hearthforge

hearthforge/internal/web/e2e/patches_test.go
patches_test.go
⎇
Raw
1package e2e
2
3import (
4 "net/http"
5 "net/url"
6 "os"
7 "strings"
8 "testing"
9
10 "github.com/PuerkitoBio/goquery"
11)
12
13// patchFile is the upload part every patch form expects.
14func patchFile(content string) file {
15 return file{Field: "patch_file", Name: "test.patch", Content: []byte(content)}
16}
17
18// patchCreate uploads a new patch and returns the response of the form POST.
19func patchCreate(s *session, repo, title, description, content string) *response {
20 return s.postMultipart("/"+repo+"/patches",
21 url.Values{"title": {title}, "description": {description}},
22 patchFile(content))
23}
24
25// patchFilterText returns the elements matching sel whose text contains sub.
26func patchFilterText(r *response, sel, sub string) *goquery.Selection {
27 return r.Find(sel).FilterFunction(func(_ int, s *goquery.Selection) bool {
28 return strings.Contains(s.Text(), sub)
29 })
30}
31
32// patchGitLog reads one formatted field of the newest commit.
33func patchGitLog(t *testing.T, repoDir, format string) string {
34 t.Helper()
35 return gitRun(t, repoDir, "log", "-1", "--format="+format)
36}
37
38// Adds a new file — applies cleanly to my-repo.
39const cleanPatch = `From a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2 Mon Sep 17 00:00:00 2001
40From: Test User <test@example.com>
41Date: Mon, 01 Jan 2024 12:00:00 +0000
42Subject: [PATCH] Add patch-test.txt
43
44---
45diff --git a/patch-test.txt b/patch-test.txt
46new file mode 100644
47index 0000000..9daeafb
48--- /dev/null
49+++ b/patch-test.txt
50@@ -0,0 +1 @@
51+patch test content
52`
53
54// References non-existent lines in README.md — always conflicts.
55const conflictPatch = `From a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b3 Mon Sep 17 00:00:00 2001
56From: Test User <test@example.com>
57Date: Mon, 01 Jan 2024 12:00:00 +0000
58Subject: [PATCH] Modify README
59
60---
61diff --git a/README.md b/README.md
62index abc1234..def5678 100644
63--- a/README.md
64+++ b/README.md
65@@ -50,3 +50,3 @@
66 nonexistent context line
67-nonexistent old line
68+nonexistent new line
69`
70
71// Adds another new file — for testing close flow.
72const closePatch = `From a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b4 Mon Sep 17 00:00:00 2001
73From: Test User <test@example.com>
74Date: Mon, 01 Jan 2024 12:00:00 +0000
75Subject: [PATCH] Add patch-close.txt
76
77---
78diff --git a/patch-close.txt b/patch-close.txt
79new file mode 100644
80index 0000000..9daeafb
81--- /dev/null
82+++ b/patch-close.txt
83@@ -0,0 +1 @@
84+close test
85`
86
87// Adds upload-test.txt — applies cleanly to my-repo.
88const uploadTestPatch = `From c1d2e3f4a5b6c1d2e3f4a5b6c1d2e3f4a5b6c1d2 Mon Sep 17 00:00:00 2001
89From: Original Author <original@example.com>
90Date: Wed, 03 Jan 2024 10:00:00 +0000
91Subject: [PATCH] Add upload-test.txt
92
93---
94diff --git a/upload-test.txt b/upload-test.txt
95new file mode 100644
96index 0000000..9daeafb
97--- /dev/null
98+++ b/upload-test.txt
99@@ -0,0 +1 @@
100+upload test
101`
102
103// Replacement: different author, same diff target.
