Files
Michael Kriese 969b3cb162 fix(util/git): use non-empty passwords for token credentials on more platforms (#47085)
* fix(util/git): use non-empty passwords for token credentials on more platforms

Co-Authored-By: Claude Opus 5.5 <michael.kriese+claude-code@mend.io>

Co-Authored-By: Claude Sonnet 5.5 <michael.kriese+claude-code@mend.io>

* docs: update git token host rule notes

Co-Authored-By: Claude Opus 5.5 <michael.kriese+claude-code@mend.io>

Co-Authored-By: Claude Sonnet 5.5 <michael.kriese+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 5.5 <michael.kriese+claude-code@mend.io>
2026-10-15 13:42:10 +00:00

309 lines
10 KiB
TypeScript

import { hostRules } from '~test/host-rules.ts';
import {
getHttpUrl,
getRemoteUrlWithToken,
getTokenCredentials,
parseGitUrl,
} from './url.ts';
describe('util/git/url', () => {
describe('parseGitUrl', () => {
it('supports ports', () => {
expect(parseGitUrl('https://gitlab.com:8443/')).toEqual({
filepath: '',
filepathtype: '',
full_name: '',
git_suffix: false,
hash: '',
host: 'gitlab.com:8443',
href: 'https://gitlab.com:8443',
name: '',
organization: '',
owner: '',
parse_failed: false,
password: '',
pathname: '/',
port: '8443',
protocol: 'https',
protocols: ['https'],
query: {},
ref: '',
resource: 'gitlab.com',
search: '',
source: 'gitlab.com',
toString: expect.toBeFunction(),
token: '',
user: '',
});
});
});
describe('getTokenCredentials()', () => {
it.each`
platform | token | expected
${'azure'} | ${'token'} | ${'x-access-token:token'}
${'bitbucket'} | ${'token'} | ${'x-token-auth:token'}
${'bitbucket-server'} | ${'token'} | ${'x-token-auth:token'}
${'scm-manager'} | ${'token'} | ${'x-access-token:token'}
${'scm-manager'} | ${'user:pass'} | ${'user:pass'}
${'gerrit'} | ${'token'} | ${'token'}
${null} | ${'token'} | ${'token'}
`(
'returns $expected for $platform and $token',
({ platform, token, expected }) => {
expect(getTokenCredentials(platform, token)).toBe(expected);
},
);
});
describe('getHttpUrl()', () => {
it('returns https url for git url', () => {
expect(getHttpUrl('git://foo.bar/')).toBe('https://foo.bar/');
});
it('returns https url for https url', () => {
expect(getHttpUrl('https://foo.bar/')).toBe('https://foo.bar/');
});
it('returns http url for http url', () => {
expect(getHttpUrl('http://foo.bar/')).toBe('http://foo.bar/');
});
it('returns http url for ssh url with port', () => {
expect(
getHttpUrl(
'ssh://git@gitlab.example.com:22222/typo3-extensions/poll-pro.git',
),
).toBe('https://gitlab.example.com/typo3-extensions/poll-pro.git');
});
it('returns gitlab url with token', () => {
expect(getHttpUrl('http://gitlab.com/', 'token')).toBe(
'http://gitlab-ci-token:token@gitlab.com/',
);
expect(getHttpUrl('http://gitlab.com/', 'gitlab-ci-token:token')).toBe(
'http://gitlab-ci-token:token@gitlab.com/',
);
expect(
getHttpUrl('http://gitlab.com:8443/', 'gitlab-ci-token:token'),
).toBe('http://gitlab-ci-token:token@gitlab.com:8443/');
expect(getHttpUrl('git@gitlab.com:some/repo', 'token')).toBe(
'https://gitlab-ci-token:token@gitlab.com/some/repo',
);
});
it('returns github url with token', () => {
expect(getHttpUrl('http://github.com/', 'token')).toBe(
'http://x-access-token:token@github.com/',
);
expect(getHttpUrl('http://github.com/', 'x-access-token:token')).toBe(
'http://x-access-token:token@github.com/',
);
expect(
getHttpUrl('http://github.com:8443/', 'x-access-token:token'),
).toBe('http://x-access-token:token@github.com:8443/');
expect(getHttpUrl('git@github.com:some/repo', 'token')).toBe(
'https://x-access-token:token@github.com/some/repo',
);
});
it('returns gitea url with token', () => {
expect(getHttpUrl('https://gitea.com/some/repo', 'token')).toBe(
'https://token:x-oauth-basic@gitea.com/some/repo',
);
expect(getHttpUrl('git@gitea.com:some/repo', 'token')).toBe(
'https://token:x-oauth-basic@gitea.com/some/repo',
);
expect(getHttpUrl('https://gitea.com/some/repo', 'user:pass')).toBe(
'https://user:pass@gitea.com/some/repo',
);
});
it('returns forgejo url with token', () => {
expect(getHttpUrl('https://codeberg.org/some/repo', 'token')).toBe(
'https://token:x-oauth-basic@codeberg.org/some/repo',
);
expect(getHttpUrl('https://codeberg.org/some/repo', 'user:pass')).toBe(
'https://user:pass@codeberg.org/some/repo',
);
});
it('returns azure url with token', () => {
expect(
getHttpUrl('https://dev.azure.com/org/proj/_git/repo', 'token'),
).toBe('https://x-access-token:token@dev.azure.com/org/proj/_git/repo');
expect(
getHttpUrl('https://dev.azure.com/org/proj/_git/repo', 'user:pass'),
).toBe('https://user:pass@dev.azure.com/org/proj/_git/repo');
});
it('returns bitbucket cloud url with a single x-token-auth username', () => {
