Skip to content

G
gitlab-ce
Commit f4ded8a8 authored by Rémy Coutable's avatar Rémy Coutable
Browse files
Options

Merge branch 'hvlad/gitlab-ce-feature/add_test_for_git_http_ldap_user' into 'master' 

Added git http requests tests for user with LDAP identity

## What does this MR do?

Added tests to git http request for a user with ldap identity.

## Are there points in the code the reviewer needs to double check?

In order to stick to the way the existing tests are defined in spec files, I have added the new tests in the same spec file that coveres the git http request feature and thus it seems to be a lot of changes in the git_http_spec.rb when looking at the commit git in Gitlab, but the largest change is indentation so please check with a better diff tool (i.e. kdiff3).

Let me know if this is OK with you or do you want to have a new file introduced (i.e. `git_http_ldap_spec.rb`)

## Why was this MR needed?

To increase test coverage and to make sure  the changes that will be introduced by #20820 will not introduce any regressions.

## What are the relevant issue numbers?

#20820

See merge request !6559
parents 684baf7e dc15201c
Hide whitespace changes
Inline Side-by-side
Showing with 381 additions and 324 deletions
spec/requests/git_http_spec.rb
View file @ f4ded8a8
require "spec_helper" require "spec_helper"
describe 'Git HTTP requests', lib: true do describe 'Git HTTP requests', lib: true do
include GitHttpHelpers
include WorkhorseHelpers include WorkhorseHelpers
let(:user) { create(:user) }
let(:project) { create(:project, path: 'project.git-project') }
it "gives WWW-Authenticate hints" do it "gives WWW-Authenticate hints" do
clone_get('doesnt/exist.git') clone_get('doesnt/exist.git')
expect(response.header['WWW-Authenticate']).to start_with('Basic ') expect(response.header['WWW-Authenticate']).to start_with('Basic ')
end end
context "when the project doesn't exist" do describe "User with no identities" do
context "when no authentication is provided" do let(:user) { create(:user) }
it "responds with status 401 (no project existence information leak)" do let(:project) { create(:project, path: 'project.git-project') }
download('doesnt/exist.git') do |response|
expect(response).to have_http_status(401)
end
end
end
context "when username and password are provided" do context "when the project doesn't exist" do
context "when authentication fails" do context "when no authentication is provided" do
it "responds with status 401" do it "responds with status 401 (no project existence information leak)" do
download('doesnt/exist.git', user: user.username, password: "nope") do |response| download('doesnt/exist.git') do |response|
expect(response).to have_http_status(401) expect(response).to have_http_status(401)
end end
end end
end end
context "when authentication succeeds" do context "when username and password are provided" do
it "responds with status 404" do context "when authentication fails" do
download('/doesnt/exist.git', user: user.username, password: user.password) do |response| it "responds with status 401" do
expect(response).to have_http_status(404) download('doesnt/exist.git', user: user.username, password: "nope") do |response|
expect(response).to have_http_status(401)
end
end end
end end
end
end
end
context "when the Wiki for a project exists" do
it "responds with the right project" do
wiki = ProjectWiki.new(project)
project.update_attribute(:visibility_level, Project::PUBLIC)
download("/#{wiki.repository.path_with_namespace}.git") do |response| context "when authentication succeeds" do
json_body = ActiveSupport::JSON.decode(response.body) it "responds with status 404" do
download('/doesnt/exist.git', user: user.username, password: user.password) do |response|
expect(response).to have_http_status(200) expect(response).to have_http_status(404)
expect(json_body['RepoPath']).to include(wiki.repository.path_with_namespace) end
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) end
end
end end
end end
end
context "when the project exists" do context "when the Wiki for a project exists" do
let(:path) { "#{project.path_with_namespace}.git" } it "responds with the right project" do
wiki = ProjectWiki.new(project)
context "when the project is public" do
before do
project.update_attribute(:visibility_level, Project::PUBLIC) project.update_attribute(:visibility_level, Project::PUBLIC)
end
it "downloads get status 200" do download("/#{wiki.repository.path_with_namespace}.git") do |response|
download(path, {}) do |response| json_body = ActiveSupport::JSON.decode(response.body)
expect(response).to have_http_status(200) expect(response).to have_http_status(200)
expect(json_body['RepoPath']).to include(wiki.repository.path_with_namespace)
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end end
end end
end
context "when the project exists" do
let(:path) { "#{project.path_with_namespace}.git" }
