fixup: federation: add test for disabled signature validation

This commit is contained in:
famfo 2025-03-03 00:50:11 +01:00
parent 73aa8a599f
commit c8aae156f8
No known key found for this signature in database

View file

@ -28,7 +28,7 @@ func TestFederationHttpSigValidation(t *testing.T) {
onGiteaRun(t, func(t *testing.T, u *url.URL) {
userID := 2
userURL := fmt.Sprintf("%vapi/v1/activitypub/user-id/%v", u, userID)
userURL := fmt.Sprintf("%sapi/v1/activitypub/user-id/%d", u, userID)
user1 := unittest.AssertExistsAndLoadBean(t, &user.User{ID: 1})
@ -39,36 +39,44 @@ func TestFederationHttpSigValidation(t *testing.T) {
require.NoError(t, err)
// Unsigned request
req := NewRequest(t, "GET", userURL)
MakeRequest(t, req, http.StatusBadRequest)
t.Run("UnsignedRequest", func(t *testing.T) {
req := NewRequest(t, "GET", userURL)
MakeRequest(t, req, http.StatusBadRequest)
})
// Signed request
resp, err := apClient.Get(userURL)
require.NoError(t, err)
assert.Equal(t, http.StatusOK, resp.StatusCode)
t.Run("SignedRequest", func(t *testing.T) {
resp, err := apClient.Get(userURL)
require.NoError(t, err)
assert.Equal(t, http.StatusOK, resp.StatusCode)
})
// HACK HACK HACK: the host part of the URL gets set to which IP forgejo is
// listening on, NOT localhost, which is the Domain given to forgejo which
// is then used for eg. the keyID all requests
applicationKeyID := fmt.Sprintf("http://localhost:%v/api/v1/activitypub/actor#main-key", u.Port())
actorKeyID := fmt.Sprintf("http://localhost:%v/api/v1/activitypub/user-id/1#main-key", u.Port())
applicationKeyID := fmt.Sprintf("http://%s/api/v1/activitypub/actor#main-key", setting.AppURL)
actorKeyID := fmt.Sprintf("http://%s/api/v1/activitypub/user-id/1#main-key", setting.AppURL)
// Check for cached public keys
host, err := forgefed.FindFederationHostByKeyID(db.DefaultContext, applicationKeyID)
require.NoError(t, err)
assert.NotNil(t, host)
assert.True(t, host.PublicKey.Valid)
t.Run("ValidateCaches", func(t *testing.T) {
host, err := forgefed.FindFederationHostByKeyID(db.DefaultContext, applicationKeyID)
require.NoError(t, err)
assert.NotNil(t, host)
assert.True(t, host.PublicKey.Valid)
user, err := user.GetFederatedUserByKeyID(db.DefaultContext, actorKeyID)
require.NoError(t, err)
assert.NotNil(t, user)
assert.True(t, user.PublicKey.Valid)
user, err := user.GetFederatedUserByKeyID(db.DefaultContext, actorKeyID)
require.NoError(t, err)
assert.NotNil(t, user)
assert.True(t, user.PublicKey.Valid)
})
// Disable signature validation
defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)()
// Unsigned request
req = NewRequest(t, "GET", userURL)
MakeRequest(t, req, http.StatusOK)
t.Run("SignatureValidationDisabled", func(t *testing.T) {
req := NewRequest(t, "GET", userURL)
MakeRequest(t, req, http.StatusOK)
})
})
}