cyph3rasi
12c806c77f
Hop-State: A_06FN8NFDRFAFN5VCJTHJAAG Hop-Proposal: R_06FN8NEGJ054CPMJF9ZAN70 Hop-Task: T_06FN8HT6XG332C3XY6PYCCG Hop-Attempt: AT_06FN8HT6XGRXW0B4WPFFBJG
197 lines
7.8 KiB
Go
197 lines
7.8 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"errors"
|
|
"io"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"hopweb/internal/gitea"
|
|
"hopweb/internal/store"
|
|
)
|
|
|
|
type fakeStore struct {
|
|
repositories []store.Repository
|
|
prompts []store.Prompt
|
|
listUserID int64
|
|
delivery store.WebhookDelivery
|
|
duplicate bool
|
|
}
|
|
|
|
func (f *fakeStore) Ping(context.Context) error { return nil }
|
|
func (f *fakeStore) ListRepositories(context.Context) ([]store.Repository, error) {
|
|
return f.repositories, nil
|
|
}
|
|
func (f *fakeStore) UpsertRepository(_ context.Context, repository gitea.Repository) (store.Repository, error) {
|
|
saved := store.Repository{ID: "RP_TEST", GiteaID: repository.ID, Owner: repository.OwnerName(), Name: repository.Name, FullName: repository.FullName}
|
|
f.repositories = append(f.repositories, saved)
|
|
return saved, nil
|
|
}
|
|
func (f *fakeStore) ListPrompts(_ context.Context, _, _ string, giteaUserID int64, _ int) ([]store.Prompt, error) {
|
|
f.listUserID = giteaUserID
|
|
return f.prompts, nil
|
|
}
|
|
func (f *fakeStore) CreatePrompt(_ context.Context, input store.CreatePromptInput) (store.Prompt, error) {
|
|
prompt := store.Prompt{ID: "PM_TEST", GiteaUserID: input.GiteaUserID, Prompt: input.Prompt, Status: input.Status, AgentName: input.AgentName, AgentModel: input.AgentModel, Metadata: input.Metadata}
|
|
f.prompts = append(f.prompts, prompt)
|
|
return prompt, nil
|
|
}
|
|
func (f *fakeStore) RecordWebhook(_ context.Context, delivery store.WebhookDelivery) (bool, error) {
|
|
f.delivery = delivery
|
|
return f.duplicate, nil
|
|
}
|
|
|
|
type fakeGitea struct {
|
|
repository gitea.Repository
|
|
user gitea.User
|
|
err error
|
|
viewerAllowed bool
|
|
authenticated bool
|
|
}
|
|
|
|
func (f fakeGitea) Repository(context.Context, string, string) (gitea.Repository, error) {
|
|
return f.repository, f.err
|
|
}
|
|
func (f fakeGitea) User(context.Context, string) (gitea.User, error) {
|
|
return f.user, f.err
|
|
}
|
|
func (f fakeGitea) AuthenticatedUser(context.Context, string) (gitea.User, bool, error) {
|
|
return f.user, f.authenticated, f.err
|
|
}
|
|
func (f fakeGitea) ViewerCanReadRepository(context.Context, string, string, string) (bool, error) {
|
|
return f.viewerAllowed, f.err
|
|
}
|
|
|
|
func testServer(data store.Store, client giteaClient) http.Handler {
|
|
return New(data, client, "admin-secret", "webhook-secret", slog.New(slog.NewTextHandler(io.Discard, nil)))
|
|
}
|
|
|
|
func TestAdminAuthentication(t *testing.T) {
|
|
handler := testServer(&fakeStore{}, fakeGitea{})
|
|
for _, header := range []string{"", "admin-secret", "Bearer wrong"} {
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/repositories", nil)
|
|
req.Header.Set("Authorization", header)
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
if response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("header %q: status = %d, want %d", header, response.Code, http.StatusUnauthorized)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestLinkRepository(t *testing.T) {
|
|
data := &fakeStore{}
|
|
client := fakeGitea{repository: gitea.Repository{ID: 42, Owner: gitea.Owner{Login: "hop"}, Name: "demo", FullName: "hop/demo"}}
|
|
handler := testServer(data, client)
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/link", bytes.NewBufferString(`{"owner":"hop","name":"demo"}`))
|
|
req.Header.Set("Authorization", "Bearer admin-secret")
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
if response.Code != http.StatusCreated {
|
|
t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusCreated, response.Body.String())
|
|
}
|
|
if len(data.repositories) != 1 || data.repositories[0].GiteaID != 42 {
|
|
t.Fatalf("repository not linked: %#v", data.repositories)
|
|
}
|
|
}
|
|
|
|
func TestWebhookVerificationAndDeduplication(t *testing.T) {
|
|
data := &fakeStore{duplicate: true}
|
|
handler := testServer(data, fakeGitea{err: errors.New("unused")})
