jschoubben
32655b95f6
The four share files (index.ts, module.json, guard.test.ts), so they land as one commit. GIT1: seat.ts serves pull, open-pulls, tags, trees, file, contains, statuses, status, comment, view, note, merge-pull as tools on the seat, each answering the contract's shape and an error of kind refused, not-found or failed; a comment, view or note whose act id is held is answered held (note matched by id). merge-pull merges the head the caller names (its from-G judgements are GIT6, GIT7, GIT9). GIT2: seatevents.ts says pull-updated, pull-merged, pull-closed, forge-pull, forge-status, forge-delete and repo-writable on mesh.seat.git.event.<event>; the module's emits drop them. GIT3: merge.ts, check.ts, the acting tools, the owed watch, the gate's source read and check-gates-merge are gone. GIT10: catalog.ts follows the seat mesh-catalog (revision, catalog-revision); no write is granted before the first view. Builds: design 47 G §310, §311, §312, §313, §314, §163, §317, §278, §321, §196 Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
734 lines
49 KiB
TypeScript
734 lines
49 KiB
TypeScript
// The forge's tools act as an account of their own, not the site administrator (novox/hq ADR 0365 §2, issue 469):
|
|
// the token the tools and the watcher use is minted for `mesh-tools`, a plain account made by the module with the
|
|
// administrator's login and given write on the mesh's repositories through one team; the administrator's own
|
|
// token by that name goes; a token kept from before, the administrator's, is minted again for the account.
|
|
//
|
|
// The forge is a fake that keeps accounts, their tokens and the organisation's teams apart, and answers as gitea
|
|
// does: an administrator may mint for another account (reqSelfOrAdmin), anyone else only for itself; a protection
|
|
// edit needs the repository's administration, which neither a plain account nor its write team holds.
|
|
|
|
import { test, after } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
|
|
import { mkdtemp, readFile, writeFile, mkdir } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
|
|
import { MintedToken, TOKEN_SCOPES } from "../dist/token.js";
|
|
import { GiteaClient } from "../dist/client.js";
|
|
import { TOOLS_ACCOUNT, TOOLS_TEAM_UNITS, BUILDER_ACCOUNT, AGENT_ACCOUNT, meshAccounts } from "../dist/tools-account.js";
|
|
import { PACKAGES_ACCOUNT, PACKAGES_TEAM_UNITS, PACKAGES_TOKEN_REFUSED, keepPackagesToken, packagesToken, renewOnRefusal } from "../dist/packages-account.js";
|
|
|
|
const ADMIN = "mesh-admin";
|
|
const PASSWORD = "the-vault-minted-this";
|
|
|
|
interface Account { admin: boolean; password: string; active: boolean }
|
|
interface Token { id: number; name: string; sha1: string; user: string; scopes: string[] }
|
|
interface Team { id: number; name: string; units: any; members: Set<string> }
|
|
|
|
interface ForgeRepo { owner: string; name: string; full: string; private: boolean; archived?: boolean; ownerVisibility: string; collaborators: Map<string, string> }
|
|
const forgeRepos: ForgeRepo[] = [];
|
|
const userRules = new Map<string, any>();
|
|
const repoFaults = { refuse: new Set<string>(), permission: new Set<string>() };
|
|
function addRepo(full: string, isPrivate: boolean, ownerVisibility = "public"): ForgeRepo {
|
|
const [owner, name] = full.split("/");
|
|
const r = { owner, name, full, private: isPrivate, ownerVisibility, collaborators: new Map<string, string>() };
|
|
forgeRepos.push(r);
|
|
return r;
|
|
}
|
|
const repoJSON = (r: ForgeRepo) => ({ full_name: r.full, name: r.name, owner: { login: r.owner, visibility: r.ownerVisibility },
|
|
private: r.private, archived: r.archived === true });
|
|
|
|
function fakeForge() {
|
|
const users = new Map<string, Account>([[ADMIN, { admin: true, password: PASSWORD, active: true }]]);
|
|
const tokens: Token[] = [];
|
|
const teams: Team[] = [];
|
|
const calls: string[] = [];
|
|
// The organisation's repositories, and the rule each has for main, which the administrator's setup puts right
|
|
// (issue 948, ADR 0398 §2).
|
|
const repos = ["hq", "mesh-catalog", "globbed"];
|
|
const globRules = new Map<string, any[]>([["globbed", [{ rule_name: "m*", enable_status_check: true,
|
|
status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"], block_admin_merge_override: true, required_approvals: 1 }]]]);
|
|
const mainRules = new Map<string, any>([["hq", { rule_name: "main", enable_status_check: true, status_check_contexts: ["mesh/merge-gate"] }]]);
|
|
// What the forge does wrong when a test says so: a token mint or delete it fails, a team another process made
|
|
// between this one's look and its create (gitea answers the create 422).
|
|
const faults = { mint: false, deleteToken: false, teamRace: false };
|
|
let next = 0;
|
|
const json = (res: ServerResponse, status: number, body: unknown): void => {
|
|
res.writeHead(status, { "Content-Type": "application/json" });
|
|
res.end(body === null ? "" : JSON.stringify(body));
|
|
};
|
|
const read = (req: IncomingMessage): Promise<any> =>
|
|
new Promise((resolve) => {
|
|
let t = "";
|
|
req.on("data", (c) => (t += c));
|
|
req.on("end", () => resolve(t ? JSON.parse(t) : null));
|
|
});
|
|
const who = (req: IncomingMessage): string | null => {
|
|
const h = req.headers.authorization ?? "";
|
|
if (h.startsWith("Basic ")) {
|
|
const [u, p] = Buffer.from(h.slice(6), "base64").toString().split(":");
|
|
return users.get(u)?.password === p ? u : null;
|
|
}
|
|
if (h.startsWith("token ")) return tokens.find((t) => t.sha1 === h.slice(6))?.user ?? null;
|
|
return null;
|
|
};
|
|
const isAdmin = (u: string | null) => u !== null && users.get(u)?.admin === true;
|
|
const permissionOf = (u: string | null, r: ForgeRepo): string => {
|
|
if (isAdmin(u)) return "admin";
|
|
if (u === r.owner) return "owner";
|
|
if (r.owner === "novox" && teams.some((t) => t.members.has(u ?? "") && t.units.units_map?.["repo.code"] === "write")) return "write";
|
|
if (u && r.collaborators.has(u)) return r.collaborators.get(u)!;
|
|
return !r.private && r.ownerVisibility === "public" ? "read" : "none";
|
|
};
|
|
|
|
const server = createServer(async (req, res) => {
|
|
const url = new URL(req.url ?? "/", "http://fake");
|
|
const p = url.pathname.replace(/^\/api\/v1/, "");
|
|
const me = url.searchParams.has("sudo") && isAdmin(who(req)) ? url.searchParams.get("sudo") : who(req);
|
|
calls.push(`${req.method} ${p} as ${me}`);
|
|
if (me === null) return json(res, 401, { message: "unauthorized" });
|
|
|
|
let m = p.match(/^\/users\/([^/]+)\/tokens(?:\/(\d+))?$/);
|
|
if (m) {
|
|
const owner = decodeURIComponent(m[1]);
|
|
if (!(req.headers.authorization ?? "").startsWith("Basic ")) return json(res, 401, { message: "basic auth required" });
|
|
if (owner !== me && !isAdmin(me)) return json(res, 403, { message: "reqSelfOrAdmin" });
|
|
if (!users.has(owner)) return json(res, 404, { message: "user does not exist" });
|
|
if (req.method === "POST") {
|
|
if (faults.mint) return json(res, 500, { message: "the forge is not well" });
|
|
const { name, scopes } = await read(req);
|
|
if (tokens.some((t) => t.user === owner && t.name === name)) return json(res, 400, { message: "token name has already been used" });
|
|
const t = { id: ++next, name, sha1: `sha-${owner}-${next}`, user: owner, scopes };
|
|
tokens.push(t);
|
|
return json(res, 201, { id: t.id, name, sha1: t.sha1, scopes });
|
|
}
|
|
if (req.method === "GET") {
|
|
const page = Number(url.searchParams.get("page") ?? "1");
|
|
const mine = tokens.filter((t) => t.user === owner);
|
|
return json(res, 200, page === 1 ? mine.map((t) => ({ id: t.id, name: t.name, sha1: "" })) : []);
|
|
}
|
|
if (req.method === "DELETE" && m[2]) {
|
|
if (faults.deleteToken && owner === ADMIN) return json(res, 500, { message: "the forge is not well" });
|
|
const i = tokens.findIndex((t) => t.user === owner && t.id === Number(m![2]));
|
|
if (i < 0) return json(res, 404, { message: "not found" });
|
|
tokens.splice(i, 1);
|
|
return json(res, 204, null);
|
|
}
|
|
}
|
|
if (req.method === "GET" && p === "/user") return json(res, 200, { login: me, is_admin: isAdmin(me) });
|
|
// The organisation's packages: a token whose scope reaches packages, of a member of a team writing them.
