Log in to artifactapi with a Vault identity OIDC token

test/login_test.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+set -u
+ARTIFACTAPI_LOGIN_NOEXEC=1 . "$(dirname "$0")/../artifactapi-login.sh"
+
+SA_TOKEN_FILE=$(mktemp)
+echo sa-jwt > "$SA_TOKEN_FILE"
+REG=artifactapi.k8s.syd1.au.unkin.net
+OK_LOGIN='{"registry":"'$REG'","username":"woodpecker","password":"oidc-jwt"}'
+VAULT_FAIL=
+
+curl() {
+  [ -z "$VAULT_FAIL" ] || return 22
+  case "$*" in
+    *auth/k8s/au/syd1/login*) grep -q '"role":"woodpecker_artifactapi_writer","jwt":"sa-jwt"' && echo '{"auth":{"client_token":"s.client"}}' ;;
+    *"X-Vault-Token: s.client"*identity/oidc/token/artifactapi-writer) echo '{"data":{"token":"oidc-jwt"}}' ;;
+    *) return 22 ;;
+  esac
+}
+
+fail=0
+check() {
+  name=$1 want=$2; shift 2
+  got=$(unset PLUGIN_REGISTRY PLUGIN_REPO PLUGIN_USERNAME PLUGIN_PASSWORD PLUGIN_LOGINS PLUGIN_DRY_RUN
+    for kv in "$@"; do export "$kv"; done
+    artifactapi_login 2>/dev/null; printf %s "${PLUGIN_LOGINS:-}")
+  if [ "$got" = "$want" ]; then echo "ok   $name"; else echo "FAIL $name: got [$got] want [$want]"; fail=1; fi
+}
+
+check "registry setting logs in" "[$OK_LOGIN]" PLUGIN_REGISTRY=$REG
+check "repo on artifactapi logs in" "[$OK_LOGIN]" PLUGIN_REPO=$REG/docker-internal/x
+check "existing logins kept" '[{"registry":"r","username":"u","password":"p"},'"$OK_LOGIN]" PLUGIN_REGISTRY=$REG 'PLUGIN_LOGINS=[{"registry":"r","username":"u","password":"p"}]'
+check "other registry skipped" "" PLUGIN_REPO=git.unkin.net/unkin/x
+check "dry run skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_DRY_RUN=true
+check "explicit creds skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_USERNAME=u PLUGIN_PASSWORD=p
+check "explicit login skipped" '[{"registry":"'$REG'"}]' PLUGIN_REGISTRY=$REG 'PLUGIN_LOGINS=[{"registry":"'$REG'"}]'
+check "missing sa token is anonymous" "" PLUGIN_REGISTRY=$REG SA_TOKEN_FILE=/nonexistent
+check "vault failure is anonymous" "" PLUGIN_REGISTRY=$REG VAULT_FAIL=1
+check "bad role is anonymous" "" PLUGIN_REGISTRY=$REG PLUGIN_VAULT_ROLE=other
+exit $fail