Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Code

395 commit(s) on main

Compare History
update readme Keenan Nemetz · 38m ago 32290114
history blame raw 5.6 KiB
1package server_test
2
3// The instance repository is the ".github" idea: fixed paths in one private
4// repository, read as data. These tests cover the files that reach a page, the
5// static handler, the private README audience, and the admin scaffold.
6
7import (
8 "net/url"
9 "strings"
10 "testing"
11)
12
13func TestInstanceRepoSuppliesThePage(t *testing.T) {
14 t.Parallel()
15 f := browserFixture(t)
16 f.instanceRepo(t, map[string][]byte{
17 "profile/README.md": []byte("# From the repo\n\nCustom words."),
18 "profile/private/README.md": []byte("# Members only\n\nInternal words."),
19 "profile/custom.css": []byte(":root { --accent: #ff0000; }\n"),
20 "profile/favicon.svg": []byte(`<svg xmlns="http://www.w3.org/2000/svg"></svg>`),
21 "assets/logo.png": []byte("PNG"),
22 "assets/evil.js": []byte("alert(1)"),
23 })
24
25 _, body := f.get("/")
26 for _, want := range []string{
27 "From the repo", "Custom words.",
28 `href="/-/static/custom/profile/custom.css?v=`,
29 `href="/-/static/custom/profile/favicon.svg?v=`,
30 } {
31 if !strings.Contains(body, want) {
32 t.Fatalf("home is missing %q:\n%s", want, body)
33 }
34 }
35 for _, unwanted := range []string{`name="intro"`, `href="/?edit=1`, `class="readme-head"`} {
36 if strings.Contains(body, unwanted) {
37 t.Fatalf("the home introduction still has %q:\n%s", unwanted, body)
38 }
39 }
40 if strings.Contains(body, "Members only") {
41 t.Fatalf("the private README leaked to an anonymous viewer:\n%s", body)
42 }
43
44 // A signed-in viewer gets the private README instead of the public one.
45 _, cookie := f.browserSession(t, f.ownerID)
46 _, signed := f.browserGet(t, "/", cookie)
47 if !strings.Contains(signed, "Members only") || strings.Contains(signed, "Custom words.") {
48 t.Fatalf("signed-in home did not use the private README:\n%s", signed)
49 }
50
51 resp, css := f.get("/-/static/custom/profile/custom.css")
52 if resp != 200 || !strings.Contains(css, "--accent") {
53 t.Fatalf("custom.css = %d %q", resp, css)
54 }
55 resp, png := f.get("/-/static/custom/assets/logo.png")
56 if resp != 200 || png != "PNG" {
57 t.Fatalf("asset = %d %q", resp, png)
58 }
59 // A same-origin script is not an asset.
60 if resp, _ := f.get("/-/static/custom/assets/evil.js"); resp != 404 {
61 t.Fatalf("a script under assets/ = %d, want 404", resp)
62 }
63}
64
65func TestInstanceThemesAppearInAppearance(t *testing.T) {
66 t.Parallel()
67 f := browserFixture(t)
68 f.instanceRepo(t, map[string][]byte{
69 "profile/themes/acme-ocean.css": []byte(`:root[data-theme="acme-ocean"] { color-scheme: dark; --accent: #38bdf8; }`),
70 "profile/themes/acme-paper.css": []byte(`:root[data-theme="acme-paper"] { color-scheme: light; --accent: #9a5b13; }`),
71 "profile/themes/notes.txt": []byte("not a theme"),
72 })
73
74 _, cookie := f.browserSession(t, f.ownerID)
75 resp, account := f.browserGet(t, "/-/account", cookie)
76 if resp.StatusCode != 200 {
77 t.Fatalf("/-/account = %d", resp.StatusCode)
78 }
79 for _, want := range []string{
80 `value="acme-ocean"`, `Acme Ocean`,
81 `value="acme-paper"`, `Acme Paper`,
82 `data-themes="acme-ocean,acme-paper"`,
83 `href="/-/static/custom/themes/acme-ocean.css?v=`,
84 `href="/-/static/custom/themes/acme-paper.css?v=`,
85 } {
86 if !strings.Contains(account, want) {
87 t.Errorf("Account is missing %q:\n%s", want, account)
88 }
89 }
90 if strings.Contains(account, `value="notes"`) {
91 t.Error("a non-CSS file under themes/ became a picker option")
92 }
93
94 code, css := f.get("/-/static/custom/themes/acme-ocean.css")
95 if code != 200 || !strings.Contains(css, "#38bdf8") {
96 t.Fatalf("theme stylesheet = %d %q", code, css)
97 }
98 if code, _ := f.get("/-/static/custom/themes/notes.css"); code != 404 {
99 t.Fatalf("a missing theme file = %d, want 404", code)
100 }
101}
102
103func TestInstanceRepoIsListedLikeAnyOtherRepository(t *testing.T) {
104 t.Parallel()
105 f := newFixture(t)
106 f.publish(f.repo)
107 f.instanceRepo(t, map[string][]byte{
108 "profile/README.md": []byte("What this forge is for."),
109 })
110 f.publish(f.cfg.InstanceRepo)
111
112 _, body := f.get("/")
113 if !strings.Contains(body, `href="/`+f.cfg.InstanceRepo+`"`) {
114 t.Fatalf("the instance repository is missing from the repository list:\n%s", body)
115 }
116 if !strings.Contains(body, `href="/demo"`) {
117 t.Fatalf("the project repository disappeared:\n%s", body)
118 }
119}
120
121func TestAdminCreatesTheInstanceRepository(t *testing.T) {
122 t.Parallel()
123 f := browserFixture(t)
124 if _, err := f.srv.Identity.SetAdmin(f.ownerID, true, "test"); err != nil {
125 t.Fatal(err)
126 }
127 sess, cookie := f.browserSession(t, f.ownerID)
128
129 resp, body := f.browserGet(t, "/-/admin?tab=configuration", cookie)
130 if resp.StatusCode != 200 || !strings.Contains(body, `action="/-/admin/instance/repo"`) ||
131 !strings.Contains(body, "does not exist yet") {
132 t.Fatalf("configuration tab has no create action = %d:\n%s", resp.StatusCode, body)
133 }
134 resp, _ = f.browserPost(t, "/-/admin/instance/repo", cookie, url.Values{"csrf": {sess.CSRF}})
135 if resp.StatusCode != 303 || resp.Header.Get("Location") != "/-/admin?tab=configuration&created=1" {
136 t.Fatalf("create = %d %q", resp.StatusCode, resp.Header.Get("Location"))
137 }
138 m, err := f.srv.Repos.Open(f.cfg.InstanceRepo)
139 if err != nil {
140 t.Fatal(err)
141 }
142 blob, err := m.Git().BlobAt("refs/heads/"+m.DefaultBranch, "profile/README.md")
143 if err != nil || !strings.Contains(string(blob), "landing page introduction") {
144 t.Fatalf("scaffold profile/README.md = %q, %v", blob, err)
145 }
146 _, body = f.browserGet(t, "/-/admin?tab=configuration", cookie)
147 if !strings.Contains(body, "Loaded from") {
148 t.Fatalf("configuration tab does not show the loaded repository:\n%s", body)
149 }
150 // The scaffolded introduction is on the home page.
151 if _, home := f.get("/"); !strings.Contains(home, "landing page introduction") {
152 t.Fatalf("home does not read the scaffolded introduction:\n%s", home)
153 }
154}
155