e2e/api_test.go

  1package e2e
  2
  3import (
  4	"bytes"
  5	"encoding/json"
  6	"fmt"
  7	"io"
  8	"net/http"
  9	"net/url"
 10	"os"
 11	"path/filepath"
 12	"strings"
 13	"testing"
 14	"time"
 15)
 16
 17// apiCall posts one command to the JSON API.
 18func (i *instance) apiCall(t *testing.T, token string, argv []string, stdin string) (int, map[string]any) {
 19	t.Helper()
 20	body, _ := json.Marshal(map[string]any{"argv": argv, "stdin": stdin})
 21	req, err := http.NewRequest("POST",
 22		fmt.Sprintf("http://127.0.0.1:%d/api/v1/cmd", i.httpPort), bytes.NewReader(body))
 23	if err != nil {
 24		t.Fatal(err)
 25	}
 26	if token != "" {
 27		req.Header.Set("Authorization", "Bearer "+token)
 28	}
 29	resp, err := http.DefaultClient.Do(req)
 30	if err != nil {
 31		t.Fatal(err)
 32	}
 33	defer resp.Body.Close()
 34	raw, _ := io.ReadAll(resp.Body)
 35	var out map[string]any
 36	if err := json.Unmarshal(raw, &out); err != nil {
 37		t.Fatalf("API response not JSON (%d): %s", resp.StatusCode, raw)
 38	}
 39	return resp.StatusCode, out
 40}
 41
 42func TestJSONAPI(t *testing.T) {
 43	t.Parallel()
 44	inst := startInstanceWith(t, "[api]\nenabled = true\n")
 45	aliceKey := inst.newKey(t, "alice")
 46	inst.admin(t, "admin", "user", "create", "alice",
 47		"--key", aliceKey+".pub", "--email", "alice@example.test", "--verified")
 48
 49	// Tokens are minted over SSH, shown once.
 50	out, errOut, code := inst.ssh(t, aliceKey, "", "token", "create", "--name", "ci", "--scope", "full", "--json")
 51	if code != 0 {
 52		t.Fatalf("token create: %s", errOut)
 53	}
 54	var env struct {
 55		Data struct {
 56			Token string `json:"token"`
 57		} `json:"data"`
 58	}
 59	if err := json.Unmarshal([]byte(out), &env); err != nil || !strings.HasPrefix(env.Data.Token, "gb_") {
 60		t.Fatalf("token create output: %v %s", err, out)
 61	}
 62	token := env.Data.Token
 63
 64	// Auth failures are uniform 401s.
 65	if status, _ := inst.apiCall(t, "", []string{"whoami"}, ""); status != 401 {
 66		t.Fatalf("no token: %d", status)
 67	}
 68	if status, _ := inst.apiCall(t, "gb_wrong", []string{"whoami"}, ""); status != 401 {
 69		t.Fatalf("bad token: %d", status)
 70	}
 71
 72	// whoami through the API: same envelope, exit_code injected.
 73	status, body := inst.apiCall(t, token, []string{"whoami"}, "")
 74	if status != 200 || body["exit_code"].(float64) != 0 {
 75		t.Fatalf("whoami: %d %v", status, body)
 76	}
 77	if data := body["data"].(map[string]any); data["username"] != "alice" {
 78		t.Fatalf("whoami data: %v", body)
 79	}
 80
 81	// Mutations work: create a repo and an issue, then read it back.
 82	if status, body = inst.apiCall(t, token, []string{"repo", "create", "alice/proj", "--private"}, ""); status != 200 {
 83		t.Fatalf("repo create: %d %v", status, body)
 84	}
 85	if status, _ = inst.apiCall(t, token, []string{"issue", "create", "alice/proj", "--title", "from the api", "--file", "-"}, "body via stdin\n"); status != 200 {
 86		t.Fatal("issue create failed")
 87	}
 88	status, body = inst.apiCall(t, token, []string{"issue", "show", "alice/proj", "1"}, "")
 89	data := body["data"].(map[string]any)
 90	if status != 200 || data["title"] != "from the api" || data["body"] != "body via stdin\n" {
 91		t.Fatalf("issue show: %d %v", status, body)
 92	}
 93
 94	// Exit codes map to HTTP statuses.
 95	if status, _ = inst.apiCall(t, token, []string{"issue", "show", "alice/proj", "99"}, ""); status != 404 {
 96		t.Fatalf("missing issue: %d", status)
 97	}
 98	if status, _ = inst.apiCall(t, token, []string{"nonsense"}, ""); status != 400 {
 99		t.Fatalf("unknown command: %d", status)
100	}
101
102	// Raw-output commands (no envelope) are wrapped. Reading a file is the
103	// cheapest raw output, so give the repo one commit to read from.
