Fix perms for http/ssh clone (#288)

2025-06-13 13:57:13 +02:00 · 2024-05-28 01:30:08 +02:00
parent 77d87aeecd
commit 38892d8a4a
12 changed files with 225 additions and 22 deletions
--- a/internal/web/test/auth_test.go
+++ b/internal/web/test/auth_test.go
@ -1,8 +1,13 @@
 package test

 import (
+	"fmt"
 	"github.com/stretchr/testify/require"
+	"github.com/thomiceli/opengist/internal/config"
 	"github.com/thomiceli/opengist/internal/db"
+	"os"
+	"os/exec"
+	"path"
 	"testing"
 )

@ -147,3 +152,167 @@ func TestAnonymous(t *testing.T) {
 	require.NoError(t, err)

 }
+
+func TestGitOperations(t *testing.T) {
+	setup(t)
+	s, err := newTestServer()
+	require.NoError(t, err, "Failed to create test server")
+	defer teardown(t, s)
+
+	admin := db.UserDTO{Username: "thomas", Password: "thomas"}
+	register(t, s, admin)
+	s.sessionCookie = ""
+	register(t, s, db.UserDTO{Username: "fujiwara", Password: "fujiwara"})
+	s.sessionCookie = ""
+	register(t, s, db.UserDTO{Username: "kaguya", Password: "kaguya"})
+
+	gist1 := db.GistDTO{
+		Title:       "kaguya-pub-gist",
+		URL:         "kaguya-pub-gist",
+		Description: "kaguya's first gist",
+		VisibilityDTO: db.VisibilityDTO{
+			Private: db.PublicVisibility,
+		},
+		Name: []string{"kaguya-file.txt"},
+		Content: []string{
+			"yeah",
+		},
+	}
+	err = s.request("POST", "/", gist1, 302)
+	require.NoError(t, err)
+
+	gist2 := db.GistDTO{
+		Title:       "kaguya-unl-gist",
+		URL:         "kaguya-unl-gist",
+		Description: "kaguya's second gist",
+		VisibilityDTO: db.VisibilityDTO{
+			Private: db.UnlistedVisibility,
+		},
+		Name: []string{"kaguya-file.txt"},
+		Content: []string{
+			"cool",
+		},
+	}
+	err = s.request("POST", "/", gist2, 302)
+	require.NoError(t, err)
+
+	gist3 := db.GistDTO{
+		Title:       "kaguya-priv-gist",
+		URL:         "kaguya-priv-gist",
+		Description: "kaguya's second gist",
+		VisibilityDTO: db.VisibilityDTO{
+			Private: db.PrivateVisibility,
+		},
+		Name: []string{"kaguya-file.txt"},
+		Content: []string{
+			"super",
+		},
+	}
+	err = s.request("POST", "/", gist3, 302)
+	require.NoError(t, err)
+
+	gitOperations := func(credentials, owner, url, filename string, expectErrorClone, expectErrorCheck, expectErrorPush bool) {
+		fmt.Println("Testing", credentials, url, expectErrorClone, expectErrorCheck, expectErrorPush)
+		err := clientGitClone(credentials, owner, url)
+		if expectErrorClone {
+			require.Error(t, err)
+		} else {
+			require.NoError(t, err)
+		}
+		err = clientCheckRepo(url, filename)
+		if expectErrorCheck {
+			require.Error(t, err)
+		} else {
+			require.NoError(t, err)
+		}
+		err = clientGitPush(url)
+		if expectErrorPush {
+			require.Error(t, err)
+		} else {
+			require.NoError(t, err)
+		}
+	}
+
+	tests := []struct {
+		credentials      string
+		user             string
+		url              string
+		expectErrorClone bool
+		expectErrorCheck bool
+		expectErrorPush  bool
+	}{
+		{":", "kaguya", "kaguya-pub-gist", false, false, true},
+		{":", "kaguya", "kaguya-unl-gist", false, false, true},
+		{":", "kaguya", "kaguya-priv-gist", true, true, true},
+		{"kaguya:kaguya", "kaguya", "kaguya-pub-gist", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-unl-gist", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-priv-gist", false, false, false},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-pub-gist", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-unl-gist", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-priv-gist", true, true, true},
+	}
+
+	for _, test := range tests {
+		gitOperations(test.credentials, test.user, test.url, "kaguya-file.txt", test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
+	}
+
+	login(t, s, admin)
+	err = s.request("PUT", "/admin-panel/set-config", settingSet{"require-login", "1"}, 200)
+	require.NoError(t, err)
+
+	testsRequireLogin := []struct {
+		credentials      string
+		user             string
+		url              string
+		expectErrorClone bool
+		expectErrorCheck bool
+		expectErrorPush  bool
+	}{
+		{":", "kaguya", "kaguya-pub-gist", true, true, true},
+		{":", "kaguya", "kaguya-unl-gist", true, true, true},
+		{":", "kaguya", "kaguya-priv-gist", true, true, true},
+		{"kaguya:kaguya", "kaguya", "kaguya-pub-gist", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-unl-gist", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-priv-gist", false, false, false},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-pub-gist", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-unl-gist", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-priv-gist", true, true, true},
+	}
+
+	for _, test := range testsRequireLogin {
+		gitOperations(test.credentials, test.user, test.url, "kaguya-file.txt", test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
+	}
+
+	login(t, s, admin)
+	err = s.request("PUT", "/admin-panel/set-config", settingSet{"allow-gists-without-login", "1"}, 200)
+	require.NoError(t, err)
+
+	for _, test := range tests {
+		gitOperations(test.credentials, test.user, test.url, "kaguya-file.txt", test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
+	}
+}
+
+func clientGitClone(creds string, user string, url string) error {
+	return exec.Command("git", "clone", "http://"+creds+"@localhost:6157/"+user+"/"+url, path.Join(config.GetHomeDir(), "tmp", url)).Run()
+}
+
+func clientGitPush(url string) error {
+	f, err := os.Create(path.Join(config.GetHomeDir(), "tmp", url, "newfile.txt"))
+	if err != nil {
+		return err
+	}
+	f.Close()
+
+	_ = exec.Command("git", "-C", path.Join(config.GetHomeDir(), "tmp", url), "add", "newfile.txt").Run()
+	_ = exec.Command("git", "-C", path.Join(config.GetHomeDir(), "tmp", url), "commit", "-m", "new file").Run()
+	err = exec.Command("git", "-C", path.Join(config.GetHomeDir(), "tmp", url), "push", "origin", "master").Run()
+
+	_ = os.RemoveAll(path.Join(config.GetHomeDir(), "tmp", url))
+
+	return err
+}
+
+func clientCheckRepo(url string, file string) error {
+	_, err := os.ReadFile(path.Join(config.GetHomeDir(), "tmp", url, file))
+	return err
+}