Skip to content

Commit 409df2c

Browse files
friel-openaifriel-openai
committed
t5563: exercise pack downloads with HTTP authentication tests
Run the existing credential-helper assertions against both ls-remote and http-fetch --packfile. This covers Basic, Bearer, proactive and multistage authentication without duplicating their fixtures. Add pack-specific checks for the retry limit, anonymous URLs, redirect configuration, and source-scoped headers. Combine the redirected request with credential.useHttpPath and http.minSessions=0 to check credential selection and curl handle lifetime. Signed-off-by: Friel <friel@openai.com>
1 parent 3805787 commit 409df2c

1 file changed

Lines changed: 142 additions & 28 deletions

File tree

‎t/t5563-simple-http-auth.sh‎

Lines changed: 142 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,116 @@ test_expect_success 'setup repository' '
6363
git push --mirror "$HTTPD_DOCUMENT_ROOT_PATH/repo.git"
6464
'
6565

66-
test_expect_success 'access using basic auth' '
66+
test_expect_success 'setup pack for authenticated downloads' '
67+
git -C "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" repack -ad &&
68+
pack=$(echo "$HTTPD_DOCUMENT_ROOT_PATH/repo.git/objects/pack/"*.pack) &&
69+
pack_hash=${pack##*/pack-} &&
70+
pack_hash=${pack_hash%.pack} &&
71+
pack_url="$HTTPD_URL/custom_auth/repo.git/objects/pack/pack-$pack_hash.pack"
72+
'
73+
74+
test_expect_success 'packfile download bounds multistage authentication retries' '
75+
test_when_finished per_test_cleanup &&
76+
set_credential_reply get <<-EOF &&
77+
capability[]=authtype
78+
capability[]=state
79+
authtype=Multistage
80+
credential=first
81+
state[]=helper:second
82+
continue=1
83+
EOF
84+
set_credential_reply get second <<-EOF &&
85+
capability[]=authtype
86+
capability[]=state
87+
authtype=Multistage
88+
credential=second
89+
state[]=helper:third
90+
continue=1
91+
EOF
92+
cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
93+
id=default response=WWW-Authenticate: Multistage challenge="retry"
94+
EOF
95+
test_config_global credential.helper test-helper &&
96+
test_must_fail git http-fetch --packfile="$pack_hash" \
97+
--index-pack-arg=index-pack --index-pack-arg=--stdin "$pack_url" &&
98+
test_path_is_file get-query.cred &&
99+
test_path_is_file get-query-second.cred &&
100+
test_path_is_missing get-query-third.cred &&
101+
test_path_is_missing store-query.cred
102+
'
103+
104+
test_expect_success 'packfile redirect does not reuse source-scoped headers' '
105+
test_when_finished per_test_cleanup &&
106+
set_credential_reply get <<-EOF &&
107+
capability[]=authtype
108+
authtype=Bearer
109+
credential=destination-token
110+
EOF
111+
cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
112+
id=1 creds=Bearer source-token
113+
id=2 creds=Bearer destination-token
114+
EOF
115+
cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
116+
id=1 status=302 response=Location: http://localhost:$LIB_HTTPD_PORT/custom_auth/repo.git/objects/pack/pack-$pack_hash.pack
117+
id=2 status=200
118+
id=default response=WWW-Authenticate: Bearer realm="destination"
119+
EOF
120+
test_config_global "http.$HTTPD_URL.extraHeader" "Authorization: Bearer source-token" &&
121+
test_config_global credential.helper test-helper &&
122+
test_config_global credential.useHttpPath true &&
123+
git -c http.minSessions=0 http-fetch --packfile="$pack_hash" \
124+
--index-pack-arg=index-pack --index-pack-arg=--stdin "$pack_url" &&
125+
expect_credential_query get <<-EOF &&
126+
capability[]=authtype
127+
capability[]=state
128+
protocol=http
129+
host=localhost:$LIB_HTTPD_PORT
130+
path=custom_auth/repo.git/objects/pack/pack-$pack_hash.pack
131+
wwwauth[]=Bearer realm="destination"
132+
EOF
133+
expect_credential_query store <<-EOF
134+
capability[]=authtype
135+
authtype=Bearer
136+
credential=destination-token
137+
protocol=http
138+
host=localhost:$LIB_HTTPD_PORT
139+
path=custom_auth/repo.git/objects/pack/pack-$pack_hash.pack
140+
EOF
141+
'
142+
143+
test_expect_success 'packfile download honors http.followRedirects=false' '
144+
test_when_finished per_test_cleanup &&
145+
test_config_global credential.helper test-helper &&
146+
test_must_fail git -c http.followRedirects=false \
147+
http-fetch --packfile="$pack_hash" \
148+
--index-pack-arg=index-pack --index-pack-arg=--stdin \
149+
"$HTTPD_URL/redir-to/auth/dumb/repo.git/objects/pack/pack-$pack_hash.pack" &&
150+
test_path_is_missing get-query.cred
151+
'
152+
153+
test_expect_success 'public packfile download does not consult credential helpers' '
154+
test_when_finished per_test_cleanup &&
155+
test_config_global credential.helper test-helper &&
156+
git http-fetch --packfile="$pack_hash" \
157+
--index-pack-arg=index-pack --index-pack-arg=--stdin \
158+
"$HTTPD_URL/dumb/repo.git/objects/pack/pack-$pack_hash.pack?signature=opaque" &&
159+
test_path_is_missing get-query.cred
160+
'
161+
162+
for request in refs pack
163+
do
164+
case "$request" in
165+
refs)
166+
command=ls-remote
167+
url="$HTTPD_URL/custom_auth/repo.git"
168+
;;
169+
pack)
170+
command="http-fetch --packfile=$pack_hash --index-pack-arg=index-pack --index-pack-arg=--stdin"
171+
url=$pack_url
172+
;;
173+
esac
174+
175+
test_expect_success "$request: access using basic auth" '
67176
test_when_finished "per_test_cleanup" &&
68177
69178
set_credential_reply get <<-EOF &&
@@ -82,7 +191,7 @@ test_expect_success 'access using basic auth' '
82191
EOF
83192
84193
test_config_global credential.helper test-helper &&
85-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
194+
git $command "$url" &&
86195
87196
expect_credential_query get <<-EOF &&
88197
capability[]=authtype
@@ -100,7 +209,7 @@ test_expect_success 'access using basic auth' '
100209
EOF
101210
'
102211