104	work := t.TempDir()
105	aliceEnv := inst.gitEnv(aliceKey)
106	mustGit(t, work, aliceEnv, "clone", inst.sshURL("alice/proj"), "proj")
107	dir := filepath.Join(work, "proj")
108	if err := os.WriteFile(filepath.Join(dir, "README"), []byte("plain text, not json\n"), 0o644); err != nil {
109		t.Fatal(err)
110	}
111	mustGit(t, dir, aliceEnv, "checkout", "-q", "-b", "main")
112	mustGit(t, dir, aliceEnv, "add", "README")
113	mustGit(t, dir, aliceEnv, "commit", "-q", "-m", "init")
114	mustGit(t, dir, aliceEnv, "push", "-q", "origin", "main")
115
116	// A tarball is not an envelope, so it comes back under "output".
117	status, body = inst.apiCall(t, token, []string{"repo", "download", "alice/proj"}, "")
118	raw, isRaw := body["output"].(string)
119	if status != 200 || !isRaw || raw == "" {
120		t.Fatalf("repo download via API: %d %v", status, body)
121	}
122
123	// help answers with the registry as data, so a consumer can read one
124	// command's arguments without scraping the whole listing.
125	status, body = inst.apiCall(t, token, []string{"help", "issue", "create"}, "")
126	if status != 200 {
127		t.Fatalf("help via API: %d %v", status, body)
128	}
129	rows, ok := body["data"].([]any)
130	if !ok || len(rows) != 1 {
131		t.Fatalf("help issue create: %v", body)
132	}
133	row := rows[0].(map[string]any)
134	if row["path"] != "issue create" || !strings.Contains(row["usage"].(string), "--title") {
135		t.Fatalf("help issue create row: %v", row)
136	}
137
138	// Git transport is refused by name.
139	if status, _ = inst.apiCall(t, token, []string{"git-upload-pack", "alice/proj"}, ""); status != 400 {
140		t.Fatalf("git over API: %d", status)
141	}
142
143	// Token management works over the API like everything else: no
144	// command is held back from a surface any more (#234). A full-scope
145	// token mints another, which is what a full-scope credential means.
146	status, body = inst.apiCall(t, token, []string{"token", "create", "--name", "minted"}, "")
147	if status != 200 {
148		t.Fatalf("token create via API: %d %v", status, body)
149	}
150
151	// Read-scoped tokens read but never write.
152	out, _, code = inst.ssh(t, aliceKey, "", "token", "create", "--name", "reader", "--scope", "read", "--json")
153	if code != 0 {
154		t.Fatal("read token create failed")
155	}
156	json.Unmarshal([]byte(out), &env)
157	readToken := env.Data.Token
158	if status, _ = inst.apiCall(t, readToken, []string{"issue", "list", "alice/proj"}, ""); status != 200 {
159		t.Fatalf("read token list: %d", status)
160	}
161	status, body = inst.apiCall(t, readToken, []string{"issue", "close", "alice/proj", "1"}, "")
162	if status != 403 || !strings.Contains(body["error"].(string), "read-only") {
163		t.Fatalf("read token write: %d %v", status, body)
164	}
165
166	// Expiry: a 1-second token dies.
167	out, _, _ = inst.ssh(t, aliceKey, "", "token", "create", "--name", "brief", "--ttl", "1s", "--json")
168	json.Unmarshal([]byte(out), &env)
169	brief := env.Data.Token
170	if status, _ = inst.apiCall(t, brief, []string{"whoami"}, ""); status != 200 {
171		t.Fatal("fresh short-ttl token rejected")
172	}
173	time.Sleep(1100 * time.Millisecond)
174	if status, _ = inst.apiCall(t, brief, []string{"whoami"}, ""); status != 401 {
175		t.Fatal("expired token accepted")
176	}
177
178	// Revocation kills a token immediately.
179	if _, _, code = inst.ssh(t, aliceKey, "", "token", "revoke", "ci"); code != 0 {
180		t.Fatal("revoke failed")
181	}
182	if status, _ = inst.apiCall(t, token, []string{"whoami"}, ""); status != 401 {
183		t.Fatal("revoked token accepted")
184	}
185
186	// With [api] disabled (the default), the endpoint does not exist.
