Files
artifactapi/internal/provider/generic/generic_test.go
T
unkinben 109ba2ce27
ci/woodpecker/tag/docker Pipeline was successful
feat: server-level GitHub machine credential for authenticated requests (#109)
## Why

Anonymous GitHub is capped at 60 requests/hour and cannot read private repositories. A machine credential usable by a free (non-enterprise) account is needed to lift the request budget to ~5000/hr and to read private-repo release assets.

Builds on the background syncer (#108, now merged to `master`); this diff is the auth changes only.

## How

- Add `internal/githubauth`: a process-wide GitHub credential delivered via env/secret, applied by default to every outbound GitHub request (releases scan, ranged asset-header GETs, and the generic-github byte proxy for private assets).
- Support two modes:
  - **PAT** — `GITHUB_TOKEN` sent as `Authorization: Bearer <token>`.
  - **GitHub App** — `GITHUB_APP_ID` + `GITHUB_APP_INSTALLATION_ID` + private key (`GITHUB_APP_PRIVATE_KEY` inline PEM or `GITHUB_APP_PRIVATE_KEY_PATH`). Mint a short-lived RS256 JWT with stdlib `crypto/rsa` (no new dependency), exchange it at `POST /app/installations/{id}/access_tokens` for a ~1h installation token, cache it, and single-flight a refresh a few minutes before expiry.
- Inject at the two GitHub call paths: the rpm github provider header builder (releases + ranged fetches) and the generic provider `AuthHeaders` (byte proxy, github.com hosts only; the pre-signed `objects.githubusercontent.com` redirect deliberately gets no Authorization).
- Honor precedence: a remote's own `username`/`password` overrides the server credential; no credential configured stays anonymous (current behavior).
- Fail closed at startup on partial App configuration (e.g. App id without a private key); a token-and-App conflict is also rejected.
- Never persist the credential to the DB, return it from an API, or log it (token-exchange failures never echo the response body).
- Read config via the existing `getenv` convention; document PAT vs App setup, the free-account fine-grained PAT scopes (Contents:read + Metadata:read), precedence, and the rate-limit implication.

## Rate limit

Authenticated requests share the syncer's single global limiter — no second limiter is added. A token raises the effective GitHub ceiling (~5000/hr vs ~60/hr), so the limiter defaults stay safe.

## Tests

`internal/githubauth` and `internal/provider/{rpm,generic}`:
- PAT attaches the correct `Authorization` header to releases + asset-header requests.
- App mints a valid RS256 JWT (verified against the app public key), exchanges it at a mocked endpoint, reuses the cached token without re-exchanging, refreshes near expiry, and single-flights concurrent callers.
- Per-remote credential overrides the server credential (rpm + generic).
- No credential → no `Authorization` header, requests still succeed anonymously.
- ETag/304 flow still works with auth attached.
- The credential does not appear in a remote's serialized JSON.
- Config validation: no-config is anonymous; partial App config and token/App conflict both error.

Verified fail-before/pass-after for the injection tests. `gofmt -l`, `go build ./...`, `go vet ./...`, `go test ./...` all clean (26 packages).

Reviewed-on: #109
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
2026-08-10 21:42:39 +10:00

115 lines
3.5 KiB
Go

package generic_test
import (
"context"
"testing"
"git.unkin.net/unkin/artifactapi/internal/githubauth"
"git.unkin.net/unkin/artifactapi/internal/provider"
"git.unkin.net/unkin/artifactapi/internal/provider/generic"
"git.unkin.net/unkin/artifactapi/pkg/models"
)
type staticCred string
func (s staticCred) Token(context.Context) (string, error) { return string(s), nil }
func TestProvider_AuthHeaders_GitHubServerCredential(t *testing.T) {
githubauth.SetServer(staticCred("ghs_server"))
t.Cleanup(func() { githubauth.SetServer(nil) })
p := &generic.Provider{}
h, err := p.AuthHeaders(context.Background(), models.Remote{BaseURL: "https://github.com"})
if err != nil {
t.Fatalf("auth headers: %v", err)
}
if h.Get("Authorization") != "Bearer ghs_server" {
t.Fatalf("Authorization = %q, want Bearer ghs_server", h.Get("Authorization"))
}
}
func TestProvider_AuthHeaders_NonGitHubHostNoServerCredential(t *testing.T) {
githubauth.SetServer(staticCred("ghs_server"))
t.Cleanup(func() { githubauth.SetServer(nil) })
p := &generic.Provider{}
h, _ := p.AuthHeaders(context.Background(), models.Remote{BaseURL: "https://example.com/downloads"})
if h.Get("Authorization") != "" {
t.Fatalf("server credential must not be sent to non-github host, got %q", h.Get("Authorization"))
}
}
func TestProvider_AuthHeaders_PerRemoteOverridesServerCredential(t *testing.T) {
githubauth.SetServer(staticCred("ghs_server"))
t.Cleanup(func() { githubauth.SetServer(nil) })
p := &generic.Provider{}
h, _ := p.AuthHeaders(context.Background(), models.Remote{
BaseURL: "https://github.com",
Username: "user",
Password: "pass",
})
if got := h.Get("Authorization"); got != "Basic dXNlcjpwYXNz" {
t.Fatalf("per-remote Basic auth must win, got %q", got)
}
}
func TestProvider_Type(t *testing.T) {
p := &generic.Provider{}
if p.Type() != models.PackageGeneric {
t.Errorf("expected generic, got %q", p.Type())
}
}
func TestProvider_Classify_AllImmutable(t *testing.T) {
p := &generic.Provider{}
paths := []string{"file.tar.gz", "path/to/binary", "index.html", "data.json"}
for _, path := range paths {
if p.Classify(path) != provider.Immutable {
t.Errorf("generic should classify %q as immutable", path)
}
}
}
func TestProvider_ContentType(t *testing.T) {
p := &generic.Provider{}
tests := []struct{ path, want string }{
{"file.tar.gz", "application/gzip"},
{"file.tgz", "application/gzip"},
{"file.zip", "application/zip"},
{"file.rpm", "application/x-rpm"},
{"file.json", "application/json"},
{"file.unknown", "application/octet-stream"},
}
for _, tt := range tests {
if got := p.ContentType(tt.path); got != tt.want {
t.Errorf("ContentType(%q) = %q, want %q", tt.path, got, tt.want)
}
}
}
func TestProvider_UpstreamURL(t *testing.T) {
p := &generic.Provider{}
got := p.UpstreamURL(models.Remote{BaseURL: "https://example.com/repo"}, "path/to/file.tar.gz")
want := "https://example.com/repo/path/to/file.tar.gz"
if got != want {
t.Errorf("got %q, want %q", got, want)
}
}
func TestProvider_AuthHeaders_BasicAuth(t *testing.T) {
p := &generic.Provider{}
h, _ := p.AuthHeaders(context.Background(), models.Remote{Username: "user", Password: "pass"})
if h.Get("Authorization") != "Basic dXNlcjpwYXNz" {
t.Errorf("unexpected auth header: %q", h.Get("Authorization"))
}
}
func TestProvider_AuthHeaders_NoAuth(t *testing.T) {
p := &generic.Provider{}
h, _ := p.AuthHeaders(context.Background(), models.Remote{})
if h.Get("Authorization") != "" {
t.Error("expected no auth header")
}
}