GnosysLabs/GitHop
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Recognize authenticated Gitea browser sessions without weakening per-user prompt isolation

Browse Source 
Hop-State: A_06FNB6HTKZAXH2SX1G8AB0R
Hop-Proposal: R_06FNB6HA40Y1E1T39G6YJHG
Hop-Task: T_06FNB5TE4DHAVABVH82WBN8
Hop-Attempt: AT_06FNB5TE4FW7MD6KTFYP3EG
This commit is contained in:
cyph3rasi
2026-07-12 02:13:18 -07:00
committed by Hop
parent 12c806c77f
commit 96cd6823b2
3 changed files with 104 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/control-plane/internal/gitea/client_test.go
+44 -7
View File
@@ -66,16 +66,23 @@ func TestUserUsesTokenAndDecodesStableID(t *testing.T) {
func TestAuthenticatedUserForwardsSessionCookie(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path != "/api/v1/user" {
switch r.URL.Path {
case "/user/settings":
if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {
t.Fatalf("cookie = %q", got)
}
_, _ = w.Write([]byte(`<input id="username" name="name" value="alice" data-name="alice" required>`))
case "/api/v1/users/alice":
if got := r.Header.Get("Authorization"); got != "token gitea-token" {
t.Fatalf("authorization = %q", got)
}
_, _ = w.Write([]byte(`{"id":42,"login":"alice"}`))
default:
t.Fatalf("path = %q", r.URL.Path)
}
if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {
t.Fatalf("cookie = %q", got)
}
_, _ = w.Write([]byte(`{"id":42,"login":"alice"}`))
}))
defer server.Close()
client, err := NewClient(server.URL, "")
client, err := NewClient(server.URL, "gitea-token")
if err != nil {
t.Fatal(err)
}
@@ -85,6 +92,36 @@ func TestAuthenticatedUserForwardsSessionCookie(t *testing.T) {
}
}
func TestAuthenticatedUserRejectsLoginRedirect(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
http.Redirect(w, r, "/user/login", http.StatusSeeOther)
}))
defer server.Close()
client, err := NewClient(server.URL, "gitea-token")
if err != nil {
t.Fatal(err)
}
user, authenticated, err := client.AuthenticatedUser(context.Background(), "i_like_gitea=expired")
if err != nil || authenticated || user.ID != 0 {
t.Fatalf("user = %#v, authenticated = %t, err = %v", user, authenticated, err)
}
}
func TestAuthenticatedUserRejectsUnidentifiableSettingsPage(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
_, _ = w.Write([]byte(`<main>settings changed</main>`))
}))
defer server.Close()
client, err := NewClient(server.URL, "gitea-token")
if err != nil {
t.Fatal(err)
}
_, authenticated, err := client.AuthenticatedUser(context.Background(), "i_like_gitea=session")
if err == nil || authenticated {
t.Fatalf("authenticated = %t, err = %v", authenticated, err)
}
}
func TestAuthenticatedUserRejectsMissingSession(t *testing.T) {
client, err := NewClient("http://gitea.test", "")
if err != nil {
@@ -98,7 +135,7 @@ func TestAuthenticatedUserRejectsMissingSession(t *testing.T) {
func TestViewerCanReadRepositoryForwardsSessionCookie(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path != "/api/v1/repos/hop/private" {
if r.URL.Path != "/hop/private" {
t.Fatalf("path = %q", r.URL.Path)
}
if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {