|
| 1 | +package cmd |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "errors" |
| 6 | + "os" |
| 7 | + "path/filepath" |
| 8 | + "testing" |
| 9 | + |
| 10 | + "github.com/dependabot/cli/internal/infra" |
| 11 | + "github.com/dependabot/cli/internal/model" |
| 12 | +) |
| 13 | + |
| 14 | +func TestGraphHostedCredentialsKeepCallbacksLocal(t *testing.T) { |
| 15 | + t.Setenv("DEPENDABOT_CREDENTIALS_TOKEN", "opaque-credentials-token") |
| 16 | + t.Setenv("JOB_TOKEN", "opaque-job-token") |
| 17 | + t.Setenv("LOCAL_GITHUB_ACCESS_TOKEN", "must-not-be-used") |
| 18 | + previousRun, previousFetch := executeGraphJob, fetchGraphCredentials |
| 19 | + t.Cleanup(func() { executeGraphJob, fetchGraphCredentials = previousRun, previousFetch }) |
| 20 | + fetchGraphCredentials = func(_ context.Context, endpoint, token string) ([]model.Credential, error) { |
| 21 | + if endpoint != "https://api.example/update_jobs/1/credentials" || token != "opaque-credentials-token" { |
| 22 | + t.Error("incorrect credential request") |
| 23 | + } |
| 24 | + return []model.Credential{{"type": "npm_registry", "registry": "registry.example", "token": "$literal-token"}}, nil |
| 25 | + } |
| 26 | + var called bool |
| 27 | + executeGraphJob = func(p infra.RunParams) error { |
| 28 | + called = true |
| 29 | + if p.ApiUrl != "" || p.ProxyApiUrl != "https://api.example" || !p.CredentialsResolved { |
| 30 | + t.Error("credential lookup must not redirect graph callbacks or expand resolved secrets") |
| 31 | + } |
| 32 | + if len(p.Creds) != 1 || p.Creds[0]["token"] != "$literal-token" { |
| 33 | + t.Error("hosted credentials must not include ambient local credentials") |
| 34 | + } |
| 35 | + if p.Job.Command != model.UpdateGraphCommand || p.Job.Experiments["enable_dependency_submission_poc"] != true { |
| 36 | + t.Error("must execute graph with dependency submission enabled") |
| 37 | + } |
| 38 | + if len(p.Job.CredentialsMetadata) != 1 || p.Job.CredentialsMetadata[0]["token"] != nil { |
| 39 | + t.Error("updater metadata must not contain secrets") |
| 40 | + } |
| 41 | + return nil |
| 42 | + } |
| 43 | + command := NewGraphCommand() |
| 44 | + command.SetArgs([]string{"npm_and_yarn", "owner/repo", "--credentials-url", "https://api.example/update_jobs/1/credentials", "--proxy-api-url", "https://api.example"}) |
| 45 | + if err := command.Execute(); err != nil { |
| 46 | + t.Fatal(err) |
| 47 | + } |
| 48 | + if !called { |
| 49 | + t.Fatal("graph runner was not called") |
| 50 | + } |
| 51 | +} |
| 52 | + |
| 53 | +func TestGraphCredentialFailureDoesNotRun(t *testing.T) { |
| 54 | + t.Setenv("DEPENDABOT_CREDENTIALS_TOKEN", "opaque-token") |
| 55 | + previousRun, previousFetch := executeGraphJob, fetchGraphCredentials |
| 56 | + t.Cleanup(func() { executeGraphJob, fetchGraphCredentials = previousRun, previousFetch }) |
| 57 | + expected := errors.New("credentials denied") |
| 58 | + fetchGraphCredentials = func(context.Context, string, string) ([]model.Credential, error) { return nil, expected } |
| 59 | + executeGraphJob = func(infra.RunParams) error { |
| 60 | + t.Fatal("must not run without credentials") |
| 61 | + return nil |
| 62 | + } |
| 63 | + |
| 64 | + command := NewGraphCommand() |
| 65 | + command.SetArgs([]string{"npm_and_yarn", "owner/repo", "--credentials-url", "https://api.example/credentials"}) |
| 66 | + if err := command.Execute(); !errors.Is(err, expected) { |
| 67 | + t.Fatalf("expected credential error, got %v", err) |
| 68 | + } |
| 69 | +} |
| 70 | + |
| 71 | +func TestGraphHostedCredentialsRejectOtherCommands(t *testing.T) { |
| 72 | + previousFetch := fetchGraphCredentials |
| 73 | + t.Cleanup(func() { fetchGraphCredentials = previousFetch }) |
| 74 | + fetchGraphCredentials = func(context.Context, string, string) ([]model.Credential, error) { |
| 75 | + return []model.Credential{}, nil |
| 76 | + } |
| 77 | + input := &model.Input{Job: model.Job{Command: model.UpdateFilesCommand}} |
| 78 | + if err := loadGraphCredentials(context.Background(), input, "https://api.example/credentials", "", "", ""); err == nil { |
| 79 | + t.Fatal("hosted graph credentials must not execute an update job") |
| 80 | + } |
| 81 | +} |
| 82 | + |
| 83 | +func TestGraphLocalCredentialFile(t *testing.T) { |
| 84 | + t.Setenv("LOCAL_GITHUB_ACCESS_TOKEN", "") |
| 85 | + previousRun := executeGraphJob |
| 86 | + t.Cleanup(func() { executeGraphJob = previousRun }) |
| 87 | + file := filepath.Join(t.TempDir(), "credentials.yml") |
| 88 | + if err := os.WriteFile(file, []byte("credentials:\n- type: npm_registry\n registry: registry.example\n token: $NPM_TOKEN\n"), 0600); err != nil { |
| 89 | + t.Fatal(err) |
| 90 | + } |
| 91 | + |
| 92 | + executeGraphJob = func(p infra.RunParams) error { |
| 93 | + if p.CredentialsResolved || len(p.Creds) != 1 || p.Creds[0]["token"] != "$NPM_TOKEN" { |
| 94 | + t.Error("local credential references must retain normal environment expansion") |
| 95 | + } |
| 96 | + if !p.OmitCredentials { |
| 97 | + t.Error("explicit credentials must be omitted from the captured scenario") |
| 98 | + } |
| 99 | + return nil |
| 100 | + } |
| 101 | + command := NewGraphCommand() |
| 102 | + command.SetArgs([]string{"npm_and_yarn", "owner/repo", "--credentials-file", file}) |
| 103 | + if err := command.Execute(); err != nil { |
| 104 | + t.Fatal(err) |
| 105 | + } |
| 106 | +} |
0 commit comments