it "uploads get status 401" do context "when the project is public" do
upload(path, {}) do |response| before do
expect(response).to have_http_status(401) project.update_attribute(:visibility_level, Project::PUBLIC)
end end
end
context "with correct credentials" do it "downloads get status 200" do
let(:env) { { user: user.username, password: user.password } } download(path, {}) do |response|
expect(response).to have_http_status(200)
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end
end
it "uploads get status 403" do it "uploads get status 401" do
upload(path, env) do |response| upload(path, {}) do |response|
expect(response).to have_http_status(403) expect(response).to have_http_status(401)
end end
end end
context 'but git-receive-pack is disabled' do context "with correct credentials" do
it "responds with status 404" do let(:env) { { user: user.username, password: user.password } }
allow(Gitlab.config.gitlab_shell).to receive(:receive_pack).and_return(false)
it "uploads get status 403" do
upload(path, env) do |response| upload(path, env) do |response|
expect(response).to have_http_status(403) expect(response).to have_http_status(403)
end end
end end
end
end
context 'but git-upload-pack is disabled' do context 'but git-receive-pack is disabled' do
it "responds with status 404" do it "responds with status 404" do
allow(Gitlab.config.gitlab_shell).to receive(:upload_pack).and_return(false) allow(Gitlab.config.gitlab_shell).to receive(:receive_pack).and_return(false)
download(path, {}) do |response| upload(path, env) do |response|
expect(response).to have_http_status(404) expect(response).to have_http_status(403)
end
end
end end
end end
end
context 'when the request is not from gitlab-workhorse' do
it 'raises an exception' do
expect do
get("/#{project.path_with_namespace}.git/info/refs?service=git-upload-pack")
end.to raise_error(JWT::DecodeError)
end
end
end
context "when the project is private" do context 'but git-upload-pack is disabled' do
before do it "responds with status 404" do
project.update_attribute(:visibility_level, Project::PRIVATE) allow(Gitlab.config.gitlab_shell).to receive(:upload_pack).and_return(false)
end
context "when no authentication is provided" do download(path, {}) do |response|
it "responds with status 401 to downloads" do expect(response).to have_http_status(404)
download(path, {}) do |response| end
expect(response).to have_http_status(401)
end end
end end
it "responds with status 401 to uploads" do context 'when the request is not from gitlab-workhorse' do
upload(path, {}) do |response| it 'raises an exception' do
expect(response).to have_http_status(401) expect do
get("/#{project.path_with_namespace}.git/info/refs?service=git-upload-pack")
end.to raise_error(JWT::DecodeError)
end end
end end
end end
context "when username and password are provided" do context "when the project is private" do
let(:env) { { user: user.username, password: 'nope' } } before do
project.update_attribute(:visibility_level, Project::PRIVATE)
end
context "when authentication fails" do context "when no authentication is provided" do
it "responds with status 401" do it "responds with status 401 to downloads" do
download(path, env) do |response| download(path, {}) do |response|
expect(response).to have_http_status(401) expect(response).to have_http_status(401)
end end
end end
context "when the user is IP banned" do it "responds with status 401 to uploads" do
it "responds with status 401" do upload(path, {}) do |response|
expect(Rack::Attack::Allow2Ban).to receive(:filter).and_return(true)
allow_any_instance_of(Rack::Request).to receive(:ip).and_return('1.2.3.4')
clone_get(path, env)
expect(response).to have_http_status(401) expect(response).to have_http_status(401)
end end
end end
end end
context "when authentication succeeds" do context "when username and password are provided" do
let(:env) { { user: user.username, password: user.password } } let(:env) { { user: user.username, password: 'nope' } }
context "when the user has access to the project" do context "when authentication fails" do
before do it "responds with status 401" do
project.team << [user, :master] download(path, env) do |response|
expect(response).to have_http_status(401)
end
end end
context "when the user is blocked" do context "when the user is IP banned" do
it "responds with status 404" do it "responds with status 401" do
user.block expect(Rack::Attack::Allow2Ban).to receive(:filter).and_return(true)
project.team << [user, :master] allow_any_instance_of(Rack::Request).to receive(:ip).and_return('1.2.3.4')
download(path, env) do |response| clone_get(path, env)
expect(response).to have_http_status(404)
end expect(response).to have_http_status(401)
end end
end end
end
context "when the user isn't blocked" do context "when authentication succeeds" do
it "downloads get status 200" do let(:env) { { user: user.username, password: user.password } }
expect(Rack::Attack::Allow2Ban).to receive(:reset)
