| |
@@ -3,539 +3,681 @@
|
| |
import tempfile
|
| |
import os
|
| |
|
| |
- import mock
|
| |
+ from mock import Mock, patch
|
| |
|
| |
# These are the tests from the pagure/ git repo.
|
| |
# Run with:
|
| |
# PYTHONPATH=.:/path/to/pagure/checkout nosetests dist_git_auth_tests.py
|
| |
import pagure
|
| |
+ import pagure.lib
|
| |
import tests
|
| |
|
| |
import dist_git_auth
|
| |
|
| |
|
| |
- expected = """
|
| |
- repo test
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/test
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo test2
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/test2
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo somenamespace/test3
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/somenamespace/test3
|
| |
- RWC = pingou
|
| |
-
|
| |
- # end of body
|
| |
- """
|
| |
-
|
| |
-
|
| |
- class DistGitoliteAuthTestCase(tests.Modeltests):
|
| |
- """ Test generating the gitolite configuration file for dist-git. """
|
| |
+ def setUp():
|
| |
+ tests.setUp()
|
| |
+
|
| |
+
|
| |
+ def tearDown():
|
| |
+ tests.tearDown()
|
| |
+
|
| |
+
|
| |
+ def patch_pdc(values):
|
| |
+ """ Decorator to patch the PDC calls to return values for this test.
|
| |
+
|
| |
+ Args:
|
| |
+ values (dict): A dictionary where the keys are project fullnames
|
| |
+ (i.e. namespace/name), and the values are dicts with key branch
|
| |
+ names, and values their supported status.
|
| |
+ Note that as namespace, the PDC "type" is used, which lacks the "s"
|
| |
+ for rpms and modules.
|
| |
+ e.g.: {'rpm/test': {'f28': True, 'f27': False}}
|
| |
+ """
|
| |
+ def pdc_get_paged(_, global_component, type, name, fields):
|
| |
+ """ Function that emulates the pdc.get_paged call
|
| |
+
|
| |
+ Args as provided by dist_git_auth's calls to it.
|
| |
+
|
| |
+ Args:
|
| |
+ _ (anything): PDCClient internal
|
| |
+ global_component (string): package name
|
| |
+ type (string): The PDC "type": "rpm", "module", ...
|
| |
+ name (string): The branch name
|
| |
+ fields (list): Always ["active"]
|
| |
+ """
|
| |
+ fullname = '%s/%s' % (type, global_component)
|
| |
+ if fullname not in values:
|
| |
+ return []
|
| |
+ val = values[fullname]
|
| |
+ if name not in val:
|
| |
+ return []
|
| |
+ val = val[name]
|
| |
+ if val in (True, False):
|
| |
+ return [{"active": val}]
|
| |
+ # This case is used to emulate "weird" results
|
| |
+ return val
|
| |
+
|
| |
+ def decorator(func):
|
| |
+ def test_wrapper(*args, **kwargs):
|
| |
+ with patch.object(dist_git_auth.PDCClient, '__getitem__'):
|
| |
+ with patch.object(dist_git_auth.PDCClient, 'get_paged',
|
| |
+ side_effect=pdc_get_paged):
|
| |
+ return func(*args, **kwargs)
|
| |
+ return test_wrapper
|
| |
+ return decorator
|
| |
+
|
| |
+
|
| |
+ class DistGitAuthTests(tests.Modeltests):
|
| |
+ """ Test DistGitAuth ACLs with Fedora config. """
|
| |
|
| |
maxDiff = None
|
| |
|
| |
def setUp(self):
|
| |
""" Set up the environment in which to run the tests. """
|
| |
- super(DistGitoliteAuthTestCase, self).setUp()
|
| |
- self.configfile = tempfile.mkstemp()[1]
|
| |
+ super(DistGitAuthTests, self).setUp()
|
| |
+
|
| |
+ pagure.config.config['ACL_DEBUG'] = True
|
| |
+ pagure.config.config.update(self.dga_config)
|
| |
+
|
| |
+ self.dga = dist_git_auth.DistGitAuth()
|
| |
+ self.dga.info = Mock(side_effect=print)
|
| |
+ # We default to saying it's not a forced push
|
| |
+ dist_git_auth.is_forced_push = Mock(return_value=False)
|
| |
+
|
| |
+ # Create an RCM user/group
|
| |
+ rcmuser = pagure.lib.model.User(
|
| |
+ user='releng',
|
| |
+ fullname='Release Engineering',
|
| |
+ token='aaabbbcd',
|
| |
+ default_email='rcm@local.local',
|
| |
+ )
|
| |
+ self.session.add(rcmuser)
|
| |
