t5563: add tests for basic and anoymous HTTP access

Add a test showing simple anoymous HTTP access to an unprotected
repository, that results in no credential helper invocations.
Also add a test demonstrating simple basic authentication with
simple credential helper support.

Leverage a no-parsed headers (NPH) CGI script so that we can directly
control the HTTP responses to simulate a multitude of good, bad and ugly
remote server implementations around auth.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/t/lib-httpd.sh b/t/lib-httpd.sh
index 608949ea80b9a90cd00fcde239e7a39e21184f29..2c49569f6757b04eb6639439749ff786682c0d8b 100644 (file)
--- a/t/lib-httpd.sh
+++ b/t/lib-httpd.sh
@@ -137,6 +137,7 @@ prepare_httpd() {
        install_script error-smart-http.sh
        install_script error.sh
        install_script apply-one-time-perl.sh
+       install_script nph-custom-auth.sh
 
        ln -s "$LIB_HTTPD_MODULE_PATH" "$HTTPD_ROOT_PATH/modules"
 

diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf
index 0294739a77a24f9c005250cffb0cab86f0b113ff..76335cdb24d7d7a3b74799aaeae8cadc99f77656 100644 (file)
--- a/t/lib-httpd/apache.conf
+++ b/t/lib-httpd/apache.conf
@@ -135,6 +135,11 @@ Alias /auth/dumb/ www/auth/dumb/
        SetEnv GIT_HTTP_EXPORT_ALL
        SetEnv GIT_PROTOCOL
 </LocationMatch>
+<LocationMatch /custom_auth/>
+       SetEnv GIT_EXEC_PATH ${GIT_EXEC_PATH}
+       SetEnv GIT_HTTP_EXPORT_ALL
+       CGIPassAuth on
+</LocationMatch>
 ScriptAlias /smart/incomplete_length/git-upload-pack incomplete-length-upload-pack-v2-http.sh/
 ScriptAlias /smart/incomplete_body/git-upload-pack incomplete-body-upload-pack-v2-http.sh/
 ScriptAlias /smart/no_report/git-receive-pack error-no-report.sh/
@@ -144,6 +149,7 @@ ScriptAlias /broken_smart/ broken-smart-http.sh/
 ScriptAlias /error_smart/ error-smart-http.sh/
 ScriptAlias /error/ error.sh/
 ScriptAliasMatch /one_time_perl/(.*) apply-one-time-perl.sh/$1
+ScriptAliasMatch /custom_auth/(.*) nph-custom-auth.sh/$1
 <Directory ${GIT_EXEC_PATH}>
        Options FollowSymlinks
 </Directory>

diff --git a/t/lib-httpd/nph-custom-auth.sh b/t/lib-httpd/nph-custom-auth.sh
new file mode 100644 (file)
index 0000000..f5345e7
--- /dev/null
+++ b/t/lib-httpd/nph-custom-auth.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+VALID_CREDS_FILE=custom-auth.valid
+CHALLENGE_FILE=custom-auth.challenge
+
+#
+# If $VALID_CREDS_FILE exists in $HTTPD_ROOT_PATH, consider each line as a valid
+# credential for the current request. Each line in the file is considered a
+# valid HTTP Authorization header value. For example:
+#
+# Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
+#
+# If $CHALLENGE_FILE exists in $HTTPD_ROOT_PATH, output the contents as headers
+# in a 401 response if no valid authentication credentials were included in the
+# request. For example:
+#
+# WWW-Authenticate: Bearer authorize_uri="id.example.com" p=1 q=0
+# WWW-Authenticate: Basic realm="example.com"
+#
+
+if test -n "$HTTP_AUTHORIZATION" && \
+       grep -Fqsx "${HTTP_AUTHORIZATION}" "$VALID_CREDS_FILE"
+then
+       # Note that although git-http-backend returns a status line, it
+       # does so using a CGI 'Status' header. Because this script is an
+       # No Parsed Headers (NPH) script, we must return a real HTTP
+       # status line.
+       # This is only a test script, so we don't bother to check for
+       # the actual status from git-http-backend and always return 200.
+       echo 'HTTP/1.1 200 OK'
+       exec "$GIT_EXEC_PATH"/git-http-backend
+fi
+
+echo 'HTTP/1.1 401 Authorization Required'
+if test -f "$CHALLENGE_FILE"
+then
+       cat "$CHALLENGE_FILE"
+fi
+echo

diff --git a/t/t5563-simple-http-auth.sh b/t/t5563-simple-http-auth.sh
new file mode 100755 (executable)
index 0000000..bc880bf
--- /dev/null
+++ b/t/t5563-simple-http-auth.sh
@@ -0,0 +1,83 @@
+#!/bin/sh
+
+test_description='test http auth header and credential helper interop'
+
+. ./test-lib.sh
+. "$TEST_DIRECTORY"/lib-httpd.sh
+
+start_httpd
+
+test_expect_success 'setup_credential_helper' '
+       mkdir "$TRASH_DIRECTORY/bin" &&
+       PATH=$PATH:"$TRASH_DIRECTORY/bin" &&
+       export PATH &&
+
+       CREDENTIAL_HELPER="$TRASH_DIRECTORY/bin/git-credential-test-helper" &&
+       write_script "$CREDENTIAL_HELPER" <<-\EOF
+       cmd=$1
+       teefile=$cmd-query.cred
+       catfile=$cmd-reply.cred
+       sed -n -e "/^$/q" -e "p" >>$teefile
+       if test "$cmd" = "get"
+       then
+               cat $catfile
+       fi
+       EOF
+'
+
+set_credential_reply () {
+       cat >"$TRASH_DIRECTORY/$1-reply.cred"
+}
+
+expect_credential_query () {
+       cat >"$TRASH_DIRECTORY/$1-expect.cred" &&
+       test_cmp "$TRASH_DIRECTORY/$1-expect.cred" \
+                "$TRASH_DIRECTORY/$1-query.cred"
+}
+
+per_test_cleanup () {
+       rm -f *.cred &&
+       rm -f "$HTTPD_ROOT_PATH"/custom-auth.valid \
+             "$HTTPD_ROOT_PATH"/custom-auth.challenge
+}
+
+test_expect_success 'setup repository' '
+       test_commit foo &&
+       git init --bare "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
+       git push --mirror "$HTTPD_DOCUMENT_ROOT_PATH/repo.git"
+'
+
+test_expect_success 'access using basic auth' '
+       test_when_finished "per_test_cleanup" &&
+
+       set_credential_reply get <<-EOF &&
+       username=alice
+       password=secret-passwd
+       EOF
+
+       # Basic base64(alice:secret-passwd)
+       cat >"$HTTPD_ROOT_PATH/custom-auth.valid" <<-EOF &&
+       Basic YWxpY2U6c2VjcmV0LXBhc3N3ZA==
+       EOF
+
+       cat >"$HTTPD_ROOT_PATH/custom-auth.challenge" <<-EOF &&
+       WWW-Authenticate: Basic realm="example.com"
+       EOF
+
+       test_config_global credential.helper test-helper &&
+       git ls-remote "$HTTPD_URL/custom_auth/repo.git" &&
+
+       expect_credential_query get <<-EOF &&
+       protocol=http
+       host=$HTTPD_DEST
+       EOF
+
+       expect_credential_query store <<-EOF
+       protocol=http
+       host=$HTTPD_DEST
+       username=alice
+       password=secret-passwd
+       EOF
+'
+
+test_done