clone_get(path, env) context "when the user has access to the project" do
before do
project.team << [user, :master]
end
expect(response).to have_http_status(200) context "when the user is blocked" do
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) it "responds with status 404" do
user.block
project.team << [user, :master]
download(path, env) do |response|
expect(response).to have_http_status(404)
end
end
end end
it "uploads get status 200" do context "when the user isn't blocked" do
upload(path, env) do |response| it "downloads get status 200" do
expect(Rack::Attack::Allow2Ban).to receive(:reset)
clone_get(path, env)
expect(response).to have_http_status(200) expect(response).to have_http_status(200)
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end end
end
end
context "when an oauth token is provided" do it "uploads get status 200" do
before do upload(path, env) do |response|
application = Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) expect(response).to have_http_status(200)
@token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id) expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end
end
end end
it "downloads get status 200" do context "when an oauth token is provided" do
clone_get "#{project.path_with_namespace}.git", user: 'oauth2', password: @token.token before do
application = Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user)
@token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id)
end
expect(response).to have_http_status(200) it "downloads get status 200" do
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) clone_get "#{project.path_with_namespace}.git", user: 'oauth2', password: @token.token
end
it "uploads get status 401 (no project existence information leak)" do expect(response).to have_http_status(200)
push_get "#{project.path_with_namespace}.git", user: 'oauth2', password: @token.token expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end
expect(response).to have_http_status(401) it "uploads get status 401 (no project existence information leak)" do
push_get "#{project.path_with_namespace}.git", user: 'oauth2', password: @token.token
expect(response).to have_http_status(401)
end
end end
end
context 'when user has 2FA enabled' do context 'when user has 2FA enabled' do
let(:user) { create(:user, :two_factor) } let(:user) { create(:user, :two_factor) }
let(:access_token) { create(:personal_access_token, user: user) } let(:access_token) { create(:personal_access_token, user: user) }
before do before do
project.team << [user, :master] project.team << [user, :master]
end end
context 'when username and password are provided' do context 'when username and password are provided' do
it 'rejects the clone attempt' do it 'rejects the clone attempt' do
download("#{project.path_with_namespace}.git", user: user.username, password: user.password) do |response| download("#{project.path_with_namespace}.git", user: user.username, password: user.password) do |response|
expect(response).to have_http_status(401) expect(response).to have_http_status(401)
expect(response.body).to include('You have 2FA enabled, please use a personal access token for Git over HTTP') expect(response.body).to include('You have 2FA enabled, please use a personal access token for Git over HTTP')
end
end end
end
it 'rejects the push attempt' do it 'rejects the push attempt' do
upload("#{project.path_with_namespace}.git", user: user.username, password: user.password) do |response| upload("#{project.path_with_namespace}.git", user: user.username, password: user.password) do |response|
expect(response).to have_http_status(401) expect(response).to have_http_status(401)
expect(response.body).to include('You have 2FA enabled, please use a personal access token for Git over HTTP') expect(response.body).to include('You have 2FA enabled, please use a personal access token for Git over HTTP')
end
end end
end end
end
context 'when username and personal access token are provided' do context 'when username and personal access token are provided' do
it 'allows clones' do it 'allows clones' do
download("#{project.path_with_namespace}.git", user: user.username, password: access_token.token) do |response| download("#{project.path_with_namespace}.git", user: user.username, password: access_token.token) do |response|
expect(response).to have_http_status(200) expect(response).to have_http_status(200)
end
end end
end
it 'allows pushes' do it 'allows pushes' do
upload("#{project.path_with_namespace}.git", user: user.username, password: access_token.token) do |response| upload("#{project.path_with_namespace}.git", user: user.username, password: access_token.token) do |response|
expect(response).to have_http_status(200) expect(response).to have_http_status(200)
end
end end
end end
end end
end
context "when blank password attempts follow a valid login" do context "when blank password attempts follow a valid login" do
