github.com/zppinho/prow@v0.0.0-20240510014325-1738badeb017/cmd/deck/abort_test.go

/*
Copyright 2022 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package main

import (
	"context"
	"fmt"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/gorilla/sessions"
	"github.com/sirupsen/logrus"
	"golang.org/x/oauth2"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	prowapi "sigs.k8s.io/prow/pkg/apis/prowjobs/v1"
	"sigs.k8s.io/prow/pkg/client/clientset/versioned/fake"
	"sigs.k8s.io/prow/pkg/github/fakegithub"
	"sigs.k8s.io/prow/pkg/githuboauth"
	"sigs.k8s.io/prow/pkg/plugins"
)

// TestAbort that an aborted job has an updated status and
// that permissions were granted appropriately
func TestAbort(t *testing.T) {
	testCases := []struct {
		name        string
		login       string
		authorized  []string
		allowAnyone bool
		jobState    prowapi.ProwJobState
		httpCode    int
		httpMethod  string
	}{
		{
			name:        "Abort on triggered state",
			login:       "authorized",
			authorized:  []string{"authorized", "alsoauthorized"},
			allowAnyone: false,
			jobState:    prowapi.TriggeredState,
			httpCode:    http.StatusOK,
			httpMethod:  http.MethodPost,
		},
		{
			name:        "Abort on pending state",
			login:       "authorized",
			authorized:  []string{"authorized", "alsoauthorized"},
			allowAnyone: false,
			jobState:    prowapi.PendingState,
			httpCode:    http.StatusOK,
			httpMethod:  http.MethodPost,
		},
		{
			name:        "Attempt to abort on success state",
			login:       "authorized",
			authorized:  []string{"authorized", "alsoauthorized"},
			allowAnyone: false,
			jobState:    prowapi.SuccessState,
			httpCode:    http.StatusBadRequest,
			httpMethod:  http.MethodPost,
		},
		{
			name:        "Attempt to abort on aborted state",
			login:       "authorized",
			authorized:  []string{"authorized", "alsoauthorized"},
			allowAnyone: false,
			jobState:    prowapi.AbortedState,
			httpCode:    http.StatusBadRequest,
			httpMethod:  http.MethodPost,
		},
		{
			name:        "User not authorized to abort job",
			login:       "random-dude",
			authorized:  []string{"authorized", "alsoauthorized"},
			allowAnyone: false,
			jobState:    prowapi.PendingState,
			httpCode:    http.StatusUnauthorized,
			httpMethod:  http.MethodPost,
		},
		{
			name:        "Allow anyone set to true, abort job",
			login:       "ugh",
			authorized:  []string{"authorized", "alsoauthorized"},
			allowAnyone: true,
			jobState:    prowapi.PendingState,
			httpCode:    http.StatusOK,
			httpMethod:  http.MethodPost,
		},
		{
			name:        "User permitted to abort on specific job",
			login:       "authorized",
			authorized:  []string{},
			allowAnyone: false,
			jobState:    prowapi.PendingState,
			httpCode:    http.StatusOK,
			httpMethod:  http.MethodPost,
		},
		{
			name:        "User on permitted team",
			login:       "sig-lead",
			authorized:  []string{},
			allowAnyone: false,
			jobState:    prowapi.PendingState,
			httpCode:    http.StatusOK,
			httpMethod:  http.MethodPost,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			fakeProwJobClient := fake.NewSimpleClientset(&prowapi.ProwJob{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "wowsuch",
					Namespace: "prowjobs",
				},
				Spec: prowapi.ProwJobSpec{
					Job:  "whoa",
					Type: prowapi.PresubmitJob,
					Refs: &prowapi.Refs{
						Org:  "org",
						Repo: "repo",
						Pulls: []prowapi.Pull{
							{
								Number: 1,
								Author: tc.login,
							},
						},
					},
					RerunAuthConfig: &prowapi.RerunAuthConfig{
						AllowAnyone:   false,
						GitHubUsers:   []string{"authorized", "alsoauthorized"},
						GitHubTeamIDs: []int{42},
					},
				},
				Status: prowapi.ProwJobStatus{
					State: tc.jobState,
				},
			})
			authCfgGetter := func(refs *prowapi.ProwJobSpec) *prowapi.RerunAuthConfig {
				return &prowapi.RerunAuthConfig{
					AllowAnyone: tc.allowAnyone,
					GitHubUsers: tc.authorized,
				}
			}

			req, err := http.NewRequest(tc.httpMethod, "/abort?prowjob=wowsuch", nil)
			if err != nil {
				t.Fatalf("Error making request: %v", err)
			}
			req.AddCookie(&http.Cookie{
				Name:    "github_login",
				Value:   tc.login,
				Path:    "/",
				Expires: time.Now().Add(time.Hour * 24 * 30),
				Secure:  true,
			})
			mockCookieStore := sessions.NewCookieStore([]byte("secret-key"))
			session, err := sessions.GetRegistry(req).Get(mockCookieStore, "access-token-session")
			if err != nil {
				t.Fatalf("Error making access token session: %v", err)
			}
			session.Values["access-token"] = &oauth2.Token{AccessToken: "validtoken"}

			rr := httptest.NewRecorder()
			mockConfig := &githuboauth.Config{
				CookieStore: mockCookieStore,
			}
			goa := githuboauth.NewAgent(mockConfig, &logrus.Entry{})
			ghc := &fakeAuthenticatedUserIdentifier{login: tc.login}
			rc := fakegithub.NewFakeClient()
			rc.OrgMembers = map[string][]string{"org": {"org-member"}}
			pca := plugins.NewFakeConfigAgent()
			handler := handleAbort(fakeProwJobClient.ProwV1().ProwJobs("prowjobs"), authCfgGetter, goa, ghc, rc, &pca, logrus.WithField("handler", "/abort"))
			handler.ServeHTTP(rr, req)
			if rr.Code != tc.httpCode {
				t.Fatalf("Bad error code: %d", rr.Code)
			}

			if tc.httpCode == http.StatusOK {
				pj, err := fakeProwJobClient.ProwV1().ProwJobs("prowjobs").Get(context.TODO(), "wowsuch", metav1.GetOptions{})
				if err != nil {
					t.Fatalf("Job not found: %v", err)
				}
				if pj.Status.State != prowapi.AbortedState {
					t.Errorf("Wrong state, expected \"%v\", got \"%v\"", prowapi.AbortedState, pj.Status.State)
				}
				if pj.Complete() {
					t.Errorf("Did not expect to be complete, expected \"%v\", got \"%v\"", !pj.Complete(), pj.Complete())
				}
				expectedDescription := fmt.Sprintf("%v successfully aborted wowsuch.", tc.login)
				if tc.allowAnyone {
					expectedDescription = "Successfully aborted wowsuch."
				}
				if pj.Status.Description != expectedDescription {
					t.Errorf("Wrong description, expected \"%v\", got \"%v\"", expectedDescription, pj.Status.Description)
				}
			}
		})
	}
}