mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-03 10:50:50 +00:00
silverwind
cf89ecd887
The `gitea.com/go-chi/session` package only exists for Gitea, so it moves into `modules/session` to fix its bugs directly. Fixes the flake in https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400. - Sessions are only written back when changed, so a read-only request can't revert a concurrent change or restore a logged-out session, like https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12 - The session cookie is only set once a session holds data - Every backend refreshes the expiry on load and file sessions are written atomically - Also fix https://github.com/go-gitea/gitea/issues/36176 ## ⚠️ BREAKING ⚠️ * the `mysql`, `postgres`, `couchbase` and `memcache` session providers are removed, use `file`, `db` or `redis` instead * login-related cookies are renamed to `gitea_session` and `gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME` and `COOKIE_REMEMBER_NAME` in app.ini --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
72 lines
2.4 KiB
Go
72 lines
2.4 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/session"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
"gitea.dev/services/contexttest"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestReverseProxyIgnoresBot(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
defer test.MockVariableValue(&setting.ReverseProxyAuthUser, "X-WEBAUTH-USER")()
|
|
defer test.MockVariableValue(&setting.ReverseProxyAuthEmail, "X-WEBAUTH-EMAIL")()
|
|
defer test.MockVariableValue(&setting.Service.EnableReverseProxyEmail, true)()
|
|
require.NoError(t, user_model.UpdateUserCols(t.Context(), &user_model.User{ID: 2, Type: user_model.UserTypeBot}, "type"))
|
|
|
|
req, err := http.NewRequest(http.MethodGet, "/", nil)
|
|
require.NoError(t, err)
|
|
req.Header.Set(setting.ReverseProxyAuthUser, "user2")
|
|
req.Header.Set(setting.ReverseProxyAuthEmail, "user2@example.com")
|
|
user, err := (&ReverseProxy{}).Verify(req, nil, nil, nil)
|
|
require.NoError(t, err)
|
|
assert.Nil(t, user)
|
|
}
|
|
|
|
type releaseCountingStore struct {
|
|
session.Store
|
|
released int
|
|
}
|
|
|
|
func (s *releaseCountingStore) Release() error {
|
|
s.released++
|
|
return s.Store.Release()
|
|
}
|
|
|
|
func TestReverseProxyLastLogin(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
defer test.MockVariableValue(&setting.ReverseProxyAuthUser, "X-WEBAUTH-USER")()
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
require.Zero(t, user.LastLoginUnix)
|
|
|
|
sess := &releaseCountingStore{Store: session.NewMockMemStore("reverse-proxy-last-login")}
|
|
ctx, resp := contexttest.MockContext(t, "/", contexttest.MockContextOption{SessionStore: sess})
|
|
ctx.Req.Header.Set(setting.ReverseProxyAuthUser, user.Name)
|
|
rp := &ReverseProxy{CreateSession: true}
|
|
|
|
_, err := rp.Verify(ctx.Req, resp, ctx, ctx.Session)
|
|
require.NoError(t, err)
|
|
assert.NotZero(t, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: user.ID}).LastLoginUnix)
|
|
assert.Equal(t, 1, sess.released)
|
|
|
|
user.LastLoginUnix = 1
|
|
require.NoError(t, user_model.UpdateUserCols(t.Context(), user, "last_login_unix"))
|
|
|
|
_, err = rp.Verify(ctx.Req, resp, ctx, ctx.Session)
|
|
require.NoError(t, err)
|
|
assert.EqualValues(t, 1, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: user.ID}).LastLoginUnix) // no write without a new session
|
|
assert.Equal(t, 1, sess.released)
|
|
}
|