From c8aae156f8fda44e4c24c28c3ae8ca7ee20cf152 Mon Sep 17 00:00:00 2001 From: famfo Date: Mon, 3 Mar 2025 00:50:11 +0100 Subject: [PATCH] fixup: federation: add test for disabled signature validation --- .../api_federation_httpsig_test.go | 44 +++++++++++-------- 1 file changed, 26 insertions(+), 18 deletions(-) diff --git a/tests/integration/api_federation_httpsig_test.go b/tests/integration/api_federation_httpsig_test.go index 56d6794535..0fe647ac4a 100644 --- a/tests/integration/api_federation_httpsig_test.go +++ b/tests/integration/api_federation_httpsig_test.go @@ -28,7 +28,7 @@ func TestFederationHttpSigValidation(t *testing.T) { onGiteaRun(t, func(t *testing.T, u *url.URL) { userID := 2 - userURL := fmt.Sprintf("%vapi/v1/activitypub/user-id/%v", u, userID) + userURL := fmt.Sprintf("%sapi/v1/activitypub/user-id/%d", u, userID) user1 := unittest.AssertExistsAndLoadBean(t, &user.User{ID: 1}) @@ -39,36 +39,44 @@ func TestFederationHttpSigValidation(t *testing.T) { require.NoError(t, err) // Unsigned request - req := NewRequest(t, "GET", userURL) - MakeRequest(t, req, http.StatusBadRequest) + t.Run("UnsignedRequest", func(t *testing.T) { + req := NewRequest(t, "GET", userURL) + MakeRequest(t, req, http.StatusBadRequest) + }) // Signed request - resp, err := apClient.Get(userURL) - require.NoError(t, err) - assert.Equal(t, http.StatusOK, resp.StatusCode) + t.Run("SignedRequest", func(t *testing.T) { + resp, err := apClient.Get(userURL) + require.NoError(t, err) + assert.Equal(t, http.StatusOK, resp.StatusCode) + }) // HACK HACK HACK: the host part of the URL gets set to which IP forgejo is // listening on, NOT localhost, which is the Domain given to forgejo which // is then used for eg. the keyID all requests - applicationKeyID := fmt.Sprintf("http://localhost:%v/api/v1/activitypub/actor#main-key", u.Port()) - actorKeyID := fmt.Sprintf("http://localhost:%v/api/v1/activitypub/user-id/1#main-key", u.Port()) + applicationKeyID := fmt.Sprintf("http://%s/api/v1/activitypub/actor#main-key", setting.AppURL) + actorKeyID := fmt.Sprintf("http://%s/api/v1/activitypub/user-id/1#main-key", setting.AppURL) // Check for cached public keys - host, err := forgefed.FindFederationHostByKeyID(db.DefaultContext, applicationKeyID) - require.NoError(t, err) - assert.NotNil(t, host) - assert.True(t, host.PublicKey.Valid) + t.Run("ValidateCaches", func(t *testing.T) { + host, err := forgefed.FindFederationHostByKeyID(db.DefaultContext, applicationKeyID) + require.NoError(t, err) + assert.NotNil(t, host) + assert.True(t, host.PublicKey.Valid) - user, err := user.GetFederatedUserByKeyID(db.DefaultContext, actorKeyID) - require.NoError(t, err) - assert.NotNil(t, user) - assert.True(t, user.PublicKey.Valid) + user, err := user.GetFederatedUserByKeyID(db.DefaultContext, actorKeyID) + require.NoError(t, err) + assert.NotNil(t, user) + assert.True(t, user.PublicKey.Valid) + }) // Disable signature validation defer test.MockVariableValue(&setting.Federation.SignatureEnforced, false)() // Unsigned request - req = NewRequest(t, "GET", userURL) - MakeRequest(t, req, http.StatusOK) + t.Run("SignatureValidationDisabled", func(t *testing.T) { + req := NewRequest(t, "GET", userURL) + MakeRequest(t, req, http.StatusOK) + }) }) }