feat(ext/sw): universal commitSigned — isomorphic-git receive-pack push + SSHSIG
Add CommitFile/CommitSigner types + commitSigned to GitHost interface.
Implement git-push.ts (clone→add→commit({onSign=SSHSIG})→push over http/web)
and wire GiteaHost.commitSigned / GitHubHost.commitSigned. Tests: 7/7 incl.
golden-vector tie against the sshsig.test.ts byte-exact vector.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LKBbrAjmpVXMEK15pNi3Ha
This commit is contained in:
adlee-was-taken
192
extension/src/service-worker/__tests__/git-push.test.ts
Normal file
192
extension/src/service-worker/__tests__/git-push.test.ts
Normal file
@@ -0,0 +1,192 @@
|
||||
import { beforeEach, describe, expect, test, vi } from 'vitest';
|
||||
import { createPrivateKey, sign as nodeSign } from 'node:crypto';
|
||||
import * as git from 'isomorphic-git';
|
||||
import { commitSignedPush } from '../git-push';
|
||||
import { GiteaHost } from '../gitea';
|
||||
import { GitHubHost } from '../github';
|
||||
import type { CommitFile, CommitSigner } from '../git-host';
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Mock isomorphic-git so no network or filesystem I/O occurs.
|
||||
// The vi.mock calls are hoisted by Vitest and run before any imports.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
vi.mock('isomorphic-git', () => ({
|
||||
clone: vi.fn(async () => {}),
|
||||
add: vi.fn(async () => {}),
|
||||
commit: vi.fn(async () => 'oid'),
|
||||
push: vi.fn(async () => ({ ok: true, errors: [] })),
|
||||
}));
|
||||
vi.mock('isomorphic-git/http/web', () => ({ default: {} }));
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Golden-vector constants — byte-exact, identical to sshsig.test.ts.
|
||||
// Tied to the SSHSIG spec proven against `git verify-commit`.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
const SEED_HEX =
|
||||
'000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f';
|
||||
|
||||
const PUB_OPENSSH =
|
||||
'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOhB7/zzhC+HXDdGOdLwJln5NYwm6UNXx3chmQSVTG4';
|
||||
|
||||
const PAYLOAD =
|
||||
'tree 4b825dc642cb6eb9a060e54bf8d69288fbee4904\nauthor Owner <o@acme> 1750000000 +0000\ncommitter Owner <o@acme> 1750000000 +0000\n\norg add\n';
|
||||
|
||||
const GOLDEN_ARMOR =
|
||||
'-----BEGIN SSH SIGNATURE-----\n' +
|
||||
'U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgA6EHv/POEL4dcN0Y50vAmWfk1j\n' +
|
||||
'CbpQ1fHdyGZBJVMbgAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5\n' +
|
||||
'AAAAQFLDkEyykOw6Z+I9qLKtTDToj2pXIfgvn+PoNDa5PfE6DQ/BmetpymL2aVdQXSpQ4k\n' +
|
||||
'i4fjWKgx63Q43NsyR/cAs=\n' +
|
||||
'-----END SSH SIGNATURE-----';
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Fixed-seed deterministic ed25519 signer (Node.js only; test-only).
|
||||
// The injected rawSign approach mirrors the production SW wiring, where
|
||||
// rawSign wraps wasm.sign_for_git; here we use node:crypto for the seed.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function fixedSigner(): (data: Uint8Array) => Uint8Array {
|
||||
const pkcs8 = Buffer.concat([
|
||||
Buffer.from('302e020100300506032b657004220420', 'hex'),
|
||||
Buffer.from(SEED_HEX, 'hex'),
|
||||
]);
|
||||
const key = createPrivateKey({ key: pkcs8, format: 'der', type: 'pkcs8' });
|
||||
return (data: Uint8Array) =>
|
||||
new Uint8Array(nodeSign(null, Buffer.from(data), key));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Shared test fixtures
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
const GIT_URL = 'https://git.example.com/org/vault.git';
|
||||
const BRANCH = 'main';
|
||||
const AUTH = { username: 'relicario', password: 'test-token' };
|
||||
|
||||
function makeSigner(): CommitSigner {
|
||||
return {
|
||||
author: { name: 'Test User', email: 'test@example.com' },
|
||||
signingPubOpenssh: PUB_OPENSSH,
|
||||
rawSign: fixedSigner(),
|
||||
};
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Engine tests
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
describe('commitSignedPush engine', () => {
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
});
|
||||
|
||||
test('1 — clone called once with correct url / ref / singleBranch / depth / onAuth', async () => {
|
||||
const files: CommitFile[] = [{ path: 'vault/item.enc', content: new Uint8Array([1, 2, 3]) }];
|
||||
await commitSignedPush({ gitUrl: GIT_URL, branch: BRANCH, auth: AUTH, files, message: 'test', signer: makeSigner() });
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const args = (vi.mocked(git.clone).mock.calls[0][0] as any);
|
||||
expect(vi.mocked(git.clone)).toHaveBeenCalledTimes(1);
|
||||
expect(args.url).toBe(GIT_URL);
|
||||
expect(args.ref).toBe(BRANCH);
|
||||
expect(args.singleBranch).toBe(true);
|
||||
expect(args.depth).toBe(1);
|
||||
expect(typeof args.onAuth).toBe('function');
|
||||
expect(args.onAuth()).toEqual(AUTH);
|
||||
});
|
||||
|
||||
test('2 — add called once per file with the right filepath', async () => {
|
||||
const files: CommitFile[] = [
|
||||
{ path: 'a/b.enc', content: new Uint8Array([1]) },
|
||||
{ path: 'c.enc', content: new Uint8Array([2]) },
|
||||
];
|
||||
await commitSignedPush({ gitUrl: GIT_URL, branch: BRANCH, auth: AUTH, files, message: 'test', signer: makeSigner() });
|
||||
|
||||
expect(vi.mocked(git.add)).toHaveBeenCalledTimes(2);
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
expect((vi.mocked(git.add).mock.calls[0][0] as any).filepath).toBe('a/b.enc');
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
expect((vi.mocked(git.add).mock.calls[1][0] as any).filepath).toBe('c.enc');
|
||||
});
|
||||
|
||||
test('3 — golden-vector tie: onSign wires buildSshSig correctly', async () => {
|
||||
// Use the fixed vector signer (same seed/key as sshsig.test.ts).
