João Salavisa
f814859ab2
Managed GitHub credentials compared a repository's scope identity verbatim across sides that spell it differently. A repository cloned over SSH stores an SSH remote_url, which kandev itself backfills for local-path repositories, and the strict scheme assertion added in #2117 then rejected the launch with "must use an HTTPS clone URL for managed credentials". Credential identity now comes from the persisted provider identity, whose host carries the real HTTPS origin including a non-default port, falling back to rewriting a non-HTTPS remote in place. Issuance and authorization derive it the same way, so they cannot disagree. Cloning is untouched. Scope paths are compared through one canonical form (no trailing slash, no ".git") at the shim, the broker redemption, and the backend authorizer, so the suffix never decides whether a lease matches. Lease scopes still carry the exact path their provider resolver was issued for, because plugin providers compare it verbatim. Closes #2673 Closes #2675
37 lines
1.5 KiB
Go
37 lines
1.5 KiB
Go
package githubauth
|
|
|
|
import "testing"
|
|
|
|
func TestCanonicalCredentialPath(t *testing.T) {
|
|
for name, testCase := range map[string]struct {
|
|
raw string
|
|
want string
|
|
}{
|
|
"clone URL path": {raw: "/acme/widgets.git", want: "/acme/widgets"},
|
|
"shim path": {raw: "/acme/widgets", want: "/acme/widgets"},
|
|
"trailing slash": {raw: "/acme/widgets/", want: "/acme/widgets"},
|
|
"suffix then slash": {raw: "/acme/widgets.git/", want: "/acme/widgets"},
|
|
"surrounding spaces": {raw: " /acme/widgets.git ", want: "/acme/widgets"},
|
|
"nested namespace": {raw: "/scm/ENG/widgets.git", want: "/scm/ENG/widgets"},
|
|
"case preserved": {raw: "/Acme/Widgets.git", want: "/Acme/Widgets"},
|
|
"root": {raw: "/", want: "/"},
|
|
"bare suffix": {raw: "/.git", want: "/.git"},
|
|
"empty": {raw: "", want: ""},
|
|
// GitHub forbids a repository named ".git"; reducing it keeps the
|
|
// function idempotent instead of leaving a trailing slash behind.
|
|
"repository named .git": {raw: "/acme/.git", want: "/acme"},
|
|
// ".github" is a real repository name and must survive intact.
|
|
"dot-prefixed repository": {raw: "/acme/.github", want: "/acme/.github"},
|
|
} {
|
|
t.Run(name, func(t *testing.T) {
|
|
got := CanonicalCredentialPath(testCase.raw)
|
|
if got != testCase.want {
|
|
t.Fatalf("CanonicalCredentialPath(%q) = %q, want %q", testCase.raw, got, testCase.want)
|
|
}
|
|
if again := CanonicalCredentialPath(got); again != got {
|
|
t.Fatalf("CanonicalCredentialPath(%q) is not idempotent: %q then %q", testCase.raw, got, again)
|
|
}
|
|
})
|
|
}
|
|
}
|