diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2020-07-20 12:26:25 +0000 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2020-07-20 12:26:25 +0000 |
commit | a09983ae35713f5a2bbb100981116d31ce99826e (patch) | |
tree | 2ee2af7bd104d57086db360a7e6d8c9d5d43667a /spec/requests/api/go_proxy_spec.rb | |
parent | 18c5ab32b738c0b6ecb4d0df3994000482f34bd8 (diff) | |
download | gitlab-ce-a09983ae35713f5a2bbb100981116d31ce99826e.tar.gz |
Add latest changes from gitlab-org/gitlab@13-2-stable-ee
Diffstat (limited to 'spec/requests/api/go_proxy_spec.rb')
-rw-r--r-- | spec/requests/api/go_proxy_spec.rb | 465 |
1 files changed, 465 insertions, 0 deletions
diff --git a/spec/requests/api/go_proxy_spec.rb b/spec/requests/api/go_proxy_spec.rb new file mode 100644 index 00000000000..91e455dac19 --- /dev/null +++ b/spec/requests/api/go_proxy_spec.rb @@ -0,0 +1,465 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe API::GoProxy do + include PackagesManagerApiSpecHelpers + + let_it_be(:user) { create :user } + let_it_be(:project) { create :project_empty_repo, creator: user, path: 'my-go-lib' } + let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" } + + let_it_be(:oauth) { create :oauth_access_token, scopes: 'api', resource_owner: user } + let_it_be(:job) { create :ci_build, user: user } + let_it_be(:pa_token) { create :personal_access_token, user: user } + + let_it_be(:modules) do + commits = [ + create(:go_module_commit, :files, project: project, tag: 'v1.0.0', files: { 'README.md' => 'Hi' } ), + create(:go_module_commit, :module, project: project, tag: 'v1.0.1' ), + create(:go_module_commit, :package, project: project, tag: 'v1.0.2', path: 'pkg' ), + create(:go_module_commit, :module, project: project, tag: 'v1.0.3', name: 'mod' ), + create(:go_module_commit, :files, project: project, files: { 'y.go' => "package a\n" } ), + create(:go_module_commit, :module, project: project, name: 'v2' ), + create(:go_module_commit, :files, project: project, tag: 'v2.0.0', files: { 'v2/x.go' => "package a\n" }) + ] + + { sha: [commits[4].sha, commits[5].sha] } + end + + before do + project.add_developer(user) + + stub_feature_flags(go_proxy_disable_gomod_validation: false) + + modules + end + + shared_examples 'an unavailable resource' do + it 'returns not found' do + get_resource(user) + + expect(response).to have_gitlab_http_status(:not_found) + end + end + + shared_examples 'a module version list resource' do |*versions, path: ''| + let(:module_name) { "#{base}#{path}" } + let(:resource) { "list" } + + it "returns #{versions.empty? ? 'nothing' : versions.join(', ')}" do + get_resource(user) + + expect(response).to have_gitlab_http_status(:ok) + expect(response.body.split("\n").to_set).to eq(versions.to_set) + end + end + + shared_examples 'a missing module version list resource' do |path: ''| + let(:module_name) { "#{base}#{path}" } + let(:resource) { "list" } + + it_behaves_like 'an unavailable resource' + end + + shared_examples 'a module version information resource' do |version, path: ''| + let(:module_name) { "#{base}#{path}" } + let(:resource) { "#{version}.info" } + + it "returns information for #{version}" do + get_resource(user) + + time = project.repository.find_tag(version).dereferenced_target.committed_date + + expect(response).to have_gitlab_http_status(:ok) + expect(json_response).to be_kind_of(Hash) + expect(json_response['Version']).to eq(version) + expect(json_response['Time']).to eq(time.strftime('%Y-%m-%dT%H:%M:%S.