56 lines
2.5 KiB
Python
56 lines
2.5 KiB
Python
"""A browser OAuth credential is stored only after account and Git checks."""
|
|
import importlib.util
|
|
from pathlib import Path
|
|
import sys
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
|
|
SCRIPTS = Path(__file__).resolve().parents[1] / "skills" / "updating-gitea-repositories" / "scripts"
|
|
sys.path.insert(0, str(SCRIPTS))
|
|
spec = importlib.util.spec_from_file_location("credential_oauth_bootstrap_test", SCRIPTS / "credential_oauth_bootstrap.py")
|
|
bootstrap = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(bootstrap)
|
|
|
|
|
|
class BootstrapTest(unittest.TestCase):
|
|
def setUp(self):
|
|
self.fields = {"username": "oauth2", "password": "fake-access", "password_expiry_utc": "9999999999", "oauth_refresh_token": "fake-refresh"}
|
|
self.namespace = "gitea-oauth-" + "a" * 32
|
|
self.store = {}
|
|
|
|
def run_bootstrap(self, api="matched_account", git="read_advertisement", occupied=False):
|
|
reads = ([{"existing": "entry"}] if occupied else [None, self.fields])
|
|
with patch.object(bootstrap.probe, "check_requests", side_effect=[(api, "ignored"), ("ignored", git)]), \
|
|
patch.object(bootstrap.vault, "read_record", side_effect=reads), \
|
|
patch.object(bootstrap.vault, "write_record") as write:
|
|
try:
|
|
bootstrap.persist_verified("https://example.invalid", "alice", "https://example.invalid/team/repo.git", self.fields, self.namespace, object())
|
|
finally:
|
|
self.store["write"] = write.call_count
|
|
|
|
def test_saves_after_matching_identity_and_git_read(self):
|
|
self.run_bootstrap()
|
|
self.assertEqual(self.store["write"], 1)
|
|
|
|
def test_rejects_wrong_identity_or_denied_git_without_storing(self):
|
|
for api, git in [("identity_mismatch_or_unexpected_response", "read_advertisement"), ("matched_account", "http_401")]:
|
|
with self.subTest(api=api, git=git), self.assertRaises(bootstrap.BootstrapError):
|
|
self.run_bootstrap(api, git)
|
|
self.assertEqual(self.store["write"], 0)
|
|
|
|
def test_refuses_to_replace_an_existing_vault_entry(self):
|
|
with self.assertRaises(bootstrap.BootstrapError):
|
|
self.run_bootstrap(occupied=True)
|
|
self.assertEqual(self.store["write"], 0)
|
|
|
|
def test_rejects_incomplete_refreshable_credential(self):
|
|
del self.fields["oauth_refresh_token"]
|
|
with self.assertRaises(bootstrap.BootstrapError):
|
|
self.run_bootstrap()
|
|
self.assertEqual(self.store["write"], 0)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|