103-
test_expect_success 'access using basic auth via authtype' '
212+
test_expect_success "$request: access using basic auth via authtype" '
104213
test_when_finished "per_test_cleanup" &&
105214
106215
set_credential_reply get <<-EOF &&
@@ -120,7 +229,7 @@ test_expect_success 'access using basic auth via authtype' '
120229
EOF
121230
122231
test_config_global credential.helper test-helper &&
123-
GIT_CURL_VERBOSE=1 git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
232+
GIT_CURL_VERBOSE=1 git $command "$url" &&
124233
125234
expect_credential_query get <<-EOF &&
126235
capability[]=authtype
@@ -139,7 +248,7 @@ test_expect_success 'access using basic auth via authtype' '
139248
EOF
140249
'
141250

142-
test_expect_success 'access using basic auth invalid credentials' '
251+
test_expect_success "$request: access using basic auth invalid credentials" '
143252
test_when_finished "per_test_cleanup" &&
144253
145254
set_credential_reply get <<-EOF &&
@@ -158,7 +267,7 @@ test_expect_success 'access using basic auth invalid credentials' '
158267
EOF
159268
160269
test_config_global credential.helper test-helper &&
161-
test_must_fail git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
270+
test_must_fail git $command "$url" &&
162271
163272
expect_credential_query get <<-EOF &&
164273
capability[]=authtype
@@ -177,7 +286,7 @@ test_expect_success 'access using basic auth invalid credentials' '
177286
EOF
178287
'
179288

180-
test_expect_success 'access using basic proactive auth' '
289+
test_expect_success "$request: access using basic proactive auth" '
181290
test_when_finished "per_test_cleanup" &&
182291
183292
set_credential_reply get <<-EOF &&
@@ -197,7 +306,7 @@ test_expect_success 'access using basic proactive auth' '
197306
198307
test_config_global credential.helper test-helper &&
199308
test_config_global http.proactiveAuth basic &&
200-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
309+
git $command "$url" &&
201310
202311
expect_credential_query get <<-EOF &&
203312
capability[]=authtype
@@ -215,7 +324,7 @@ test_expect_success 'access using basic proactive auth' '
215324
EOF
216325
'
217326