104const replacementPatch = `From d1e2f3a4b5c6d1e2f3a4b5c6d1e2f3a4b5c6d1e2 Mon Sep 17 00:00:00 2001
105From: Replaced Author <replaced@example.com>
106Date: Thu, 04 Jan 2024 10:00:00 +0000
107Subject: [PATCH] Add upload-test.txt (v2)
108
109---
110diff --git a/upload-test.txt b/upload-test.txt
111new file mode 100644
112index 0000000..9daeafb
113--- /dev/null
114+++ b/upload-test.txt
115@@ -0,0 +1 @@
116+upload test v2
117`
118
119func TestPatches(t *testing.T) {
120 e := newEnv(t)
121 e.register("alice", "password123")
122 admin := e.admin()
123 e.createRepo(admin, "my-repo")
124 e.seedRepo("my-repo", nil)
125
126 var cleanURL, conflictURL, closeURL, uploadTestURL string
127
128 t.Run("reject file without patch markers", func(t *testing.T) {
129 r := admin.postMultipart("/my-repo/patches", url.Values{"title": {"Bad patch"}},
130 file{Field: "patch_file", Name: "not-a-patch.txt", Content: []byte("this is just plain text")})
131 if !strings.Contains(r.Text(".form-error"), "valid patch") {
132 t.Errorf("error = %q", r.Text(".form-error"))
133 }
134 })
135
136 t.Run("reject patch missing Subject header", func(t *testing.T) {
137 r := patchCreate(admin, "my-repo", "No subject", "", `From: Test User <test@example.com>
138Date: Mon, 01 Jan 2024 12:00:00 +0000
139
140---
141diff --git a/f.txt b/f.txt
142new file mode 100644
143--- /dev/null
144+++ b/f.txt
145@@ -0,0 +1 @@
146+x
147`)
148 if !strings.Contains(r.Text(".form-error"), "Subject") {
149 t.Errorf("error = %q", r.Text(".form-error"))
150 }
151 })
152
153 t.Run("reject patch missing From header", func(t *testing.T) {
154 r := patchCreate(admin, "my-repo", "No from", "", `Date: Mon, 01 Jan 2024 12:00:00 +0000
155Subject: [PATCH] Add f.txt
156
157---
158diff --git a/f.txt b/f.txt
159new file mode 100644
160--- /dev/null
161+++ b/f.txt
162@@ -0,0 +1 @@
163+x
164`)
165 if !strings.Contains(r.Text(".form-error"), "From") {
166 t.Errorf("error = %q", r.Text(".form-error"))
167 }
168 })
169
170 t.Run("reject patch missing Date header", func(t *testing.T) {
171 r := patchCreate(admin, "my-repo", "No date", "", `From: Test User <test@example.com>
172Subject: [PATCH] Add f.txt
173
174---
175diff --git a/f.txt b/f.txt
176new file mode 100644
177--- /dev/null
178+++ b/f.txt
179@@ -0,0 +1 @@
180+x
181`)
182 if !strings.Contains(r.Text(".form-error"), "Date") {
183 t.Errorf("error = %q", r.Text(".form-error"))
184 }
185 })
186
187 t.Run("upload clean patch", func(t *testing.T) {
188 r := patchCreate(admin, "my-repo", "Add patch-test.txt",
189 "Adds a file with **markdown** desc.", cleanPatch)
190 cleanURL = r.mustRedirect("/my-repo/patches/")
191 if got := admin.get(cleanURL).Text(".issue-detail-title"); got != "Add patch-test.txt" {
192 t.Errorf("title = %q", got)
193 }
194 })
195
196 t.Run("changes tab shows commit metadata card", func(t *testing.T) {
197 r := admin.get(cleanURL + "?tab=changes")
198 if !r.Has(".commit-card") {
199 t.Fatal("commit-card missing")
200 }
201 if !strings.Contains(r.Text(".commit-card-subject"), "Add patch-test.txt") {
202 t.Errorf("subject = %q", r.Text(".commit-card-subject"))
203 }
204 meta := r.Text(".commit-card-meta")
205 if !strings.Contains(meta, "Test User") || !strings.Contains(meta, "test@example.com") {
206 t.Errorf("meta = %q", meta)
207 }
