vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Code

392 commit(s) on main

history blame raw 1.3 KiB

1	package server_test
2
3	// Dev login is a loopback-only development shortcut: no passkey ceremony, no
4	// HTTPS, but the same session and CSRF machinery every write uses.
5
6	import (
7	"net/http"
8	"strings"
9	"testing"
10
11	"rodent.software/vole/forge/config"
12	)
13
14	func TestDevLoginSignsInALoopbackBrowser(t *testing.T) {
15	t.Parallel()
16	f := newFixtureWith(t, func(c *config.Config) { c.DevOnly = true; c.DevLogin = "keenan" })
17	f.publish(f.repo)
18	// The development listener is the address the browser actually reached; in a
19	// real deployment that is what http_addr names.
20	f.cfg.HTTPAddr = f.http.Listener.Addr().String()
21
22	resp, body := f.browserGet(t, "/"+f.repo+"/issues", "")
23	if resp.StatusCode != http.StatusOK {
24	t.Fatalf("issues page = %d\n%s", resp.StatusCode, body)
25	}
26	if !strings.Contains(body, "New issue") {
27	t.Fatalf("dev login did not grant the owner's write controls:\n%s", body)
28	}
29	if !strings.Contains(body, `title="Development sign-in"`) {
30	t.Fatalf("the page does not mark the development session:\n%s", body)
31	}
32	var dev *http.Cookie
33	for _, c := range resp.Cookies() {
34	if c.Name == "vole_dev_session" {
35	dev = c
36	}
37	}
38	if dev == nil {
39	t.Fatal("no development session cookie was set")
40	}
41	if dev.Secure {
42	t.Fatal("the loopback dev cookie is Secure; an HTTP preview cannot return it")
43	}
44	}
45