187	inst2 := startInstance(t)
188	req, _ := http.NewRequest("POST", fmt.Sprintf("http://127.0.0.1:%d/api/v1/cmd", inst2.httpPort),
189		strings.NewReader(`{"argv":["whoami"]}`))
190	req.Header.Set("Authorization", "Bearer gb_x")
191	resp, err := http.DefaultClient.Do(req)
192	if err != nil {
193		t.Fatal(err)
194	}
195	resp.Body.Close()
196	if resp.StatusCode != 404 {
197		t.Fatalf("API on disabled instance: %d, want 404", resp.StatusCode)
198	}
199}
200
201// TestAPIRateLimit covers the limiter over the wire: a caller who exceeds
202// their budget gets 429 with a Retry-After a client can honour, writes are
203// metered separately from reads, and one caller cannot spend another's
204// budget.
205func TestAPIRateLimit(t *testing.T) {
206	t.Parallel()
207	// 6/minute sustained, so the read burst is 6 and the write burst 0.6 —
208	// the first write is allowed and the second is not.
209	inst := startInstanceWith(t, "[api]\nenabled = true\n[limits]\napi_rate = 6\n")
210	aliceKey := inst.newKey(t, "alice")
211	bobKey := inst.newKey(t, "bob")
212	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
213	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub")
214	aliceTok := mintToken(t, inst, aliceKey, "alice-app")
215	bobTok := mintToken(t, inst, bobKey, "bob-app")
216
217	// Reads: the burst is spendable, then the door closes.
218	var limited bool
219	for i := 0; i < 12; i++ {
220		status, body := inst.apiCall(t, aliceTok, []string{"whoami"}, "")
221		if status == http.StatusTooManyRequests {
222			limited = true
223			if msg, _ := body["error"].(string); !strings.Contains(msg, "retry") {
224				t.Errorf("429 body does not say when to retry: %v", body)
225			}
226			break
227		}
228	}
229	if !limited {
230		t.Fatal("a caller never hit the rate limit")
231	}
232
233	// The 429 carries Retry-After, so a client backs off correctly instead
234	// of hammering.
235	req, _ := http.NewRequest("POST",
236		fmt.Sprintf("http://127.0.0.1:%d/api/v1/cmd", inst.httpPort),
237		strings.NewReader(`{"argv":["whoami"]}`))
238	req.Header.Set("Authorization", "Bearer "+aliceTok)
239	resp, err := http.DefaultClient.Do(req)
240	if err != nil {
241		t.Fatal(err)
242	}
243	resp.Body.Close()
244	if resp.StatusCode != http.StatusTooManyRequests {
245		t.Fatalf("expected a second 429, got %d", resp.StatusCode)
246	}
247	if ra := resp.Header.Get("Retry-After"); ra == "" || ra == "0" {
248		t.Errorf("Retry-After = %q", ra)
249	}
250
251	// One caller's flood does not spend another's budget.
252	if status, _ := inst.apiCall(t, bobTok, []string{"whoami"}, ""); status != http.StatusOK {
253		t.Errorf("bob was limited by alice's traffic: %d", status)
254	}
255
256	// Writes are metered separately: bob's read budget is nearly full, but
257	// his write budget is not.
258	inst.apiCall(t, bobTok, []string{"repo", "create", "bob/one"}, "")
259	status, _ := inst.apiCall(t, bobTok, []string{"repo", "create", "bob/two"}, "")
260	if status != http.StatusTooManyRequests {
261		t.Errorf("second write status %d, want 429 from the write budget", status)
262	}
263}
264
265// mintToken creates an API token over SSH and returns its value.
266func mintToken(t *testing.T, inst *instance, key, name string) string {
267	t.Helper()
268	out, errOut, code := inst.ssh(t, key, "", "token", "create", "--name", name, "--scope", "full", "--json")
269	if code != 0 {
270		t.Fatalf("token create: %s", errOut)
271	}
272	var env struct {
273		Data struct {
274			Token string `json:"token"`
275		} `json:"data"`
276	}
277	if err := json.Unmarshal([]byte(out), &env); err != nil || env.Data.Token == "" {
278		t.Fatalf("token JSON: %v\n%s", err, out)
279	}
280	return env.Data.Token
281}
282
283// apiGet fetches one read command, optionally conditionally.