|
|
if (req.method === "GET" && p === "/packages/novox") {
|
|
const scopes = tokens.find((t) => `token ${t.sha1}` === req.headers.authorization)?.scopes ?? [];
|
|
if (!scopes.some((s) => /:package$/.test(s))) return json(res, 403, { message: "token does not have at least one of required scope(s): [read:package]" });
|
|
if (!teams.some((t) => t.members.has(me) && t.units.units_map?.["repo.packages"] === "write")) return json(res, 403, { message: "no access to the packages" });
|
|
return json(res, 200, []);
|
|
}
|
|
m = p.match(/^\/users\/([^/]+)$/);
|
|
if (m && req.method === "GET") {
|
|
const u = users.get(decodeURIComponent(m[1]));
|
|
if (!u) return json(res, 404, { message: "user does not exist" });
|
|
return json(res, 200, { login: m[1], is_admin: u.admin, active: u.active, prohibit_login: false });
|
|
}
|
|
if (p.startsWith("/admin/") && !isAdmin(me)) return json(res, 403, { message: "must be a site administrator" });
|
|
if (req.method === "POST" && p === "/admin/users") {
|
|
const b = await read(req);
|
|
if (users.has(b.username)) return json(res, 422, { message: "user already exists" });
|
|
if (!b.password || b.password.length < 8) return json(res, 422, { message: "password is too short" });
|
|
users.set(b.username, { admin: b.admin === true, password: b.password, active: true });
|
|
return json(res, 201, { login: b.username, is_admin: b.admin === true });
|
|
}
|
|
m = p.match(/^\/admin\/users\/([^/]+)$/);
|
|
if (m && req.method === "PATCH") {
|
|
const u = users.get(decodeURIComponent(m[1]));
|
|
if (!u) return json(res, 404, { message: "user does not exist" });
|
|
const b = await read(req);
|
|
if (b.admin !== undefined) u.admin = b.admin;
|
|
if (b.active !== undefined) u.active = b.active;
|
|
return json(res, 200, { login: m[1], is_admin: u.admin });
|
|
}
|
|
if (p === "/orgs/novox/teams") {
|
|
if (!isAdmin(me)) return json(res, 403, { message: "must be an owner of the organisation" });
|
|
if (req.method === "GET") return json(res, 200, teams.map((t) => ({ id: t.id, name: t.name })));
|
|
const b = await read(req);
|
|
const t = { id: ++next, name: b.name, units: b, members: new Set<string>() };
|
|
teams.push(t);
|
|
if (faults.teamRace) return json(res, 422, { message: "team already exists" });
|
|
return json(res, 201, { id: t.id, name: t.name });
|
|
}
|
|
m = p.match(/^\/teams\/(\d+)(?:\/members\/([^/]+))?$/);
|
|
if (m) {
|
|
if (!isAdmin(me)) return json(res, 403, { message: "must be an owner of the organisation" });
|
|
const t = teams.find((x) => x.id === Number(m![1]));
|
|
if (!t) return json(res, 404, { message: "team does not exist" });
|
|
if (req.method === "PATCH") { t.units = await read(req); return json(res, 200, { id: t.id }); }
|
|
if (req.method === "PUT" && m[2]) { t.members.add(decodeURIComponent(m[2])); return json(res, 204, null); }
|
|
}
|
|
if (req.method === "GET" && p === "/orgs/novox/repos") {
|
|
if (!isAdmin(me)) return json(res, 403, { message: "must be an owner of the organisation" });
|
|
return json(res, 200, url.searchParams.get("page") === "1" ? repos.map((name) => ({ name })) : []);
|
|
}
|
|
// Repository administration: a site administrator, or a team member whose team administers the repository.
|
|
m = p.match(/^\/repos\/novox\/([^/]+)\/branches\/(.+)$/);
|
|
if (m && req.method === "GET") {
|
|
if (m[2] === "main") return json(res, 200, { name: "main", protected: true, effective_branch_protection_name: "main",
|
|
enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"], user_can_push: false });
|
|
if (m[2] === "feat/unguarded") return json(res, 200, { name: m[2], protected: false });
|
|
return json(res, 404, { message: "branch does not exist" });
|
|
}
|
|
// A repository of a user: its rules are its administrator's (a site administrator, or a collaborator with admin).
|
|
m = p.match(/^\/repos\/(?!novox\/)([^/]+)\/([^/]+)\/branch_protections(?:\/(.*))?$/);
|
|
if (m) {
|
|
const key = `${m[1]}/${m[2]}`;
|
|
const repo = forgeRepos.find((r) => r.full === key);
|
|
if (!repo || !["admin", "owner"].includes(permissionOf(me, repo))) return json(res, 403, { message: "user should be an owner or a collaborator with admin write of a repository" });
|
|
if (req.method === "GET" && m[3] === undefined) return json(res, 200, userRules.has(key) ? [userRules.get(key)] : []);
|
|
// As gitea does: a whitelist login that cannot write the repository is dropped, and the write still answered.