expect(getHttpUrl('https://bitbucket.org/some/repo', 'token')).toBe(
'https://x-token-auth:token@bitbucket.org/some/repo',
);
expect(getHttpUrl('git@bitbucket.org:some/repo', 'token')).toBe(
'https://x-token-auth:token@bitbucket.org/some/repo',
);
expect(getHttpUrl('https://bitbucket.com/some/repo', 'token')).toBe(
'https://x-token-auth:token@bitbucket.com/some/repo',
);
expect(getHttpUrl('https://bitbucket.org/some/repo', 'user:pass')).toBe(
'https://user:pass@bitbucket.org/some/repo',
);
});
it('returns bitbucket-server url with token', () => {
hostRules.add({
matchHost: 'git.mycompany.com',
hostType: 'bitbucket-server',
});
expect(
getHttpUrl('https://git.mycompany.com/scm/proj/repo.git', 'token'),
).toBe('https://x-token-auth:token@git.mycompany.com/scm/proj/repo.git');
expect(
getHttpUrl('https://git.mycompany.com/scm/proj/repo.git', 'user:pass'),
).toBe('https://user:pass@git.mycompany.com/scm/proj/repo.git');
});
it('returns bitbucket-server url', () => {
expect(getHttpUrl('http://git.mycompany.com/scm/proj/repo.git')).toBe(
'http://git.mycompany.com/scm/proj/repo.git',
);
hostRules.add({
matchHost: 'git.mycompany.com',
hostType: 'bitbucket-server',
});
expect(getHttpUrl('ssh://git@git.mycompany.com:7999/proj/repo.git')).toBe(
'https://git.mycompany.com/scm/proj/repo.git',
);
});
it('removes username/password from URL', () => {
expect(getHttpUrl('https://user:password@foo.bar/someOrg/someRepo')).toBe(
'https://foo.bar/someOrg/someRepo',
);
});
it('replaces username/password with given token', () => {
expect(
getHttpUrl(
'https://user:password@foo.bar/someOrg/someRepo',
'another-user:a-secret-pwd',
),
).toBe('https://another-user:a-secret-pwd@foo.bar/someOrg/someRepo');
});
});
describe('getRemoteUrlWithToken()', () => {
it('returns original url if no host rule is found', () => {
expect(getRemoteUrlWithToken('https://foo.bar/')).toBe(
'https://foo.bar/',
);
});
it('transforms an ssh git url to https for the purpose of finding hostRules', () => {
// this rule can only match after the ssh url is transformed to https
hostRules.add({
matchHost: 'https://foo.bar/some/repo',
token: 'token',
});
expect(getRemoteUrlWithToken('git@foo.bar:some/repo')).toBe(
'https://token@foo.bar/some/repo',
);
});
it('does not transform urls that are not parseable as git urls', () => {
expect(getRemoteUrlWithToken('abcdefg')).toBe('abcdefg');
});
it('returns http url with token', () => {
hostRules.add({ token: 'token' });
expect(getRemoteUrlWithToken('http://foo.bar/')).toBe(
'http://token@foo.bar/',
);
});
it('returns https url with token', () => {
hostRules.add({ token: 'token' });
expect(getRemoteUrlWithToken('https://foo.bar/')).toBe(
'https://token@foo.bar/',
);
});
it('returns https url with token for non-http protocols', () => {
hostRules.add({ token: 'token' });
expect(getRemoteUrlWithToken('ssh://foo.bar/')).toBe(
'https://token@foo.bar/',
);
});
it('returns https url with encoded token', () => {
hostRules.add({ token: 't#ken' });
expect(getRemoteUrlWithToken('https://foo.bar/')).toBe(
'https://t%23ken@foo.bar/',
);
});
it('returns http url with username and password', () => {
hostRules.add({
username: 'user',
password: 'pass',
});
expect(getRemoteUrlWithToken('http://foo.bar/')).toBe(
'http://user:pass@foo.bar/',
);
});
it('returns https url with username and password', () => {
hostRules.add({
username: 'user',
password: 'pass',
});
expect(getRemoteUrlWithToken('https://foo.bar/')).toBe(
'https://user:pass@foo.bar/',
);
});
it('returns https url with username and password for non-http protocols', () => {
hostRules.add({
username: 'user',
password: 'pass',
});
expect(getRemoteUrlWithToken('ssh://foo.bar/')).toBe(
'https://user:pass@foo.bar/',
);
});
it('returns https url with encoded username and password', () => {
hostRules.add({
username: 'u$er',
password: 'p@ss',
});
expect(getRemoteUrlWithToken('https://foo.bar/')).toBe(
'https://u%24er:p%40ss@foo.bar/',
);
});
it('returns https url with encoded gitlab token', () => {
hostRules.add({ token: 'token' });
expect(getRemoteUrlWithToken('ssh://gitlab.com/some/repo.git')).toBe(
'https://gitlab-ci-token:token@gitlab.com/some/repo.git',
);
});
it('returns https url with x-oauth-basic password for gitea token', () => {
hostRules.add({ token: 'token' });
expect(getRemoteUrlWithToken('git@gitea.com:some/repo.git')).toBe(
'https://token:x-oauth-basic@gitea.com/some/repo.git',
);
});
it('returns https url for ssh url with encoded github token', () => {
hostRules.add({ token: 'token' });
expect(getRemoteUrlWithToken('ssh://github.com/some/repo.git')).toBe(
'https://x-access-token:token@github.com/some/repo.git',
);
});
});
});