mirror of
https://gitea.com/gitea/tea.git
synced 2026-09-10 07:26:33 -04:00
9bd537c72e
The custom api client only sent a bearer token, so a login that authenticates with an SSH key (HTTP Signature) sent no credentials at all — `tea api` failed with 401/404 on every endpoint. The SDK signs such requests; the custom client did not. Authenticate via token or SSH key/cert, reusing the SDK's exported HTTPSign signer construction plus the same httpsig signing path. Also detect MSYS2/Git-Bash path mangling of the endpoint argument and surface a clear, actionable error instead of a confusing "404 page not found". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
100 lines
2.7 KiB
Go
100 lines
2.7 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package api
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"encoding/pem"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"gitea.dev/tea/modules/config"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
// captureRequest starts an httptest server that records the last request it
|
|
// received and returns the server plus a pointer to the captured request.
|
|
func captureRequest(t *testing.T) (*httptest.Server, **http.Request) {
|
|
t.Helper()
|
|
var captured *http.Request
|
|
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
captured = r
|
|
w.WriteHeader(http.StatusOK)
|
|
_, _ = io.WriteString(w, "{}")
|
|
}))
|
|
t.Cleanup(ts.Close)
|
|
return ts, &captured
|
|
}
|
|
|
|
// generateSSHKey writes an ed25519 OpenSSH private key to a temp file and
|
|
// returns the file path and the SHA256 fingerprint of its public key.
|
|
func generateSSHKey(t *testing.T) (keyPath, fingerprint string) {
|
|
t.Helper()
|
|
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
|
require.NoError(t, err)
|
|
|
|
block, err := ssh.MarshalPrivateKey(priv, "")
|
|
require.NoError(t, err)
|
|
|
|
keyPath = filepath.Join(t.TempDir(), "id_ed25519")
|
|
require.NoError(t, os.WriteFile(keyPath, pem.EncodeToMemory(block), 0o600))
|
|
|
|
pubKey, err := ssh.NewPublicKey(pub)
|
|
require.NoError(t, err)
|
|
return keyPath, ssh.FingerprintSHA256(pubKey)
|
|
}
|
|
|
|
// doGet issues a single GET against the server using a client built from login.
|
|
func doGet(t *testing.T, login *config.Login) {
|
|
t.Helper()
|
|
c, err := NewClient(login)
|
|
require.NoError(t, err)
|
|
resp, err := c.Do(http.MethodGet, "/anything", nil, nil)
|
|
require.NoError(t, err)
|
|
require.NoError(t, resp.Body.Close())
|
|
}
|
|
|
|
func TestClient_TokenLoginSetsAuthorization(t *testing.T) {
|
|
ts, captured := captureRequest(t)
|
|
login := &config.Login{
|
|
URL: ts.URL,
|
|
Token: "abc123",
|
|
}
|
|
|
|
doGet(t, login)
|
|
|
|
assert.Equal(t, "token abc123", (*captured).Header.Get("Authorization"))
|
|
// No SSH signature for a plain token login.
|
|
assert.Empty(t, (*captured).Header.Get("Signature"))
|
|
}
|
|
|
|
func TestClient_SSHKeyLoginSignsRequest(t *testing.T) {
|
|
ts, captured := captureRequest(t)
|
|
keyPath, fingerprint := generateSSHKey(t)
|
|
|
|
login := &config.Login{
|
|
URL: ts.URL,
|
|
SSHKey: keyPath,
|
|
SSHKeyFingerprint: fingerprint,
|
|
}
|
|
|
|
doGet(t, login)
|
|
|
|
// An SSH-key login has no bearer token, so it must authenticate via an
|
|
// HTTP Signature header instead. This is the bug: the custom client used
|
|
// to send neither.
|
|
assert.Empty(t, (*captured).Header.Get("Authorization"),
|
|
"SSH-key login must not rely on a bearer token")
|
|
assert.NotEmpty(t, (*captured).Header.Get("Signature"),
|
|
"SSH-key login must sign the request")
|
|
}
|