mirror of https://github.com/go-gitea/gitea
Refactor secrets modification logic (#26873)
- Share code between web and api - Add some testspull/26913/head^2
KN4CK3R
1 year ago
committed by
GitHub
parent
e9f5067653
commit
a99b96cbcd
@ -0,0 +1,83 @@ |
||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package secrets |
||||
|
||||
import ( |
||||
"context" |
||||
|
||||
"code.gitea.io/gitea/models/db" |
||||
secret_model "code.gitea.io/gitea/models/secret" |
||||
) |
||||
|
||||
func CreateOrUpdateSecret(ctx context.Context, ownerID, repoID int64, name, data string) (*secret_model.Secret, bool, error) { |
||||
if err := ValidateName(name); err != nil { |
||||
return nil, false, err |
||||
} |
||||
|
||||
s, err := secret_model.FindSecrets(ctx, secret_model.FindSecretsOptions{ |
||||
OwnerID: ownerID, |
||||
RepoID: repoID, |
||||
Name: name, |
||||
}) |
||||
if err != nil { |
||||
return nil, false, err |
||||
} |
||||
|
||||
if len(s) == 0 { |
||||
s, err := secret_model.InsertEncryptedSecret(ctx, ownerID, repoID, name, data) |
||||
if err != nil { |
||||
return nil, false, err |
||||
} |
||||
return s, true, nil |
||||
} |
||||
|
||||
if err := secret_model.UpdateSecret(ctx, s[0].ID, data); err != nil { |
||||
return nil, false, err |
||||
} |
||||
|
||||
return s[0], false, nil |
||||
} |
||||
|
||||
func DeleteSecretByID(ctx context.Context, ownerID, repoID, secretID int64) error { |
||||
s, err := secret_model.FindSecrets(ctx, secret_model.FindSecretsOptions{ |
||||
OwnerID: ownerID, |
||||
RepoID: repoID, |
||||
SecretID: secretID, |
||||
}) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
if len(s) != 1 { |
||||
return secret_model.ErrSecretNotFound{} |
||||
} |
||||
|
||||
return deleteSecret(ctx, s[0]) |
||||
} |
||||
|
||||
func DeleteSecretByName(ctx context.Context, ownerID, repoID int64, name string) error { |
||||
if err := ValidateName(name); err != nil { |
||||
return err |
||||
} |
||||
|
||||
s, err := secret_model.FindSecrets(ctx, secret_model.FindSecretsOptions{ |
||||
OwnerID: ownerID, |
||||
RepoID: repoID, |
||||
Name: name, |
||||
}) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
if len(s) != 1 { |
||||
return secret_model.ErrSecretNotFound{} |
||||
} |
||||
|
||||
return deleteSecret(ctx, s[0]) |
||||
} |
||||
|
||||
func deleteSecret(ctx context.Context, s *secret_model.Secret) error { |
||||
if _, err := db.DeleteByID(ctx, s.ID, s); err != nil { |
||||
return err |
||||
} |
||||
return nil |
||||
} |
||||
@ -0,0 +1,25 @@ |
||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package secrets |
||||
|
||||
import ( |
||||
"regexp" |
||||
|
||||
"code.gitea.io/gitea/modules/util" |
||||
) |
||||
|
||||
// https://docs.github.com/en/actions/security-guides/encrypted-secrets#naming-your-secrets
|
||||
var ( |
||||
namePattern = regexp.MustCompile("(?i)^[A-Z_][A-Z0-9_]*$") |
||||
forbiddenPrefixPattern = regexp.MustCompile("(?i)^GIT(EA|HUB)_") |
||||
|
||||
ErrInvalidName = util.NewInvalidArgumentErrorf("invalid secret name") |
||||
) |
||||
|
||||
func ValidateName(name string) error { |
||||
if !namePattern.MatchString(name) || forbiddenPrefixPattern.MatchString(name) { |
||||
return ErrInvalidName |
||||
} |
||||
return nil |
