43 lines
1.9 KiB
Python
43 lines
1.9 KiB
Python
import contextlib
|
|
import importlib.util
|
|
import io
|
|
from pathlib import Path
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
|
|
SCRIPT = Path(__file__).resolve().parents[1] / "skills" / "updating-gitea-repositories" / "scripts" / "credential_win_oauth.py"
|
|
spec = importlib.util.spec_from_file_location("credential_win_oauth_unit_test", SCRIPT)
|
|
vault = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(vault)
|
|
|
|
|
|
class VaultHelperTest(unittest.TestCase):
|
|
def setUp(self):
|
|
self.namespace = "gitea-oauth-" + "a" * 32
|
|
self.fields = {"protocol": "https", "host": "example.invalid", "username": "oauth2",
|
|
"password": "fake-access", "password_expiry_utc": "9999999999", "oauth_refresh_token": "fake-refresh"}
|
|
|
|
def test_empty_namespace_cannot_get_or_store_unverified_identity(self):
|
|
with patch.object(vault, "credential_lock", return_value=contextlib.nullcontext()), \
|
|
patch.object(vault, "read_record", return_value=None), \
|
|
patch.object(vault, "write_record") as write:
|
|
for operation in ("get", "store"):
|
|
with self.subTest(operation=operation), self.assertRaises(vault.VaultError):
|
|
vault.run(self.namespace, operation, self.fields, io.BytesIO())
|
|
write.assert_not_called()
|
|
|
|
def test_refuses_cross_site_refresh_endpoint_before_sending_token(self):
|
|
with patch.object(vault, "oauth_setting", side_effect=["client", "https://other.invalid/token"]), \
|
|
patch.object(vault, "build_opener") as opener, self.assertRaises(vault.VaultError):
|
|
vault.refresh_record("https", "example.invalid", self.fields)
|
|
opener.assert_not_called()
|
|
|
|
def test_missing_context_fails_closed(self):
|
|
with self.assertRaises(vault.VaultError):
|
|
vault.run(self.namespace, "get", {"protocol": "https", "host": "example.invalid"}, io.BytesIO())
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|