Preflight Gitea credentials with repository reads

internal/gitea/backend_test.go

@@ -114,3 +114,134 @@ func TestBackendRejectsAssetHandleFromAnotherBackendType(t *testing.T) {
 		t.Fatalf("OpenAsset() error = %v, want invalid handle", err)
 	}
 }
+
+func TestBackendPreflightUsesAuthenticatedRepositoryReadsAndIgnoresCodePushPermission(t *testing.T) {
+	var requests []string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			t.Errorf("method = %q, want GET", r.Method)
+		}
+		if got, want := r.Header.Get("Authorization"), "token fixture-secret-token"; got != want {
+			t.Errorf("authorization = %q, want %q", got, want)
+		}
+		requests = append(requests, r.URL.Path)
+		writeRepository := func() {
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"id": 31, "name": "project", "full_name": "owner/project",
+				"owner":       map[string]string{"login": "owner"},
+				"permissions": map[string]bool{"admin": false, "push": false, "pull": true},
+			})
+		}
+		switch r.URL.Path {
+		case "/api/v1/repos/owner/project", "/api/v1/repositories/31":
+			writeRepository()
+		default:
+			t.Errorf("unexpected path %q", r.URL.Path)
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	if err := NewBackend(testDestination(server.URL), server.Client()).Preflight(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if len(requests) != 2 || requests[0] != "/api/v1/repos/owner/project" || requests[1] != "/api/v1/repositories/31" {
+		t.Fatalf("preflight requests = %v, want both repository reads", requests)
+	}
+}
+
+func TestBackendPreflightRequiresCredentialWithoutMakingRequests(t *testing.T) {
+	var requests int
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { requests++ }))
+	defer server.Close()
+	destination := testDestination(server.URL)
+	destination.Token = " \t"
+
+	err := NewBackend(destination, server.Client()).Preflight(context.Background())
+	var failure *forge.PreflightFailure
+	if !errors.As(err, &failure) || failure.Kind != forge.PreflightMissingCredential {
+		t.Fatalf("Preflight() error = %v, want missing credential", err)
+	}
+	if requests != 0 {
+		t.Fatalf("made %d requests without a credential", requests)
+	}
+}
+
+func TestBackendPreflightDoesNotAcceptPublicLookupWithoutAuthenticatedAccess(t *testing.T) {
+	var requests []string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests = append(requests, r.URL.Path)
+		if r.URL.Path == "/api/v1/repos/owner/project" {
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 31, "name": "project", "full_name": "owner/project", "owner": map[string]string{"login": "owner"}})
+			return
+		}
+		http.Error(w, "token rejected", http.StatusUnauthorized)
+	}))
+	defer server.Close()
+
+	err := NewBackend(testDestination(server.URL), server.Client()).Preflight(context.Background())
+	var failure *forge.PreflightFailure
+	if !errors.As(err, &failure) || failure.Kind != forge.PreflightInvalidCredential {
+		t.Fatalf("Preflight() error = %v, want invalid credential", err)
+	}
+	if len(requests) != 2 || requests[1] != "/api/v1/repositories/31" {
+		t.Fatalf("preflight requests = %v, want authenticated repository read", requests)
+	}
+	if strings.Contains(err.Error(), testDestination(server.URL).Token) {
+		t.Fatalf("preflight error exposed the credential: %v", err)
+	}
+}
+
+func TestBackendPreflightClassifiesDeniedAndHiddenRepositoriesAsInaccessible(t *testing.T) {
+	for _, status := range []int{http.StatusForbidden, http.StatusNotFound} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Error(w, "repository unavailable", status)
+			}))
+			defer server.Close()
+
+			err := NewBackend(testDestination(server.URL), server.Client()).Preflight(context.Background())
+			var failure *forge.PreflightFailure
+			if !errors.As(err, &failure) || failure.Kind != forge.PreflightInaccessibleDestination {
+				t.Fatalf("Preflight() error = %v, want inaccessible destination", err)
+			}
+		})
+	}
+}
+
+func TestBackendPreflightClassifiesUnverifiableResponsesAsUnavailable(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		respond func(http.ResponseWriter)
+	}{
+		{name: "malformed JSON", respond: func(w http.ResponseWriter) { _, _ = io.WriteString(w, "{") }},
+		{name: "service failure", respond: func(w http.ResponseWriter) { http.Error(w, "temporarily unavailable", http.StatusServiceUnavailable) }},
+		{name: "wrong repository identity", respond: func(w http.ResponseWriter) {
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 31, "name": "other", "full_name": "owner/other", "owner": map[string]string{"login": "owner"}})
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { test.respond(w) }))
+			defer server.Close()
+
+			err := NewBackend(testDestination(server.URL), server.Client()).Preflight(context.Background())
+			var failure *forge.PreflightFailure
+			if !errors.As(err, &failure) || failure.Kind != forge.PreflightUnavailable {
+				t.Fatalf("Preflight() error = %v, want unavailable", err)
+			}
+		})
+	}
+}
+
+func TestBackendPreflightPreservesCancellation(t *testing.T) {
+	server := httptest.NewServer(http.NotFoundHandler())
+	defer server.Close()
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	err := NewBackend(testDestination(server.URL), server.Client()).Preflight(ctx)
+	var failure *forge.PreflightFailure
+	if !errors.As(err, &failure) || failure.Kind != forge.PreflightUnavailable || !errors.Is(err, context.Canceled) {
+		t.Fatalf("Preflight() error = %v, want unavailable and context cancellation", err)
+	}
+}