+ self.session.flush()
|
| |
+ rcmgroup = pagure.lib.model.PagureGroup(
|
| |
+ group_name='relenggroup',
|
| |
+ group_type='user',
|
| |
+ display_name='Releng group',
|
| |
+ user_id=rcmuser.id,
|
| |
+ )
|
| |
+ self.session.add(rcmgroup)
|
| |
+ self.session.flush()
|
| |
+ rcmuser.group_objs.append(rcmgroup)
|
| |
+ self.session.commit()
|
| |
|
| |
def tearDown(self):
|
| |
""" Tear down the environment in which the tests ran. """
|
| |
- try:
|
| |
- os.remove(self.configfile)
|
| |
- except:
|
| |
- print("Couldn't remove %r" % self.configfile)
|
| |
- pass
|
| |
- super(DistGitoliteAuthTestCase, self).tearDown()
|
| |
-
|
| |
- @mock.patch('dist_git_auth.get_supported_branches')
|
| |
- def test_write_gitolite_acls(self, get_supported_branches):
|
| |
- """ Test generating the entire gitolite configuration file
|
| |
- (project == -1).
|
| |
+ self.dga = None
|
| |
+ super(DistGitAuthTests, self).tearDown()
|
| |
|
| |
- """
|
| |
- get_supported_branches.return_value = ['master', 'f9000']
|
| |
- print("Initializing DB.")
|
| |
- tests.create_projects(self.session)
|
| |
+ def create_namespaced_project(self, namespace, name, is_fork=False):
|
| |
+ item = pagure.lib.model.Project(
|
| |
+ user_id=1, # pingou
|
| |
+ name=name,
|
| |
+ is_fork=is_fork,
|
| |
+ parent_id=3 if is_fork else None,
|
| |
+ description='namespaced test project',
|
| |
+ hook_token='aaabbbeee',
|
| |
+ namespace=namespace,
|
| |
+ )
|
| |
+ item.close_status = [
|
| |
+ 'Invalid', 'Insufficient data', 'Fixed', 'Duplicate']
|
| |
+ self.session.add(item)
|
| |
+ self.session.commit()
|
| |
+ return pagure.lib._get_project(
|
| |
+ self.session, name=name, namespace=namespace)
|
| |
+
|
| |
+ def expect_info_msg(self, expect_msg):
|
| |
+ found = False
|
| |
+ for call in self.dga.info.call_args_list:
|
| |
+ args = call[0]
|
| |
+ msg = args[0]
|
| |
+ if msg == expect_msg:
|
| |
+ found = True
|
| |
+ if not found:
|
| |
+ raise AssertionError(
|
| |
+ "Info message '%s' expected but not found" % expect_msg)
|
| |
+
|
| |
+
|
| |
+ class DistGitAuthTestsGeneric(DistGitAuthTests):
|
| |
+ dga_config = {}
|
| |
+
|
| |
+ def test_unused_repotype(self):
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=None,
|
| |
+ username=None,
|
| |
+ refname=None,
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='tickets',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- print("Generating %r" % self.configfile)
|
| |
- dist_git_auth.DistGitoliteAuth.write_gitolite_acls(
|
| |
- self.session,
|
| |
- configfile=self.configfile,
|
| |
- project=-1)
|
| |
+ self.expect_info_msg("Repotype tickets not in use")
|
| |
+
|
| |
+ def test_branch_deletion(self):
|
| |
+ dist_git_auth.is_forced_push.return_value = True
|
| |
+
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username=None,
|
| |
+ refname=None,
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto='0000000000000000000000000000000000000000',
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- print("Checking the contents of %r" % self.configfile)
|
| |
- with open(self.configfile, 'r') as f:
|
| |
- contents = f.read()
|
| |
- self.assertMultiLineEqual(contents.strip(), expected.strip())
|
| |
+ self.expect_info_msg("Branch deletion is not allowed")
|
| |
+
|
| |
+ def test_forced_push(self):
|
| |
+ dist_git_auth.is_forced_push.return_value = True
|
| |
+
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username=None,
|
| |
+ refname=None,
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- @mock.patch('dist_git_auth.get_supported_branches')
|
| |
- def test_write_gitolite_acls_none_project(self, get_supported_branches):
|
| |
- """ Test not touching the gitolite configuration file
|
| |
- (project == None).
