summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--lang/en.lua5
-rw-r--r--lib/gitano/actions.lua2
-rw-r--r--lib/gitano/auth.lua6
-rw-r--r--lib/gitano/lace.lua12
-rw-r--r--lib/gitano/supple.lua7
-rw-r--r--testing/01-basics.yarn19
-rw-r--r--testing/library.yarn10
-rw-r--r--testing/rules-patches/post-receive-alert.patch11
8 files changed, 56 insertions, 16 deletions
diff --git a/lang/en.lua b/lang/en.lua
index ded6ba6..43837ea 100644
--- a/lang/en.lua
+++ b/lang/en.lua
@@ -68,6 +68,7 @@ example administration repository rules and an admin user and group.
SETUP_PREPARE_COMMIT = "=> Commit that tree",
SETUP_PREPARE_MASTER = "=> Attach that commit to master",
SETUP_CHECK_ADMIN_REPO = "=> Ensure we can parse our resultant admin repository",
+ SETUP_ADMIN_CONFIG = "=> Configure admin repo description and owner",
SETUP_ERROR_NO_USER = "Could not find user",
SETUP_ERROR_NOT_ADMIN = "User was not a gitano-admin",
SETUP_ADMIN_REF = "=> Change the admin ref for gitano-admin.git",
@@ -220,6 +221,10 @@ example administration repository rules and an admin user and group.
DEBUG_ATTEMPT_LOADSTRING = "Attempting to loadstring in the sandbox",
DEBUG_SET_GLOBALS = "Setting globals in supple sandbox",
DEBUG_SUPPLE_HOST_RUN = "Entering supple.host.run()",
+ SUPPLE_BYPASS_BANNER_HEADER = "**** PERIL **** A VERY HAZARDOUS OPERATION IS UNDERWAY **** PERIL ****",
+ SUPPLE_BYPASS_ALERT_MESSAGE = "**** The running of a hook was bypassed thanks to gitano-bypass ****",
+ SUPPLE_BYPASS_BANNER_FOOTER = "**** PERIL **** HOOK BYPASS MAY CAUSE CRITICAL FAILURE **** PERIL ****",
+ SUPPLE_BYPASSED = "Hook run bypassed because caller is gitano-bypass",
-- Messages from the util module
DEBUG_WELCOME_TO = "Welcome to ${site}",
diff --git a/lib/gitano/actions.lua b/lib/gitano/actions.lua
index 94cb1dd..336a71f 100644
--- a/lib/gitano/actions.lua
+++ b/lib/gitano/actions.lua
@@ -20,7 +20,7 @@ local function update_actions(conf, repo, tags)
tags["ref"] == "refs/heads/master" then
-- Update to the master branch of the gitano-admin repo, perform a conf
-- check based on the target sha
- log.chat(i18n.expand(VERIFY_NEW_GITANO_ADMIN))
+ log.chat(i18n.expand("VERIFY_NEW_GITANO_ADMIN"))
local conf, msg = config.parse(repo.git:get(tags["newsha"]))
if not conf then
return false, msg
diff --git a/lib/gitano/auth.lua b/lib/gitano/auth.lua
index 705002d..0a2388d 100644
--- a/lib/gitano/auth.lua
+++ b/lib/gitano/auth.lua
@@ -105,9 +105,9 @@ local function is_authorized(user, source, cmdline, repo_root,
end
if user == "gitano-bypass" then
- log.stdout(i18n.expand("BYPASS_USER_BANNER_HEADER"))
- log.stdout(i18n.expand("BYPASS_USER_ALERT_MESSAGE"))
- log.stdout(i18n.expand("BYPASS_USER_BANNER_FOOTER"))
+ log.state(i18n.expand("BYPASS_USER_BANNER_HEADER"))
+ log.state(i18n.expand("BYPASS_USER_ALERT_MESSAGE"))
+ log.state(i18n.expand("BYPASS_USER_BANNER_FOOTER"))
end
if not cmd.validate(admin_conf, repo, parsed_cmdline) then
diff --git a/lib/gitano/lace.lua b/lib/gitano/lace.lua
index 59c5a7a..f50c3d4 100644
--- a/lib/gitano/lace.lua
+++ b/lib/gitano/lace.lua
@@ -211,15 +211,15 @@ end
local function run_ruleset(ruleset, ctx)
-- First check if we're running as bypass
if ctx.as_user == "gitano-bypass" then
- log.stdout(i18n.expand("LACE_BYPASS_BANNER_HEADER"))
- log.stdout(i18n.expand("LACE_BYPASS_ALERT_MESSAGE"))
- log.stdout(i18n.expand("LACE_BYPASS_BANNER_FOOTER"))
+ log.state(i18n.expand("LACE_BYPASS_BANNER_HEADER"))
+ log.state(i18n.expand("LACE_BYPASS_ALERT_MESSAGE"))
+ log.state(i18n.expand("LACE_BYPASS_BANNER_FOOTER"))
return "allow", i18n.expand("LACE_BYPASSED")
end
if ctx.as_user == nil and ctx.user == "gitano-bypass" then
- log.stdout(i18n.expand("LACE_BYPASS_BANNER_HEADER"))
- log.stdout(i18n.expand("LACE_BYPASS_ALERT_MESSAGE"))
- log.stdout(i18n.expand("LACE_BYPASS_BANNER_FOOTER"))
+ log.state(i18n.expand("LACE_BYPASS_BANNER_HEADER"))
+ log.state(i18n.expand("LACE_BYPASS_ALERT_MESSAGE"))
+ log.state(i18n.expand("LACE_BYPASS_BANNER_FOOTER"))
return "allow", i18n.expand("LACE_BYPASSED")
end
return lace.engine.run(ruleset, ctx)
diff --git a/lib/gitano/supple.lua b/lib/gitano/supple.lua
index 693fdf5..fe44c0b 100644
--- a/lib/gitano/supple.lua
+++ b/lib/gitano/supple.lua
@@ -139,6 +139,13 @@ end)(...)