|
|
const keep = (b: any) => (Array.isArray(b.merge_whitelist_usernames)
|
|
? { ...b, merge_whitelist_usernames: b.merge_whitelist_usernames.filter((u: string) => ["write", "admin", "owner"].includes(permissionOf(u, repo))) } : b);
|
|
if (req.method === "PATCH" && m[3] === "main") {
|
|
if (!userRules.has(key)) return json(res, 404, { message: "branch protection does not exist" });
|
|
Object.assign(userRules.get(key), keep(await read(req)));
|
|
return json(res, 200, userRules.get(key));
|
|
}
|
|
if (req.method === "POST") { const b = keep(await read(req)); userRules.set(key, b); return json(res, 201, b); }
|
|
}
|
|
// gitea's reqAdmin on the whole group: reading the rules is administration too.
|
|
m = p.match(/^\/repos\/novox\/([^/]+)\/branch_protections(?:\/(.*))?$/);
|
|
if (m) {
|
|
const admins = isAdmin(me) || teams.some((t) => t.members.has(me) && t.units.permission === "admin");
|
|
if (!admins) return json(res, 403, { message: "user should be an owner or a collaborator with admin write of a repository" });
|
|
if (req.method === "GET" && m[2] === undefined) {
|
|
return json(res, 200, [...(mainRules.has(m[1]) ? [mainRules.get(m[1])] : []), ...(globRules.get(m[1]) ?? [])]);
|
|
}
|
|
if (req.method === "PATCH" && m[2] === "main") {
|
|
const rule = mainRules.get(m[1]);
|
|
if (!rule) return json(res, 404, { message: "branch protection does not exist" });
|
|
Object.assign(rule, await read(req));
|
|
return json(res, 200, rule);
|
|
}
|
|
if (req.method === "POST" && p.endsWith("/branch_protections")) {
|
|
const b = await read(req);
|
|
mainRules.set(m[1], b);
|
|
return json(res, 201, b);
|
|
}
|
|
return json(res, 201, { rule_name: "main" });
|
|
}
|
|
m = p.match(/^\/repos\/novox\/([^/]+)\/statuses\/([0-9a-f]+)$/);
|
|
if (m && req.method === "POST") {
|
|
const writes = isAdmin(me) || teams.some((t) => t.members.has(me) && t.units.units_map?.["repo.code"] === "write");
|
|
if (!writes) return json(res, 403, { message: "write on code required" });
|
|
return json(res, 201, { context: (await read(req)).context, creator: { login: me } });
|
|
}
|
|
// Every repository of every owner, and who reads it (readall.ts): the site administrator reads all; the tools' account
|
|
// a repository of novox through its team, a public one of a public owner, and one it is a collaborator of.
|
|
if (req.method === "GET" && p === "/repos/search") {
|
|
const page = Number(url.searchParams.get("page") ?? "1");
|
|
const seen = forgeRepos.filter((r) => permissionOf(me, r) !== "none");
|
|
return json(res, 200, { data: page === 1 ? seen.map(repoJSON) : [] });
|
|
}
|
|
m = p.match(/^\/repos\/([^/]+)\/([^/]+)(?:\/collaborators\/([^/]+)(\/permission)?)?$/);
|
|
if (m) {
|
|
const repo = forgeRepos.find((r) => r.owner === decodeURIComponent(m![1]) && r.name === decodeURIComponent(m![2]));
|
|
if (repo && req.method === "GET" && !m[3] && url.searchParams.has("sudo") && repoFaults.permission.has(repo.full)) return json(res, 500, { message: "the forge is not well" });
|
|
if (!repo || permissionOf(me, repo) === "none") return json(res, 404, { message: "repository does not exist" });
|
|
if (req.method === "GET" && !m[3]) {
|
|
const mine = permissionOf(me, repo);
|
|
return json(res, 200, { ...repoJSON(repo), permissions: { pull: true, push: ["write", "admin", "owner"].includes(mine), admin: ["admin", "owner"].includes(mine) } });
|
|
}
|
|
const user = decodeURIComponent(m[3] ?? "");
|
|
if (req.method === "GET" && m[4]) {
|
|
if (repoFaults.permission.has(repo.full)) return json(res, 500, { message: "the forge is not well" });
|
|
if (!isAdmin(me) && me !== user) return json(res, 403, { message: "only the user or an administrator" });
|
|
// As gitea answers: the collaborator's own permission, not what a team gives the account.
|
|
return json(res, 200, { permission: repo.collaborators.get(user) ?? "read" });
|
|
}
|
|
if (req.method === "PUT" && !m[4]) {
|
|
// gitea's reqAdmin: the repository's administration, which on a repository of another user the site administrator alone holds.
|
|
if (!isAdmin(me) && me !== repo.owner) return json(res, 403, { message: "user should be an owner or a collaborator with admin write of a repository" });
|
|
if (repoFaults.refuse.has(repo.full)) return json(res, 422, { message: "the forge would not have it" });
|
|
repo.collaborators.set(user, (await read(req))?.permission ?? "write");
|
|
return json(res, 204, null);
|
|
}
|
|
}
|
|
return json(res, 404, { message: "no such route in the fake" });
|
|
});
|
|
return new Promise<{ url: string; users: typeof users; tokens: typeof tokens; teams: typeof teams; calls: string[]; mainRules: typeof mainRules;
|
|
faults: typeof faults; close(): Promise<void> }>((resolve) => {
|
|
server.listen(0, "127.0.0.1", () => {
|
|
const { port } = server.address() as { port: number };
|
|
resolve({ url: `http://127.0.0.1:${port}`, users, tokens, teams, calls, faults, mainRules,
|
|
close: () => new Promise((r) => server.close(() => r())) });
|
|
});
|
|
});
|
|
}
|
|
|
|
const forge = await fakeForge();
|
|
after(() => forge.close());
|
|
|
|
async function environment(keepMainRules = false): Promise<NodeJS.ProcessEnv & { MESH_GITEA_STATE_DIR: string }> {
|
|
const dir = await mkdtemp(join(tmpdir(), "gitea-tools-account-"));
|
|
const passwordFile = join(dir, "admin.secret");
|
|
await writeFile(passwordFile, PASSWORD + "\n", { mode: 0o600 });
|
|
const config = join(dir, "config.json");
|
|
await writeFile(config, JSON.stringify({ "keep-main-rules": keepMainRules }));
|
|
return {
|
|
MESH_GITEA_CONFIG_FILE: config,
|
|
MESH_GITEA_URL: forge.url,
|
|
MESH_GITEA_ADMIN_USER: ADMIN,
|
|
MESH_GITEA_ADMIN_PASSWORD_FILE: passwordFile,
|
|
MESH_GITEA_STATE_DIR: join(dir, "state"),
|
|
};
|
|
}
|
|
|
|
/** A source as a fresh process builds it from the manifest's environment (fromEnv shares one per file). */
|
|
function fresh(env: NodeJS.ProcessEnv): GiteaClient {
|
|
return GiteaClient.fromEnv(env);
|
|
}
|
|
|
|
test("the tools' token is minted for an account of their own, which is no administrator and writes through its team", async () => {
|
|
const env = await environment();
|
|
await fresh(env).listRepos();
|
|
|
|
const account = forge.users.get(TOOLS_ACCOUNT);
|
|
assert.ok(account, "the module made the tools' account");
|
|
assert.equal(account!.admin, false, "the tools' account is no administrator");
|
|
const held = forge.tokens.filter((t) => t.name === "mesh-tools");
|
|