218-
test_expect_success 'access using auto proactive auth with basic default' '
327+
test_expect_success "$request: access using auto proactive auth with basic default" '
219328
test_when_finished "per_test_cleanup" &&
220329
221330
set_credential_reply get <<-EOF &&
@@ -235,7 +344,7 @@ test_expect_success 'access using auto proactive auth with basic default' '
235344
236345
test_config_global credential.helper test-helper &&
237346
test_config_global http.proactiveAuth auto &&
238-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
347+
git $command "$url" &&
239348
240349
expect_credential_query get <<-EOF &&
241350
capability[]=authtype
@@ -252,7 +361,7 @@ test_expect_success 'access using auto proactive auth with basic default' '
252361
EOF
253362
'
254363

255-
test_expect_success 'access using auto proactive auth with authtype from credential helper' '
364+
test_expect_success "$request: access using auto proactive auth with authtype from credential helper" '
256365
test_when_finished "per_test_cleanup" &&
257366
258367
set_credential_reply get <<-EOF &&
@@ -275,7 +384,7 @@ test_expect_success 'access using auto proactive auth with authtype from credent
275384
276385
test_config_global credential.helper test-helper &&
277386
test_config_global http.proactiveAuth auto &&
278-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
387+
git $command "$url" &&
279388
280389
expect_credential_query get <<-EOF &&
281390
capability[]=authtype
@@ -293,7 +402,7 @@ test_expect_success 'access using auto proactive auth with authtype from credent
293402
EOF
294403
'
295404

296-
test_expect_success 'access using basic auth with extra challenges' '
405+
test_expect_success "$request: access using basic auth with extra challenges" '
297406
test_when_finished "per_test_cleanup" &&
298407
299408
set_credential_reply get <<-EOF &&
@@ -314,7 +423,7 @@ test_expect_success 'access using basic auth with extra challenges' '
314423
EOF
315424
316425
test_config_global credential.helper test-helper &&
317-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
426+
git $command "$url" &&
318427
319428
expect_credential_query get <<-EOF &&
320429
capability[]=authtype
@@ -334,7 +443,7 @@ test_expect_success 'access using basic auth with extra challenges' '
334443
EOF
335444
'
336445

337-
test_expect_success 'access using basic auth mixed-case wwwauth header name' '
446+
test_expect_success "$request: access using basic auth mixed-case wwwauth header name" '
338447
test_when_finished "per_test_cleanup" &&
339448
340449
set_credential_reply get <<-EOF &&
@@ -355,7 +464,7 @@ test_expect_success 'access using basic auth mixed-case wwwauth header name' '
355464
EOF
356465
357466
test_config_global credential.helper test-helper &&
358-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
467+
git $command "$url" &&
359468
360469
expect_credential_query get <<-EOF &&
361470
capability[]=authtype
@@ -375,7 +484,7 @@ test_expect_success 'access using basic auth mixed-case wwwauth header name' '
375484
EOF
376485
'
377486

378-
test_expect_success 'access using basic auth with wwwauth header continuations' '
487+
test_expect_success "$request: access using basic auth with wwwauth header continuations" '
379488
test_when_finished "per_test_cleanup" &&
380489
381490
set_credential_reply get <<-EOF &&
@@ -401,7 +510,7 @@ test_expect_success 'access using basic auth with wwwauth header continuations'
401510
EOF
402511
403512
test_config_global credential.helper test-helper &&
404-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
513+
git $command "$url" &&
405514
406515
expect_credential_query get <<-EOF &&
407516
capability[]=authtype
@@ -421,7 +530,7 @@ test_expect_success 'access using basic auth with wwwauth header continuations'
421530
EOF
422531
'
423532

