Add latest changes from gitlab-org/gitlab@13-2-stable-ee

1 files changed, 465 insertions, 0 deletions

diff --git a/spec/requests/api/go_proxy_spec.rb b/spec/requests/api/go_proxy_spec.rb
new file mode 100644
index 00000000000..91e455dac19
--- /dev/null
+++ b/spec/requests/api/go_proxy_spec.rb
@@ -0,0 +1,465 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::GoProxy do
+  include PackagesManagerApiSpecHelpers
+
+  let_it_be(:user) { create :user }
+  let_it_be(:project) { create :project_empty_repo, creator: user, path: 'my-go-lib' }
+  let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }
+
+  let_it_be(:oauth) { create :oauth_access_token, scopes: 'api', resource_owner: user }
+  let_it_be(:job) { create :ci_build, user: user }
+  let_it_be(:pa_token) { create :personal_access_token, user: user }
+
+  let_it_be(:modules) do
+    commits = [
+      create(:go_module_commit, :files,   project: project, tag: 'v1.0.0', files: { 'README.md' => 'Hi' }       ),
+      create(:go_module_commit, :module,  project: project, tag: 'v1.0.1'                                       ),
+      create(:go_module_commit, :package, project: project, tag: 'v1.0.2', path: 'pkg'                          ),
+      create(:go_module_commit, :module,  project: project, tag: 'v1.0.3', name: 'mod'                          ),
+      create(:go_module_commit, :files,   project: project,                files: { 'y.go' => "package a\n" }   ),
+      create(:go_module_commit, :module,  project: project,                name: 'v2'                           ),
+      create(:go_module_commit, :files,   project: project, tag: 'v2.0.0', files: { 'v2/x.go' => "package a\n" })
+    ]
+
+    { sha: [commits[4].sha, commits[5].sha] }
+  end
+
+  before do
+    project.add_developer(user)
+
+    stub_feature_flags(go_proxy_disable_gomod_validation: false)
+
+    modules
+  end
+
+  shared_examples 'an unavailable resource' do
+    it 'returns not found' do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:not_found)
+    end
+  end
+
+  shared_examples 'a module version list resource' do |*versions, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "list" }
+
+    it "returns #{versions.empty? ? 'nothing' : versions.join(', ')}" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.body.split("\n").to_set).to eq(versions.to_set)
+    end
+  end
+
+  shared_examples 'a missing module version list resource' do |path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "list" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module version information resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.info" }
+
+    it "returns information for #{version}" do
+      get_resource(user)
+
+      time = project.repository.find_tag(version).dereferenced_target.committed_date
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response).to be_kind_of(Hash)
+      expect(json_response['Version']).to eq(version)
+      expect(json_response['Time']).to eq(time.strftime('%Y-%m-%dT%H:%M:%S.%L%:z'))
+    end
+  end
+
+  shared_examples 'a missing module version information resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.info" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module pseudo-version information resource' do |prefix, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:commit) { project.repository.commit_by(oid: sha) }
+    let(:version) { fmt_pseudo_version prefix, commit }
+    let(:resource) { "#{version}.info" }
+
+    it "returns information for #{prefix}yyyymmddhhmmss-abcdefabcdef" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response).to be_kind_of(Hash)
+      expect(json_response['Version']).to eq(version)
+      expect(json_response['Time']).to eq(commit.committed_date.strftime('%Y-%m-%dT%H:%M:%S.%L%:z'))
+    end
+  end
+
+  shared_examples 'a missing module pseudo-version information resource' do |path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:commit) do
+      raise "tried to reference :commit without defining :sha" unless defined?(sha)
+
+      project.repository.commit_by(oid: sha)
+    end
+    let(:resource) { "#{version}.info" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module file resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.mod" }
+
+    it "returns #{path}/go.mod from the repo" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.body.split("\n", 2).first).to eq("module #{module_name}")
+    end
+  end
+
+  shared_examples 'a missing module file resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.mod" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module archive resource' do |version, entries, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.zip" }
+
+    it "returns an archive of #{path.empty? ? '/' : path} @ #{version} from the repo" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+
+      entries = entries.map { |e| "#{module_name}@#{version}/#{e}" }.to_set
+      actual = Set[]
+      Zip::InputStream.open(StringIO.new(response.body)) do |zip|
+        while (entry = zip.get_next_entry)
+          actual.add(entry.name)