|
|
body := []byte(`{"repository":{"id":42,"owner":{"login":"hop"},"name":"demo","full_name":"hop/demo"}}`)
|
|
mac := hmac.New(sha256.New, []byte("webhook-secret"))
|
|
_, _ = mac.Write(body)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/gitea/webhooks", bytes.NewReader(body))
|
|
req.Header.Set("X-Gitea-Signature", hex.EncodeToString(mac.Sum(nil)))
|
|
req.Header.Set("X-Gitea-Delivery", "delivery-1")
|
|
req.Header.Set("X-Gitea-Event", "push")
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
|
|
if response.Code != http.StatusNoContent {
|
|
t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusNoContent, response.Body.String())
|
|
}
|
|
if response.Header().Get("X-Hop-Duplicate") != "true" {
|
|
t.Fatal("expected duplicate response header")
|
|
}
|
|
if data.delivery.DeliveryID != "delivery-1" || data.delivery.Repository == nil || data.delivery.Repository.ID != 42 {
|
|
t.Fatalf("delivery not recorded: %#v", data.delivery)
|
|
}
|
|
}
|
|
|
|
func TestWebhookRejectsInvalidSignature(t *testing.T) {
|
|
handler := testServer(&fakeStore{}, fakeGitea{})
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/gitea/webhooks", bytes.NewBufferString(`{}`))
|
|
req.Header.Set("X-Gitea-Signature", "bad")
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
if response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want %d", response.Code, http.StatusUnauthorized)
|
|
}
|
|
}
|
|
|
|
func TestListPromptsRequiresGiteaSession(t *testing.T) {
|
|
data := &fakeStore{prompts: []store.Prompt{{ID: "PM_TEST", Prompt: "Ship the prompt view", Status: "completed"}}}
|
|
handler := testServer(data, fakeGitea{user: gitea.User{ID: 42, Login: "alice"}, viewerAllowed: true, authenticated: true})
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/prompts?owner=hop&repo=demo", nil)
|
|
req.Header.Set("Cookie", "i_like_gitea=session")
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
if response.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusOK, response.Body.String())
|
|
}
|
|
if !bytes.Contains(response.Body.Bytes(), []byte("Ship the prompt view")) {
|
|
t.Fatalf("prompt missing from response: %s", response.Body.String())
|
|
}
|
|
if data.listUserID != 42 {
|
|
t.Fatalf("prompts listed for Gitea user %d, want 42", data.listUserID)
|
|
}
|
|
}
|
|
|
|
func TestListPromptsRejectsUnauthenticatedViewer(t *testing.T) {
|
|
handler := testServer(&fakeStore{}, fakeGitea{})
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/prompts?owner=hop&repo=demo", nil)
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
if response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusUnauthorized, response.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestCreatePrompt(t *testing.T) {
|
|
data := &fakeStore{}
|
|
handler := testServer(data, fakeGitea{user: gitea.User{ID: 42, Login: "alice"}})
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/hop/demo/prompts", bytes.NewBufferString(`{"user_login":"alice","prompt":"Ship the prompt view","agent_name":"codex","status":"completed","metadata":{"duration_ms":1200}}`))
|
|
req.Header.Set("Authorization", "Bearer admin-secret")
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
if response.Code != http.StatusCreated {
|
|
t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusCreated, response.Body.String())
|
|
}
|
|
if len(data.prompts) != 1 || data.prompts[0].Prompt != "Ship the prompt view" {
|
|
t.Fatalf("prompt not created: %#v", data.prompts)
|
|
}
|
|
if data.prompts[0].GiteaUserID != 42 {
|
|
t.Fatalf("prompt owner = %d, want 42", data.prompts[0].GiteaUserID)
|
|
}
|
|
}
|
|
|
|
func TestCreatePromptRequiresOwner(t *testing.T) {
|
|
handler := testServer(&fakeStore{}, fakeGitea{})
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/hop/demo/prompts", bytes.NewBufferString(`{"prompt":"private work","status":"completed"}`))
|
|
req.Header.Set("Authorization", "Bearer admin-secret")
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, req)
|
|
if response.Code != http.StatusBadRequest {
|
|
t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusBadRequest, response.Body.String())
|
|
}
|
|
}
|