| 1 | package home |
| 2 | |
| 3 | import ( |
| 4 | "encoding/json" |
| 5 | "net/http" |
| 6 | "net/http/httptest" |
| 7 | "os" |
| 8 | "path/filepath" |
| 9 | "strings" |
| 10 | "testing" |
| 11 | |
| 12 | "amadan.net/oficina/estilo.git/credits" |
| 13 | "amadan.net/oficina/estilo.git/theme" |
| 14 | ) |
| 15 | |
| 16 | func TestCreditsArePublicOnKnownHostsAndDoNotStartSignin(t *testing.T) { |
| 17 | credential := newTestApp(t) |
| 18 | directory := newMountedChooser(t) |
| 19 | for name, handler := range map[string]http.Handler{"credential": credential.Router(), "directory": directory.handler} { |
| 20 | host := Origin |
| 21 | if name == "directory" { |
| 22 | host = directoryOrigin |
| 23 | } |
| 24 | request := httptest.NewRequest(http.MethodGet, host+"/help/open-source", nil) |
| 25 | response := httptest.NewRecorder() |
| 26 | handler.ServeHTTP(response, request) |
| 27 | if response.Code != http.StatusOK || len(response.Result().Cookies()) != 0 || response.Header().Get("Location") != "" { |
| 28 | t.Fatalf("%s credits started authentication: %d", name, response.Code) |
| 29 | } |
| 30 | body := response.Body.String() |
| 31 | for _, wanted := range []string{"No notice file is included in this release.", "Open source", "estilo-credits", "Go", "modernc.org/sqlite", "gorm.io/gorm", "gormlite/LICENSE", "Permission", "/static/credits.css"} { |
| 32 | if !strings.Contains(body, wanted) { |
| 33 | t.Fatalf("%s credits missing %s", name, wanted) |
| 34 | } |
| 35 | } |
| 36 | if hasOtherScript(body) || strings.Contains(body, "chooser-person") { |
| 37 | t.Fatal("credits page includes application state or script") |
| 38 | } |
| 39 | if name == "directory" { |
| 40 | if output := os.Getenv("HOME_CREDITS_EVIDENCE_DIR"); output != "" { |
| 41 | if err := os.MkdirAll(output, 0700); err != nil { |
| 42 | t.Fatal(err) |
| 43 | } |
| 44 | for filename, raw := range map[string][]byte{"page.html": response.Body.Bytes(), "tokens.css": staticAsset("tokens.css"), "theme.css": theme.CSS(), "credits.css": credits.CSS()} { |
| 45 | if err := os.WriteFile(filepath.Join(output, filename), raw, 0600); err != nil { |
| 46 | t.Fatal(err) |
| 47 | } |
| 48 | } |
| 49 | } |
| 50 | } |
| 51 | } |
| 52 | if _, ok := credential.mailer.last(); ok { |
| 53 | t.Fatal("credits request sent mail") |
| 54 | } |
| 55 | } |
| 56 | |
| 57 | func TestCreditsInventoryKeepsOriginalNoticesAndKnownGap(t *testing.T) { |
| 58 | var inventory creditInventory |
| 59 | if err := json.Unmarshal(creditNotices, &inventory); err != nil { |
| 60 | t.Fatal(err) |
| 61 | } |
| 62 | if len(inventory.Components) < 18 { |
| 63 | t.Fatal("incomplete dependency inventory") |
| 64 | } |
| 65 | seen := map[string]bool{} |
| 66 | for _, component := range inventory.Components { |
| 67 | if component.Name == "" || (component.Version == "" && component.Name != "Lucide and Feather") || seen[component.Name] { |
| 68 | t.Fatal("invalid or duplicate component") |
| 69 | } |
| 70 | seen[component.Name] = true |
| 71 | if strings.HasPrefix(component.Name, "amadan.net/oficina/") { |
| 72 | t.Fatal("first-party module was classified as third-party") |
| 73 | } |
| 74 | for _, notice := range component.Notices { |
| 75 | if notice.Name == "" || notice.Text == "" { |
| 76 | t.Fatal("empty notice") |
| 77 | } |
| 78 | } |
| 79 | } |
| 80 | // This pinned first-party sign-in library ships no notice file. Keep the |
| 81 | // gap explicit in the inventory rather than inventing a licence for it. |
| 82 | if len(inventory.MissingNotices) != 1 || inventory.MissingNotices[0] != "github.com/keymaildev/signin" { |
| 83 | t.Fatal("new or changed missing-notice entry requires review") |
| 84 | } |
| 85 | } |
| 86 | |
amadan