debian-mirror-gitlab/spec/requests/api/go_proxy_spec.rb

# frozen_string_literal: true

require 'spec_helper'

RSpec.describe API::GoProxy do
  include PackagesManagerApiSpecHelpers
  include HttpBasicAuthHelpers

  let_it_be(:user) { create :user }
  let_it_be(:project) { create :project_empty_repo, creator: user, path: 'my-go-lib' }
  let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }

  let_it_be(:oauth) { create :oauth_access_token, scopes: 'api', resource_owner: user }
  let_it_be(:job) { create :ci_build, user: user, status: :running, project: project }
  let_it_be(:pa_token) { create :personal_access_token, user: user }

  let_it_be(:modules) do
    commits = [
      create(:go_module_commit, :files,   project: project, tag: 'v1.0.0', files: { 'README.md' => 'Hi' }),
      create(:go_module_commit, :module,  project: project, tag: 'v1.0.1'),
      create(:go_module_commit, :package, project: project, tag: 'v1.0.2', path: 'pkg'),
      create(:go_module_commit, :module,  project: project, tag: 'v1.0.3', name: 'mod'),
      create(:go_module_commit, :files,   project: project,                files: { 'y.go' => "package a\n" }),
      create(:go_module_commit, :module,  project: project,                name: 'v2'),
      create(:go_module_commit, :files,   project: project, tag: 'v2.0.0', files: { 'v2/x.go' => "package a\n" })
    ]

    { sha: [commits[4].sha, commits[5].sha] }
  end

  before do
    project.add_developer(user)

    stub_feature_flags(go_proxy_disable_gomod_validation: false)

    modules
  end

  shared_examples 'an unavailable resource' do
    it 'returns not found' do
      get_resource(user)

      expect(response).to have_gitlab_http_status(:not_found)
    end
  end

  shared_examples 'a module version list resource' do |*versions, path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:resource) { "list" }

    it "returns #{versions.empty? ? 'nothing' : versions.join(', ')}" do
      get_resource(user)

      expect(response).to have_gitlab_http_status(:ok)
      expect(response.body.split("\n").to_set).to eq(versions.to_set)
    end
  end

  shared_examples 'a missing module version list resource' do |path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:resource) { "list" }

    it_behaves_like 'an unavailable resource'
  end

  shared_examples 'a module version information resource' do |version, path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:resource) { "#{version}.info" }

    it "returns information for #{version}" do
      get_resource(user)

      time = project.repository.find_tag(version).dereferenced_target.committed_date

      expect(response).to have_gitlab_http_status(:ok)
      expect(json_response).to be_kind_of(Hash)
      expect(json_response['Version']).to eq(version)
      expect(json_response['Time']).to eq(time.strftime('%Y-%m-%dT%H:%M:%S.%L%:z'))
    end
  end

  shared_examples 'a missing module version information resource' do |version, path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:resource) { "#{version}.info" }

    it_behaves_like 'an unavailable resource'
  end

  shared_examples 'a module pseudo-version information resource' do |prefix, path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:commit) { project.repository.commit_by(oid: sha) }
    let(:version) { fmt_pseudo_version prefix, commit }
    let(:resource) { "#{version}.info" }

    it "returns information for #{prefix}yyyymmddhhmmss-abcdefabcdef" do
      get_resource(user)

      expect(response).to have_gitlab_http_status(:ok)
      expect(json_response).to be_kind_of(Hash)
      expect(json_response['Version']).to eq(version)
      expect(json_response['Time']).to eq(commit.committed_date.strftime('%Y-%m-%dT%H:%M:%S.%L%:z'))
    end
  end

  shared_examples 'a missing module pseudo-version information resource' do |path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:commit) do
      raise "tried to reference :commit without defining :sha" unless defined?(sha)

      project.repository.commit_by(oid: sha)
    end

    let(:resource) { "#{version}.info" }

    it_behaves_like 'an unavailable resource'
  end

  shared_examples 'a module file resource' do |version, path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:resource) { "#{version}.mod" }

    it "returns #{path}/go.mod from the repo" do
      get_resource(user)

      expect(response).to have_gitlab_http_status(:ok)
      expect(response.body.split("\n", 2).first).to eq("module #{module_name}")
    end
  end

  shared_examples 'a missing module file resource' do |version, path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:resource) { "#{version}.mod" }

    it_behaves_like 'an unavailable resource'
  end

  shared_examples 'a module archive resource' do |version, entries, path: ''|
    let(:module_name) { "#{base}#{path}" }
    let(:resource) { "#{version}.zip" }

    it "returns an archive of #{path.empty? ? '/' : path} @ #{version} from the repo" do
      get_resource(user)

      expect(response).to have_gitlab_http_status(:ok)

      entries = entries.map { |e| "#{module_name}@#{version}/#{e}" }.to_set
      actual = Set[]
      Zip::InputStream.open(StringIO.new(response.body)) do |zip|
        while (entry = zip.get_next_entry)
          actual.add(entry.name)
        end
      end

