &auth.AuthContext{UserID: 7, Username: "bob", UserType: auth.USER_TYPE_USER, AuthMethod: auth.AUTH_COOKIE}
_, err := i.authorize(ctx, bob, mCommit, req)
wantCode(t, err, codes.NotFound)
if st.createCalls != 0 {
t.Fatalf("CreateRepo calls = %d, want 0", st.createCalls)
}
})
t.Run("anonymous is not found, no create", func(t *testing.T) {
st := &stubStore{repoErr: db.ErrNotFound}
i := testInterceptor(st)
_, err := i.authorize(ctx, nil, mCommit, req)
wantCode(t, err, codes.NotFound)
if st.createCalls != 0 {
t.Fatalf("CreateRepo calls = %d, want 0", st.createCalls)
}
})
t.Run("suspended owner is not found, no create", func(t *testing.T) {
st := &stubStore{repoErr: db.ErrNotFound}
i := testInterceptor(st)
suspended := &auth.AuthContext{UserID: 42, Username: "alice", UserType: auth.USER_TYPE_SUSPENDED, AuthMethod: auth.AUTH_COOKIE}
_, err := i.authorize(ctx, suspended, mCommit, req)
wantCode(t, err, codes.NotFound)
if st.createCalls != 0 {
t.Fatalf("CreateRepo calls = %d, want 0", st.createCalls)
}
})
t.Run("invalid name is not found, no create", func(t *testing.T) {
st := &stubStore{repoErr: db.ErrNotFound}
i := testInterceptor(st)
// "bad name" passes ParseRepoPath (2 non-traversal segments) but fails
// core.ValidateName (space is not an allowed character).
_, err := i.authorize(ctx, cookieCaller(42), mCommit, fakeReq{path: "~alice/bad name"})
wantCode(t, err, codes.NotFound)
if st.createCalls != 0 {
t.Fatalf("CreateRepo calls = %d, want 0", st.createCalls)
}
})
}
// TestUnaryAnonymous exercises the full unary path (authenticate + authorize)
// for an anonymous request: no metadata ⇒ anonymous caller, no crypto/PG.
func TestUnaryAnonymous(t *testing.T) {
i := &interceptor{
conf: ini.File{},
service: "dolt.sr.ht",
logger: discardLogger(),
stores: func() repoStore { return &stubStore{repo: repo(1, 100, core.VisibilityPublic)} },
}
var gotCaller bool
handler := func(ctx context.Context, _ any) (any, error) {
// The handler must see a caller-carrying context (anonymous ⇒ nil ac).
gotCaller = authn.CallerFromContext(ctx) == nil
return "ok", nil
}
info := &grpc.UnaryServerInfo{FullMethod: mGetMeta}
resp, err := i.unary()(context.Background(), fakeReq{path: "~alice/db"}, info, handler)
if err != nil {
t.Fatalf("unary: %v", err)
}
if resp != "ok" || !gotCaller {
t.Fatalf("handler not invoked with anonymous caller context (resp=%v)", resp)
}
}
func TestNormalizeAud(t *testing.T) {
cases := map[string]string{
"dolt.srht.bigb.es": "dolt.srht.bigb.es",
"dolt.srht.bigb.es:443": "dolt.srht.bigb.es",
"127.0.0.1:5306": "127.0.0.1",
"": "",
}
for in, want := range cases {
if got := normalizeAud(in); got != want {
t.Errorf("normalizeAud(%q) = %q, want %q", in, got, want)
}
}
}