|
| |
+ self.expect_info_msg("Forced pushes are not allowed")
|
| |
+
|
| |
+ def test_internal(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username=None,
|
| |
+ refname=None,
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=True,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- """
|
| |
- get_supported_branches.return_value = ['master', 'f9000']
|
| |
- print("Initializing DB.")
|
| |
- tests.create_projects(self.session)
|
| |
+ self.expect_info_msg("Internal push allowed")
|
| |
+
|
| |
+ def test_deploykey(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="deploykey_foobar",
|
| |
+ refname=None,
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
+
|
| |
+ self.expect_info_msg("Deploy keys are disabled")
|
| |
|
| |
- print("Generating %r" % self.configfile)
|
| |
- dist_git_auth.DistGitoliteAuth.write_gitolite_acls(
|
| |
+ def test_invalid_user(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertRaises(
|
| |
+ pagure.exceptions.PagureException,
|
| |
+ self.dga.check_acl,
|
| |
self.session,
|
| |
- configfile=self.configfile,
|
| |
- project=None)
|
| |
+ project=project,
|
| |
+ username="nosuchuser",
|
| |
+ refname=None,
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
|
| |
- print("Checking the contents of %r" % self.configfile)
|
| |
- with open(self.configfile, 'r') as f:
|
| |
- contents = f.read()
|
| |
- self.assertMultiLineEqual(contents.strip(), '')
|
| |
+ def test_unprotected_committer(self):
|
| |
+ project = self.create_namespaced_project('unprotected', 'test')
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/mywip",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- @mock.patch('dist_git_auth.get_supported_branches')
|
| |
- def test_write_gitolite_acls_test_project(self, get_supported_branches):
|
| |
- """ Test updating the gitolite configuration file for just one
|
| |
- project (project == a pagure.lib.model.Project).
|
| |
+ self.expect_info_msg("Committer push to unprotected")
|
| |
+
|
| |
+ def test_unprotected_non_committer(self):
|
| |
+ project = self.create_namespaced_project('unprotected', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="foo",
|
| |
+ refname="refs/heads/mywip",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- """
|
| |
+ self.expect_info_msg("Fall-through deny")
|
| |
+
|
| |
+ def test_unprotected_pr_required_pr(self):
|
| |
+ project = self.create_namespaced_project('unprotected', 'test')
|
| |
+ self.dga.global_pr_only = True
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/mywip",
|
| |
+ pull_request=True,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- get_supported_branches.return_value = ['master', 'f9000']
|
| |
- self.test_write_gitolite_acls()
|
| |
+ self.expect_info_msg("Committer push to unprotected")
|
| |
+
|
| |
+ def test_unprotected_pr_required_no_pr(self):
|
| |
+ project = self.create_namespaced_project('unprotected', 'test')
|
| |
+ self.dga.global_pr_only = True
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/mywip",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- print("Modifying the test project so the output differs.")