      expect(actual).to eq(entries)
    end
  end

  describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
    context 'for the root module' do
      it_behaves_like 'a module version list resource', 'v1.0.1', 'v1.0.2', 'v1.0.3'
    end

    context 'for the package' do
      it_behaves_like 'a module version list resource', path: '/pkg'
    end

    context 'for the submodule' do
      it_behaves_like 'a module version list resource', 'v1.0.3', path: '/mod'
    end

    context 'for the root module v2' do
      it_behaves_like 'a module version list resource', 'v2.0.0', path: '/v2'
    end

    context 'with a URL encoded relative path component' do
      it_behaves_like 'a missing module version list resource', path: '/%2E%2E%2Fxyz'
    end

    context 'with the feature disabled' do
      before do
        stub_feature_flags(go_proxy: false)
      end

      it_behaves_like 'a missing module version list resource'
    end
  end

  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
    context 'with the root module v1.0.1' do
      it_behaves_like 'a module version information resource', 'v1.0.1'
    end

    context 'with the submodule v1.0.3' do
      it_behaves_like 'a module version information resource', 'v1.0.3', path: '/mod'
    end

    context 'with the root module v2.0.0' do
      it_behaves_like 'a module version information resource', 'v2.0.0', path: '/v2'
    end

    context 'with an invalid path' do
      it_behaves_like 'a missing module version information resource', 'v1.0.3', path: '/pkg'
    end

    context 'with an invalid version' do
      it_behaves_like 'a missing module version information resource', 'v1.0.1', path: '/mod'
    end

    context 'with a pseudo-version for v1' do
      it_behaves_like 'a module pseudo-version information resource', 'v1.0.4-0.' do
        let(:sha) { modules[:sha][0] }
      end
    end

    context 'with a pseudo-version for v2' do
      it_behaves_like 'a module pseudo-version information resource', 'v2.0.0-', path: '/v2' do
        let(:sha) { modules[:sha][1] }
      end
    end

    context 'with a pseudo-version with an invalid timestamp' do
      it_behaves_like 'a missing module pseudo-version information resource' do
        let(:version) { "v1.0.4-0.00000000000000-#{modules[:sha][0][0..11]}" }
      end
    end

    context 'with a pseudo-version with an invalid commit sha' do
      it_behaves_like 'a missing module pseudo-version information resource' do
        let(:sha) { modules[:sha][0] }
        let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-000000000000" }
      end
    end

    context 'with a pseudo-version with a short commit sha' do
      it_behaves_like 'a missing module pseudo-version information resource' do
        let(:sha) { modules[:sha][0] }
        let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{modules[:sha][0][0..10]}" }
      end
    end
  end

  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.mod' do
    context 'with the root module v1.0.1' do
      it_behaves_like 'a module file resource', 'v1.0.1'
    end

    context 'with the submodule v1.0.3' do
      it_behaves_like 'a module file resource', 'v1.0.3', path: '/mod'
    end

    context 'with the root module v2.0.0' do
      it_behaves_like 'a module file resource', 'v2.0.0', path: '/v2'
    end

    context 'with an invalid path' do
      it_behaves_like 'a missing module file resource', 'v1.0.3', path: '/pkg'
    end

    context 'with an invalid version' do
      it_behaves_like 'a missing module file resource', 'v1.0.1', path: '/mod'
    end
  end

  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.zip' do
    context 'with the root module v1.0.1' do
      it_behaves_like 'a module archive resource', 'v1.0.1', ['README.md', 'go.mod', 'a.go']
    end

    context 'with the root module v1.0.2' do
      it_behaves_like 'a module archive resource', 'v1.0.2', ['README.md', 'go.mod', 'a.go', 'pkg/b.go']
    end

    context 'with the root module v1.0.3' do
      it_behaves_like 'a module archive resource', 'v1.0.3', ['README.md', 'go.mod', 'a.go', 'pkg/b.go']
    end

    context 'with the submodule v1.0.3' do
      it_behaves_like 'a module archive resource', 'v1.0.3', ['go.mod', 'a.go'], path: '/mod'
    end

    context 'with the root module v2.0.0' do
      it_behaves_like 'a module archive resource', 'v2.0.0', ['go.mod', 'a.go', 'x.go'], path: '/v2'
    end
  end

  context 'with an invalid module directive' do
    let_it_be(:project) { create :project_empty_repo, :public, creator: user }
    let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }

    let_it_be(:modules) do
      create(:go_module_commit, :files, project: project,                files: { 'a.go' => "package\a" })
      create(:go_module_commit, :files, project: project, tag: 'v1.0.0', files: { 'go.mod' => "module not/a/real/module\n" })
      create(:go_module_commit, :files, project: project,                files: { 'v2/a.go' => "package a\n" })
      create(:go_module_commit, :files, project: project, tag: 'v2.0.0', files: { 'v2/go.mod' => "module #{base}\n" })
    end

