releasekit/cmd/releasekit/token_file_test.go

package main

import (
	"bytes"
	"context"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"go.maximumdirect.net/releasekit/cmd/releasekit/internal/cli"
)

func TestDeliveryTokenFileSelection(t *testing.T) {
	for _, test := range []struct {
		name, env, contents, file, want string
		status                          int
	}{
		{name: "relative file", contents: "fixture-token\n", file: "token", want: "fixture-token"},
		{name: "absolute file", contents: "fixture-token\n", file: "absolute", want: "fixture-token"},
		{name: "environment overrides missing file", env: "env-token", file: "missing", want: "env-token"},
		{name: "blank environment falls back", env: " \t", contents: "fixture-token\n", file: "token", want: "fixture-token"},
		{name: "missing file", file: "missing", status: 2},
		{name: "blank file", contents: " \n\t", file: "token", status: 2},
		{name: "empty file", file: "token", status: 2},
		{name: "unreadable as file", file: ".", status: 2},
		{name: "no credential", status: 2},
	} {
		t.Run(test.name, func(t *testing.T) {
			repository := t.TempDir()
			if err := os.WriteFile(filepath.Join(repository, "token"), []byte(test.contents), 0o600); err != nil {
				t.Fatal(err)
			}
			name := test.file
			if name == "absolute" {
				name = filepath.Join(repository, "token")
			}
			t.Setenv("RELEASEKIT_TEST_TOKEN", test.env)
			var stderr bytes.Buffer
			destination, status := deliveryDestination(repository, cli.Settings{Delivery: &cli.DeliverySettings{Forge: "gitea",
				BaseURL: "https://gitea.example", Owner: "owner", Repository: "example",
				TokenEnv: "RELEASEKIT_TEST_TOKEN", TokenFile: name,
			}}, &stderr)
			if status != test.status || destination.Token != test.want {
				t.Fatalf("status=%d token matches=%t, want status=%d; diagnostics=%s", status, destination.Token == test.want, test.status, &stderr)
			}
			for _, secret := range []string{"fixture-token", "env-token"} {
				if strings.Contains(stderr.String(), secret) {
					t.Fatal("diagnostics exposed a token")
				}
			}
		})
	}
}

func TestCheckReadsForbiddenFilesSelectionFromProfile(t *testing.T) {
	repository := newCLIRepository(t)
	writeDeliveryProfile(t, repository, cli.Settings{
		Product:    "Example Product",
		Validation: &cli.ValidationSettings{ForbiddenFiles: []string{"token-file"}},
		Delivery:   &cli.DeliverySettings{Forge: "gitea", BaseURL: "https://gitea.example", Owner: "owner", Repository: "example", TokenFile: "missing-token-file"},
	})
	writeRepositoryFile(t, repository, "token-file", "fixture-secret\n")
	cliGitRun(t, repository, "add", "token-file")
	cliGitRun(t, repository, "commit", "-m", "capture a selected token path")
	var stdout, stderr bytes.Buffer
	status := run(context.Background(), []string{"check", "--repo", repository, "v1.2.3"}, &stdout, &stderr)
	if status != 1 || !strings.Contains(stderr.String(), "forbidden-files") || !strings.Contains(stderr.String(), "token-file") {
		t.Fatalf("check status=%d output=%s diagnostics=%s", status, &stdout, &stderr)
	}
	if strings.Contains(stdout.String()+stderr.String(), "fixture-secret") {
		t.Fatal("check exposed the token")
	}
}

func TestDeliverAndCIDeliverReadTokenFileFromRepositoryRoot(t *testing.T) {
	for _, command := range []string{"deliver", "ci-deliver"} {
		t.Run(command, func(t *testing.T) {
			repository := newCLIRepository(t)
			state := &deliveryServerState{}
			server := newDeliveryServer(t, state)
			defer server.Close()
			writeDeliveryProfile(t, repository, cli.Settings{
				Product:  "Example Product",
				Delivery: &cli.DeliverySettings{Forge: "gitea", BaseURL: server.URL, Owner: "owner", Repository: "example", TokenFile: ".releasekit/token"},
			})
			writeRepositoryFile(t, repository, ".gitignore", ".releasekit/\n")
			cliGitRun(t, repository, "add", ".gitignore")
			cliGitRun(t, repository, "commit", "-m", "ignore local delivery credentials")
			commit := pushTaggedCLIRepository(t, repository)
			state.update(func(data *deliveryServerData) { data.commit = commit })
			writeRepositoryFile(t, repository, ".releasekit/token", "fixture-token\n")
			t.Setenv("RELEASEKIT_GITEA_TOKEN", "")
			var stdout, stderr bytes.Buffer
			args := []string{command, "--repo", filepath.Join(repository, ".releasekit")}
			if command == "ci-deliver" {
				args = append(args, "--commit", commit)
			}
			args = append(args, "v1.2.3")
			if status := run(context.Background(), args, &stdout, &stderr); status != 0 {
				t.Fatalf("delivery status=%d output=%s diagnostics=%s", status, &stdout, &stderr)
			}
			if state.snapshot().releaseCreates != 1 {
				t.Fatal("token-file delivery did not create the release page")
			}
			if strings.Contains(stdout.String()+stderr.String(), "fixture-token") {
				t.Fatal("delivery exposed the token")
			}
		})
	}
}