renovate/lib/util/http/gitlab.spec.ts

import { HTTPError } from 'got';
import * as httpMock from '~test/http-mock.ts';
import { logger } from '~test/util.ts';
import { EXTERNAL_HOST_ERROR } from '../../constants/error-messages.ts';
import { GitlabReleasesDatasource } from '../../modules/datasource/gitlab-releases/index.ts';
import * as hostRules from '../host-rules.ts';
import { GitlabHttp, setBaseUrl } from './gitlab.ts';

hostRules.add({
  hostType: 'gitlab',
  token: '123test',
});

const gitlabApiHost = 'https://gitlab.com';
const selfHostedUrl = 'http://mycompany.com/gitlab';

describe('util/http/gitlab', () => {
  let gitlabApi: GitlabHttp;

  beforeEach(() => {
    gitlabApi = new GitlabHttp();
    setBaseUrl(`${gitlabApiHost}/api/v4/`);
    vi.stubEnv('GITLAB_IGNORE_REPO_URL', undefined);

    hostRules.add({
      hostType: 'gitlab',
      token: 'abc123',
    });
  });

  it('paginates', async () => {
    httpMock
      .scope(gitlabApiHost)
      .get('/api/v4/some-url')
      .reply(200, ['a'], {
        link: '<https://gitlab.com/api/v4/some-url&page=2>; rel="next", <https://gitlab.com/api/v4/some-url&page=4>; rel="last"',
      })
      .get('/api/v4/some-url&page=2')
      .reply(200, ['b', 'c'], {
        link: '<https://gitlab.com/api/v4/some-url&page=3>; rel="next", <https://gitlab.com/api/v4/some-url&page=4>; rel="last"',
      })
      .get('/api/v4/some-url&page=3')
      .reply(200, ['d'], {
        link: '<https://gitlab.com/api/v4/some-url&page=4>; rel="next", <https://gitlab.com/api/v4/some-url&page=4>; rel="last"',
      })
      .get('/api/v4/some-url&page=4')
      .reply(500);
    const res = await gitlabApi.getJsonUnchecked('some-url', {
      paginate: true,
    });
    expect(res.body).toHaveLength(4);

    expect(logger.logger.warn).toHaveBeenCalledWith(
      { err: expect.any(Error) },
      'Pagination error',
    );
  });

  it('paginates with GITLAB_IGNORE_REPO_URL set', async () => {
    vi.stubEnv('GITLAB_IGNORE_REPO_URL', 'true');
    setBaseUrl(`${selfHostedUrl}/api/v4/`);

    httpMock
      .scope(selfHostedUrl)
      .get('/api/v4/some-url')
      .reply(200, ['a'], {
        link: '<https://other.host.com/gitlab/api/v4/some-url&page=2>; rel="next", <https://other.host.com/gitlab/api/v4/some-url&page=3>; rel="last"',
      })
      .get('/api/v4/some-url&page=2')
      .reply(200, ['b', 'c'], {
        link: '<https://other.host.com/gitlab/api/v4/some-url&page=3>; rel="next", <https://other.host.com/gitlab/api/v4/some-url&page=3>; rel="last"',
      })
      .get('/api/v4/some-url&page=3')
      .reply(200, ['d']);
    const res = await gitlabApi.getJsonUnchecked('some-url', {
      paginate: true,
    });
    expect(res.body).toHaveLength(4);
  });

  it('does not follow pagination links to a different origin', async () => {
    // If a misconfigured/malicious host suggests pagination links across origins, ignore them by default
    // In this case, only the first page of results is fetched, and a warning message is logged
    httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(200, ['a'], {
      link: '<https://other.host.com/api/v4/some-url&page=2>; rel="next", <https://other.host.com/api/v4/some-url&page=3>; rel="last"',
    });
    const res = await gitlabApi.getJsonUnchecked('some-url', {
      paginate: true,
    });
    expect(res.body).toHaveLength(1);
    expect(logger.logger.once.warn).toHaveBeenCalledWith(
      {
        requestOrigin: 'https://gitlab.com',
        paginationOrigin: 'https://other.host.com',
      },
      'Ignoring cross-origin GitLab pagination link. Set GITLAB_IGNORE_REPO_URL if this is a self-hosted instance that returns a different origin in pagination links.',
    );
  });

  it('does not follow pagination links to a different protocol on the same host', async () => {
    // Same host, but a different scheme still counts as a different origin
    httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(200, ['a'], {
      link: '<http://gitlab.com/api/v4/some-url&page=2>; rel="next", <http://gitlab.com/api/v4/some-url&page=3>; rel="last"',
    });
    const res = await gitlabApi.getJsonUnchecked('some-url', {
      paginate: true,
    });
    expect(res.body).toHaveLength(1);
    expect(logger.logger.once.warn).toHaveBeenCalledWith(
      {
        requestOrigin: 'https://gitlab.com',
        paginationOrigin: 'http://gitlab.com',
      },
      'Ignoring cross-origin GitLab pagination link. Set GITLAB_IGNORE_REPO_URL if this is a self-hosted instance that returns a different origin in pagination links.',
    );
  });