assert.deepEqual(held.map((t) => t.user), [TOOLS_ACCOUNT], "the one token is the tools' account's, none is the administrator's");
|
|
assert.equal(await readFile(join(env.MESH_GITEA_STATE_DIR, "token"), "utf8"), held[0].sha1 + "\n");
|
|
|
|
const team = forge.teams.find((t) => t.name === "mesh-tools");
|
|
assert.ok(team, "the team is made in the mesh's organisation");
|
|
assert.ok(team!.members.has(TOOLS_ACCOUNT));
|
|
assert.equal(team!.units.permission, "write");
|
|
assert.equal(team!.units.includes_all_repositories, true);
|
|
assert.equal(team!.units.can_create_org_repo, false, "a repository's maker would administer it");
|
|
assert.deepEqual(team!.units.units_map, TOOLS_TEAM_UNITS.units_map);
|
|
assert.ok(!Object.values(team!.units.units_map).includes("admin"));
|
|
});
|
|
|
|
test("with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard", async () => {
|
|
const env = await environment();
|
|
const client = fresh(env);
|
|
await client.setCommitStatus("novox", "hq", "abc123def4567890abc123def4567890abc12345", { state: "success", context: "mesh/merge-gate", description: "ok" } as any);
|
|
await assert.rejects(
|
|
client.setBranchProtection("novox", "hq", "main", {}),
|
|
/403/,
|
|
);
|
|
});
|
|
|
|
test("what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not", async () => {
|
|
const env = await environment();
|
|
const client = fresh(env);
|
|
await assert.rejects(client.branchProtections("novox", "hq"), /403/);
|
|
const rule = await client.appliedProtection("novox", "hq", "main");
|
|
assert.deepEqual(rule?.status_check_contexts, ["mesh/merge-gate", "mesh/repo-check"]);
|
|
assert.equal(rule?.enable_status_check, true);
|
|
assert.equal(rule?.rule_name, "main");
|
|
assert.equal(await client.appliedProtection("novox", "hq", "feat/unguarded"), null);
|
|
assert.equal(await client.appliedProtection("novox", "hq", "no/such-branch"), null);
|
|
});
|
|
|
|
test("the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one", async () => {
|
|
const env = await environment();
|
|
// What the module kept before ADR 0365: a token of the administrator's own, by the same name, its scopes beside it.
|
|
const old = { id: 900, name: "mesh-tools", sha1: "sha-admin-old", user: ADMIN, scopes: ["write:repository", "write:issue", "read:user"] };
|
|
forge.tokens.push(old);
|
|
await mkdir(env.MESH_GITEA_STATE_DIR, { recursive: true });
|
|
await writeFile(join(env.MESH_GITEA_STATE_DIR, "token"), old.sha1 + "\n", { mode: 0o600 });
|
|
await writeFile(join(env.MESH_GITEA_STATE_DIR, "token.scopes"), "read:user,write:issue,write:repository\n", { mode: 0o600 });
|
|
|
|
await fresh(env).listRepos();
|
|
|
|
assert.ok(!forge.tokens.some((t) => t.user === ADMIN), "the administrator holds no tools' token any more");
|
|
const kept = (await readFile(join(env.MESH_GITEA_STATE_DIR, "token"), "utf8")).trim();
|
|
assert.notEqual(kept, old.sha1);
|
|
assert.equal(forge.tokens.find((t) => t.sha1 === kept)?.user, TOOLS_ACCOUNT);
|
|
assert.match(await readFile(join(env.MESH_GITEA_STATE_DIR, "token.scopes"), "utf8"), / for mesh-tools\n$/);
|
|
});
|
|
|
|
test("a tools' account someone made an administrator is made a plain account again at the next mint", async () => {
|
|
const env = await environment();
|
|
forge.users.get(TOOLS_ACCOUNT)!.admin = true;
|
|
await fresh(env).listRepos();
|
|
assert.equal(forge.users.get(TOOLS_ACCOUNT)!.admin, false);
|
|
});
|
|
|
|
test("the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused", async () => {
|
|
const env = await environment();
|
|
assert.throws(() => MintedToken.fromEnv(forge.url, { ...env, MESH_GITEA_TOOLS_USER: ADMIN }), /names the admin account/);
|
|
});
|
|
|
|
test("the manifest hands the tools their account, and the Go forge bundle holds no administrator password", async () => {
|
|
const manifest = JSON.parse(await readFile(new URL("../module.json", import.meta.url), "utf8"));
|
|
const code = manifest.build.artifacts.find((a: any) => a.name === "code");
|
|
assert.equal(code.env.MESH_GITEA_TOOLS_USER, TOOLS_ACCOUNT);
|
|
// The Go forge bundle reads the token the tools' account holds, never the administrator's password.
|
|
const forgeBundle = manifest.build.artifacts.find((a: any) => a.name === "forge");
|
|
assert.ok(forgeBundle.env.MESH_GITEA_TOKEN_FILE);
|
|
assert.equal(forgeBundle.env.MESH_GITEA_ADMIN_PASSWORD_FILE, undefined);
|
|
// The package registry's bundle reads with the tools' token and writes with the packages account's (design 51).
|
|
const packages = manifest.build.artifacts.find((a: any) => a.name === "package-registry");
|
|
assert.equal(packages.env.MESH_GITEA_TOKEN_FILE, forgeBundle.env.MESH_GITEA_TOKEN_FILE);
|
|
assert.equal(packages.env.MESH_GITEA_PACKAGES_USER, PACKAGES_ACCOUNT);
|
|
assert.match(packages.env.MESH_GITEA_PACKAGES_TOKEN_FILE, /^\$\{dir:runtime-state\}\/packages-token$/);
|
|
assert.equal(packages.env.MESH_GITEA_ADMIN_PASSWORD_FILE, undefined);
|
|
assert.equal(code.env.MESH_GITEA_STATE_DIR, "${dir:runtime-state}", "the watcher mints the packages token where the bundle reads it");
|
|
});
|
|
|
|
test("the package seats write as an account of their own: plain, in a team writing only packages, its token write:package alone, renewed when the forge rejects it", async () => {
|
|
const env = await environment();
|
|
const source = packagesToken(forge.url, env, () => {});
|
|
assert.equal(await keepPackagesToken(source, forge.url), "the package seats' write token holds");
|
|
const account = forge.users.get(PACKAGES_ACCOUNT);
|
|
assert.ok(account, "the module made the packages account");
|
|
assert.equal(account!.admin, false, "the packages account is no administrator");
|
|
const held = forge.tokens.filter((t) => t.name === "mesh-packages");
|
|
assert.deepEqual(held.map((t) => [t.user, t.scopes]), [[PACKAGES_ACCOUNT, ["write:package"]]]);
|
|
assert.equal(await readFile(join(env.MESH_GITEA_STATE_DIR, "packages-token"), "utf8"), held[0].sha1 + "\n");
|
|
assert.equal(await readFile(join(env.MESH_GITEA_STATE_DIR, "packages-token.scopes"), "utf8"), "write:package for mesh-packages\n");
|
|
const team = forge.teams.find((t) => t.name === "mesh-packages");
|
|
assert.ok(team?.members.has(PACKAGES_ACCOUNT));
|
|
assert.deepEqual(team!.units.units_map, PACKAGES_TEAM_UNITS.units_map, "the team writes packages and nothing else");
|
|
// The forge drops the token behind the module's back: the Go bundle's refusal (the finding's put) mints it afresh and
|
|
// clears the finding; no timer looks at it, and another key of the findings state is not its own.
