unkin-agent
7ef0e28e96
Vault-minted Gitea tokens last ~1h, far less than a watch, and every poll past expiry 401'd into a warning while watchpr looked healthy. - retry a rejected request once with a freshly minted token - abort the watch when the fresh token is rejected too - poll anonymously when no token can be minted, mint only on a real 401/403
73 lines
2.2 KiB
Go
73 lines
2.2 KiB
Go
package main
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
// A bad PR reference must fail the command (so main exits non-zero) rather than
|
|
// return nil. Parsing rejects the ref before any Vault/Gitea call, so this stays
|
|
// hermetic.
|
|
func TestExecuteBadRefErrors(t *testing.T) {
|
|
cmd := newRootCmd()
|
|
cmd.SetArgs([]string{"--once", "not-a-ref"})
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
if err := cmd.Execute(); err == nil {
|
|
t.Fatal("Execute() = nil, want error for a bad PR reference")
|
|
}
|
|
}
|
|
|
|
// No arguments is also an error (nothing to watch).
|
|
func TestExecuteNoArgsErrors(t *testing.T) {
|
|
cmd := newRootCmd()
|
|
cmd.SetArgs(nil)
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
if err := cmd.Execute(); err == nil {
|
|
t.Fatal("Execute() = nil, want error when no PR references are given")
|
|
}
|
|
}
|
|
|
|
// Watching a public repo with no credentials available must work: the failed
|
|
// mint is a warning, the poll goes out unauthenticated, and the command exits 0.
|
|
func TestOnceRunsAnonymouslyWhenNoTokenIsAvailable(t *testing.T) {
|
|
vault := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusForbidden)
|
|
}))
|
|
defer vault.Close()
|
|
|
|
authHeaders := 0
|
|
mux := http.NewServeMux()
|
|
mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("Authorization") != "" {
|
|
authHeaders++
|
|
}
|
|
_, _ = io.WriteString(w, `{"number":7,"state":"open","mergeable":true,"head":{"sha":"cafebabe"}}`)
|
|
})
|
|
mux.HandleFunc("/api/v1/repos/unkin/repo/commits/cafebabe/status", func(w http.ResponseWriter, r *http.Request) {
|
|
_, _ = io.WriteString(w, `{"state":"success"}`)
|
|
})
|
|
mux.HandleFunc("/api/v1/repos/unkin/repo/issues/7/comments", func(w http.ResponseWriter, r *http.Request) {
|
|
_, _ = io.WriteString(w, `[]`)
|
|
})
|
|
gitea := httptest.NewServer(mux)
|
|
defer gitea.Close()
|
|
|
|
t.Setenv("VAULT_ADDR", vault.URL)
|
|
t.Setenv("GITEA_URL", gitea.URL)
|
|
|
|
cmd := newRootCmd()
|
|
cmd.SetArgs([]string{"--once", "unkin/repo#7"})
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
if err := cmd.Execute(); err != nil {
|
|
t.Fatalf("anonymous --once should succeed without a token: %v", err)
|
|
}
|
|
if authHeaders != 0 {
|
|
t.Errorf("sent %d Authorization headers, want none", authHeaders)
|
|
}
|
|
}
|