gitea/tests/integration/api_packages_helm_test.go

// Copyright 2022 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package integration

import (
	"archive/tar"
	"bytes"
	"compress/gzip"
	"fmt"
	"net/http"
	"testing"
	"time"

	"gitea.dev/models/packages"
	"gitea.dev/models/unittest"
	user_model "gitea.dev/models/user"
	helm_module "gitea.dev/modules/packages/helm"
	"gitea.dev/modules/setting"
	"gitea.dev/tests"

	"github.com/stretchr/testify/assert"
	"go.yaml.in/yaml/v4"
)

func TestPackageHelm(t *testing.T) {
	defer tests.PrepareTestEnv(t)()

	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})

	packageName := "test-chart"
	packageVersion := "1.0.3"
	packageAuthor := "KN4CK3R"
	packageDescription := "Gitea Test Package"

	filename := fmt.Sprintf("%s-%s.tgz", packageName, packageVersion)

	chartContent := `apiVersion: v2
description: ` + packageDescription + `
name: ` + packageName + `
type: application
version: ` + packageVersion + `
maintainers:
- name: ` + packageAuthor + `
dependencies:
- name: dep1
  repository: https://example.com/
  version: 1.0.0`

	var buf bytes.Buffer
	zw := gzip.NewWriter(&buf)
	archive := tar.NewWriter(zw)
	archive.WriteHeader(&tar.Header{
		Name: packageName + "/Chart.yaml",
		Mode: 0o600,
		Size: int64(len(chartContent)),
	})
	archive.Write([]byte(chartContent))
	archive.Close()
	zw.Close()
	content := buf.Bytes()

	// The signature is invalid, but the repository isn't verifying it.
	provContent := `-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

apiVersion: v2
description: ` + packageDescription + `
name: ` + packageName + `
type: application
version: ` + packageVersion + `
maintainers:
- - name: ` + packageAuthor + `
dependencies:
- - name: dep1
repository: https://example.com/

...
files:
  ` + filename + `: sha256:d31d2f08b885ec696c37c7f7ef106709aaf5e8575b6d3dc5d52112ed29a9cb92
-----BEGIN PGP SIGNATURE-----

wsBcBAEBCgAQBQJdy0ReCRCEO7+YH8GHYgAAfhUIADx3pHHLLINv0MFkiEYpX/Kd
nvHFBNps7hXqSocsg0a9Fi1LRAc3OpVh3knjPfHNGOy8+xOdhbqpdnB+5ty8YopI
mYMWp6cP/Mwpkt7/gP1ecWFMevicbaFH5AmJCBihBaKJE4R1IX49/wTIaLKiWkv2
cR64bmZruQPSW83UTNULtdD7kuTZXeAdTMjAK0NECsCz9/eK5AFggP4CDf7r2zNi
hZsNrzloIlBZlGGns6mUOTO42J/+JojnOLIhI3Psd0HBD2bTlsm/rSfty4yZUs7D
qtgooNdohoyGSzR5oapd7fEvauRQswJxOA0m0V+u9/eyLR0+JcYB8Udi1prnWf8=
=aHfz
-----END PGP SIGNATURE-----`

	url := fmt.Sprintf("/api/packages/%s/helm", user.Name)

	t.Run("UploadProvFileWithoutChart", func(t *testing.T) {
		defer tests.PrintCurrentTest(t)()

		provURL := url + "/api/prov"

		// Attempt to upload provenance file without chart to back it.
		req := NewRequestWithBody(t, "POST", provURL, bytes.NewReader([]byte(provContent))).
			AddBasicAuth(user.Name)
		MakeRequest(t, req, http.StatusNotFound)
	})

	t.Run("Upload", func(t *testing.T) {
		defer tests.PrintCurrentTest(t)()

		uploadURL := url + "/api/charts"

		req := NewRequestWithBody(t, "POST", uploadURL, bytes.NewReader(content)).
			AddBasicAuth(user.Name)
		MakeRequest(t, req, http.StatusCreated)

		pvs, err := packages.GetVersionsByPackageType(t.Context(), user.ID, packages.TypeHelm)
		assert.NoError(t, err)
		assert.Len(t, pvs, 1)

		pd, err := packages.GetPackageDescriptor(t.Context(), pvs[0])
		assert.NoError(t, err)
		assert.NotNil(t, pd.SemVer)
		assert.IsType(t, &helm_module.Metadata{}, pd.Metadata)
		assert.Equal(t, packageName, pd.Package.Name)
		assert.Equal(t, packageVersion, pd.Version.Version)