|
|
forge.tokens.splice(forge.tokens.indexOf(held[0]), 1);
|
|
const cleared: string[] = [];
|
|
const said: string[] = [];
|
|
const renew = renewOnRefusal(source, forge.url, { delete: async (k) => { cleared.push(k); } }, (l) => said.push(l));
|
|
await renew({ key: "seat.gitea.other", op: "put" });
|
|
await renew({ key: PACKAGES_TOKEN_REFUSED, op: "delete" });
|
|
assert.equal(forge.tokens.filter((t) => t.name === "mesh-packages").length, 0, "nothing renews but the refusal");
|
|
await renew({ key: PACKAGES_TOKEN_REFUSED, op: "put" });
|
|
assert.deepEqual(said, ["the forge rejected the package seats' write token; minted afresh"]);
|
|
assert.deepEqual(cleared, [PACKAGES_TOKEN_REFUSED]);
|
|
assert.equal(forge.tokens.filter((t) => t.name === "mesh-packages").length, 1);
|
|
// The tools' token reads packages too: read:package (design 51's read-only tool token).
|
|
assert.ok(TOKEN_SCOPES.includes("read:package"));
|
|
});
|
|
|
|
// Review of issue 469: what reads the rules' list is moved to the branch, and nothing leaves the tools without a token.
|
|
|
|
test("a mint that fails leaves the administrator's old token in place: the tools are never left without one", async () => {
|
|
const env = await environment();
|
|
const old = { id: 901, name: "mesh-tools", sha1: "sha-admin-kept", user: ADMIN, scopes: ["read:user"] };
|
|
forge.tokens.push(old);
|
|
forge.faults.mint = true;
|
|
try {
|
|
await assert.rejects(fresh(env).listRepos(), /500/);
|
|
} finally {
|
|
forge.faults.mint = false;
|
|
}
|
|
assert.ok(forge.tokens.some((t) => t.sha1 === old.sha1), "the admin's token was deleted before a new one was kept");
|
|
forge.tokens.splice(forge.tokens.indexOf(old), 1);
|
|
});
|
|
|
|
test("an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start", async () => {
|
|
const env = await environment();
|
|
const old = { id: 902, name: "mesh-tools", sha1: "sha-admin-stuck", user: ADMIN, scopes: ["read:user"] };
|
|
forge.tokens.push(old);
|
|
forge.faults.deleteToken = true;
|
|
try {
|
|
await fresh(env).listRepos();
|
|
} finally {
|
|
forge.faults.deleteToken = false;
|
|
}
|
|
const kept = (await readFile(join(env.MESH_GITEA_STATE_DIR, "token"), "utf8")).trim();
|
|
assert.equal(forge.tokens.find((t) => t.sha1 === kept)?.user, TOOLS_ACCOUNT, "the account's token is kept and works");
|
|
assert.ok(forge.tokens.some((t) => t.sha1 === old.sha1));
|
|
// The next process reuses the kept token and retires the old one it could not before.
|
|
const next = new MintedToken({ url: forge.url, admin: ADMIN, passwordFile: env.MESH_GITEA_ADMIN_PASSWORD_FILE!,
|
|
file: join(env.MESH_GITEA_STATE_DIR, "token"), account: TOOLS_ACCOUNT, log: () => {} });
|
|
assert.equal(await next.current(), kept);
|
|
assert.ok(!forge.tokens.some((t) => t.sha1 === old.sha1), "the admin's old token was deleted at the next start");
|
|
});
|
|
|
|
test("a team another process made between the look and the create is found, not a failure", async () => {
|
|
forge.teams.splice(0);
|
|
forge.faults.teamRace = true;
|
|
try {
|
|
await fresh(await environment()).listRepos();
|
|
} finally {
|
|
forge.faults.teamRace = false;
|
|
}
|
|
const team = forge.teams.find((t) => t.name === "mesh-tools");
|
|
assert.ok(team?.members.has(TOOLS_ACCOUNT));
|
|
});
|
|
|
|
test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges, no status (issue 948, ADR 0534 §1)", async () => {
|
|
const env = await environment(true);
|
|
const from = forge.calls.length;
|
|
await fresh(env).listRepos();
|
|
const hq = forge.mainRules.get("hq");
|
|
assert.equal(hq.enable_push, false);
|
|
assert.equal(hq.enable_merge_whitelist, true);
|
|
assert.deepEqual(hq.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
|
|
assert.deepEqual(hq.status_check_contexts, [], "a rule found has its required statuses taken off (ADR 0534 §1)");
|
|
assert.equal(hq.enable_status_check, false);
|
|
const catalog = forge.mainRules.get("mesh-catalog");
|
|
assert.ok(catalog, "a repository with no rule for main is given one");
|
|
assert.equal(catalog.rule_name, "main");
|
|
assert.equal(catalog.enable_push, false);
|
|
assert.deepEqual(catalog.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
|
|
assert.ok(forge.calls.slice(from).filter((c) => /branch_protections/.test(c)).every((c) => c.endsWith(` as ${ADMIN}`)),
|
|
"only the administrator's login touches a rule: the tools' account is no repository's administrator");
|
|
});
|
|
|
|
test("a glob rule covering main gives its approvals and override, not its statuses, when main is given a rule of its own name (issue 948, ADR 0534 §1)", async () => {
|
|
const env = await environment(true);
|
|
await fresh(env).listRepos();
|
|
const rule = forge.mainRules.get("globbed");
|
|
assert.ok(rule, "main is given its own rule");
|
|
assert.deepEqual(rule.status_check_contexts, []);
|
|
assert.equal(rule.enable_status_check, false);
|
|
assert.equal(rule.block_admin_merge_override, true);
|
|
assert.equal(rule.required_approvals, 1);
|
|
assert.equal(rule.enable_push, false);
|
|
assert.deepEqual(rule.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
|
|
});
|
|
|
|
test("a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1)", async () => {
|
|
const src = await readFile(new URL("../index.ts", import.meta.url), "utf8");
|
|
assert.match(src, /ensureMainMerges\("novox"\)/, "index.ts calls it outside the token's mint");
|
|
const { GiteaAdmin } = await import("../dist/client.js");
|
|
const env = await environment();
|
|
forge.mainRules.delete("hq");
|
|
await GiteaAdmin.fromEnv(env).ensureMainMerges("novox");
|
|
assert.equal(forge.mainRules.get("hq").enable_push, false, "a rule gone is made again with no token minted");
|
|
});
|
|
|
|
test("a mint with keep-main-rules false (the default) writes no branch protection", async () => {
|
|
const env = await environment();
|
|
const from = forge.calls.length;
|
|
await fresh(env).listRepos();
|
|
const writes = forge.calls.slice(from).filter((c: string) => /branch_protections/.test(c) && !/^GET /.test(c) && !/^(GET|HEAD) /.test(c));
|
|
assert.deepEqual(writes, []);
|
|
});
|
|
|
|
// The mesh's accounts read every repository (readall.ts; the operator, 2026-10-26): jschoubben/car-hunter and
|
|
// jschoubben/snake, private repositories of a user, answered the tools 404 while that user's public ones were seen; and
|
|
// once the tools' account read them, the build modules' fetch as nox-builder still could not.
