Adolfo Reyna
85 lines
3.1 KiB
Python
85 lines
3.1 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import httpx
|
|
|
|
from reyna_cli.gitea_direct import GiteaClient, GiteaCredentials, load_credentials, redact_sensitive
|
|
|
|
|
|
def test_load_credentials_prefers_environment_without_exposing_token(monkeypatch):
|
|
monkeypatch.setenv("REYNA_GITEA_TOKEN", "test-token-value")
|
|
monkeypatch.setenv("REYNA_GITEA_URL", "https://git.example.test/")
|
|
|
|
credentials = load_credentials()
|
|
|
|
assert credentials.token == "test-token-value"
|
|
assert credentials.source == "REYNA_GITEA_TOKEN"
|
|
assert credentials.public_dict() == {
|
|
"configured": True,
|
|
"host": "git.example.test",
|
|
"source": "REYNA_GITEA_TOKEN",
|
|
}
|
|
assert "token" not in credentials.public_dict()
|
|
|
|
|
|
def test_load_credentials_reads_git_credentials_file(monkeypatch, tmp_path: Path):
|
|
credentials_file = tmp_path / "credentials"
|
|
credentials_file.write_text(
|
|
"https://adolforeyna:stored-secret@git.reynafamily.com\n",
|
|
encoding="utf-8",
|
|
)
|
|
monkeypatch.delenv("REYNA_GITEA_TOKEN", raising=False)
|
|
monkeypatch.delenv("GITEA_TOKEN", raising=False)
|
|
monkeypatch.setenv("GIT_CREDENTIALS_FILE", str(credentials_file))
|
|
|
|
credentials = load_credentials()
|
|
|
|
assert credentials.username == "adolforeyna"
|
|
assert credentials.token == "stored-secret"
|
|
assert credentials.source == "GIT_CREDENTIALS_FILE"
|
|
assert "stored-secret" not in str(credentials.public_dict())
|
|
|
|
|
|
def test_repo_response_is_redacted_and_requests_authenticated_endpoint():
|
|
requests: list[httpx.Request] = []
|
|
|
|
def handler(request: httpx.Request) -> httpx.Response:
|
|
requests.append(request)
|
|
return httpx.Response(
|
|
200,
|
|
json={
|
|
"full_name": "adolforeyna/reyna-cli",
|
|
"permissions": {"push": True},
|
|
"token": "response-secret",
|
|
},
|
|
)
|
|
|
|
client = GiteaClient(
|
|
GiteaCredentials("adolforeyna", "request-secret", "test", "https://git.example.test"),
|
|
transport=httpx.MockTransport(handler),
|
|
)
|
|
|
|
result = client.repo("adolforeyna/reyna-cli")
|
|
|
|
assert requests[0].url.path == "/api/v1/repos/adolforeyna/reyna-cli"
|
|
assert requests[0].headers["authorization"] == "token request-secret"
|
|
assert result["permissions"]["push"] is True
|
|
assert result["token"] == "[REDACTED]"
|
|
assert "response-secret" not in str(result)
|
|
|
|
|
|
def test_remote_credential_helper_can_make_a_safe_api_request(monkeypatch):
|
|
credentials = GiteaCredentials("", "", "Pi 5 git credential helper", "https://git.example.test")
|
|
assert credentials.public_dict()["configured"] is True
|
|
client = GiteaClient(credentials)
|
|
monkeypatch.setattr(client, "_remote_get", lambda path: {"full_name": "adolforeyna/reyna-cli"})
|
|
|
|
assert client.repo("adolforeyna/reyna-cli") == {"full_name": "adolforeyna/reyna-cli"}
|
|
|
|
|
|
def test_redact_sensitive_handles_nested_api_values():
|
|
assert redact_sensitive(
|
|
{"password": "one", "nested": [{"access_token": "two"}], "name": "safe"}
|
|
) == {"password": "[REDACTED]", "nested": [{"access_token": "[REDACTED]"}], "name": "safe"}
|