  it('supports different datasources', async () => {
    const gitlabApiDatasource = new GitlabHttp(GitlabReleasesDatasource.id);
    hostRules.add({ hostType: 'gitlab', token: 'abc' });
    hostRules.add({
      hostType: GitlabReleasesDatasource.id,
      token: 'def',
    });
    httpMock
      .scope(gitlabApiHost, { reqheaders: { authorization: 'Bearer def' } })
      .get('/api/v4/some-url')
      .reply(200);
    const response = await gitlabApiDatasource.get('/some-url');
    expect(response).not.toBeNull();
  });

  it('attempts to paginate', async () => {
    httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(200, ['a'], {
      link: '<https://gitlab.com/api/v4/some-url&page=3>; rel="last"',
    });
    const res = await gitlabApi.getJsonUnchecked('some-url', {
      paginate: true,
    });
    expect(res.body).toHaveLength(1);
  });

  it('posts', async () => {
    const body = ['a', 'b'];
    httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(200, body);
    const res = await gitlabApi.postJson('some-url');
    expect(res.body).toEqual(body);
  });

  it('sets baseUrl', () => {
    expect(() => setBaseUrl(`${selfHostedUrl}/api/v4/`)).not.toThrow();
  });

  describe('fails with', () => {
    it('403', async () => {
      httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(403);
      await expect(
        gitlabApi.get('some-url'),
      ).rejects.toThrowErrorMatchingInlineSnapshot(
        `[HTTPError: Request failed with status code 403 (Forbidden): GET https://gitlab.com/api/v4/some-url]`,
      );
    });

    it('404', async () => {
      httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(404);
      await expect(
        gitlabApi.get('some-url'),
      ).rejects.toThrowErrorMatchingInlineSnapshot(
        `[HTTPError: Request failed with status code 404 (Not Found): GET https://gitlab.com/api/v4/some-url]`,
      );
    });

    it('500', async () => {
      httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(500);
      await expect(gitlabApi.get('some-url')).rejects.toThrow(
        EXTERNAL_HOST_ERROR,
      );
    });

    it('EAI_AGAIN', async () => {
      httpMock
        .scope(gitlabApiHost)
        .get('/api/v4/some-url')
        .replyWithError(httpMock.error({ code: 'EAI_AGAIN' }));
      await expect(gitlabApi.get('some-url')).rejects.toThrow(
        EXTERNAL_HOST_ERROR,
      );
    });

    it('ParseError', async () => {
      httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(200, '{{');
      await expect(gitlabApi.getJsonUnchecked('some-url')).rejects.toThrow(
        EXTERNAL_HOST_ERROR,
      );
    });
  });

  describe('handles 409 errors', () => {
    beforeEach(() => {
      // Unset NODE_ENV so that we can test the retry logic
      vi.stubEnv('NODE_ENV', undefined);
      gitlabApi = new GitlabHttp();
    });

    it('retries the request on resource lock', async () => {
      const body = { message: '409 Conflict: Resource lock' };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(409, body);
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(200, {});
      const res = await gitlabApi.postJson('some-url', {});
      expect(res.statusCode).toBe(200);
    });

    it('does not retry more than twice on resource lock', async () => {
      const body = { message: '409 Conflict: Resource lock' };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(409, body);
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(409, body);
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(409, body);
      await expect(gitlabApi.postJson('some-url', {})).rejects.toThrow(
        HTTPError,
      );
    });

    it('does not retry for other reasons', async () => {
      const body = { message: 'Other reason' };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(409, body);
      await expect(gitlabApi.postJson('some-url', {})).rejects.toThrow(
        HTTPError,
      );
    });
  });

  describe('handles 400 source_branch errors', () => {
    beforeEach(() => {
      // Unset NODE_ENV so that we can test the retry logic
      vi.stubEnv('NODE_ENV', undefined);
      gitlabApi = new GitlabHttp();
    });

    it('retries the request when source branch does not yet exist', async () => {
      const body = { message: { source_branch: ['does not exist'] } };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(400, body);
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(200, {});
      const res = await gitlabApi.postJson('some-url', {});
      expect(res.statusCode).toBe(200);
    });

    it('does not retry more than twice when source branch does not exist', async () => {
      const body = { message: { source_branch: ['does not exist'] } };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(400, body);
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(400, body);
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(400, body);
      await expect(gitlabApi.postJson('some-url', {})).rejects.toThrow(
        HTTPError,
      );
    });

    it('does not retry for unrelated 400 errors', async () => {
      const body = { message: { base: ['Another error'] } };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(400, body);
      await expect(gitlabApi.postJson('some-url', {})).rejects.toThrow(
        HTTPError,
      );
    });

    it('does not retry for other source_branch 400 errors', async () => {
      const body = { message: { source_branch: ['is invalid'] } };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(400, body);
      await expect(gitlabApi.postJson('some-url', {})).rejects.toThrow(
        HTTPError,
      );
    });

    it('does not retry other POST error codes', async () => {
      const body = { message: 'Forbidden' };
      httpMock.scope(gitlabApiHost).post('/api/v4/some-url').reply(403, body);
      await expect(gitlabApi.postJson('some-url', {})).rejects.toThrow(
        HTTPError,
      );
    });

    it('does not retry non-POST requests', async () => {
      const body = { message: { source_branch: ['does not exist'] } };
      httpMock.scope(gitlabApiHost).get('/api/v4/some-url').reply(400, body);
      await expect(gitlabApi.getJsonUnchecked('some-url')).rejects.toThrow(
        HTTPError,
      );
    });
  });
});