+        end
+      end
+
+      expect(actual).to eq(entries)
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+    context 'for the root module' do
+      it_behaves_like 'a module version list resource', 'v1.0.1', 'v1.0.2', 'v1.0.3'
+    end
+
+    context 'for the package' do
+      it_behaves_like 'a module version list resource', path: '/pkg'
+    end
+
+    context 'for the submodule' do
+      it_behaves_like 'a module version list resource', 'v1.0.3', path: '/mod'
+    end
+
+    context 'for the root module v2' do
+      it_behaves_like 'a module version list resource', 'v2.0.0', path: '/v2'
+    end
+
+    context 'with a URL encoded relative path component' do
+      it_behaves_like 'a missing module version list resource', path: '/%2E%2E%2Fxyz'
+    end
+
+    context 'with the feature disabled' do
+      before do
+        stub_feature_flags(go_proxy: false)
+      end
+
+      it_behaves_like 'a missing module version list resource'
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
+    context 'with the root module v1.0.1' do
+      it_behaves_like 'a module version information resource', 'v1.0.1'
+    end
+
+    context 'with the submodule v1.0.3' do
+      it_behaves_like 'a module version information resource', 'v1.0.3', path: '/mod'
+    end
+
+    context 'with the root module v2.0.0' do
+      it_behaves_like 'a module version information resource', 'v2.0.0', path: '/v2'
+    end
+
+    context 'with an invalid path' do
+      it_behaves_like 'a missing module version information resource', 'v1.0.3', path: '/pkg'
+    end
+
+    context 'with an invalid version' do
+      it_behaves_like 'a missing module version information resource', 'v1.0.1', path: '/mod'
+    end
+
+    context 'with a pseudo-version for v1' do
+      it_behaves_like 'a module pseudo-version information resource', 'v1.0.4-0.' do
+        let(:sha) { modules[:sha][0] }
+      end
+    end
+
+    context 'with a pseudo-version for v2' do
+      it_behaves_like 'a module pseudo-version information resource', 'v2.0.0-', path: '/v2' do
+        let(:sha) { modules[:sha][1] }
+      end
+    end
+
+    context 'with a pseudo-version with an invalid timestamp' do
+      it_behaves_like 'a missing module pseudo-version information resource' do
+        let(:version) { "v1.0.4-0.00000000000000-#{modules[:sha][0][0..11]}" }
+      end
+    end
+
+    context 'with a pseudo-version with an invalid commit sha' do
+      it_behaves_like 'a missing module pseudo-version information resource' do
+        let(:sha) { modules[:sha][0] }
+        let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-000000000000" }
+      end
+    end
+
+    context 'with a pseudo-version with a short commit sha' do
+      it_behaves_like 'a missing module pseudo-version information resource' do
+        let(:sha) { modules[:sha][0] }
+        let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{modules[:sha][0][0..10]}" }
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.mod' do
+    context 'with the root module v1.0.1' do
+      it_behaves_like 'a module file resource', 'v1.0.1'
+    end
+
+    context 'with the submodule v1.0.3' do
+      it_behaves_like 'a module file resource', 'v1.0.3', path: '/mod'
+    end
+
+    context 'with the root module v2.0.0' do
+      it_behaves_like 'a module file resource', 'v2.0.0', path: '/v2'
+    end
+
+    context 'with an invalid path' do
+      it_behaves_like 'a missing module file resource', 'v1.0.3', path: '/pkg'
+    end
+
+    context 'with an invalid version' do
+      it_behaves_like 'a missing module file resource', 'v1.0.1', path: '/mod'
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.zip' do
+    context 'with the root module v1.0.1' do
+      it_behaves_like 'a module archive resource', 'v1.0.1', ['README.md', 'go.mod', 'a.go']
+    end
+
+    context 'with the root module v1.0.2' do
+      it_behaves_like 'a module archive resource', 'v1.0.2', ['README.md', 'go.mod', 'a.go', 'pkg/b.go']
+    end
+
+    context 'with the root module v1.0.3' do
+      it_behaves_like 'a module archive resource', 'v1.0.3', ['README.md', 'go.mod', 'a.go', 'pkg/b.go']
+    end
+
+    context 'with the submodule v1.0.3' do
+      it_behaves_like 'a module archive resource', 'v1.0.3', ['go.mod', 'a.go'], path: '/mod'
+    end
+
+    context 'with the root module v2.0.0' do
+      it_behaves_like 'a module archive resource', 'v2.0.0', ['go.mod', 'a.go', 'x.go'], path: '/v2'
+    end
+  end
+
+  context 'with an invalid module directive' do
+    let_it_be(:project) { create :project_empty_repo, :public, creator: user }
+    let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }
+
+    let_it_be(:modules) do
+      create(:go_module_commit, :files, project: project,                files: { 'a.go' => "package\a" }                   )
+      create(:go_module_commit, :files, project: project, tag: 'v1.0.0', files: { 'go.mod' => "module not/a/real/module\n" })
+      create(:go_module_commit, :files, project: project,                files: { 'v2/a.go' => "package a\n" }              )