    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
      context 'with a completely wrong directive for v1' do
        it_behaves_like 'a module version list resource'
      end

      context 'with a directive omitting the suffix for v2' do
        it_behaves_like 'a module version list resource', path: '/v2'
      end
    end

    describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
      context 'with a completely wrong directive for v1' do
        it_behaves_like 'a missing module version information resource', 'v1.0.0'
      end

      context 'with a directive omitting the suffix for v2' do
        it_behaves_like 'a missing module version information resource', 'v2.0.0', path: '/v2'
      end
    end
  end

  context 'with a case sensitive project and versions' do
    let_it_be(:project) { create :project_empty_repo, :public, creator: user, path: 'MyGoLib' }
    let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }
    let_it_be(:base_encoded) { base.gsub(/[A-Z]/) { |s| "!#{s.downcase}" } }

    let_it_be(:modules) do
      create(:go_module_commit, :files,   project: project, files: { 'README.md' => "Hi" })
      create(:go_module_commit, :module,  project: project, tag: 'v1.0.1-prerelease')
      create(:go_module_commit, :package, project: project, tag: 'v1.0.1-Prerelease', path: 'pkg')
    end

    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
      let(:resource) { "list" }

      context 'with a case encoded path' do
        it_behaves_like 'a module version list resource', 'v1.0.1-prerelease', 'v1.0.1-Prerelease' do
          let(:module_name) { base_encoded }
        end
      end

      context 'without a case encoded path' do
        it_behaves_like 'a missing module version list resource' do
          let(:module_name) { base.downcase }
        end
      end
    end

    describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
      context 'with a case encoded path' do
        it_behaves_like 'a module version information resource', 'v1.0.1-Prerelease' do
          let(:module_name) { base_encoded }
          let(:resource) { "v1.0.1-!prerelease.info" }
        end
      end

      context 'without a case encoded path' do
        it_behaves_like 'a module version information resource', 'v1.0.1-prerelease' do
          let(:module_name) { base_encoded }
          let(:resource) { "v1.0.1-prerelease.info" }
        end
      end
    end
  end

  context 'with a private project' do
    let(:module_name) { base }

    before do
      project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
    end

    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
      let(:resource) { "list" }

      it 'returns ok with an oauth token' do
        get_resource(oauth_access_token: oauth)

        expect(response).to have_gitlab_http_status(:ok)
      end

      it 'returns ok with a job token' do
        get_resource(access_token: job)

        expect(response).to have_gitlab_http_status(:ok)
      end

      it 'returns ok with a personal access token' do
        get_resource(personal_access_token: pa_token)

        expect(response).to have_gitlab_http_status(:ok)
      end

      it 'returns ok with a personal access token and basic authentication' do
        get_resource(headers: basic_auth_header(user.username, pa_token.token))

        expect(response).to have_gitlab_http_status(:ok)
      end

      it 'returns unauthorized with a failed job token' do
        job.update!(status: :failed)
        get_resource(access_token: job)

        expect(response).to have_gitlab_http_status(:unauthorized)
      end

      it 'returns unauthorized with no authentication' do
        get_resource

        expect(response).to have_gitlab_http_status(:unauthorized)
      end
    end

    context 'with access to package registry for everyone' do
      let_it_be(:user) { nil }

      before do
        project.reload.project_feature.update!(package_registry_access_level: ProjectFeature::PUBLIC)
      end

      it_behaves_like 'a module version list resource', 'v1.0.1', 'v1.0.2', 'v1.0.3'
      it_behaves_like 'a module version information resource', 'v1.0.1'
      it_behaves_like 'a module file resource', 'v1.0.1'
      it_behaves_like 'a module archive resource', 'v1.0.1', ['README.md', 'go.mod', 'a.go']
    end
  end

  context 'with a public project' do
    let(:module_name) { base }

    before do
      project.update!(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
    end

    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
      let(:resource) { "list" }

      it 'returns ok with no authentication' do
        get_resource

        expect(response).to have_gitlab_http_status(:ok)
      end
    end
  end

  context 'with a non-existent project' do
    def get_resource(user = nil, **params)
      get api("/projects/not%2fa%2fproject/packages/go/#{base}/@v/list", user, **params)
    end

    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
      it 'returns not found with a user' do
        get_resource(user)

        expect(response).to have_gitlab_http_status(:not_found)
      end

      it 'returns not found with an oauth token' do
        get_resource(oauth_access_token: oauth)

        expect(response).to have_gitlab_http_status(:not_found)
      end

      it 'returns not found with a job token' do
        get_resource(access_token: job)

        expect(response).to have_gitlab_http_status(:not_found)
      end

      it 'returns not found with a personal access token' do
        get_resource(personal_access_token: pa_token)

        expect(response).to have_gitlab_http_status(:not_found)
      end

      it 'returns unauthorized with no authentication' do
        get_resource

        expect(response).to have_gitlab_http_status(:unauthorized)
      end
    end
  end

  def get_resource(user = nil, headers: {}, **params)
    get api("/projects/#{project.id}/packages/go/#{module_name}/@v/#{resource}", user, **params), headers: headers
  end

  def fmt_pseudo_version(prefix, commit)
    "#{prefix}#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{commit.sha[0..11]}"
  end
end