|
|
|
|
test("the start's pass gives each of the mesh's accounts read, as a collaborator that reads only, on each repository it could not read, and on no other; an account the forge does not hold is said, not refused", async () => {
|
|
const env = await environment();
|
|
await fresh(env).listRepos(); // the account and its team exist, as after any mint
|
|
forge.users.set(BUILDER_ACCOUNT, { admin: false, password: "unused", active: true }); // made by the forge-account provider
|
|
forge.users.delete(AGENT_ACCOUNT); // no machine's key asked for it yet
|
|
forgeRepos.splice(0);
|
|
addRepo("novox/hq", true);
|
|
addRepo("jschoubben/txt-game", false);
|
|
addRepo("jschoubben/car-hunter", true);
|
|
addRepo("jschoubben/snake", true);
|
|
addRepo("shy/open", false, "limited");
|
|
addRepo("elsewhere/secret", true);
|
|
const { GiteaAdmin } = await import("../dist/client.js");
|
|
const { ReadAll, readAllTools } = await import("../dist/readall.js");
|
|
const lines: string[] = [];
|
|
const readAll = new ReadAll(GiteaAdmin.fromEnv(env), meshAccounts(), (l: string) => lines.push(l));
|
|
assert.deepEqual(readAll.accounts, [TOOLS_ACCOUNT, BUILDER_ACCOUNT, AGENT_ACCOUNT]);
|
|
const [unreadableTool, grantTool] = readAllTools(() => readAll);
|
|
|
|
// What the tool says before, per account: the four the tools' account cannot read, each with why; the builders'
|
|
// account, in no write team here, also not novox/hq; nox-agent not on the forge.
|
|
const before = await unreadableTool.run({}) as any;
|
|
assert.equal(before.checked, 6);
|
|
const of = (account: string) => before.unreadable.filter((u: any) => u.account === account).map((u: any) => u.repository).sort();
|
|
assert.deepEqual(of(TOOLS_ACCOUNT), ["elsewhere/secret", "jschoubben/car-hunter", "jschoubben/snake", "shy/open"]);
|
|
assert.deepEqual(of(BUILDER_ACCOUNT), ["elsewhere/secret", "jschoubben/car-hunter", "jschoubben/snake", "novox/hq", "shy/open"]);
|
|
assert.deepEqual(before.accounts, [{ account: TOOLS_ACCOUNT, unreadable: 4 }, { account: BUILDER_ACCOUNT, unreadable: 5 }]);
|
|
assert.deepEqual(before.absent, [AGENT_ACCOUNT]);
|
|
assert.match(before.unreadable.find((u: any) => u.account === BUILDER_ACCOUNT && u.repository === "jschoubben/car-hunter").why,
|
|
/a private repository of jschoubben, on which nox-builder is no collaborator/);
|
|
const builderOnly = await unreadableTool.run({ accounts: [BUILDER_ACCOUNT] }) as any;
|
|
assert.deepEqual(builderOnly.accounts, [{ account: BUILDER_ACCOUNT, unreadable: 5 }]);
|
|
await assert.rejects(unreadableTool.run({ accounts: ["someone"] }), /not one of the mesh's accounts/);
|
|
assert.match(before.unreadable.find((u: any) => u.repository === "jschoubben/car-hunter").why,
|
|
/a private repository of jschoubben, on which mesh-tools is no collaborator/);
|
|
assert.match(before.unreadable.find((u: any) => u.repository === "shy/open").why, /visibility is limited/);
|
|
assert.deepEqual((await fresh(env).listAllRepos()).map((r) => r.full_name).sort(), ["jschoubben/txt-game", "novox/hq"]);
|
|
|
|
// The account's own token cannot grant itself: the forge asks the repository's administration (the reason for the admin login).
|
|
const own = (await readFile(join(env.MESH_GITEA_STATE_DIR, "token"), "utf8")).trim();
|
|
const self = await fetch(`${forge.url}/api/v1/repos/jschoubben/car-hunter/collaborators/${TOOLS_ACCOUNT}`,
|
|
{ method: "PUT", headers: { Authorization: `token ${own}`, "Content-Type": "application/json" }, body: JSON.stringify({ permission: "read" }) });
|
|
assert.equal(self.status, 404, "a repository the account cannot read is not even there for it");
|
|
|
|
const from = forge.calls.length;
|
|
const r = await readAll.atStart();
|
|
const grantedTo = (account: string) => r.granted.filter((x: any) => x.account === account).map((x: any) => x.repository).sort();
|
|
assert.deepEqual(grantedTo(TOOLS_ACCOUNT), ["elsewhere/secret", "jschoubben/car-hunter", "jschoubben/snake", "shy/open"]);
|
|
assert.deepEqual(grantedTo(BUILDER_ACCOUNT), ["elsewhere/secret", "jschoubben/car-hunter", "jschoubben/snake", "novox/hq", "shy/open"]);
|
|
assert.deepEqual(r.refused, []);
|
|
assert.deepEqual(r.absent, [AGENT_ACCOUNT]);
|
|
const puts = forge.calls.slice(from).filter((c) => c.startsWith("PUT "));
|
|
assert.equal(puts.length, 9, "the repositories each read already were left alone, and the absent account was asked nothing");
|
|
assert.ok(!puts.some((c) => c.includes(AGENT_ACCOUNT)));
|
|
assert.ok(puts.every((c) => c.endsWith(` as ${ADMIN}`)), "only the administrator's login grants");
|
|
for (const repo of forgeRepos.filter((x) => x.collaborators.size)) {
|
|
for (const [account, permission] of repo.collaborators) assert.equal(permission, "read", `${account} on ${repo.full} reads only`);
|
|
}
|
|
assert.equal(forgeRepos.find((x) => x.full === "jschoubben/car-hunter")!.collaborators.get(BUILDER_ACCOUNT), "read");
|
|
assert.match(lines.join("\n"), /6 looked at; mesh-tools 4 granted read now .*; nox-builder 5 granted read now .*; not on the forge yet, so not granted: nox-agent/);
|
|
|
|
// The account made later is granted by hand (or at the next pass), its rows like any other.
|
|
forge.users.set(AGENT_ACCOUNT, { admin: false, password: "unused", active: true });
|
|
const agent = await grantTool.run({ accounts: [AGENT_ACCOUNT], repositories: ["jschoubben/car-hunter"] }) as any;
|
|
assert.deepEqual(agent.granted, [{ account: AGENT_ACCOUNT, repository: "jschoubben/car-hunter" }]);
|
|
assert.deepEqual(agent.absent, []);
|
|
forge.users.delete(AGENT_ACCOUNT);
|
|
|
|
// After: the account's own token sees every repository, and the tool names none.
