feat: restore Gitea CLI access

tests/test_gitea_direct.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import httpx
+
+from reyna_cli.gitea_direct import GiteaClient, GiteaCredentials, load_credentials, redact_sensitive
+
+
+def test_load_credentials_prefers_environment_without_exposing_token(monkeypatch):
+    monkeypatch.setenv("REYNA_GITEA_TOKEN", "test-token-value")
+    monkeypatch.setenv("REYNA_GITEA_URL", "https://git.example.test/")
+
+    credentials = load_credentials()
+
+    assert credentials.token == "test-token-value"
+    assert credentials.source == "REYNA_GITEA_TOKEN"
+    assert credentials.public_dict() == {
+        "configured": True,
+        "host": "git.example.test",
+        "source": "REYNA_GITEA_TOKEN",
+    }
+    assert "token" not in credentials.public_dict()
+
+
+def test_load_credentials_reads_git_credentials_file(monkeypatch, tmp_path: Path):
+    credentials_file = tmp_path / "credentials"
+    credentials_file.write_text(
+        "https://adolforeyna:stored-secret@git.reynafamily.com\n",
+        encoding="utf-8",
+    )
+    monkeypatch.delenv("REYNA_GITEA_TOKEN", raising=False)
+    monkeypatch.delenv("GITEA_TOKEN", raising=False)
+    monkeypatch.setenv("GIT_CREDENTIALS_FILE", str(credentials_file))
+
+    credentials = load_credentials()
+
+    assert credentials.username == "adolforeyna"
+    assert credentials.token == "stored-secret"
+    assert credentials.source == "GIT_CREDENTIALS_FILE"
+    assert "stored-secret" not in str(credentials.public_dict())
+
+
+def test_repo_response_is_redacted_and_requests_authenticated_endpoint():
+    requests: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(
+            200,
+            json={
+                "full_name": "adolforeyna/reyna-cli",
+                "permissions": {"push": True},
+                "token": "response-secret",
+            },
+        )
+
+    client = GiteaClient(
+        GiteaCredentials("adolforeyna", "request-secret", "test", "https://git.example.test"),
+        transport=httpx.MockTransport(handler),
+    )
+
+    result = client.repo("adolforeyna/reyna-cli")
+
+    assert requests[0].url.path == "/api/v1/repos/adolforeyna/reyna-cli"
+    assert requests[0].headers["authorization"] == "token request-secret"
+    assert result["permissions"]["push"] is True
+    assert result["token"] == "[REDACTED]"
+    assert "response-secret" not in str(result)
+
+
+def test_remote_credential_helper_can_make_a_safe_api_request(monkeypatch):
+    credentials = GiteaCredentials("", "", "Pi 5 git credential helper", "https://git.example.test")
+    assert credentials.public_dict()["configured"] is True
+    client = GiteaClient(credentials)
+    monkeypatch.setattr(client, "_remote_get", lambda path: {"full_name": "adolforeyna/reyna-cli"})
+
+    assert client.repo("adolforeyna/reyna-cli") == {"full_name": "adolforeyna/reyna-cli"}
+
+
+def test_redact_sensitive_handles_nested_api_values():
+    assert redact_sensitive(
+        {"password": "one", "nested": [{"access_token": "two"}], "name": "safe"}
+    ) == {"password": "[REDACTED]", "nested": [{"access_token": "[REDACTED]"}], "name": "safe"}