%L%:z')) + end + end + + shared_examples 'a missing module version information resource' do |version, path: ''| + let(:module_name) { "#{base}#{path}" } + let(:resource) { "#{version}.info" } + + it_behaves_like 'an unavailable resource' + end + + shared_examples 'a module pseudo-version information resource' do |prefix, path: ''| + let(:module_name) { "#{base}#{path}" } + let(:commit) { project.repository.commit_by(oid: sha) } + let(:version) { fmt_pseudo_version prefix, commit } + let(:resource) { "#{version}.info" } + + it "returns information for #{prefix}yyyymmddhhmmss-abcdefabcdef" do + get_resource(user) + + expect(response).to have_gitlab_http_status(:ok) + expect(json_response).to be_kind_of(Hash) + expect(json_response['Version']).to eq(version) + expect(json_response['Time']).to eq(commit.committed_date.strftime('%Y-%m-%dT%H:%M:%S.%L%:z')) + end + end + + shared_examples 'a missing module pseudo-version information resource' do |path: ''| + let(:module_name) { "#{base}#{path}" } + let(:commit) do + raise "tried to reference :commit without defining :sha" unless defined?(sha) + + project.repository.commit_by(oid: sha) + end + let(:resource) { "#{version}.info" } + + it_behaves_like 'an unavailable resource' + end + + shared_examples 'a module file resource' do |version, path: ''| + let(:module_name) { "#{base}#{path}" } + let(:resource) { "#{version}.mod" } + + it "returns #{path}/go.mod from the repo" do + get_resource(user) + + expect(response).to have_gitlab_http_status(:ok) + expect(response.body.split("\n", 2).first).to eq("module #{module_name}") + end + end + + shared_examples 'a missing module file resource' do |version, path: ''| + let(:module_name) { "#{base}#{path}" } + let(:resource) { "#{version}.mod" } + + it_behaves_like 'an unavailable resource' + end + + shared_examples 'a module archive resource' do |version, entries, path: ''| + let(:module_name) { "#{base}#{path}" } + let(:resource) { "#{version}.zip" } + + it "returns an archive of #{path.empty? ? '/' : path} @ #{version} from the repo" do + get_resource(user) + + expect(response).to have_gitlab_http_status(:ok) + + entries = entries.map { |e| "#{module_name}@#{version}/#{e}" }.to_set + actual = Set[] + Zip::InputStream.open(StringIO.new(response.body)) do |zip| + while (entry = zip.get_next_entry) + actual.add(entry.name) + end + end + + expect(actual).to eq(entries) + end + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/list' do + context 'for the root module' do + it_behaves_like 'a module version list resource', 'v1.0.1', 'v1.0.2', 'v1.0.3' + end + + context 'for the package' do + it_behaves_like 'a module version list resource', path: '/pkg' + end + + context 'for the submodule' do + it_behaves_like 'a module version list resource', 'v1.0.3', path: '/mod' + end + + context 'for the root module v2' do + it_behaves_like 'a module version list resource', 'v2.0.0', path: '/v2' + end + + context 'with a URL encoded relative path component' do + it_behaves_like 'a missing module version list resource', path: '/%2E%2E%2Fxyz' + end + + context 'with the feature disabled' do + before do + stub_feature_flags(go_proxy: false) + end + + it_behaves_like 'a missing module version list resource' + end + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do + context 'with the root module v1.0.1' do + it_behaves_like 'a module version information resource', 'v1.0.1' + end + + context 'with the submodule v1.0.3' do + it_behaves_like 'a module version information resource', 'v1.0.3', path: '/mod' + end + + context 'with the root module v2.0.0' do + it_behaves_like 'a module version information resource', 'v2.0.0', path: '/v2' + end + + context 'with an invalid path' do + it_behaves_like 'a missing module version information resource', 'v1.0.3', path: '/pkg' + end + + context 'with an invalid version' do + it_behaves_like 'a missing module version information resource', 'v1.0.1', path: '/mod' + end + + context 'with a pseudo-version for v1' do + it_behaves_like 'a module pseudo-version information resource', 'v1.0.4-0.' do + let(:sha) { modules[:sha][0] } + end + end + + context 'with a pseudo-version for v2' do + it_behaves_like 'a module pseudo-version information resource', 'v2.0.0-', path: '/v2' do + let(:sha) { modules[:sha][1] } + end + end + + context 'with a pseudo-version with an invalid timestamp' do + it_behaves_like 'a missing module pseudo-version information resource' do + let(:version) { "v1.0.4-0.00000000000000-#{modules[:sha][0][0..11]}" } + end + end + + context 'with a pseudo-version with an invalid commit sha' do + it_behaves_like 'a missing module pseudo-version information resource' do + let(:sha) { modules[:sha][0] } + let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-000000000000" } + end + end + + context 'with a pseudo-version with a short commit sha' do + it_behaves_like 'a missing module pseudo-version information resource' do + let(:sha) { modules[:sha][0] } + let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{modules[:sha][0][0..10]}" } + end + end + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.mod' do + context 'with the root module v1.0.1' do + it_behaves_like 'a module file resource', 'v1.0.1' + end + + context 'with the submodule v1.0.3' do + it_behaves_like 'a module file resource', 'v1.0.3', path: '/mod' + end + + context 'with the root module v2.0.0' do + it_behaves_like 'a module file resource', 'v2.0.0', path: '/v2' + end + + context 'with an invalid path' do + it_behaves_like 'a missing module file resource', 'v1.0.3', path: '/pkg' + end + + context 'with an invalid version' do + it_behaves_like 'a missing module file resource', 'v1.0.1', path: '/mod' + end + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.zip' do + context 'with the root module v1.0.1' do + it_behaves_like 'a module archive resource', 'v1.0.1', ['README.md', 'go.mod', 'a.go'] + end + + context 'with the root module v1.0.2' do + it_behaves_like 'a module archive resource', 'v1.0.2', ['README.md', 'go.mod', 'a.go', 'pkg/b.go'] + end + + context 'with the root module v1.0.3' do + it_behaves_like 'a module archive resource', 'v1.0.3', ['README.md', 'go.mod', 'a.go', 'pkg/b.go'] + end + + context 'with the submodule v1.0.3' do + it_behaves_like 'a module archive resource', 'v1.0.3', ['go.mod', 'a.go'], path: '/mod' + end + + context 'with the root module v2.0.0' do + it_behaves_like 'a module archive resource', 'v2.0.0', ['go.mod', 'a.go', 'x.go'], path: '/v2' + end + end + + context 'with an invalid module directive' do + let_it_be(:project) { create :project_empty_repo, :public, creator: user } + let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" } + + let_it_be(:modules) do + create(:go_module_commit, :files, project: project, files: { 'a.go' => "package\a" } ) + create(:go_module_commit, :files, project: project, tag: 'v1.0.0', files: { 'go.mod' => "module not/a/real/module\n" }) + create(:go_module_commit, :files, project: project, files: { 'v2/a.go' => "package a\n" } ) + create(:go_module_commit, :files, project: project, tag: 'v2.0.0', files: { 'v2/go.mod' => "module #{base}\n" } ) + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/list' do + context 'with a completely wrong directive for v1' do + it_behaves_like 'a module version list resource' + end + + context 'with a directive omitting the suffix for v2' do + it_behaves_like 'a module version list resource', path: '/v2' + end + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do + context 'with a completely wrong directive for v1' do + it_behaves_like 'a missing module version information resource', 'v1.0.0' + end + + context 'with a directive omitting the suffix for v2' do + it_behaves_like 'a missing module version information resource', 'v2.0.0', path: '/v2' + end + end + end + + context 'with a case sensitive project and versions' do + let_it_be(:project) { create :project_empty_repo, :public, creator: user, path: 'MyGoLib' } + let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" } + let_it_be(:base_encoded) { base.gsub(/[A-Z]/) { |s| "!