at-container-registry/pkg/appview/handlers/install_test.go

package handlers_test

import (
	"bytes"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"atcr.io/pkg/appview"
	"atcr.io/pkg/appview/handlers"
	"atcr.io/pkg/appview/installscript"
	"github.com/go-chi/chi/v5"
)

func brand(t *testing.T, name, display string) installscript.Brand {
	t.Helper()
	b, err := installscript.NewBrand(name, display, "")
	if err != nil {
		t.Fatalf("NewBrand: %v", err)
	}
	return b
}

func installBase(t *testing.T, name, display, registry, site string) handlers.BaseUIHandler {
	t.Helper()
	templates, err := appview.Templates(nil)
	if err != nil {
		t.Fatalf("Failed to load templates: %v", err)
	}
	return handlers.BaseUIHandler{
		Templates:       templates,
		RegistryURL:     registry,
		RegistryDomains: []string{registry},
		SiteURL:         site,
		ClientName:      display,
		ClientShortName: display,
		CredHelper:      brand(t, name, display),
	}
}

// The script must stay fetchable at exactly the path the install page and the
// docs document, even though /static/* is also mounted as a file server.
func TestInstallScriptRouteShadowsStaticFileServer(t *testing.T) {
	base := installBase(t, "seamark", "Seamark", "seamark.cr", "seamark.dev")
	scripts := &handlers.InstallScriptHandler{BaseUIHandler: base}

	r := chi.NewRouter()
	r.Get("/static/install.sh", scripts.ServeShell)
	r.Get("/static/install.ps1", scripts.ServePowerShell)
	r.Handle("/static/*", http.StripPrefix("/static/", http.HandlerFunc(
		func(w http.ResponseWriter, _ *http.Request) {
			http.Error(w, "static file server", http.StatusNotFound)
		})))

	for _, tc := range []struct{ path, contentType, want string }{
		{"/static/install.sh", "text/x-shellscript; charset=utf-8", `BINARY_NAME="docker-credential-seamark"`},
		{"/static/install.ps1", "text/plain; charset=utf-8", `$BinaryName = "docker-credential-seamark.exe"`},
	} {
		// No session, no cookie: `curl | bash` runs unauthenticated.
		req := httptest.NewRequest(http.MethodGet, tc.path, nil)
		rr := httptest.NewRecorder()
		r.ServeHTTP(rr, req)

		if rr.Code != http.StatusOK {
			t.Fatalf("%s: status = %d, want 200 (body %q)", tc.path, rr.Code, rr.Body.String())
		}
		if got := rr.Header().Get("Content-Type"); got != tc.contentType {
			t.Errorf("%s: Content-Type = %q, want %q", tc.path, got, tc.contentType)
		}
		if !strings.Contains(rr.Body.String(), tc.want) {
			t.Errorf("%s: body missing %q", tc.path, tc.want)
		}
		if strings.Contains(rr.Body.String(), "atcr") {
			t.Errorf("%s: seamark deployment served an atcr-branded script", tc.path)
		}
	}
}

func TestInstallScriptServesATCRDefault(t *testing.T) {
	base := installBase(t, "", "ATCR", "atcr.io", "atcr.io")
	scripts := &handlers.InstallScriptHandler{BaseUIHandler: base}

	rr := httptest.NewRecorder()
	scripts.ServeShell(rr, httptest.NewRequest(http.MethodGet, "/static/install.sh", nil))

	body := rr.Body.String()
	for _, want := range []string{
		`BINARY_NAME="docker-credential-atcr"`,
		`{"credHelpers": {"atcr.io": "atcr"}}`,
	} {
		if !strings.Contains(body, want) {
			t.Errorf("default install.sh missing %q", want)
		}
	}
	if strings.Contains(body, "seamark") {
		t.Error("default install.sh leaked seamark branding")
	}
}

// The /install page told every deployment to install docker-credential-atcr
// and to key credHelpers on atcr.io. Both now follow the configured brand.
func TestInstallPageNamesConfiguredHelper(t *testing.T) {
	tests := []struct {
		name       string
		helper     string
		display    string
		registry   string
		site       string
		want       []string
		unexpected []string
	}{
		{
			name: "seamark", helper: "seamark", display: "Seamark",
			registry: "seamark.cr", site: "seamark.dev",
			want: []string{
				`"seamark.cr": "seamark"`,
				"which docker-credential-seamark",
				"~/.seamark/device.json",
				"curl -fsSL seamark.dev/static/install.sh | bash",
			},
			unexpected: []string{"docker-credential-atcr", `: "atcr"`, "~/.atcr/"},
		},
		{
			name: "atcr default", helper: "", display: "ATCR",
			registry: "atcr.io", site: "atcr.io",
			want: []string{
				`"atcr.io": "atcr"`,
				"which docker-credential-atcr",
				"~/.atcr/device.json",
				"curl -fsSL atcr.io/static/install.sh | bash",
			},
			unexpected: []string{"seamark"},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			h := &handlers.InstallHandler{
				BaseUIHandler: installBase(t, tt.helper, tt.display, tt.registry, tt.site),
			}
			rr := httptest.NewRecorder()
			h.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/install", nil))

			if rr.Code != http.StatusOK {
				t.Fatalf("status = %d, want 200", rr.Code)
			}
			body := rr.Body.String()
			for _, want := range tt.want {
				if !strings.Contains(body, want) {
					t.Errorf("/install missing %q", want)
				}
			}
			for _, bad := range tt.unexpected {
				if strings.Contains(body, bad) {
					t.Errorf("/install still contains %q", bad)
				}
			}
		})
	}
}

// Same defect on the devices settings panel, which is where a logged-in user
// is actually sent to set Docker up.
func TestDevicesPanelNamesConfiguredHelper(t *testing.T) {
	templates, err := appview.Templates(nil)
	if err != nil {
		t.Fatalf("Failed to load templates: %v", err)
	}

	type profile struct{ Handle string }
	type panelData struct {
		handlers.PageData
		Profile profile
	}

	tests := []struct {
		name       string
		helper     string
		registry   string
		site       string
		want       []string
		unexpected []string
	}{
		{
			name: "seamark", helper: "seamark", registry: "seamark.cr", site: "seamark.dev",
			want: []string{
				"docker-credential-seamark",
				`"seamark.cr": "seamark"`,
				"curl -fsSL seamark.dev/static/install.sh | bash",
			},
			unexpected: []string{"docker-credential-atcr", `: "atcr"`},
		},
		{
			name: "atcr default", helper: "", registry: "atcr.io", site: "atcr.io",
			want: []string{
				"docker-credential-atcr",
				`"atcr.io": "atcr"`,
			},
			unexpected: []string{"seamark"},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			data := panelData{
				PageData: handlers.PageData{
					RegistryURL: tt.registry,
					SiteURL:     tt.site,
					CredHelper:  brand(t, tt.helper, "Brand"),
				},
				Profile: profile{Handle: "alice.test"},
			}

			var buf bytes.Buffer
			if err := templates.ExecuteTemplate(&buf, "settings-panel-devices", data); err != nil {
				t.Fatalf("ExecuteTemplate: %v", err)
			}
			for _, want := range tt.want {
				if !strings.Contains(buf.String(), want) {
					t.Errorf("devices panel missing %q", want)
				}
			}
			for _, bad := range tt.unexpected {
				if strings.Contains(buf.String(), bad) {
					t.Errorf("devices panel still contains %q", bad)
				}
			}
		})
	}
}