		pfs, err := packages.GetFilesByVersionID(t.Context(), pvs[0].ID)
		assert.NoError(t, err)
		assert.Len(t, pfs, 1)
		assert.Equal(t, filename, pfs[0].Name)
		assert.True(t, pfs[0].IsLead)

		pb, err := packages.GetBlobByID(t.Context(), pfs[0].BlobID)
		assert.NoError(t, err)
		assert.Equal(t, int64(len(content)), pb.Size)

		req = NewRequestWithBody(t, "POST", uploadURL, bytes.NewReader(content)).
			AddBasicAuth(user.Name)
		MakeRequest(t, req, http.StatusCreated)

		provURL := url + "/api/prov"

		// Upload Provenance file
		req = NewRequestWithBody(t, "POST", provURL, bytes.NewReader([]byte(provContent))).
			AddBasicAuth(user.Name)
		MakeRequest(t, req, http.StatusCreated)

		pvs, err = packages.GetVersionsByPackageType(t.Context(), user.ID, packages.TypeHelm)
		assert.NoError(t, err)
		assert.Len(t, pvs, 1)

		pfs, err = packages.GetFilesByVersionID(t.Context(), pvs[0].ID)
		assert.NoError(t, err)
		assert.Len(t, pfs, 2)

		var provFile *packages.PackageFile
		for _, pf := range pfs {
			if pf.Name == filename+".prov" {
				provFile = pf
				break
			}
		}
		assert.NotNil(t, provFile)
		assert.False(t, provFile.IsLead)

		req = NewRequest(t, "GET", fmt.Sprintf("%s/%s.prov", url, filename)).
			AddBasicAuth(user.Name)
		resp := MakeRequest(t, req, http.StatusOK)

		assert.Equal(t, provContent, resp.Body.String())
	})

	t.Run("Download", func(t *testing.T) {
		defer tests.PrintCurrentTest(t)()

		checkDownloadCount := func(count int64) {
			pvs, err := packages.GetVersionsByPackageType(t.Context(), user.ID, packages.TypeHelm)
			assert.NoError(t, err)
			assert.Len(t, pvs, 1)
			assert.Equal(t, count, pvs[0].DownloadCount)
		}

		checkDownloadCount(0)

		req := NewRequest(t, "GET", fmt.Sprintf("%s/%s", url, filename)).
			AddBasicAuth(user.Name)
		resp := MakeRequest(t, req, http.StatusOK)

		assert.Equal(t, content, resp.Body.Bytes())

		checkDownloadCount(1)
	})

	t.Run("Index", func(t *testing.T) {
		defer tests.PrintCurrentTest(t)()

		req := NewRequest(t, "GET", url+"/index.yaml").
			AddBasicAuth(user.Name)
		resp := MakeRequest(t, req, http.StatusOK)

		type ChartVersion struct {
			helm_module.Metadata `yaml:",inline"`
			URLs                 []string  `yaml:"urls"`
			Created              time.Time `yaml:"created,omitempty"`
			Removed              bool      `yaml:"removed,omitempty"`
			Digest               string    `yaml:"digest,omitempty"`
		}

		type ServerInfo struct {
			ContextPath string `yaml:"contextPath,omitempty"`
		}

		type Index struct {
			APIVersion string                     `yaml:"apiVersion"`
			Entries    map[string][]*ChartVersion `yaml:"entries"`
			Generated  time.Time                  `yaml:"generated,omitempty"`
			ServerInfo *ServerInfo                `yaml:"serverInfo,omitempty"`
		}

		var result Index
		assert.NoError(t, yaml.NewDecoder(resp.Body).Decode(&result))
		assert.NotEmpty(t, result.Entries)
		assert.Contains(t, result.Entries, packageName)

		cvs := result.Entries[packageName]
		assert.Len(t, cvs, 1)

		cv := cvs[0]
		assert.Equal(t, packageName, cv.Name)
		assert.Equal(t, packageVersion, cv.Version)
		assert.Equal(t, packageDescription, cv.Description)
		assert.Len(t, cv.Maintainers, 1)
		assert.Equal(t, packageAuthor, cv.Maintainers[0].Name)
		assert.Len(t, cv.Dependencies, 1)
		assert.ElementsMatch(t, []string{fmt.Sprintf("%s%s/%s", setting.AppURL, url[1:], filename)}, cv.URLs)

		assert.Equal(t, url, result.ServerInfo.ContextPath)
	})
}