mathiasandClaude Opus 4.8
4c1f36f9eb
Gitea host renamed (infra ADR-0004); the mcp-chassis dep already migrated
(3329ff3), so the sequencing gate is clear. `go mod edit -module` + bulk import
rewrite across all .go files. gitea-mcp is a server binary (not an imported
library), so no downstream consumers break. build + task check green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
1.8 KiB
Go
55 lines
1.8 KiB
Go
package gitea_test
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"sync/atomic"
|
|
"testing"
|
|
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// #36 second line of defence: when owner or repo is empty the path contains an
|
|
// empty segment ("//"). Rather than forward it upstream — where gitea answers
|
|
// with its opaque /api/swagger 404 — the client must reject it locally with a
|
|
// validation error and never touch the network.
|
|
func TestEmptyPathSegmentRejectedBeforeNetwork(t *testing.T) {
|
|
var hits int32
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
atomic.AddInt32(&hits, 1)
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
c := gitea.NewClient(srv.URL, "tok")
|
|
|
|
paths := []string{
|
|
"/api/v1/repos/mathias//issues", // empty repo
|
|
"/api/v1/repos//gitea-mcp/contents/", // empty owner
|
|
"/api/v1/repos/mathias//issues?state=open", // empty repo before query
|
|
}
|
|
for _, p := range paths {
|
|
_, _, err := c.GetJSON(context.Background(), p)
|
|
require.Error(t, err, "path %q should be rejected", p)
|
|
assert.ErrorIs(t, err, gitea.ErrValidation)
|
|
}
|
|
assert.Equal(t, int32(0), atomic.LoadInt32(&hits), "guard must short-circuit before any HTTP call")
|
|
}
|
|
|
|
// A well-formed path with a query string must still pass the guard.
|
|
func TestWellFormedPathPasses(t *testing.T) {
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`[]`))
|
|
}))
|
|
defer srv.Close()
|
|
|
|
c := gitea.NewClient(srv.URL, "tok")
|
|
_, status, err := c.GetJSON(context.Background(), "/api/v1/repos/mathias/gitea-mcp/issues?state=open")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 200, status)
|
|
}
|