208 if !r.Has(".commit-card-meta time") {
209 t.Error("commit-card-meta time missing")
210 }
211 })
212
213 t.Run("patch description renders markdown", func(t *testing.T) {
214 html, err := admin.get(cleanURL).Find(".timeline-body.markdown-body").First().Html()
215 if err != nil {
216 t.Fatal(err)
217 }
218 if !strings.Contains(html, "<strong>") {
219 t.Errorf("description html = %q", html)
220 }
221 })
222
223 t.Run("clean patch shows apply-clean status immediately", func(t *testing.T) {
224 r := admin.get(cleanURL)
225 if !r.Has(".apply-result") || !r.Has(".apply-clean") {
226 t.Error("apply-clean status missing")
227 }
228 })
229
230 t.Run("merge button appears for clean patch", func(t *testing.T) {
231 if !admin.get(cleanURL).Has(`form[action*="/merge"] button`) {
232 t.Error("merge button missing")
233 }
234 })
235
236 t.Run("patch diff is displayed with highlighted table", func(t *testing.T) {
237 r := admin.get(cleanURL + "?tab=changes")
238 if !r.Has(".diff-rows") {
239 t.Error("diff-rows missing")
240 }
241 if r.Count(".diff-row-add") == 0 {
242 t.Error("no added diff rows")
243 }
244 })
245
246 t.Run("patch appears in open list", func(t *testing.T) {
247 if !contains(admin.get("/my-repo/patches").Texts(".issue-title"), "Add patch-test.txt") {
248 t.Error("patch not in open list")
249 }
250 })
251
252 t.Run("unauthenticated user is redirected to login from patch upload", func(t *testing.T) {
253 e.anon().get("/my-repo/patches/new").mustRedirect("/login")
254 })
255
256 t.Run("upload conflict patch", func(t *testing.T) {
257 conflictURL = patchCreate(admin, "my-repo", "Conflict patch", "", conflictPatch).
258 mustRedirect("/my-repo/patches/")
259 })
260
261 t.Run("conflict patch shows apply-conflict status", func(t *testing.T) {
262 if !admin.get(conflictURL).Has(".apply-conflict") {
263 t.Error("apply-conflict missing")
264 }
265 })
266
267 t.Run("merge button absent for conflict patch", func(t *testing.T) {
268 if n := admin.get(conflictURL).Count(`form[action*="/merge"] button`); n != 0 {
269 t.Errorf("merge buttons = %d", n)
270 }
271 })
272
273 t.Run("merge clean patch changes status to merged", func(t *testing.T) {
274 version := admin.get(cleanURL).Value(`form[action*="/merge"] input[name=version]`)
275 admin.post(cleanURL+"/merge", url.Values{"version": {version}}).mustRedirect(cleanURL)
276 if got := admin.get(cleanURL).Text(".patch-badge"); got != "merged" {
277 t.Errorf("badge = %q", got)
278 }
279 })
280
281 t.Run("merge uses patch From header as git author", func(t *testing.T) {
282 dir := e.repoPath("my-repo")
283 if got := patchGitLog(t, dir, "%aN"); got != "Test User" {
284 t.Errorf("author name = %q", got)
285 }
286 if got := patchGitLog(t, dir, "%aE"); got != "test@example.com" {
287 t.Errorf("author email = %q", got)
288 }
289 if got := patchGitLog(t, dir, "%s"); got != "Add patch-test.txt" {
290 t.Errorf("subject = %q", got)
291 }
292 })
293
294 t.Run("merged patch appears in merged list", func(t *testing.T) {
295 if !contains(admin.get("/my-repo/patches?status=merged").Texts(".issue-title"), "Add patch-test.txt") {
296 t.Error("patch not in merged list")
297 }
298 })
299
300 t.Run("upload and close a patch", func(t *testing.T) {
301 closeURL = patchCreate(admin, "my-repo", "Close me", "", closePatch).
