Flow test: a private subrepo pinned with the environment's token is still left out for a pusher who cannot read it 370035a46397
refs andymccall/oxygen#8
- Author
- Andy McCall @andymccall <[email protected]>
- When
- · 2026-09-28 18:49 UTC
- Signature
- ✔ signed by Andy McCall
- Hash
370035a4639708f792ae0e97eafc1c75b4d4775eff2079639938693d5b34f4ae- Depends on
- 42fa95540468 fd3db644df22
- Depended on by
- a4f01d51c2a7 25091e5c3bba
- In bookmarks
- api-unknown-fields cancel-landed-runs clear-waiting close-proposal-140 diffusion-pin-bookmark draft-ready image-check job-waits main oh-comment-body-file proposal-list-fast run-one-job wiki-says-so
- In tags
- v0.1.0 v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.4.1 v0.4.2 v0.5.0 v0.5.1 v0.5.2 v0.6.0 v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9
- Edits
- 4 atoms, 0 tree operations, 1 file
Browse the tree at this change
modified crates/hub/tests/flow.rs +7 −2
| … | 365 unchanged lines |
||
| 366 | 366 | let work = tempfile::tempdir().unwrap(); |
|
| 367 | 367 | let app = client(&format!("{}/andy/app", h.base), work.path()); |
|
| 368 | 368 | app.submodule_add(&format!("{}/andy/lib", h.base), "deps/lib", Some("main")).unwrap(); |
|
| 369 | - | app.submodule_add(&format!("{}/andy/vault", h.base), "deps/vault", Some("main")).unwrap(); |
|
| 370 | - | // Vault goes private after it was pinned: this pusher cannot read it. |
|
| 369 | + | // Vault is private: adding it takes the environment's token, as a clone does. |
|
| 371 | 370 | sqlx::query("UPDATE repositories SET visibility = 'private' WHERE name = 'vault'").execute(&h.app.db).await.unwrap(); |
|
| 371 | + | assert!(app.submodule_add(&format!("{}/andy/vault", h.base), "deps/vault2", Some("main")).is_err(), "not without a token"); |
|
| 372 | + | std::env::set_var("OXY_TOKEN", "site"); |
|
| 373 | + | app.submodule_add(&format!("{}/andy/vault", h.base), "deps/vault", Some("main")).unwrap(); |
|
| 374 | + | std::env::remove_var("OXY_TOKEN"); |
|
| 375 | + | // The pusher below is the site token, which has no account: it cannot read vault. |
|
| 372 | 376 | write(work.path(), ".flow/pipeline.kdl", &pipeline("")); |
|
| 373 | 377 | write(work.path(), "Makefile", "all:\n"); |
|
| 374 | 378 | app.snapshot("t").unwrap(); |
|
| … | 4 unchanged lines |
||
| 379 | 383 | let job = claim(&h.app).await.unwrap(); |
|
| 380 | 384 | let subs = job["subrepos"].as_array().cloned().unwrap_or_default(); |
|
| 381 | 385 | assert_eq!(subs.len(), 1, "vault is private and the pusher has no account: {subs:?}"); |
|
| 386 | + | let _ = std::fs::remove_dir_all(work.path().join("deps/vault2")); |
|
| 382 | 387 | assert_eq!(subs[0]["path"], "deps/lib"); |
|
| 383 | 388 | assert_eq!(subs[0]["repo"], "andy/lib"); |
|
| 384 | 389 | assert_eq!(subs[0]["heads"], serde_json::json!(lib_heads.iter().map(|h| h.to_hex()).collect::<Vec<_>>())); |
|
| … | 12 unchanged lines |