]]
local function run_hook(hook, _repo, info, ...)
+ if info.username == "gitano-bypass" then
+ log.state("BANANA")
+ log.state(i18n.expand("SUPPLE_BYPASS_BANNER_HEADER"))
+ log.state(i18n.expand("SUPPLE_BYPASS_ALERT_MESSAGE"))
+ log.state(i18n.expand("SUPPLE_BYPASS_BANNER_FOOTER"))
+ return true, i18n.expand("SUPPLE_BYPASSED")
+ end
local proxy = get_repo_proxy(_repo)
repo = _repo
log.ddebug(i18n.expand("DEBUG_SUPPLE_HOST_RUN"))
diff --git a/testing/01-basics.yarn b/testing/01-basics.yarn
index 7ab9668..eb876da 100644
--- a/testing/01-basics.yarn
+++ b/testing/01-basics.yarn
@@ -122,13 +122,20 @@ Bypass user alerting
--------------------
When the bypass user is used, Gitano should whine strongly in order to
-discourage the human doing this. In addition this whine is sent to stdout
-in order to discourage the human from automating bypasses instead.
+discourage the human doing this.
SCENARIO using bypass warns loudly
GIVEN a standard instance
WHEN testinstance bypasskey runs ls
- THEN stdout contains ALERT
- AND stdout contains DO NOT DO THIS
- AND stdout contains DANGER
- AND stdout contains VERY RISKY
+ THEN the output contains ALERT
+ AND the output contains DO NOT DO THIS
+ AND the output contains DANGER
+ AND the output contains VERY RISKY
+ GIVEN testinstance using adminkey has patched rules with post-receive-alert.patch
+ WHEN testinstance using adminkey clones gitano-admin.git as gitano-admin
+ AND testinstance using adminkey pushes an empty commit in gitano-admin
+ WHEN testinstance using bypasskey pushes an empty commit in gitano-admin
+ THEN the output contains PERIL
+ AND the output contains CRITICAL FAILURE
+ AND the output does not contain XYZZY
+ THEN failure ensues
diff --git a/testing/library.yarn b/testing/library.yarn
index c3c39ea..5fa4e61 100644
--- a/testing/library.yarn
+++ b/testing/library.yarn
@@ -122,6 +122,10 @@ Admin repo manipulation
$GTT pushviassh $MATCH_1 $MATCH_2 tmp-rulepatch gitano-admin.git
rm -r "$($GTT clonelocation $MATCH_1 tmp-rulepatch)"
+ IMPLEMENTS WHEN ([a-z][a-z0-9]*),? using ([a-z][a-z0-9]*),? pushes an empty commit in ([^ ]+)
+ $GTT rungit $MATCH_1 $MATCH_3 commit --allow-empty -m "Make an empty commit"
+ $GTT pushviassh $MATCH_1 $MATCH_2 $MATCH_3 gitano-admin.git > $DATADIR/stdout 2>$DATADIR/stderr
+
Specific commands
-----------------
@@ -162,9 +166,15 @@ Generic utility methods
IMPLEMENTS THEN ([^ ]+) contains (.+)
grep -q "$MATCH_2" $DATADIR/"$MATCH_1"
+ IMPLEMENTS THEN the output contains (.+)
+ grep -q "$MATCH_1" $DATADIR/stdout $DATADIR/stderr
+
IMPLEMENTS THEN ([^ ]+) does not contain (.+)
if grep -q "$MATCH_2" $DATADIR/"$MATCH_1"; then false; else true; fi
+ IMPLEMENTS THEN the output does not contain (.+)
+ if grep -q "$MATCH_1" $DATADIR/stdout $DATADIR/stderr; then false; else true; fi
+
IMPLEMENTS THEN ([^ ]+) is empty
if grep -q . $DATADIR/"$MATCH_1"; then false; fi
diff --git a/testing/rules-patches/post-receive-alert.patch b/testing/rules-patches/post-receive-alert.patch
new file mode 100644
index 0000000..5785567
--- /dev/null
+++ b/testing/rules-patches/post-receive-alert.patch
@@ -0,0 +1,11 @@
+diff --git a/global-hooks/post-receive.lua b/global-hooks/post-receive.lua
+new file mode 100644
+index 0000000..77df072
+--- /dev/null
++++ a/global-hooks/post-receive.lua
+@@ -0,0 +1,5 @@
++(function (hookf, ...)
++ log.state("XYZZY XYZZY HOOK RUN XYZZY XYZZY")
++ return hookf(...)
++end)(...)
++
View Lorry Controller Status