302 mustRedirect("/my-repo/patches/")
303 admin.post(closeURL+"/close", nil).mustRedirect(closeURL)
304 if got := admin.get(closeURL).Text(".patch-badge"); got != "closed" {
305 t.Errorf("badge = %q", got)
306 }
307 })
308
309 t.Run("closed patch appears in closed list", func(t *testing.T) {
310 if !contains(admin.get("/my-repo/patches?status=closed").Texts(".issue-title"), "Close me") {
311 t.Error("patch not in closed list")
312 }
313 })
314
315 t.Run("closed patch can be reopened", func(t *testing.T) {
316 if got := admin.get(closeURL).Text(".patch-badge"); got != "closed" {
317 t.Fatalf("badge = %q", got)
318 }
319 admin.post(closeURL+"/close", nil).mustRedirect(closeURL)
320 if got := admin.get(closeURL).Text(".patch-badge"); got != "open" {
321 t.Errorf("badge = %q", got)
322 }
323 })
324
325 t.Run("patch title and description can be edited", func(t *testing.T) {
326 // The title form resubmits the unchanged description.
327 desc := admin.get(conflictURL).Value(`.title-edit-form [name=edit_description]`)
328 admin.post(conflictURL+"/edit", url.Values{
329 "title": {"Edited Conflict Patch"}, "edit_description": {desc},
330 }).mustRedirect(conflictURL)
331 if got := admin.get(conflictURL).Text(".issue-detail-title"); got != "Edited Conflict Patch" {
332 t.Errorf("title = %q", got)
333 }
334 // The inline description form resubmits the unchanged title.
335 title := admin.get(conflictURL).Value(`.inline-edit-form [name=title]`)
336 admin.post(conflictURL+"/edit", url.Values{
337 "title": {title}, "edit_description": {"Updated desc"},
338 }).mustRedirect(conflictURL)
339 if !strings.Contains(admin.get(conflictURL).Text(".timeline-body"), "Updated desc") {
340 t.Error("description not updated")
341 }
342 })
343
344 t.Run("patch comment: add and edit", func(t *testing.T) {
345 admin.post(conflictURL+"/comments", url.Values{"body": {"My patch comment"}}).
346 mustRedirect(conflictURL)
347 r := admin.get(conflictURL)
348 bodies := r.Texts(".timeline-body")
349 if len(bodies) == 0 || !strings.Contains(bodies[len(bodies)-1], "My patch comment") {
350 t.Fatalf("comment bodies = %q", bodies)
351 }
352 // Edit the comment through its own edit form.
353 action, ok := patchFilterText(r, ".timeline-item", "My patch comment").
354 Find(".inline-edit-form").First().Attr("action")
355 if !ok {
356 t.Fatal("comment edit form missing")
357 }
358 admin.post(action, url.Values{"edit_body": {"Edited patch comment"}}).mustRedirect(conflictURL)
359 bodies = admin.get(conflictURL).Texts(".timeline-body")
360 if !strings.Contains(bodies[len(bodies)-1], "Edited patch comment") {
361 t.Errorf("comment bodies = %q", bodies)
362 }
363 })
364
365 t.Run("patch reaction on description", func(t *testing.T) {
366 // The picker of the first timeline item reacts on the description.
367 emoji := admin.get(conflictURL).
368 Find(".timeline-item").First().
369 Find(".reaction-picker-dropdown input[name=emoji]").First().AttrOr("value", "")
370 if emoji == "" {
371 t.Fatal("reaction picker empty")
372 }
373 admin.post(conflictURL+"/react", url.Values{"emoji": {emoji}}).mustRedirect(conflictURL)
374 if got := admin.get(conflictURL).Text(".reaction-btn"); !strings.ContainsAny(got, "0123456789") {
375 t.Errorf("reaction button = %q", got)
376 }
377 })
378
379 t.Run("admin can delete a patch", func(t *testing.T) {
380 r := admin.post(conflictURL+"/delete", nil)
381 r.mustStatus(http.StatusFound)
382 if !strings.Contains(r.Location(), "/patches") {
383 t.Errorf("location = %q", r.Location())
384 }
385 admin.get(conflictURL).mustStatus(http.StatusNotFound)
386 })
387
388 t.Run("author cannot delete own closed patch", func(t *testing.T) {
389 alice := e.login("alice", "password123")
390 p := patchCreate(alice, "my-repo", "Alice patch", "", uploadTestPatch).