|
| |
- project = pagure.lib._get_project(self.session, 'test')
|
| |
- project.user_id = 2
|
| |
- self.session.add(project)
|
| |
- self.session.commit()
|
| |
+ self.expect_info_msg("A pull request is required for this branch")
|
| |
+
|
| |
+ def test_unprotected_pr_required_requests(self):
|
| |
+ project = self.create_namespaced_project('unprotected', 'test')
|
| |
+ self.dga.global_pr_only = True
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/mywip",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='requests',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- project = pagure.lib._get_project(self.session, 'test')
|
| |
- msg = pagure.lib.add_user_to_project(
|
| |
- self.session,
|
| |
- project=project,
|
| |
- new_user='pingou',
|
| |
- user='foo',
|
| |
- access='commit'
|
| |
+ self.expect_info_msg("Committer push to unprotected")
|
| |
+
|
| |
+
|
| |
+ class DistGitAuthTestsFedora(DistGitAuthTests):
|
| |
+ dga_config = {
|
| |
+ 'PR_ONLY': False,
|
| |
+ 'ACL_BLOCK_UNSPECIFIED': False,
|
| |
+ 'BLACKLIST_RES': ['refs/heads/c[0-9]+.*'],
|
| |
+ 'UNSPECIFIED_BLACKLIST_RES': [
|
| |
+ 'refs/heads/f[0-9]+',
|
| |
+ ],
|
| |
+ 'RCM_GROUP': 'relenggroup',
|
| |
+ 'RCM_BRANCHES': ['refs/heads/f[0-9]+'],
|
| |
+ 'ACL_PROTECTED_NAMESPACES': ['rpms', 'modules', 'container'],
|
| |
+ 'PDC_URL': 'invalid://',
|
| |
+ }
|
| |
+
|
| |
+ def test_protected_blacklisted_ref(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/c7",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
)
|
| |
- self.assertEqual(msg, 'User added')
|
| |
- self.session.commit()
|
| |
|
| |
- print("Rewriting %r" % self.configfile)
|
| |
- project = pagure.lib._get_project(self.session, 'test')
|
| |
- dist_git_auth.DistGitoliteAuth.write_gitolite_acls(
|
| |
- self.session,
|
| |
- configfile=self.configfile,
|
| |
- project=project
|
| |
+ self.expect_info_msg("Ref refs/heads/c7 is blocked")
|
| |
+
|
| |
+ def test_protected_rcm(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="releng",
|
| |
+ refname="refs/heads/f27",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
)
|
| |
|
| |
- print("Checking the contents of %r" % self.configfile)
|
| |
- with open(self.configfile, 'r') as f:
|
| |
- contents = f.read()
|
| |
-
|
| |
- expected = '''repo test2
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/test2
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo somenamespace/test3
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/somenamespace/test3
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo test
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = foo pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = foo pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = foo pingou
|
| |
-
|
| |
- repo requests/test
|
| |
- RWC = foo pingou
|
| |
-
|
| |
- # end of body'''
|
| |
- self.assertMultiLineEqual(expected, contents.strip())
|
| |
-
|
| |
- def test_get_supported_branches(self):
|
| |
- """ Test for real what is returned by PDC. """
|
| |
- expected = ['master', 'f27', 'f26', 'f25', 'el6']
|
| |
- actual = dist_git_auth.get_supported_branches('rpms', 'nethack')
|
| |
- self.assertEquals(set(actual), set(expected))
|
| |
-
|
| |
- @mock.patch('dist_git_auth.get_supported_branches')
|
| |
- def test_write_gitolite_acls_test_project_w_group(
|
| |
- self, get_supported_branches):
|
| |
- """ Test updating the gitolite configuration file for just one
|
| |
- project (project == a pagure.lib.model.Project).
|
| |
+ self.expect_info_msg("RCM push")
|
| |
+
|
| |
+ @patch_pdc({"rpm/test": {"f26": False, "f27": True}})
|
| |
+ def test_protected_unsupported_branch(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/f26",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- """
|
| |
+ self.expect_info_msg("Branch refs/heads/f26 is unsupported")
|
| |
+
|
| |
+ @patch_pdc({"rpm/test": {"f26": False, "f27": True}})
|
| |
+ def test_protected_supported_branch_committer(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/f27",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- get_supported_branches.return_value = ['master', 'f9000']
|
| |
- self.test_write_gitolite_acls()
|
| |
+ self.expect_info_msg("Branch refs/heads/f27 is supported")
|
| |
+
|
| |
+ @patch_pdc({"rpm/test": {"f26": False, "f27": True}})
|
| |
+ def test_protected_supported_branch_non_committer(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="foo",
|
| |
+ refname="refs/heads/f27",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- print("Modifying the test project so the output differs.")
