mathias
ee9ac99c40
Estate-wide consolidation pass. golangci-lint v2 default set enables NO formatter, so gofmt drift accumulated silently across the estate -- 8 repos were carrying it, this one included. Same hole that let two files rot in dma-cli until they were found by hand (dma-cli#12). Mechanical and deterministic: `gofmt -w`, nothing hand-edited. Verified before commit -- gofmt -l now reports 0, go build and go vet both pass. Clears this repo to adopt the canonical .golangci.yml (infra ci-templates/golangci.yml, infra#309 pattern) in a later wave.
55 lines
1.8 KiB
Go
55 lines
1.8 KiB
Go
package gitea_test
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"sync/atomic"
|
|
"testing"
|
|
|
|
"git.d-ma.be/mathias/gitea-mcp/internal/gitea"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// #36 second line of defence: when owner or repo is empty the path contains an
|
|
// empty segment ("//"). Rather than forward it upstream — where gitea answers
|
|
// with its opaque /api/swagger 404 — the client must reject it locally with a
|
|
// validation error and never touch the network.
|
|
func TestEmptyPathSegmentRejectedBeforeNetwork(t *testing.T) {
|
|
var hits int32
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
atomic.AddInt32(&hits, 1)
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
c := gitea.NewClient(srv.URL, "tok")
|
|
|
|
paths := []string{
|
|
"/api/v1/repos/mathias//issues", // empty repo
|
|
"/api/v1/repos//gitea-mcp/contents/", // empty owner
|
|
"/api/v1/repos/mathias//issues?state=open", // empty repo before query
|
|
}
|
|
for _, p := range paths {
|
|
_, _, err := c.GetJSON(context.Background(), p)
|
|
require.Error(t, err, "path %q should be rejected", p)
|
|
assert.ErrorIs(t, err, gitea.ErrValidation)
|
|
}
|
|
assert.Equal(t, int32(0), atomic.LoadInt32(&hits), "guard must short-circuit before any HTTP call")
|
|
}
|
|
|
|
// A well-formed path with a query string must still pass the guard.
|
|
func TestWellFormedPathPasses(t *testing.T) {
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`[]`))
|
|
}))
|
|
defer srv.Close()
|
|
|
|
c := gitea.NewClient(srv.URL, "tok")
|
|
_, status, err := c.GetJSON(context.Background(), "/api/v1/repos/mathias/gitea-mcp/issues?state=open")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 200, status)
|
|
}
|