Private subrepos clone with the parent's credentials for the same hub a07f60a37fb2

/// Whether `url` is an Oxygen repository (else it is taken to be Git),

/// probed with `options`, the credentials a clone of it would use; with

/// the probe's error when it is not, to report if Git cannot clone it

/// either.

fn probe_oxy_url(url: &str, options: &RemoteOptions) -> std::result::Result<(), String> {

        return crate::protocol::open_remote(url, options)

                Pin::Oxy { .. } => self.clone_as_subrepo(&m.url, &dir).map(|_| ()),

        let probe = probe_oxy_url(url, &self.credentials_for(url));

            let mut nested = self.clone_as_subrepo(url, &dir)?;

        Self::clone_using(url, dest, max_blob, sparse, depth, &options, false)

    }

    /// Clone a subrepo with credentials the parent has for the same hub

    /// (see [`Repo::credentials_for`]), recording them on its `origin` so it

    /// fetches and pushes with them after.

    pub(crate) fn clone_as_subrepo(&self, url: &str, dest: &Path) -> Result<Repo> {

        // Only credentials from a remote are recorded; the environment's

        // stay in the environment.

        let borrowed = self.remote_on_same_hub(url).is_some();

        let options = self.credentials_for(url);

        Self::clone_using(url, dest, None, &[], None, &options, borrowed)

    }

    /// The name of a remote of this repository on the same hub (scheme,

    /// host and port) as `url`.

    fn remote_on_same_hub(&self, url: &str) -> Option<String> {

        let origin = |u: &str| -> Option<String> {

            let (scheme, rest) = u.split_once("://")?;

            let host = rest.split('/').next()?;

            Some(format!(

                "{}://{}",

                scheme.to_ascii_lowercase(),

                host.to_ascii_lowercase()

            ))

        };

        let want = origin(url)?;

        self.config

            .remotes

            .iter()

            .find(|(_, u)| origin(u).as_deref() == Some(want.as_str()))

            .map(|(name, _)| name.clone())

    }

    /// The token and CA to reach `url` with: those of a remote of this

    /// repository on the same hub (scheme, host and port), else the

    /// environment's (`OXY_TOKEN`, `OXY_CA`), as a clone would use them.

    pub(crate) fn credentials_for(&self, url: &str) -> RemoteOptions {

        match self.remote_on_same_hub(url) {

            Some(name) => RemoteOptions {

                repo_id: None,

                ..self.remote_options(&name)

            },

            None => RemoteOptions {

                token: std::env::var("OXY_TOKEN").ok(),

                ca: std::env::var("OXY_CA").ok().map(PathBuf::from),

                repo_id: None,

            },

        }

    }

    fn clone_using(

        url: &str,

        dest: &Path,

        max_blob: Option<u64>,

        sparse: &[String],

        depth: Option<u32>,

        options: &RemoteOptions,

        record: bool,

    ) -> Result<Repo> {

        let remote = open_remote(url, options)?;

        if record {

            if let Some(t) = &options.token {

                repo.config.set("remote.origin.token", t)?;

            }

            if let Some(ca) = &options.ca {

                repo.config.set("remote.origin.ca", &ca.to_string_lossy())?;

            }

        }

/// oxygen#32: a subrepo on the same hub as one of the parent's remotes is

/// reached with that remote's token and CA (a private subrepo then clones

/// for anyone who can read the parent); another hub gets none of them.

#[test]

fn a_subrepo_on_the_parents_hub_borrows_its_credentials() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut repo = Repo::init(dir.path()).unwrap();

    repo.config

        .set(

            "remote.origin.url",

            "https://Hub.example:7343/doomsdayone/metalgear",

        )

        .unwrap();

    repo.config.set("remote.origin.token", "secret").unwrap();

    repo.config

        .set("remote.origin.ca", "/tmp/hub-ca.pem")

        .unwrap();

    let same = repo.credentials_for("https://hub.example:7343/doomsdayone/rstar-api");

    assert_eq!(same.token.as_deref(), Some("secret"));

    assert_eq!(same.ca.as_deref(), Some(Path::new("/tmp/hub-ca.pem")));

    for other in [

        "https://elsewhere.example:7343/doomsdayone/rstar-api",

        "https://hub.example/doomsdayone/rstar-api",

        "http://hub.example:7343/doomsdayone/rstar-api",

    ] {

        let o = repo.credentials_for(other);

        assert_ne!(o.token.as_deref(), Some("secret"), "{other}");

    }

}