|
|
assert.equal((await fresh(env).listAllRepos()).length, 6);
|
|
assert.deepEqual(((await unreadableTool.run({})) as any).unreadable, []);
|
|
// Granting again asks nothing of the forge but reads.
|
|
const again = forge.calls.length;
|
|
assert.deepEqual(((await grantTool.run({})) as any).granted, []);
|
|
assert.ok(forge.calls.slice(again).every((c) => c.startsWith("GET ")));
|
|
});
|
|
|
|
test("on the forge's events: a repository made is granted read at once, a known readable one asks nothing, a refusal is said, not thrown", async () => {
|
|
const env = await environment();
|
|
await fresh(env).listRepos();
|
|
forgeRepos.splice(0);
|
|
addRepo("jschoubben/txt-game", false);
|
|
const { GiteaAdmin } = await import("../dist/client.js");
|
|
const { ReadAll, readAllTools } = await import("../dist/readall.js");
|
|
const lines: string[] = [];
|
|
forge.users.set(BUILDER_ACCOUNT, { admin: false, password: "unused", active: true });
|
|
const readAll = new ReadAll(GiteaAdmin.fromEnv(env), [TOOLS_ACCOUNT, BUILDER_ACCOUNT], (l: string) => lines.push(l));
|
|
await readAll.atStart();
|
|
|
|
const cases: { name: string; event: string; repo: string; make?: boolean; refuse?: boolean; unanswered?: boolean; asks: boolean; reads: string }[] = [
|
|
{ name: "a repository made", event: "forge.repository.created", repo: "jschoubben/new-private", make: true, asks: true, reads: "read" },
|
|
{ name: "a fork made", event: "forge.fork", repo: "someone/fork", make: true, asks: true, reads: "read" },
|
|
{ name: "a push to a repository seen readable", event: "forge.push", repo: "jschoubben/txt-game", asks: false, reads: "read" },
|
|
{ name: "a push to a private repository never seen", event: "forge.push", repo: "jschoubben/quiet", make: true, asks: true, reads: "read" },
|
|
{ name: "a repository the forge refuses the grant on", event: "forge.repository.created", repo: "jschoubben/stuck", make: true, refuse: true, asks: true, reads: "none" },
|
|
{ name: "a repository whose permission the forge will not answer", event: "forge.repository.created", repo: "jschoubben/mute", make: true, unanswered: true, asks: true, reads: "none" },
|
|
];
|
|
for (const c of cases) {
|
|
if (c.make) addRepo(c.repo, true);
|
|
if (c.refuse) repoFaults.refuse.add(c.repo);
|
|
if (c.unanswered) repoFaults.permission.add(c.repo);
|
|
const from = forge.calls.length;
|
|
const [owner, repo] = c.repo.split("/");
|
|
await readAll.onEvent({ name: c.event, body: { owner, repo } });
|
|
assert.equal(forge.calls.length > from, c.asks, `${c.name}: asks the forge`);
|
|
for (const account of [TOOLS_ACCOUNT, BUILDER_ACCOUNT]) {
|
|
assert.equal(forgeRepos.find((x) => x.full === c.repo)!.collaborators.get(account) ?? (c.make ? "none" : "read"), c.reads, `${c.name}: ${account}`);
|
|
}
|
|
}
|
|
assert.match(lines.join("\n"), /mesh-tools could not be given read on jschoubben\/stuck — .*422/);
|
|
assert.match(lines.join("\n"), /nox-builder was given read on someone\/fork, on the forge's forge.fork/);
|
|
const named = await (readAllTools(() => readAll)[1].run({ repositories: ["jschoubben/stuck"] })) as any;
|
|
assert.deepEqual(named.refused.map((x: any) => `${x.account} ${x.repository}`), [`${TOOLS_ACCOUNT} jschoubben/stuck`, `${BUILDER_ACCOUNT} jschoubben/stuck`]);
|
|
await assert.rejects(readAllTools(() => readAll)[1].run({ repositories: ["no-slash"] }), /not a repository/);
|
|
assert.match(lines.join("\n"), /could not be given read on jschoubben\/mute — its permission could not be read — .*500/);
|
|
// A whole pass goes past the repository it cannot judge: every other one is still granted, and the listing names it.
|
|
addRepo("jschoubben/after-mute", true);
|
|
const pass = await readAll.grant();
|
|
assert.ok(pass.granted.some((x: any) => x.repository === "jschoubben/after-mute" && x.account === BUILDER_ACCOUNT), "the pass did not stop at the repository it could not judge");
|
|
assert.ok(pass.refused.some((x: any) => x.repository === "jschoubben/mute" && /permission could not be read/.test(x.why)));
|
|
const listed = await readAllTools(() => readAll)[0].run({}) as any;
|
|
assert.equal(listed.unreadable.find((u: any) => u.repository === "jschoubben/mute").permission, "unknown");
|
|
repoFaults.refuse.clear();
|
|
repoFaults.permission.clear();
|
|
});
|
|
|
|
// The merging account writes every repository that builds a registered module, and no other (writes.ts; the operator,
|
|
// 2026-10-26; issue 1945): car-hunter #2 was approved and its commit status refused 403, mesh-tools reading only there.
|
|
|
|
test("the merging account is given write on each repository the catalog half's modules name, read back and said; the operator's other repositories stay read-only; the tools say both", async () => {
|
|
const env = await environment();
|
|
const client = fresh(env);
|
|
await client.listRepos(); // the account and its team exist, as after any mint
|
|
forgeRepos.splice(0);
|
|
addRepo("novox/hq", true);
|
|
for (const full of ["jschoubben/car-hunter", "jschoubben/snake", "jschoubben/dotfiles"]) addRepo(full, true).collaborators.set(TOOLS_ACCOUNT, "read");
|
|
const { GiteaAdmin } = await import("../dist/client.js");
|
|
const { DeliveredWrites, writeTools, WRITABLE_EVENT } = await import("../dist/writes.js");
|
|
const lines: string[] = [];
|
|
const said: { type: string; body: any }[] = [];
|
|
const writes = new DeliveredWrites(GiteaAdmin.fromEnv(env), TOOLS_ACCOUNT, "novox", (l: string) => lines.push(l),
|
|
async (type: string, body: unknown) => { said.push({ type, body }); });
|
|
const [unwritableTool, grantTool] = writeTools(() => writes);
|
|
await assert.rejects(grantTool.run({}), /not known yet/, "nothing is granted before the catalog half's first view is held");
|
|
assert.equal((await client.getRepo("jschoubben", "car-hunter")).writes, false, "the statuses' answer says the account cannot write");
|
|
|
|
// 1945/AC1: the first view hands the catalog half's modules; a user's repository a module builds from is made writable,
|
|
// once, and only once the first view is held (design 47: a part acts on nothing before its first view).