|
| |
- project = pagure.lib._get_project(self.session, 'test')
|
| |
- project.user_id = 2
|
| |
- self.session.add(project)
|
| |
- self.session.commit()
|
| |
+ self.expect_info_msg("Branch refs/heads/f27 is supported")
|
| |
+
|
| |
+ @patch_pdc({"rpm/test": {"f26": False, "f27": True}})
|
| |
+ def test_protected_unspecified_branch_blacklisted(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/f28",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- # Add a group to a project and someone to this group
|
| |
- project = pagure.lib._get_project(self.session, 'test')
|
| |
- msg = pagure.lib.add_group_to_project(
|
| |
- session=self.session,
|
| |
- project=project,
|
| |
- new_group='test_grp',
|
| |
- user='pingou',
|
| |
- access='admin',
|
| |
- create=True,
|
| |
- is_admin=True)
|
| |
- self.assertEqual(msg, 'Group added')
|
| |
- grp = pagure.lib.search_groups(self.session, group_name='test_grp')
|
| |
- msg = pagure.lib.add_user_to_group(
|
| |
- session=self.session,
|
| |
- username='pingou',
|
| |
- group=grp,
|
| |
- user='pingou',
|
| |
- is_admin=False)
|
| |
- self.session.commit()
|
| |
+ self.expect_info_msg("Unspecified ref refs/heads/f28 is blocked")
|
| |
+
|
| |
+ @patch_pdc({"rpm/test": {"f26": False, "f27": True}})
|
| |
+ def test_protected_unspecified_branch_normal_committer(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/mywip",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- print("Rewriting %r" % self.configfile)
|
| |
- project = pagure.lib._get_project(self.session, 'test')
|
| |
- dist_git_auth.DistGitoliteAuth.write_gitolite_acls(
|
| |
- self.session,
|
| |
- configfile=self.configfile,
|
| |
- project=project
|
| |
+ self.expect_info_msg("Unspecified branch push")
|
| |
+
|
| |
+ @patch_pdc({"rpm/test": {"f26": False, "f27": True}})
|
| |
+ def test_protected_unspecified_branch_normal_non_committer(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="foo",
|
| |
+ refname="refs/heads/mywip",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
)
|
| |
|
| |
- print("Checking the contents of %r" % self.configfile)
|
| |
- with open(self.configfile, 'r') as f:
|
| |
- contents = f.read()
|
| |
-
|
| |
- expected = '''@test_grp = pingou
|
| |
- # end of groups
|
| |
-
|
| |
- repo test2
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/test2
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo somenamespace/test3
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/somenamespace/test3
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo test
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = foo
|
| |
- RWC master = @test_grp @provenpackager
|
| |
- RWC f9000 = foo
|
| |
- RWC f9000 = @test_grp @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @test_grp @provenpackager
|
| |
- RWC = foo
|
| |
-
|
| |
- repo requests/test
|
| |
- RWC = @test_grp
|
| |
- RWC = foo
|
| |
-
|
| |
- # end of body'''
|
| |
- self.assertMultiLineEqual(expected, contents.strip())
|
| |
-
|
| |
- @mock.patch('dist_git_auth.get_supported_branches')
|
| |
- def test_write_gitolite_acls_fork(
|
| |
- self, get_supported_branches):
|
| |
- """ Test updating the gitolite configuration file when forking a
|
| |
- project.
|
| |
+ self.expect_info_msg("Unspecified branch push")
|
| |
|
| |
- """
|
| |
|
| |
- get_supported_branches.return_value = ['master', 'f9000']
|
| |
- self.test_write_gitolite_acls()
|
| |
-
|
| |
- print("Forking the test project.")
