Add the runnable Gitea, PostgreSQL, and Hop control-plane foundation

Hop-State: A_06FN3QYA1N56NQYGZ81DWGR Hop-Proposal: R_06FN3QXJRYPPEQZQA6S69QG Hop-Task: T_06FN3MVGY3MT82ESQ89BND0 Hop-Attempt: AT_06FN3MVGY092BFA5MR9C7EG
2026-07-11 08:50:48 -07:00
parent dd2c0abfd2
commit d9544b435b
22 changed files with 1114 additions and 0 deletions
@@ -0,0 +1,116 @@
+package httpapi
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"hopweb/internal/gitea"
+	"hopweb/internal/store"
+)
+
+type fakeStore struct {
+	repositories []store.Repository
+	delivery     store.WebhookDelivery
+	duplicate    bool
+}
+
+func (f *fakeStore) Ping(context.Context) error { return nil }
+func (f *fakeStore) ListRepositories(context.Context) ([]store.Repository, error) {
+	return f.repositories, nil
+}
+func (f *fakeStore) UpsertRepository(_ context.Context, repository gitea.Repository) (store.Repository, error) {
+	saved := store.Repository{ID: "RP_TEST", GiteaID: repository.ID, Owner: repository.OwnerName(), Name: repository.Name, FullName: repository.FullName}
+	f.repositories = append(f.repositories, saved)
+	return saved, nil
+}
+func (f *fakeStore) RecordWebhook(_ context.Context, delivery store.WebhookDelivery) (bool, error) {
+	f.delivery = delivery
+	return f.duplicate, nil
+}
+
+type fakeGitea struct {
+	repository gitea.Repository
+	err        error
+}
+
+func (f fakeGitea) Repository(context.Context, string, string) (gitea.Repository, error) {
+	return f.repository, f.err
+}
+
+func testServer(data store.Store, client giteaClient) http.Handler {
+	return New(data, client, "admin-secret", "webhook-secret", slog.New(slog.NewTextHandler(io.Discard, nil)))
+}
+
+func TestAdminAuthentication(t *testing.T) {
+	handler := testServer(&fakeStore{}, fakeGitea{})
+	for _, header := range []string{"", "admin-secret", "Bearer wrong"} {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/repositories", nil)
+		req.Header.Set("Authorization", header)
+		response := httptest.NewRecorder()
+		handler.ServeHTTP(response, req)
+		if response.Code != http.StatusUnauthorized {
+			t.Fatalf("header %q: status = %d, want %d", header, response.Code, http.StatusUnauthorized)
+		}
+	}
+}
+
+func TestLinkRepository(t *testing.T) {
+	data := &fakeStore{}
+	client := fakeGitea{repository: gitea.Repository{ID: 42, Owner: gitea.Owner{Login: "hop"}, Name: "demo", FullName: "hop/demo"}}
+	handler := testServer(data, client)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/link", bytes.NewBufferString(`{"owner":"hop","name":"demo"}`))
+	req.Header.Set("Authorization", "Bearer admin-secret")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, req)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusCreated, response.Body.String())
+	}
+	if len(data.repositories) != 1 || data.repositories[0].GiteaID != 42 {
+		t.Fatalf("repository not linked: %#v", data.repositories)
+	}
+}
+
+func TestWebhookVerificationAndDeduplication(t *testing.T) {
+	data := &fakeStore{duplicate: true}
+	handler := testServer(data, fakeGitea{err: errors.New("unused")})
+	body := []byte(`{"repository":{"id":42,"owner":{"login":"hop"},"name":"demo","full_name":"hop/demo"}}`)
+	mac := hmac.New(sha256.New, []byte("webhook-secret"))
+	_, _ = mac.Write(body)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/gitea/webhooks", bytes.NewReader(body))
+	req.Header.Set("X-Gitea-Signature", hex.EncodeToString(mac.Sum(nil)))
+	req.Header.Set("X-Gitea-Delivery", "delivery-1")
+	req.Header.Set("X-Gitea-Event", "push")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, req)
+
+	if response.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusNoContent, response.Body.String())
+	}
+	if response.Header().Get("X-Hop-Duplicate") != "true" {
+		t.Fatal("expected duplicate response header")
+	}
+	if data.delivery.DeliveryID != "delivery-1" || data.delivery.Repository == nil || data.delivery.Repository.ID != 42 {
+		t.Fatalf("delivery not recorded: %#v", data.delivery)
+	}
+}
+
+func TestWebhookRejectsInvalidSignature(t *testing.T) {
+	handler := testServer(&fakeStore{}, fakeGitea{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/gitea/webhooks", bytes.NewBufferString(`{}`))
+	req.Header.Set("X-Gitea-Signature", "bad")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, req)
+	if response.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want %d", response.Code, http.StatusUnauthorized)
+	}
+}