def attempt_login(include_password) def attempt_login(include_password)
password = include_password ? user.password : "" password = include_password ? user.password : ""
clone_get path, user: user.username, password: password clone_get path, user: user.username, password: password
response.status response.status
end end
it "repeated attempts followed by successful attempt" do it "repeated attempts followed by successful attempt" do
options = Gitlab.config.rack_attack.git_basic_auth options = Gitlab.config.rack_attack.git_basic_auth
maxretry = options[:maxretry] - 1 maxretry = options[:maxretry] - 1
ip = '1.2.3.4' ip = '1.2.3.4'
allow_any_instance_of(Rack::Request).to receive(:ip).and_return(ip) allow_any_instance_of(Rack::Request).to receive(:ip).and_return(ip)
Rack::Attack::Allow2Ban.reset(ip, options) Rack::Attack::Allow2Ban.reset(ip, options)
maxretry.times.each do maxretry.times.each do
expect(attempt_login(false)).to eq(401) expect(attempt_login(false)).to eq(401)
end end
expect(attempt_login(true)).to eq(200) expect(attempt_login(true)).to eq(200)
expect(Rack::Attack::Allow2Ban.banned?(ip)).to be_falsey expect(Rack::Attack::Allow2Ban.banned?(ip)).to be_falsey
maxretry.times.each do maxretry.times.each do
expect(attempt_login(false)).to eq(401) expect(attempt_login(false)).to eq(401)
end end
Rack::Attack::Allow2Ban.reset(ip, options) Rack::Attack::Allow2Ban.reset(ip, options)
end
end end
end end
end
context "when the user doesn't have access to the project" do context "when the user doesn't have access to the project" do
it "downloads get status 404" do it "downloads get status 404" do
download(path, user: user.username, password: user.password) do |response| download(path, user: user.username, password: user.password) do |response|
expect(response).to have_http_status(404) expect(response).to have_http_status(404)
end
end end
end
it "uploads get status 404" do it "uploads get status 404" do
upload(path, user: user.username, password: user.password) do |response| upload(path, user: user.username, password: user.password) do |response|
expect(response).to have_http_status(404) expect(response).to have_http_status(404)
end
end end
end end
end end
end end
end
context "when a gitlab ci token is provided" do
let(:build) { create(:ci_build, :running) }
let(:project) { build.project }
let(:other_project) { create(:empty_project) }
before do
project.project_feature.update_attributes(builds_access_level: ProjectFeature::ENABLED)
end
context 'when build created by system is authenticated' do
it "downloads get status 200" do
clone_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(200)
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end
it "uploads get status 401 (no project existence information leak)" do
push_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(401)
end
it "downloads from other project get status 404" do
clone_get "#{other_project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(404) context "when a gitlab ci token is provided" do
end let(:build) { create(:ci_build, :running) }
end let(:project) { build.project }
let(:other_project) { create(:empty_project) }
context 'and build created by' do
before do before do
build.update(user: user) project.project_feature.update_attributes(builds_access_level: ProjectFeature::ENABLED)
project.team << [user, :reporter]
end end
shared_examples 'can download code only' do context 'when build created by system is authenticated' do
it 'downloads get status 200' do it "downloads get status 200" do
clone_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token clone_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(200) expect(response).to have_http_status(200)
expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end end
it 'uploads get status 403' do it "uploads get status 401 (no project existence information leak)" do
push_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token push_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(401) expect(response).to have_http_status(401)
end end
it "downloads from other project get status 404" do
clone_get "#{other_project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(404)
end
end end
context 'administrator' do context 'and build created by' do
let(:user) { create(:admin) } before do
build.update(user: user)
project.team << [user, :reporter]
end
it_behaves_like 'can download code only' shared_examples 'can download code only' do
it 'downloads get status 200' do
clone_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
it 'downloads from other project get status 403' do expect(response).to have_http_status(200)
clone_get "#{other_project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
end
expect(response).to have_http_status(403) it 'uploads get status 403' do
push_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(401)
end
end end
end
context 'regular user' do context 'administrator' do