||||
} |
||||
@ -0,0 +1,103 @@ |
||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package integration |
||||
|
||||
import ( |
||||
"fmt" |
||||
"net/http" |
||||
"testing" |
||||
|
||||
auth_model "code.gitea.io/gitea/models/auth" |
||||
repo_model "code.gitea.io/gitea/models/repo" |
||||
"code.gitea.io/gitea/models/unittest" |
||||
user_model "code.gitea.io/gitea/models/user" |
||||
api "code.gitea.io/gitea/modules/structs" |
||||
"code.gitea.io/gitea/tests" |
||||
) |
||||
|
||||
func TestAPIRepoSecrets(t *testing.T) { |
||||
defer tests.PrepareTestEnv(t)() |
||||
|
||||
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1}) |
||||
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID}) |
||||
session := loginUser(t, user.Name) |
||||
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository) |
||||
|
||||
t.Run("Create", func(t *testing.T) { |
||||
cases := []struct { |
||||
Name string |
||||
ExpectedStatus int |
||||
}{ |
||||
{ |
||||
Name: "", |
||||
ExpectedStatus: http.StatusNotFound, |
||||
}, |
||||
{ |
||||
Name: "-", |
||||
ExpectedStatus: http.StatusBadRequest, |
||||
}, |
||||
{ |
||||
Name: "_", |
||||
ExpectedStatus: http.StatusCreated, |
||||
}, |
||||
{ |
||||
Name: "secret", |
||||
ExpectedStatus: http.StatusCreated, |
||||
}, |
||||
{ |
||||
Name: "2secret", |
||||
ExpectedStatus: http.StatusBadRequest, |
||||
}, |
||||
{ |
||||
Name: "GITEA_secret", |
||||
ExpectedStatus: http.StatusBadRequest, |
||||
}, |
||||
{ |
||||
Name: "GITHUB_secret", |
||||
ExpectedStatus: http.StatusBadRequest, |
||||
}, |
||||
} |
||||
|
||||
for _, c := range cases { |
||||
req := NewRequestWithJSON(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/actions/secrets/%s?token=%s", repo.FullName(), c.Name, token), api.CreateOrUpdateSecretOption{ |
||||
Data: "data", |
||||
}) |
||||
MakeRequest(t, req, c.ExpectedStatus) |
||||
} |
||||
}) |
||||
|
||||
t.Run("Update", func(t *testing.T) { |
||||
name := "update_secret" |
||||
url := fmt.Sprintf("/api/v1/repos/%s/actions/secrets/%s?token=%s", repo.FullName(), name, token) |
||||
|
||||
req := NewRequestWithJSON(t, "PUT", url, api.CreateOrUpdateSecretOption{ |
||||
Data: "initial", |
||||
}) |
||||
MakeRequest(t, req, http.StatusCreated) |
||||
|
||||
req = NewRequestWithJSON(t, "PUT", url, api.CreateOrUpdateSecretOption{ |
||||
Data: "changed", |
||||
}) |
||||
MakeRequest(t, req, http.StatusNoContent) |
||||
}) |
||||
|
||||
t.Run("Delete", func(t *testing.T) { |
||||
name := "delete_secret" |
||||
url := fmt.Sprintf("/api/v1/repos/%s/actions/secrets/%s?token=%s", repo.FullName(), name, token) |
||||
|
||||
req := NewRequestWithJSON(t, "PUT", url, api.CreateOrUpdateSecretOption{ |
||||
Data: "initial", |
||||
}) |
||||
MakeRequest(t, req, http.StatusCreated) |
||||
|
||||
req = NewRequest(t, "DELETE", url) |
||||
MakeRequest(t, req, http.StatusNoContent) |
||||
|
||||
req = NewRequest(t, "DELETE", url) |
||||
MakeRequest(t, req, http.StatusNotFound) |
||||
|
||||
req = NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/repos/%s/actions/secrets/000?token=%s", repo.FullName(), token)) |
||||
MakeRequest(t, req, http.StatusBadRequest) |
||||
}) |
||||
} |
||||
Loading…
Reference in new issue