gitea: say that a repository made private later is granted only at the next start or by hand, and let one unreadable permission refuse its repository, not the whole pass

modules/gitea/test/tools-account.test.ts

@@ -28,7 +28,7 @@ interface Team { id: number; name: string; units: any; members: Set<string> }
 
 interface ForgeRepo { owner: string; name: string; full: string; private: boolean; archived?: boolean; ownerVisibility: string; collaborators: Map<string, string> }
 const forgeRepos: ForgeRepo[] = [];
-const repoFaults = { refuse: new Set<string>() };
+const repoFaults = { refuse: new Set<string>(), permission: new Set<string>() };
 function addRepo(full: string, isPrivate: boolean, ownerVisibility = "public"): ForgeRepo {
   const [owner, name] = full.split("/");
   const r = { owner, name, full, private: isPrivate, ownerVisibility, collaborators: new Map<string, string>() };
@@ -209,6 +209,7 @@ function fakeForge() {
       if (req.method === "GET" && !m[3]) return json(res, 200, repoJSON(repo));
       const user = decodeURIComponent(m[3] ?? "");
       if (req.method === "GET" && m[4]) {
+        if (repoFaults.permission.has(repo.full)) return json(res, 500, { message: "the forge is not well" });
         if (!isAdmin(me) && me !== user) return json(res, 403, { message: "only the user or an administrator" });
         return json(res, 200, { permission: permissionOf(user, repo) });
       }
@@ -511,16 +512,18 @@ test("on the forge's events: a repository made is granted read at once, a known
   const readAll = new ReadAll(GiteaAdmin.fromEnv(env), TOOLS_ACCOUNT, (l: string) => lines.push(l));
   await readAll.atStart();
 
-  const cases: { name: string; event: string; repo: string; make?: boolean; refuse?: boolean; asks: boolean; reads: string }[] = [
+  const cases: { name: string; event: string; repo: string; make?: boolean; refuse?: boolean; unanswered?: boolean; asks: boolean; reads: string }[] = [
     { name: "a repository made", event: "forge.repository.created", repo: "jschoubben/new-private", make: true, asks: true, reads: "read" },
     { name: "a fork made", event: "forge.fork", repo: "someone/fork", make: true, asks: true, reads: "read" },
     { name: "a push to a repository seen readable", event: "forge.push", repo: "jschoubben/txt-game", asks: false, reads: "read" },
     { name: "a push to a private repository never seen", event: "forge.push", repo: "jschoubben/quiet", make: true, asks: true, reads: "read" },
     { name: "a repository the forge refuses the grant on", event: "forge.repository.created", repo: "jschoubben/stuck", make: true, refuse: true, asks: true, reads: "none" },
+    { name: "a repository whose permission the forge will not answer", event: "forge.repository.created", repo: "jschoubben/mute", make: true, unanswered: true, asks: true, reads: "none" },
   ];
   for (const c of cases) {
     if (c.make) addRepo(c.repo, true);
     if (c.refuse) repoFaults.refuse.add(c.repo);
+    if (c.unanswered) repoFaults.permission.add(c.repo);
     const from = forge.calls.length;
     const [owner, repo] = c.repo.split("/");
     await readAll.onEvent({ name: c.event, body: { owner, repo } });
@@ -531,5 +534,14 @@ test("on the forge's events: a repository made is granted read at once, a known
   const named = await (readAllTools(() => readAll)[1].run({ repositories: ["jschoubben/stuck"] })) as any;
   assert.deepEqual(named.refused.map((x: any) => x.repository), ["jschoubben/stuck"]);
   await assert.rejects(readAllTools(() => readAll)[1].run({ repositories: ["no-slash"] }), /not a repository/);
+  assert.match(lines.join("\n"), /could not be given read on jschoubben\/mute — its permission could not be read — .*500/);
+  // A whole pass goes past the repository it cannot judge: every other one is still granted, and the listing names it.
+  addRepo("jschoubben/after-mute", true);
+  const pass = await readAll.grant();
+  assert.ok(pass.granted.includes("jschoubben/after-mute"), "the pass did not stop at the repository it could not judge");
+  assert.ok(pass.refused.some((x: any) => x.repository === "jschoubben/mute" && /permission could not be read/.test(x.why)));
+  const listed = await readAllTools(() => readAll)[0].run({}) as any;
+  assert.equal(listed.unreadable.find((u: any) => u.repository === "jschoubben/mute").permission, "unknown");
   repoFaults.refuse.clear();
+  repoFaults.permission.clear();
 });