|
| |
- project = pagure.lib._get_project(self.session, 'test')
|
| |
- pagure.lib.fork_project(
|
| |
- session=self.session,
|
| |
- user='pingou',
|
| |
- repo=project,
|
| |
- gitfolder=self.path,
|
| |
- docfolder=None,
|
| |
- ticketfolder=None,
|
| |
- requestfolder=None)
|
| |
-
|
| |
- print("Rewriting %r" % self.configfile)
|
| |
- dist_git_auth.DistGitoliteAuth.write_gitolite_acls(
|
| |
- self.session,
|
| |
- configfile=self.configfile,
|
| |
- project=-1
|
| |
+ class DistGitAuthTestsCentOS(DistGitAuthTests):
|
| |
+ dga_config = {
|
| |
+ 'PR_ONLY': False,
|
| |
+ 'ACL_BLOCK_UNSPECIFIED': True,
|
| |
+ 'BLACKLIST_RES': ['refs/heads/f[0-9]+.*'],
|
| |
+ 'RCM_GROUP': 'relenggroup',
|
| |
+ 'RCM_BRANCHES': ['refs/heads/c[0-9]+'],
|
| |
+ 'SUPPORTED_SIGS': ['sig-core'],
|
| |
+ 'SIG_PREFIXES': ['refs/heads/c7'],
|
| |
+ 'ACL_PROTECTED_NAMESPACES': ['rpms'],
|
| |
+ }
|
| |
+
|
| |
+ def setUp(self):
|
| |
+ super(DistGitAuthTestsCentOS, self).setUp()
|
| |
+
|
| |
+ # Create an RCM user/group
|
| |
+ arrfab = pagure.lib.model.User(
|
| |
+ user='arrfab',
|
| |
+ fullname='Fabian Arriton',
|
| |
+ token='aaabbbcd',
|
| |
+ default_email='arrfab@local.local',
|
| |
)
|
| |
+ self.session.add(arrfab)
|
| |
+ self.session.flush()
|
| |
+ sigcore = pagure.lib.model.PagureGroup(
|
| |
+ group_name='sig-core',
|
| |
+ group_type='user',
|
| |
+ display_name='Core SIG group',
|
| |
+ user_id=arrfab.id,
|
| |
+ )
|
| |
+ self.session.add(sigcore)
|
| |
+ self.session.flush()
|
| |
+ arrfab.group_objs.append(sigcore)
|
| |
+ self.session.commit()
|
| |
|
| |
- print("Checking the contents of %r" % self.configfile)
|
| |
- with open(self.configfile, 'r') as f:
|
| |
- contents = f.read()
|
| |
-
|
| |
- expected = '''repo test
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/test
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo test2
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/test2
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo somenamespace/test3
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/somenamespace/test3
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo forks/pingou/test
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RW+C = pingou
|
| |
-
|
| |
- repo requests/forks/pingou/test
|
| |
- RW+C = pingou
|
| |
-
|
| |
- # end of body'''
|
| |
- self.assertMultiLineEqual(expected, contents.strip())
|
| |
-
|
| |
- @mock.patch('dist_git_auth.get_supported_branches')
|
| |
- def test_write_gitolite_acls_rpms_firefox(self, get_supported_branches):
|
| |
- """ Test generating the entire gitolite configuration file
|
| |
- with the firefox project in the rpms namespace (ie a project not
|
| |
- allowing provenpackager access).
|
| |
+ def test_protected_blacklisted_ref(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/f27",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- """
|
| |
- get_supported_branches.return_value = ['master', 'f9000']
|
| |
- print("Initializing DB.")