391 mustRedirect("/my-repo/patches/")
392 admin.post(p+"/close", nil)
393 alice.post(p+"/delete", nil).mustStatus(http.StatusForbidden)
394 admin.get(p).mustStatus(http.StatusOK)
395 admin.post(p+"/delete", nil).mustStatus(http.StatusFound)
396 })
397
398 // ── Patch file re-upload & version protection ──────────────────────────
399
400 t.Run("create patch for re-upload tests", func(t *testing.T) {
401 uploadTestURL = patchCreate(admin, "my-repo", "Upload test patch", "", uploadTestPatch).
402 mustRedirect("/my-repo/patches/")
403 })
404
405 t.Run("upload patch file button is visible for admin on open patch", func(t *testing.T) {
406 if n := admin.get(uploadTestURL).Count("details:has([name=patch_file])"); n != 1 {
407 t.Errorf("upload details = %d", n)
408 }
409 })
410
411 t.Run("non-author non-admin cannot upload patch file", func(t *testing.T) {
412 alice := e.login("alice", "password123")
413 alice.postMultipart(uploadTestURL+"/upload", nil, patchFile(uploadTestPatch)).
414 mustStatus(http.StatusForbidden)
415 })
416
417 t.Run("upload button hidden for non-author non-admin", func(t *testing.T) {
418 alice := e.login("alice", "password123")
419 if n := alice.get(uploadTestURL).Count("details:has([name=patch_file])"); n != 0 {
420 t.Errorf("upload details = %d", n)
421 }
422 })
423
424 t.Run("admin can upload replacement patch file", func(t *testing.T) {
425 admin.postMultipart(uploadTestURL+"/upload", nil, patchFile(replacementPatch)).
426 mustRedirect(uploadTestURL)
427 })
428
429 t.Run("merge fails when version token is stale", func(t *testing.T) {
430 stalePatch := `From e1f2a3b4c5d6e1f2a3b4c5d6e1f2a3b4c5d6e1f2 Mon Sep 17 00:00:00 2001
431From: Test User <test@example.com>
432Date: Fri, 05 Jan 2024 10:00:00 +0000
433Subject: [PATCH] Add stale-version.txt
434
435---
436diff --git a/stale-version.txt b/stale-version.txt
437new file mode 100644
438index 0000000..9daeafb
439--- /dev/null
440+++ b/stale-version.txt
441@@ -0,0 +1 @@
442+stale
443`
444 stalePatchV2 := strings.ReplaceAll(
445 strings.ReplaceAll(stalePatch, "Add stale-version.txt", "Add stale-version.txt (v2)"),
446 "+stale", "+stale v2",
447 )
448
449 staleURL := patchCreate(admin, "my-repo", "Stale version test", "", stalePatch).
450 mustRedirect("/my-repo/patches/")
451
452 // The version the admin sees on the page.
453 staleVersion := admin.get(staleURL).Value(`form[action*="/merge"] input[name=version]`)
454
455 // The author uploads a new patch file, bumping the version.
456 admin.postMultipart(staleURL+"/upload", nil, patchFile(stalePatchV2)).mustRedirect(staleURL)
457
458 r := admin.post(staleURL+"/merge", url.Values{"version": {staleVersion}})
459 r.mustStatus(http.StatusConflict)
460 if !r.Contains("updated") {
461 t.Errorf("body = %q", r.BodyString())
462 }
463 check := admin.get(staleURL).mustStatus(http.StatusOK)
464 if !check.Contains("open") {
465 t.Error("patch is no longer open")
466 }
467 })
468
469 t.Run("merge succeeds with current version token after replacement upload", func(t *testing.T) {
470 version := admin.get(uploadTestURL).Value(`form[action*="/merge"] input[name=version]`)
471 admin.post(uploadTestURL+"/merge", url.Values{"version": {version}}).mustRedirect(uploadTestURL)
472 if got := admin.get(uploadTestURL).Text(".patch-badge"); got != "merged" {
473 t.Errorf("badge = %q", got)
474 }
475 if got := patchGitLog(t, e.repoPath("my-repo"), "%aN"); got != "Replaced Author" {
476 t.Errorf("author name = %q", got)
477 }
478 })
479
480 t.Run("upload patch file button hidden on merged patch", func(t *testing.T) {
481 if n := admin.get(uploadTestURL).Count("details:has([name=patch_file])"); n != 0 {
482 t.Errorf("upload details = %d", n)
483 }
484 })
485
486 t.Run("POST to upload on merged patch returns 400", func(t *testing.T) {
487 admin.postMultipart(uploadTestURL+"/upload", nil, patchFile(uploadTestPatch)).
