gregandClaude Opus 5.5
f3a2a1f099
The worker committed as a hard-coded "gbr-bot", and a token without Write access only showed up when a build finished and its push failed. On start it now reads the token's account (GET /user) for the commit author, and refuses to run if that account can't push to the games repo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.3 KiB
Go
48 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestCheckBotNeedsPushAccess(t *testing.T) {
|
|
push := false
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("Authorization") != "token secret" {
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
return
|
|
}
|
|
switch r.URL.Path {
|
|
case "/api/v1/user":
|
|
w.Write([]byte(`{"login":"git_ai_bot","email":"bot@example.com"}`))
|
|
case "/api/v1/repos/org/games":
|
|
if push {
|
|
w.Write([]byte(`{"permissions":{"push":true}}`))
|
|
} else {
|
|
w.Write([]byte(`{"permissions":{"push":false}}`))
|
|
}
|
|
default:
|
|
w.WriteHeader(http.StatusNotFound)
|
|
}
|
|
}))
|
|
defer srv.Close()
|
|
|
|
c := &workerConfig{gitea: srv.URL, repo: "org/games", botToken: "secret"}
|
|
if err := c.checkBot(); err == nil || !strings.Contains(err.Error(), "git_ai_bot can't push to org/games") {
|
|
t.Errorf("read-only bot: got %v", err)
|
|
}
|
|
push = true
|
|
if err := c.checkBot(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if c.botLogin != "git_ai_bot" || c.botEmail != "bot@example.com" {
|
|
t.Errorf("identity = %s <%s>", c.botLogin, c.botEmail)
|
|
}
|
|
c.botToken = "wrong"
|
|
if err := c.checkBot(); err == nil || !strings.Contains(err.Error(), "GITEA_TOKEN") {
|
|
t.Errorf("bad token: got %v", err)
|
|
}
|
|
}
|