Initial curated RepoPulse source from 2524ccc3c1c27739996dccb2b7992989f88cd26d

backend/tests/test_api_v11.py

@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+
+from fastapi.testclient import TestClient
+
+from app import main as main_module
+from app.gitea import GiteaClient
+from app.models import Repository
+from app.store import ScanStore
+
+
+def test_repository_catalog_and_durable_scan_job_contract(tmp_path) -> None:
+    main_module.store = ScanStore(str(tmp_path / "history.db"))
+    main_module.job_runner = None
+    main_module.gitea_client = GiteaClient("http://gitea.local", "test-token", transport=lambda *_: (500, b""))
+    repository = Repository(
+        id="gitea:64",
+        provider="gitea",
+        provider_repository_id="64",
+        owner="Jens",
+        name="RepoPulse",
+        full_name="Jens/RepoPulse",
+        default_branch="main",
+        latest_revision="0123456789abcdef0123456789abcdef01234567",
+    )
+    main_module.store.upsert_repository(repository)
+    client = TestClient(main_module.app)
+
+    catalog = client.get("/api/v1/repositories")
+    assert catalog.status_code == 200
+    assert catalog.json()[0]["id"] == "gitea:64"
+    assert "latest_scan" not in catalog.json()[0]
+
+    queued = client.post("/api/v1/repositories/gitea%3A64/scans", json={"force": False})
+    assert queued.status_code == 202
+    job = queued.json()
+    assert job["repository_id"] == "gitea:64"
+    assert job["status"] == "queued"
+
+    duplicate = client.post("/api/v1/repositories/gitea%3A64/scans", json={"force": False})
+    assert duplicate.status_code == 202
+    assert duplicate.json()["id"] == job["id"]
+    assert duplicate.json()["deduplicated"] is True
+
+    detail = client.get("/api/v1/repositories/gitea%3A64")
+    assert detail.status_code == 200
+    assert detail.json()["latest_scan"] is None
+    assert client.get(f"/api/v1/scan-jobs/{job['id']}").json()["status"] == "queued"
+
+
+def test_signed_gitea_webhook_only_schedules_default_branch_push(
+    tmp_path, monkeypatch
+) -> None:
+    main_module.store = ScanStore(str(tmp_path / "history.db"))
+    main_module.job_runner = None
+    main_module.gitea_client = GiteaClient("http://gitea.local", "test-token", transport=lambda *_: (500, b""))
+    repository = Repository(
+        id="gitea:64",
+        provider="gitea",
+        provider_repository_id="64",
+        owner="Jens",
+        name="RepoPulse",
+        full_name="Jens/RepoPulse",
+        default_branch="main",
+        latest_revision="0123456789abcdef0123456789abcdef01234567",
+    )
+    main_module.store.upsert_repository(repository)
+    monkeypatch.setenv("REPOPULSE_GITEA_WEBHOOK_SECRET", "webhook-secret")
+    payload = {
+        "repository": {"id": 64},
+        "ref": "refs/heads/main",
+        "after": "abcdef0123456789abcdef0123456789abcdef01",
+    }
+    body = json.dumps(payload).encode()
+    signature = hmac.new(b"webhook-secret", body, hashlib.sha256).hexdigest()
+    client = TestClient(main_module.app)
+
+    response = client.post(
+        "/api/v1/webhooks/gitea",
+        content=body,
+        headers={"X-Gitea-Signature": signature, "X-Gitea-Event": "push"},
+    )
+    assert response.status_code == 200
+    assert response.json()["job_id"]
+    assert main_module.store.get_repository("gitea:64").latest_revision == payload["after"]
+
+    wrong_signature = client.post(
+        "/api/v1/webhooks/gitea",
+        content=body,
+        headers={"X-Gitea-Signature": "0" * 64, "X-Gitea-Event": "push"},
+    )
+    assert wrong_signature.status_code == 401
+
+    feature_payload = payload | {"ref": "refs/heads/feature"}
+    feature_body = json.dumps(feature_payload).encode()
+    feature_signature = hmac.new(b"webhook-secret", feature_body, hashlib.sha256).hexdigest()
+    feature = client.post(
+        "/api/v1/webhooks/gitea",
+        content=feature_body,
+        headers={"X-Gitea-Signature": feature_signature, "X-Gitea-Event": "push"},
+    )
+    assert feature.status_code == 200
+    assert feature.json()["job_id"] is None
+
+
+def test_meta_exposes_operational_counts_without_connector_token(tmp_path) -> None:
+    main_module.store = ScanStore(str(tmp_path / "history.db"))
+    main_module.job_runner = None
+    main_module.gitea_client = GiteaClient("http://gitea.local", "never-return-this-token")
+    main_module.store.upsert_repository(
+        Repository(
+            id="gitea:64",
+            provider="gitea",
+            provider_repository_id="64",
+            owner="Jens",
+            name="RepoPulse",
+            full_name="Jens/RepoPulse",
+            latest_revision="0123456789abcdef0123456789abcdef01234567",
+        )
+    )
+
+    response = TestClient(main_module.app).get("/api/v1/meta")
+
+    assert response.status_code == 200
+    assert response.json()["repository_count"] == 1
+    assert response.json()["repository_states"]["never_scanned"] == 1
+    assert "never-return-this-token" not in response.text