488 mustStatus(http.StatusBadRequest)
489 })
490}
491
492// TestCommitSigning checks the signature of a patch merged by the server.
493// It repeats the merge the patches suite did, because each test gets a fresh
494// server and data directory.
495func TestCommitSigning(t *testing.T) {
496 e := newEnv(t)
497 admin := e.admin()
498 e.createRepo(admin, "my-repo")
499 e.seedRepo("my-repo", nil)
500 patchURL := patchCreate(admin, "my-repo", "Add patch-test.txt", "", cleanPatch).
501 mustRedirect("/my-repo/patches/")
502 version := admin.get(patchURL).Value(`form[action*="/merge"] input[name=version]`)
503 admin.post(patchURL+"/merge", url.Values{"version": {version}}).mustRedirect(patchURL)
504
505 repoDir := e.repoPath("my-repo")
506 hashOf := func(grep string) string {
507 t.Helper()
508 h := gitRun(t, repoDir, "log", "--format=%H", "--grep="+grep, "-1")
509 if h == "" {
510 t.Fatalf("no commit matching %q", grep)
511 }
512 return h
513 }
514
515 t.Run("allowed_signers file is generated at startup", func(t *testing.T) {
516 content, err := os.ReadFile(e.Cfg.AllowedSignersPath())
517 if err != nil {
518 t.Fatal(err)
519 }
520 if !strings.Contains(string(content), `namespaces="git"`) ||
521 !strings.Contains(string(content), "ssh-ed25519") {
522 t.Errorf("allowed_signers = %q", content)
523 }
524 })
525
526 t.Run("merged commit has a gpgsig header", func(t *testing.T) {
527 obj := gitRun(t, repoDir, "cat-file", "-p", hashOf("Add patch-test.txt"))
528 if !strings.Contains(obj, "gpgsig") {
529 t.Error("gpgsig header missing")
530 }
531 })
532
533 t.Run("unsigned commits have no gpgsig header", func(t *testing.T) {
534 obj := gitRun(t, repoDir, "cat-file", "-p", hashOf("Initial commit"))
535 if strings.Contains(obj, "gpgsig") {
536 t.Error("gpgsig header present on unsigned commit")
537 }
538 })
539
540 t.Run("commit log shows verified badge on signed commit", func(t *testing.T) {
541 r := admin.get("/my-repo/commits/main")
542 item := patchFilterText(r, ".commit-item", "Add patch-test.txt")
543 if item.Find(".sig-badge.verified").Length() == 0 {
544 t.Error("verified badge missing")
545 }
546 })
547
548 t.Run("commit log shows no sig badge on unsigned commit", func(t *testing.T) {
549 r := admin.get("/my-repo/commits/main")
550 item := patchFilterText(r, ".commit-item", "Initial commit")
551 if n := item.Find(".sig-badge").Length(); n != 0 {
552 t.Errorf("sig badges = %d", n)
553 }
554 })
555
556 t.Run("commit detail shows verified signature row for signed commit", func(t *testing.T) {
557 r := admin.get("/my-repo/commit/" + hashOf("Add patch-test.txt"))
558 row := patchFilterText(r, ".commit-card-meta-row", "Signature")
559 if row.Length() == 0 {
560 t.Fatal("signature row missing")
561 }
562 if row.Find(".sig-badge.verified").Length() == 0 {
563 t.Error("verified badge missing")
564 }
565 })
566
567 t.Run("commit detail shows no signature row for unsigned commit", func(t *testing.T) {
568 r := admin.get("/my-repo/commit/" + hashOf("Initial commit"))
569 if n := patchFilterText(r, ".commit-card-meta-row", "Signature").Length(); n != 0 {
570 t.Errorf("signature rows = %d", n)
571 }
572 })
573}
574