42 lines
1.5 KiB
TypeScript
42 lines
1.5 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import { spawnSync } from "node:child_process";
|
|
import { test } from "node:test";
|
|
|
|
const credential = "synthetic-askpass-fixture";
|
|
function ask(prompt: string, value = credential) {
|
|
return spawnSync("/bin/sh", ["scripts/git-askpass.sh", prompt], {
|
|
encoding: "utf8", env: { RELEASE_CREDENTIAL: value, LC_ALL: "C" },
|
|
});
|
|
}
|
|
|
|
test("gives Git its username and password over captured stdout, never credential argv", () => {
|
|
for (const suffix of ["", " "]) {
|
|
const username = ask(`Username for 'https://git.garvis.dev':${suffix}`);
|
|
const password = ask(`Password for 'https://dmg@git.garvis.dev':${suffix}`);
|
|
assert.equal(username.status, 0);
|
|
assert.equal(username.stdout, "dmg\n");
|
|
assert.equal(password.status, 0);
|
|
assert.equal(password.stdout, `${credential}\n`);
|
|
assert.equal(password.stderr, "");
|
|
}
|
|
});
|
|
|
|
for (const prompt of [
|
|
"Password for 'https://dmg@git.garvis.dev.evil.invalid': ",
|
|
"Password for 'http://dmg@git.garvis.dev': ",
|
|
"Password for 'https://other@git.garvis.dev': ", "unexpected prompt",
|
|
]) {
|
|
test(`refuses non-approved authentication prompts: ${prompt}`, () => {
|
|
const result = ask(prompt);
|
|
assert.notEqual(result.status, 0);
|
|
assert.equal(result.stdout, "");
|
|
assert.equal(result.stderr, "");
|
|
});
|
|
}
|
|
|
|
test("missing release credential fails without falling back to another secret", () => {
|
|
const result = ask("Password for 'https://dmg@git.garvis.dev': ", "");
|
|
assert.notEqual(result.status, 0);
|
|
assert.equal(result.stdout, "");
|
|
});
|