284func (i *instance) apiGet(t *testing.T, token string, argv []string, ifNoneMatch string) (int, string, string) {
285	t.Helper()
286	q := url.Values{}
287	for _, a := range argv {
288		q.Add("argv", a)
289	}
290	req, err := http.NewRequest("GET",
291		fmt.Sprintf("http://127.0.0.1:%d/api/v1/read?%s", i.httpPort, q.Encode()), nil)
292	if err != nil {
293		t.Fatal(err)
294	}
295	if token != "" {
296		req.Header.Set("Authorization", "Bearer "+token)
297	}
298	if ifNoneMatch != "" {
299		req.Header.Set("If-None-Match", ifNoneMatch)
300	}
301	resp, err := http.DefaultClient.Do(req)
302	if err != nil {
303		t.Fatal(err)
304	}
305	defer resp.Body.Close()
306	raw, _ := io.ReadAll(resp.Body)
307	return resp.StatusCode, resp.Header.Get("ETag"), string(raw)
308}
309
310// TestAPIReadGET covers the conditional-request surface: reads over GET
311// with an ETag, 304 on revalidation, writes refused, and one caller's ETag
312// never matching another's.
313func TestAPIReadGET(t *testing.T) {
314	t.Parallel()
315	inst := startInstanceWith(t, "[api]\nenabled = true\n")
316	aliceKey := inst.newKey(t, "alice")
317	bobKey := inst.newKey(t, "bob")
318	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
319	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub")
320	aliceTok := mintToken(t, inst, aliceKey, "alice-get")
321	bobTok := mintToken(t, inst, bobKey, "bob-get")
322	if _, errOut, code := inst.ssh(t, aliceKey, "", "repo", "create", "alice/app"); code != 0 {
323		t.Fatalf("repo create: %s", errOut)
324	}
325
326	status, etag, body := inst.apiGet(t, aliceTok, []string{"repo", "show", "alice/app"}, "")
327	if status != 200 {
328		t.Fatalf("GET read: %d %s", status, body)
329	}
330	if etag == "" {
331		t.Fatal("no ETag, so a client cannot revalidate")
332	}
333	if !strings.Contains(body, `"alice/app"`) {
334		t.Errorf("body: %s", body)
335	}
336
337	// Revalidation returns 304 with no body — the point of the surface.
338	status, _, body = inst.apiGet(t, aliceTok, []string{"repo", "show", "alice/app"}, etag)
339	if status != http.StatusNotModified {
340		t.Fatalf("revalidation status %d, want 304", status)
341	}
342	if body != "" {
343		t.Errorf("304 carried a body: %q", body)
344	}
345	// A weak validator from an intermediary still matches.
346	if status, _, _ := inst.apiGet(t, aliceTok, []string{"repo", "show", "alice/app"}, "W/"+etag); status != http.StatusNotModified {
347		t.Errorf("weak ETag not honoured: %d", status)
348	}
349
350	// A stale ETag gets the real body back, not a 304.
351	if status, _, body := inst.apiGet(t, aliceTok, []string{"repo", "show", "alice/app"}, `"stale"`); status != 200 || body == "" {
352		t.Errorf("stale ETag: %d %q", status, body)
353	}
354
355	// The ETag is salted per caller, so one account can never be handed a
356	// 304 for another account's cached answer.
357	if status, _, _ := inst.apiGet(t, bobTok, []string{"repo", "show", "alice/app"}, etag); status == http.StatusNotModified {
358		t.Error("another caller's ETag matched")
359	}
360
361	// Responses must not be storable by shared caches.
362	req, _ := http.NewRequest("GET",
363		fmt.Sprintf("http://127.0.0.1:%d/api/v1/read?argv=whoami", inst.httpPort), nil)
364	req.Header.Set("Authorization", "Bearer "+aliceTok)
365	resp, err := http.DefaultClient.Do(req)
366	if err != nil {
367		t.Fatal(err)
368	}
369	resp.Body.Close()
370	if cc := resp.Header.Get("Cache-Control"); !strings.Contains(cc, "private") {
371		t.Errorf("Cache-Control = %q, want private", cc)
372	}
373
374	// A GET can never mutate: writes are refused by the registry's own
375	// ReadOnly flag rather than by a hand-kept list.
376	status, _, body = inst.apiGet(t, aliceTok, []string{"repo", "create", "alice/sneaky"}, "")
377	if status != http.StatusBadRequest || !strings.Contains(body, "POST it") {
378		t.Fatalf("write over GET: %d %s", status, body)
379	}
380	if _, _, code := inst.ssh(t, aliceKey, "", "repo", "show", "alice/sneaky"); code == 0 {
381		t.Fatal("a GET created a repository")
382	}
383
384	// Unauthenticated reads are refused like everywhere else.
385	if status, _, _ := inst.apiGet(t, "", []string{"whoami"}, ""); status != http.StatusUnauthorized {
386		t.Errorf("anonymous GET status %d, want 401", status)
387	}
388}