mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-28 12:15:46 +00:00
ToastyTheBot
646ea0f253
Deploy keys only work over SSH. A deploy token is their counterpart for HTTPS: a repository scoped credential, used as the password of a Git request, with read or read and write access. It covers Git operations and LFS, and can be regenerated in place. Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude Mythos <noreply@anthropic.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
77 lines
3.1 KiB
Go
77 lines
3.1 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
deploykey_model "gitea.dev/models/deploykey"
|
|
"gitea.dev/models/perm"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/models/unittest"
|
|
"gitea.dev/modules/git"
|
|
lfs_module "gitea.dev/modules/lfs"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestDeployTokenGitHTTP(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
// need to disable agit, otherwise the "write" permission check is skipped at pre-receive (git-receive-pack) step
|
|
defer test.MockVariableValue(&git.DefaultFeatures().SupportProcReceive, false)()
|
|
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
otherRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
|
|
readKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "read", perm.AccessModeRead)
|
|
require.NoError(t, err)
|
|
writeKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "write", perm.AccessModeWrite)
|
|
require.NoError(t, err)
|
|
|
|
requestAs := func(t *testing.T, token, path string, expected int) {
|
|
MakeRequest(t, NewRequest(t, "GET", path).AddBasicAuth("deploy-token", token), expected)
|
|
}
|
|
|
|
t.Run("Clone", func(t *testing.T) {
|
|
requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusOK)
|
|
})
|
|
t.Run("PushWithReadToken", func(t *testing.T) {
|
|
requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusNotFound)
|
|
})
|
|
t.Run("PushWithWriteToken", func(t *testing.T) {
|
|
requestAs(t, writeKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusOK)
|
|
})
|
|
t.Run("OtherRepo", func(t *testing.T) {
|
|
requestAs(t, readKey.Token, "/"+otherRepo.FullName()+"/info/refs?service=git-upload-pack", http.StatusNotFound)
|
|
})
|
|
t.Run("UnknownToken", func(t *testing.T) {
|
|
requestAs(t, deploykey_model.DeployTokenPrefix+"0123456789abcdef", "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusUnauthorized)
|
|
})
|
|
t.Run("RejectedOutsideGitHTTP", func(t *testing.T) {
|
|
// the owner of the repo would be able to read it, the token must not act as that owner
|
|
requestAs(t, readKey.Token, "/api/v1/repos/"+repo.FullName(), http.StatusUnauthorized)
|
|
})
|
|
|
|
t.Run("LFS", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.LFS.StartServer, true)()
|
|
|
|
batchAs := func(t *testing.T, token, repoName, operation string, expected int) {
|
|
req := NewRequestWithJSON(t, "POST", "/"+repoName+"/info/lfs/objects/batch", lfs_module.BatchRequest{Operation: operation}).
|
|
AddBasicAuth("deploy-token", token).
|
|
SetHeader("Accept", lfs_module.AcceptHeader).
|
|
SetHeader("Content-Type", lfs_module.MediaType)
|
|
MakeRequest(t, req, expected)
|
|
}
|
|
|
|
batchAs(t, readKey.Token, repo.FullName(), "download", http.StatusOK)
|
|
batchAs(t, readKey.Token, repo.FullName(), "upload", http.StatusUnauthorized)
|
|
batchAs(t, writeKey.Token, repo.FullName(), "upload", http.StatusOK)
|
|
batchAs(t, readKey.Token, otherRepo.FullName(), "download", http.StatusUnauthorized)
|
|
})
|
|
}
|