+      create(:go_module_commit, :files, project: project, tag: 'v2.0.0', files: { 'v2/go.mod' => "module #{base}\n" }       )
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      context 'with a completely wrong directive for v1' do
+        it_behaves_like 'a module version list resource'
+      end
+
+      context 'with a directive omitting the suffix for v2' do
+        it_behaves_like 'a module version list resource', path: '/v2'
+      end
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
+      context 'with a completely wrong directive for v1' do
+        it_behaves_like 'a missing module version information resource', 'v1.0.0'
+      end
+
+      context 'with a directive omitting the suffix for v2' do
+        it_behaves_like 'a missing module version information resource', 'v2.0.0', path: '/v2'
+      end
+    end
+  end
+
+  context 'with a case sensitive project and versions' do
+    let_it_be(:project) { create :project_empty_repo, :public, creator: user, path: 'MyGoLib' }
+    let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }
+    let_it_be(:base_encoded) { base.gsub(/[A-Z]/) { |s| "!#{s.downcase}"} }
+
+    let_it_be(:modules) do
+      create(:go_module_commit, :files,   project: project, files: { 'README.md' => "Hi" })
+      create(:go_module_commit, :module,  project: project, tag: 'v1.0.1-prerelease')
+      create(:go_module_commit, :package, project: project, tag: 'v1.0.1-Prerelease', path: 'pkg')
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      let(:resource) { "list" }
+
+      context 'with a case encoded path' do
+        it_behaves_like 'a module version list resource', 'v1.0.1-prerelease', 'v1.0.1-Prerelease' do
+          let(:module_name) { base_encoded }
+        end
+      end
+
+      context 'without a case encoded path' do
+        it_behaves_like 'a missing module version list resource' do
+          let(:module_name) { base.downcase }
+        end
+      end
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
+      context 'with a case encoded path' do
+        it_behaves_like 'a module version information resource', 'v1.0.1-Prerelease' do
+          let(:module_name) { base_encoded }
+          let(:resource) { "v1.0.1-!prerelease.info" }
+        end
+      end
+
+      context 'without a case encoded path' do
+        it_behaves_like 'a module version information resource', 'v1.0.1-prerelease' do
+          let(:module_name) { base_encoded }
+          let(:resource) { "v1.0.1-prerelease.info" }
+        end
+      end
+    end
+  end
+
+  context 'with a private project' do
+    let(:module_name) { base }
+
+    before do
+      project.update(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      let(:resource) { "list" }
+
+      it 'returns ok with an oauth token' do
+        get_resource(oauth_access_token: oauth)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns ok with a job token' do
+        get_resource(oauth_access_token: job)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns ok with a personal access token' do
+        get_resource(personal_access_token: pa_token)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns ok with a personal access token and basic authentication' do
+        get_resource(headers: build_basic_auth_header(user.username, pa_token.token))
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns unauthorized with no authentication' do
+        get_resource
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+  end
+
+  context 'with a public project' do
+    let(:module_name) { base }
+
+    before do
+      project.update(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      let(:resource) { "list" }
+
+      it 'returns ok with no authentication' do
+        get_resource
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+  end
+
+  context 'with a non-existent project' do
+    def get_resource(user = nil, **params)
+      get api("/projects/not%2fa%2fproject/packages/go/#{base}/@v/list", user, params)
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      it 'returns not found with a user' do
+        get_resource(user)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns not found with an oauth token' do
+        get_resource(oauth_access_token: oauth)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns not found with a job token' do
+        get_resource(oauth_access_token: job)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns not found with a personal access token' do
+        get_resource(personal_access_token: pa_token)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns unauthorized with no authentication' do
+        get_resource
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+  end
+
+  def get_resource(user = nil, headers: {}, **params)
+    get api("/projects/#{project.id}/packages/go/#{module_name}/@v/#{resource}", user, params), headers: headers
+  end
+
+  def fmt_pseudo_version(prefix, commit)
+    "#{prefix}#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{commit.sha[0..11]}"
+  end
+end