#{s.downcase}"} } + + let_it_be(:modules) do + create(:go_module_commit, :files, project: project, files: { 'README.md' => "Hi" }) + create(:go_module_commit, :module, project: project, tag: 'v1.0.1-prerelease') + create(:go_module_commit, :package, project: project, tag: 'v1.0.1-Prerelease', path: 'pkg') + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/list' do + let(:resource) { "list" } + + context 'with a case encoded path' do + it_behaves_like 'a module version list resource', 'v1.0.1-prerelease', 'v1.0.1-Prerelease' do + let(:module_name) { base_encoded } + end + end + + context 'without a case encoded path' do + it_behaves_like 'a missing module version list resource' do + let(:module_name) { base.downcase } + end + end + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do + context 'with a case encoded path' do + it_behaves_like 'a module version information resource', 'v1.0.1-Prerelease' do + let(:module_name) { base_encoded } + let(:resource) { "v1.0.1-!prerelease.info" } + end + end + + context 'without a case encoded path' do + it_behaves_like 'a module version information resource', 'v1.0.1-prerelease' do + let(:module_name) { base_encoded } + let(:resource) { "v1.0.1-prerelease.info" } + end + end + end + end + + context 'with a private project' do + let(:module_name) { base } + + before do + project.update(visibility_level: Gitlab::VisibilityLevel::PRIVATE) + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/list' do + let(:resource) { "list" } + + it 'returns ok with an oauth token' do + get_resource(oauth_access_token: oauth) + + expect(response).to have_gitlab_http_status(:ok) + end + + it 'returns ok with a job token' do + get_resource(oauth_access_token: job) + + expect(response).to have_gitlab_http_status(:ok) + end + + it 'returns ok with a personal access token' do + get_resource(personal_access_token: pa_token) + + expect(response).to have_gitlab_http_status(:ok) + end + + it 'returns ok with a personal access token and basic authentication' do + get_resource(headers: build_basic_auth_header(user.username, pa_token.token)) + + expect(response).to have_gitlab_http_status(:ok) + end + + it 'returns unauthorized with no authentication' do + get_resource + + expect(response).to have_gitlab_http_status(:unauthorized) + end + end + end + + context 'with a public project' do + let(:module_name) { base } + + before do + project.update(visibility_level: Gitlab::VisibilityLevel::PUBLIC) + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/list' do + let(:resource) { "list" } + + it 'returns ok with no authentication' do + get_resource + + expect(response).to have_gitlab_http_status(:ok) + end + end + end + + context 'with a non-existent project' do + def get_resource(user = nil, **params) + get api("/projects/not%2fa%2fproject/packages/go/#{base}/@v/list", user, params) + end + + describe 'GET /projects/:id/packages/go/*module_name/@v/list' do + it 'returns not found with a user' do + get_resource(user) + + expect(response).to have_gitlab_http_status(:not_found) + end + + it 'returns not found with an oauth token' do + get_resource(oauth_access_token: oauth) + + expect(response).to have_gitlab_http_status(:not_found) + end + + it 'returns not found with a job token' do + get_resource(oauth_access_token: job) + + expect(response).to have_gitlab_http_status(:not_found) + end + + it 'returns not found with a personal access token' do + get_resource(personal_access_token: pa_token) + + expect(response).to have_gitlab_http_status(:not_found) + end + + it 'returns unauthorized with no authentication' do + get_resource + + expect(response).to have_gitlab_http_status(:unauthorized) + end + end + end + + def get_resource(user = nil, headers: {}, **params) + get api("/projects/#{project.id}/packages/go/#{module_name}/@v/#{resource}", user, params), headers: headers + end + + def fmt_pseudo_version(prefix, commit) + "#{prefix}#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{commit.sha[0..11]}" + end +end |