let(:user) { create(:user) } let(:user) { create(:admin) }
it_behaves_like 'can download code only' it_behaves_like 'can download code only'
it 'downloads from other project get status 404' do it 'downloads from other project get status 403' do
clone_get "#{other_project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token clone_get "#{other_project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(404) expect(response).to have_http_status(403)
end
end
context 'regular user' do
let(:user) { create(:user) }
it_behaves_like 'can download code only'
it 'downloads from other project get status 404' do
clone_get "#{other_project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
expect(response).to have_http_status(404)
end
end end
end end
end end
end end
end end
end
context "when the project path doesn't end in .git" do context "when the project path doesn't end in .git" do
context "GET info/refs" do context "GET info/refs" do
let(:path) { "/#{project.path_with_namespace}/info/refs" } let(:path) { "/#{project.path_with_namespace}/info/refs" }
context "when no params are added" do context "when no params are added" do
before { get path } before { get path }
it "redirects to the .git suffix version" do it "redirects to the .git suffix version" do
expect(response).to redirect_to("/#{project.path_with_namespace}.git/info/refs") expect(response).to redirect_to("/#{project.path_with_namespace}.git/info/refs")
end
end end
end
context "when the upload-pack service is requested" do context "when the upload-pack service is requested" do
let(:params) { { service: 'git-upload-pack' } } let(:params) { { service: 'git-upload-pack' } }
before { get path, params } before { get path, params }
it "redirects to the .git suffix version" do it "redirects to the .git suffix version" do
expect(response).to redirect_to("/#{project.path_with_namespace}.git/info/refs?service=#{params[:service]}") expect(response).to redirect_to("/#{project.path_with_namespace}.git/info/refs?service=#{params[:service]}")
end
end end
end
context "when the receive-pack service is requested" do context "when the receive-pack service is requested" do
let(:params) { { service: 'git-receive-pack' } } let(:params) { { service: 'git-receive-pack' } }
before { get path, params } before { get path, params }
it "redirects to the .git suffix version" do it "redirects to the .git suffix version" do
expect(response).to redirect_to("/#{project.path_with_namespace}.git/info/refs?service=#{params[:service]}") expect(response).to redirect_to("/#{project.path_with_namespace}.git/info/refs?service=#{params[:service]}")
end
end end
end
context "when the params are anything else" do context "when the params are anything else" do
let(:params) { { service: 'git-implode-pack' } } let(:params) { { service: 'git-implode-pack' } }
before { get path, params } before { get path, params }
it "redirects to the sign-in page" do it "redirects to the sign-in page" do
expect(response).to redirect_to(new_user_session_path) expect(response).to redirect_to(new_user_session_path)
end
end end
end end
end
context "POST git-upload-pack" do context "POST git-upload-pack" do
it "fails to find a route" do it "fails to find a route" do
expect { clone_post(project.path_with_namespace) }.to raise_error(ActionController::RoutingError) expect { clone_post(project.path_with_namespace) }.to raise_error(ActionController::RoutingError)
end
end end
end
context "POST git-receive-pack" do context "POST git-receive-pack" do
it "failes to find a route" do it "failes to find a route" do
expect { push_post(project.path_with_namespace) }.to raise_error(ActionController::RoutingError) expect { push_post(project.path_with_namespace) }.to raise_error(ActionController::RoutingError)
end
end end
end end
end
context "retrieving an info/refs file" do context "retrieving an info/refs file" do
before { project.update_attribute(:visibility_level, Project::PUBLIC) } before { project.update_attribute(:visibility_level, Project::PUBLIC) }
context "when the file exists" do context "when the file exists" do
before do before do
# Provide a dummy file in its place # Provide a dummy file in its place
allow_any_instance_of(Repository).to receive(:blob_at).and_call_original allow_any_instance_of(Repository).to receive(:blob_at).and_call_original
allow_any_instance_of(Repository).to receive(:blob_at).with('5937ac0a7beb003549fc5fd26fc247adbce4a52e', 'info/refs') do allow_any_instance_of(Repository).to receive(:blob_at).with('5937ac0a7beb003549fc5fd26fc247adbce4a52e', 'info/refs') do
Gitlab::Git::Blob.find(project.repository, 'master', '.gitignore') Gitlab::Git::Blob.find(project.repository, 'master', '.gitignore')
end end
get "/#{project.path_with_namespace}/blob/master/info/refs" get "/#{project.path_with_namespace}/blob/master/info/refs"
end end
it "returns the file" do it "returns the file" do
expect(response).to have_http_status(200) expect(response).to have_http_status(200)
end
end end
end
context "when the file does not exist" do context "when the file does not exist" do
before { get "/#{project.path_with_namespace}/blob/master/info/refs" } before { get "/#{project.path_with_namespace}/blob/master/info/refs" }
it "returns not found" do it "returns not found" do
expect(response).to have_http_status(404) expect(response).to have_http_status(404)
end
end end
end end
end end
def clone_get(project, options = {}) describe "User with LDAP identity" do
get "/#{project}/info/refs", { service: 'git-upload-pack' }, auth_env(*options.values_at(:user, :password, :spnego_request_token)) let(:user) { create(:omniauth_user, extern_uid: dn) }
end let(:dn) { 'uid=john,ou=people,dc=example,dc=com' }
def clone_post(project, options = {})
post "/#{project}/git-upload-pack", {}, auth_env(*options.values_at(:user, :password, :spnego_request_token))
end
def push_get(project, options = {})
get "/#{project}/info/refs", { service: 'git-receive-pack' }, auth_env(*options.values_at(:user, :password, :spnego_request_token))
end
def push_post(project, options = {})
post "/#{project}/git-receive-pack", {}, auth_env(*options.values_at(:user, :password, :spnego_request_token))
end
def download(project, user: nil, password: nil, spnego_request_token: nil) before do
args = [project, { user: user, password: password, spnego_request_token: spnego_request_token }] allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
allow(Gitlab::LDAP::Authentication).to receive(:login).and_return(nil)
allow(Gitlab::LDAP::Authentication).to receive(:login).with(user.username, user.password).and_return(user)
end
clone_get(*args) context "when authentication fails" do
yield response context "when no authentication is provided" do
it "responds with status 401" do
download('doesnt/exist.git') do |response|
expect(response).to have_http_status(401)
end
end
end
clone_post(*args) context "when username and invalid password are provided" do
yield response it "responds with status 401" do
end download('doesnt/exist.git', user: user.username, password: "nope") do |response|
expect(response).to have_http_status(401)
end
end
end
end
def upload(project, user: nil, password: nil, spnego_request_token: nil) context "when authentication succeeds" do
args = [project, { user: user, password: password, spnego_request_token: spnego_request_token }] context "when the project doesn't exist" do
it "responds with status 404" do
download('/doesnt/exist.git', user: user.username, password: user.password) do |response|
expect(response).to have_http_status(404)
end
end
end
push_get(*args) context "when the project exists" do
yield response let(:project) { create(:project, path: 'project.git-project') }
push_post(*args) before do
yield response project.team << [user, :master]
end end
def auth_env(user, password, spnego_request_token) it "responds with status 200" do
env = workhorse_internal_api_request_header clone_get(path, user: user.username, password: user.password) do |response|
if user && password expect(response).to have_http_status(200)
env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials(user, password) end
elsif spnego_request_token end
env['HTTP_AUTHORIZATION'] = "Negotiate #{::Base64.strict_encode64('opaque_request_token')}" end
end end
env
end end
end end
spec/support/git_http_helpers.rb 0 → 100644
View file @ f4ded8a8
module GitHttpHelpers
def clone_get(project, options = {})
get "/#{project}/info/refs", { service: 'git-upload-pack' }, auth_env(*options.values_at(:user, :password, :spnego_request_token))
end
def clone_post(project, options = {})
post "/#{project}/git-upload-pack", {}, auth_env(*options.values_at(:user, :password, :spnego_request_token))
end
def push_get(project, options = {})
get "/#{project}/info/refs", { service: 'git-receive-pack' }, auth_env(*options.values_at(:user, :password, :spnego_request_token))
end
def push_post(project, options = {})
post "/#{project}/git-receive-pack", {}, auth_env(*options.values_at(:user, :password, :spnego_request_token))
end
def download(project, user: nil, password: nil, spnego_request_token: nil)
args = [project, { user: user, password: password, spnego_request_token: spnego_request_token }]
clone_get(*args)
yield response
clone_post(*args)
yield response
end
def upload(project, user: nil, password: nil, spnego_request_token: nil)
args = [project, { user: user, password: password, spnego_request_token: spnego_request_token }]
push_get(*args)
yield response
push_post(*args)
yield response
end
def auth_env(user, password, spnego_request_token)
env = workhorse_internal_api_request_header
if user && password
env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials(user, password)
elsif spnego_request_token
env['HTTP_AUTHORIZATION'] = "Negotiate #{::Base64.strict_encode64('opaque_request_token')}"
end
env
end
end
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7