|
| |
- item = pagure.lib.model.Project(
|
| |
- user_id=1, # pingou
|
| |
- name='firefox',
|
| |
- description='The firefox project',
|
| |
- hook_token='aaabbbeee',
|
| |
- namespace='rpms',
|
| |
+ self.expect_info_msg("Ref refs/heads/f27 is blocked")
|
| |
+
|
| |
+ def test_protected_rcm(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="releng",
|
| |
+ refname="refs/heads/c7",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
)
|
| |
- self.session.add(item)
|
| |
- self.session.commit()
|
| |
|
| |
- print("Generating %r" % self.configfile)
|
| |
- dist_git_auth.DistGitoliteAuth.write_gitolite_acls(
|
| |
- self.session,
|
| |
- configfile=self.configfile,
|
| |
- project=-1)
|
| |
-
|
| |
- print("Checking the contents of %r" % self.configfile)
|
| |
- with open(self.configfile, 'r') as f:
|
| |
- contents = f.read()
|
| |
- expected = """repo rpms/firefox
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC f9000 = pingou
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/rpms/firefox
|
| |
- RWC = pingou
|
| |
-
|
| |
- # end of body
|
| |
- """
|
| |
- self.assertMultiLineEqual(contents.strip(), expected.strip())
|
| |
-
|
| |
- @mock.patch('dist_git_auth.get_supported_branches')
|
| |
- def test_write_gitolite_acls_firefox(self, get_supported_branches):
|
| |
- """ Test generating the entire gitolite configuration file
|
| |
- with the firefox project.
|
| |
+ self.expect_info_msg("RCM push")
|
| |
+
|
| |
+ def test_protected_sig_sig_member(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertTrue(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="arrfab",
|
| |
+ refname="refs/heads/c7-sig-core-test",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
|
| |
- """
|
| |
- get_supported_branches.return_value = ['master', 'f9000']
|
| |
- print("Initializing DB.")
|
| |
- item = pagure.lib.model.Project(
|
| |
- user_id=1, # pingou
|
| |
- name='firefox',
|
| |
- description='The firefox project',
|
| |
- hook_token='aaabbbeee',
|
| |
- namespace=None,
|
| |
+ self.expect_info_msg("SIG push")
|
| |
+
|
| |
+ def test_protected_sig_no_sig_member(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="pingou",
|
| |
+ refname="refs/heads/c7-sig-core-test",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
)
|
| |
- self.session.add(item)
|
| |
- self.session.commit()
|
| |
|
| |
- print("Generating %r" % self.configfile)
|
| |
- dist_git_auth.DistGitoliteAuth.write_gitolite_acls(
|
| |
- self.session,
|
| |
- configfile=self.configfile,
|
| |
- project=-1)
|
| |
-
|
| |
- print("Checking the contents of %r" % self.configfile)
|
| |
- with open(self.configfile, 'r') as f:
|
| |
- contents = f.read()
|
| |
- expected = """repo firefox
|
| |
- RW = releng
|
| |
- R = @all
|
| |
- RWC master = pingou
|
| |
- RWC master = @provenpackager
|
| |
- RWC f9000 = pingou
|
| |
- RWC f9000 = @provenpackager
|
| |
- - f[0-9][0-9] = @all
|
| |
- - epel[0-9] = @all
|
| |
- - epel[0-9][0-9] = @all
|
| |
- - el[0-9] = @all
|
| |
- - olpc[0-9] = @all
|
| |
- RWC = @provenpackager
|
| |
- RWC = pingou
|
| |
-
|
| |
- repo requests/firefox
|
| |
- RWC = pingou
|
| |
-
|
| |
- # end of body
|
| |
- """
|
| |
- self.assertMultiLineEqual(contents.strip(), expected.strip())
|
| |
+ self.expect_info_msg("Access to namespace rpms is restricted")
|
| |
+
|
| |
+ def test_protected_sig_sig_member_no_sig_branch(self):
|
| |
+ project = self.create_namespaced_project('rpms', 'test')
|
| |
+
|
| |
+ self.assertFalse(
|
| |
+ self.dga.check_acl(
|
| |
+ self.session,
|
| |
+ project=project,
|
| |
+ username="arrfab",
|
| |
+ refname="refs/heads/c7",
|
| |
+ pull_request=None,
|
| |
+ repodir=None,
|
| |
+ repotype='main',
|
| |
+ revfrom=None,
|
| |
+ revto=None,
|
| |
+ is_internal=False,
|
| |
+ )
|
| |
+ )
|
| |
+
|
| |
+ self.expect_info_msg("Access to namespace rpms is restricted")
|
| |
puiterwijk
commented 7 years ago
This is basically a full rewrite of the actual dist_git_auth, so I would suggest for review to only look at the new code instead of the actual diff.