424-
test_expect_success 'access using basic auth with wwwauth header empty continuations' '
533+
test_expect_success "$request: access using basic auth with wwwauth header empty continuations" '
425534
test_when_finished "per_test_cleanup" &&
426535
427536
set_credential_reply get <<-EOF &&
@@ -449,7 +558,7 @@ test_expect_success 'access using basic auth with wwwauth header empty continuat
449558
printf "id=default response=WWW-Authenticate: Basic realm=\"example.com\"\r\n" >>"$CHALLENGE" &&
450559
451560
test_config_global credential.helper test-helper &&
452-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
561+
git $command "$url" &&
453562
454563
expect_credential_query get <<-EOF &&
455564
capability[]=authtype
@@ -469,7 +578,7 @@ test_expect_success 'access using basic auth with wwwauth header empty continuat
469578
EOF
470579
'
471580

472-
test_expect_success 'access using basic auth with wwwauth header mixed continuations' '
581+
test_expect_success "$request: access using basic auth with wwwauth header mixed continuations" '
473582
test_when_finished "per_test_cleanup" &&
474583
475584
set_credential_reply get <<-EOF &&
@@ -493,7 +602,7 @@ test_expect_success 'access using basic auth with wwwauth header mixed continuat
493602
printf "id=default response=WWW-Authenticate: Basic realm=\"example.com\"\r\n" >>"$CHALLENGE" &&
494603
495604
test_config_global credential.helper test-helper &&
496-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
605+
git $command "$url" &&
497606
498607
expect_credential_query get <<-EOF &&
499608
capability[]=authtype
@@ -512,7 +621,7 @@ test_expect_success 'access using basic auth with wwwauth header mixed continuat
512621
EOF
513622
'
514623

515-
test_expect_success 'access using bearer auth' '
624+
test_expect_success "$request: access using bearer auth" '
516625
test_when_finished "per_test_cleanup" &&
517626
518627
set_credential_reply get <<-EOF &&
@@ -536,7 +645,7 @@ test_expect_success 'access using bearer auth' '
536645
EOF
537646
538647
test_config_global credential.helper test-helper &&
539-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
648+
git $command "$url" &&
540649
541650
expect_credential_query get <<-EOF &&
542651
capability[]=authtype
@@ -557,7 +666,7 @@ test_expect_success 'access using bearer auth' '
557666
EOF
558667
'
559668

560-
test_expect_success 'access using bearer auth with invalid credentials' '
669+
test_expect_success "$request: access using bearer auth with invalid credentials" '
561670
test_when_finished "per_test_cleanup" &&
562671
563672
set_credential_reply get <<-EOF &&
@@ -581,7 +690,7 @@ test_expect_success 'access using bearer auth with invalid credentials' '
581690
EOF
582691
583692
test_config_global credential.helper test-helper &&
584-
test_must_fail git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
693+
test_must_fail git $command "$url" &&
585694
586695
expect_credential_query get <<-EOF &&
587696
capability[]=authtype
@@ -605,6 +714,8 @@ test_expect_success 'access using bearer auth with invalid credentials' '
605714
EOF
606715
'
607716

717+
if test "$request" = refs
718+
then
608719
test_expect_success 'clone with bearer auth and probe_rpc' '
609720
test_when_finished "per_test_cleanup" &&
610721
test_when_finished "rm -rf large.git" &&
@@ -649,8 +760,9 @@ test_expect_success 'clone with bearer auth and probe_rpc' '
649760
test_config_global credential.helper test-helper &&
650761
git clone "$HTTPD_URL/custom_auth/large.git" partial-auth-clone 2>clone-error
651762
'
763+
fi
652764

653-
test_expect_success 'access using three-legged auth' '
765+
test_expect_success "$request: access using three-legged auth" '
654766
test_when_finished "per_test_cleanup" &&
655767
656768
set_credential_reply get <<-EOF &&
@@ -686,7 +798,7 @@ test_expect_success 'access using three-legged auth' '
686798
EOF
687799
688800
test_config_global credential.helper test-helper &&
689-
git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
801+
git $command "$url" &&
690802
691803
expect_credential_query get <<-EOF &&
692804
capability[]=authtype
@@ -721,6 +833,8 @@ test_expect_success 'access using three-legged auth' '
721833

722834
test_lazy_prereq SPNEGO 'curl --version | grep -qi "SPNEGO\|GSS-API\|Kerberos\|negotiate"'
723835

836+
done
837+
724838
test_expect_success SPNEGO 'http.emptyAuth=auto attempts Negotiate before credential_fill' '
725839
test_when_finished "per_test_cleanup" &&
726840

0 commit comments

Comments
 (0)