|
||||
const vectorSigner: CommitSigner = {
|
||||
author: { name: 'Owner', email: 'o@acme' },
|
||||
signingPubOpenssh: PUB_OPENSSH,
|
||||
rawSign: fixedSigner(),
|
||||
};
|
||||
await commitSignedPush({
|
||||
gitUrl: GIT_URL, branch: BRANCH, auth: AUTH,
|
||||
files: [],
|
||||
message: 'org add',
|
||||
signer: vectorSigner,
|
||||
});
|
||||
|
||||
// Capture the onSign that was passed to git.commit and invoke it with the
|
||||
// fixed PAYLOAD. The returned signature MUST equal GOLDEN_ARMOR byte-for-byte.
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const commitArgs = (vi.mocked(git.commit).mock.calls[0][0] as any);
|
||||
const { signature } = await commitArgs.onSign({ payload: PAYLOAD, secretKey: 'device' });
|
||||
expect(signature).toBe(GOLDEN_ARMOR);
|
||||
});
|
||||
|
||||
test('4 — push called with correct url / ref / remoteRef / onAuth', async () => {
|
||||
const files: CommitFile[] = [{ path: 'vault/item.enc', content: new Uint8Array([1]) }];
|
||||
await commitSignedPush({ gitUrl: GIT_URL, branch: BRANCH, auth: AUTH, files, message: 'test', signer: makeSigner() });
|
||||
|
||||
expect(vi.mocked(git.push)).toHaveBeenCalledTimes(1);
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const args = (vi.mocked(git.push).mock.calls[0][0] as any);
|
||||
expect(args.url).toBe(GIT_URL);
|
||||
expect(args.ref).toBe(BRANCH);
|
||||
expect(args.remoteRef).toBe(BRANCH);
|
||||
expect(typeof args.onAuth).toBe('function');
|
||||
expect(args.onAuth()).toEqual(AUTH);
|
||||
});
|
||||
|
||||
test('5 — push rejection throws with server detail', async () => {
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
vi.mocked(git.push).mockResolvedValueOnce({ ok: false, errors: ['pre-receive hook declined'] } as any);
|
||||
const files: CommitFile[] = [{ path: 'vault/item.enc', content: new Uint8Array([1]) }];
|
||||
|
||||
await expect(
|
||||
commitSignedPush({ gitUrl: GIT_URL, branch: BRANCH, auth: AUTH, files, message: 'test', signer: makeSigner() }),
|
||||
).rejects.toThrow('pre-receive hook declined');
|
||||
});
|
||||
});
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Host wrapper tests — verifies commitSigned delegates correctly to the engine.
|
||||
// The mocked git.clone captures the gitUrl and auth shape for each host.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
describe('GitHost wrappers — commitSigned wires commitSignedPush correctly', () => {
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
});
|
||||
|
||||
test('GiteaHost: builds https://<host>/<repo>.git gitUrl; auth.password === apiToken', async () => {
|
||||
// LIVE RESIDUAL: exact Basic-auth acceptance confirmed only by a live push against Gitea.
|
||||
const signer = makeSigner();
|
||||
await new GiteaHost('https://git.example', 'o/r', 'tok').commitSigned([], 'm', signer);
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const args = (vi.mocked(git.clone).mock.calls[0][0] as any);
|
||||
expect(args.url).toBe('https://git.example/o/r.git');
|
||||
expect(args.onAuth()).toEqual({ username: 'relicario', password: 'tok' });
|
||||
});
|
||||
|
||||
test('GitHubHost: builds https://github.com/<repo>.git; auth.username === apiToken', async () => {
|
||||
// LIVE RESIDUAL: GitHub PAT-over-Basic (username=token, password=x-oauth-basic) unconfirmed live.
|
||||
const signer = makeSigner();
|
||||
await new GitHubHost('o/r', 'tok').commitSigned([], 'm', signer);
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const args = (vi.mocked(git.clone).mock.calls[0][0] as any);
|
||||
expect(args.url).toBe('https://github.com/o/r.git');
|
||||
expect(args.onAuth()).toEqual({ username: 'tok', password: 'x-oauth-basic' });
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user