|
|
const viewing = forge.calls.length;
|
|
await writes.take({ key: "car-hunter", op: "put", value: { v: 1, repository: "jschoubben/car-hunter", commit: "c" } });
|
|
await writes.take({ key: "gitea", op: "put", value: { v: 1, repository: "novox/hq", commit: "c" } });
|
|
await writes.take({ key: "broken", op: "put", value: { v: 1, repository: "no-slash" } });
|
|
assert.equal(forge.calls.length, viewing, "the first view's entries ask the forge nothing until it is held");
|
|
await writes.viewed();
|
|
const from = forge.calls.length;
|
|
await writes.take({ key: "car-hunter-2", op: "put", value: { v: 1, repository: "jschoubben/car-hunter" } });
|
|
assert.equal(forge.calls.length, from, "a repository already written asks nothing more");
|
|
const repo = (full: string) => forgeRepos.find((x) => x.full === full)!;
|
|
assert.equal(repo("jschoubben/car-hunter").collaborators.get(TOOLS_ACCOUNT), "write", "a user's repository is written, not administered");
|
|
assert.equal(userRules.has("jschoubben/car-hunter"), false, "a repository with no rule for main is given none");
|
|
assert.equal(repo("novox/hq").collaborators.size, 0, "the organisation's repository is written through its team, no collaborator");
|
|
assert.equal((await client.getRepo("jschoubben", "car-hunter")).writes, true);
|
|
assert.deepEqual(said, [{ type: WRITABLE_EVENT, body: { owner: "jschoubben", repo: "car-hunter", account: TOOLS_ACCOUNT } }]);
|
|
assert.match(lines.join("\n"), /mesh-tools was given write on jschoubben\/car-hunter, which builds a registered module/);
|
|
assert.match(lines.join("\n"), /broken names no repository/);
|
|
|
|
// 1945/AC2: a delivered repository the forge refuses is said, in its words, by the listing and the grant; the operator's
|
|
// repository no module builds from is left read-only, named with why, and a grant naming it asks the forge nothing.
|
|
repoFaults.refuse.add("jschoubben/snake");
|
|
await writes.take({ key: "snake", op: "put", value: { v: 1, repository: "jschoubben/snake" } });
|
|
assert.match(lines.join("\n"), /could not be given write on jschoubben\/snake, which builds snake — .*422/);
|
|
const listed = await unwritableTool.run({}) as any;
|
|
assert.deepEqual(listed.unwritable.map((u: any) => [u.repository, u.permission]), [["jschoubben/snake", "read"]]);
|
|
assert.match(listed.unwritable[0].why, /builds snake.*gitea_grant_write/);
|
|
const all = await grantTool.run({}) as any;
|
|
assert.deepEqual(all.delivered, ["jschoubben/car-hunter", "jschoubben/snake", "novox/hq"]);
|
|
assert.deepEqual(all.already, ["jschoubben/car-hunter", "novox/hq"]);
|
|
assert.deepEqual(all.granted, []);
|
|
assert.match(all.refused.find((x: any) => x.repository === "jschoubben/snake").why, /422.*would not have it/);
|
|
assert.deepEqual(all.left_read_only.map((x: any) => x.repository), ["jschoubben/dotfiles"]);
|
|
assert.match(all.left_read_only[0].why, /builds no registered module/);
|
|
const puts = forge.calls.length;
|
|
const named = await grantTool.run({ repositories: ["jschoubben/dotfiles"] }) as any;
|
|
assert.deepEqual([named.granted, named.left_read_only.map((x: any) => x.repository)], [[], ["jschoubben/dotfiles"]]);
|
|
assert.ok(!forge.calls.slice(puts).some((c) => c.startsWith("PUT ")), "no write is asked on a repository no module builds from");
|
|
assert.equal(repo("jschoubben/dotfiles").collaborators.get(TOOLS_ACCOUNT), "read");
|
|
repoFaults.refuse.clear();
|
|
// The operator's rule is left as set (the operator, 2026-10-26: "Write, rule untouched"): only mesh-tools is added to its
|
|
// merge whitelist; a status the mesh does not set and required approvals are said as blocking the mesh's merge, unchanged.
|
|
const operators = { rule_name: "main", enable_push: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"],
|
|
enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "ci/external"], required_approvals: 2,
|
|
block_admin_merge_override: false, require_signed_commits: true, block_on_outdated_branch: true, block_on_rejected_reviews: true };
|
|
userRules.set("jschoubben/snake", structuredClone(operators));
|
|
const after = await grantTool.run({ repositories: ["jschoubben/snake"] }) as any;
|
|
assert.deepEqual(after.granted, ["jschoubben/snake"]);
|
|
assert.equal(repo("jschoubben/snake").collaborators.get(TOOLS_ACCOUNT), "write");
|
|
assert.deepEqual(userRules.get("jschoubben/snake"), { ...operators, merge_whitelist_usernames: ["jschoubben", TOOLS_ACCOUNT] }, "only the whitelist changed");
|
|
assert.deepEqual(after.merge_whitelist, [{ repository: "jschoubben/snake", changed: true, listed: ["jschoubben", TOOLS_ACCOUNT] }]);
|
|
const blockedWhy = "writable, but main's rule blocks the mesh's merge: it requires the status ci/external, which the mesh does not set; " +
|
|
"it requires 2 approving reviews on the forge, which the gate does not give; it requires signed commits, which the mesh does not make; " +
|
|
"it refuses a branch behind main, which the mesh does not bring up to date; " +
|
|
"it refuses a merge after a review asked for changes, which the gate does not clear";
|
|
assert.deepEqual(after.merge_blocked, [{ repository: "jschoubben/snake", why: blockedWhy }]);
|
|
const again = await unwritableTool.run({}) as any;
|
|
assert.deepEqual([again.unwritable, again.merge_blocked], [[], [{ repository: "jschoubben/snake", why: blockedWhy }]]);
|
|
const writesBefore = forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length;
|
|
assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_whitelist[0].changed, false);
|
|
assert.equal(forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length, writesBefore, "a listed account is not written again");
|
|
// The mesh's own statuses never block: a rule requiring only them, with mesh-tools listed, is not reported.
|
|
userRules.set("jschoubben/snake", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT],
|
|
enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "mesh/repo-check"] });
|
|
assert.deepEqual(((await unwritableTool.run({})) as any).merge_blocked, []);
|
|
assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_blocked, []);
|
|
// The forge drops a whitelist login that cannot write and still answers 200: the whitelist is read back and that fails loud.
|
|
userRules.set("jschoubben/dotfiles", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"] });
|
|
await assert.rejects(GiteaAdmin.fromEnv(env).ensureMergerListed("jschoubben", "dotfiles", TOOLS_ACCOUNT),
|
|
/mesh-tools was added to the merge whitelist of main's rule main of jschoubben\/dotfiles, but the forge holds \[jschoubben\]: it drops a login that cannot write/);
|
|
userRules.delete("jschoubben/dotfiles");
|
|
// A module gone from the catalog half leaves its repository out of the delivered list.
|
|
await writes.take({ key: "snake", op: "delete" });
|
|
assert.deepEqual(writes.delivered(), ["jschoubben/car-hunter", "novox/hq"]);
|
|
});
|