@@ -2,6 +2,7 @@ use crate::tests::util::MockRequestExt;
22use crate :: tests:: { RequestHelper , TestApp } ;
33use crate :: util:: token:: HashedToken ;
44use crate :: { models:: ApiToken , schema:: api_tokens} ;
5+ use crates_io_github:: { GitHubPublicKey , MockGitHubClient } ;
56use diesel:: prelude:: * ;
67use diesel_async:: RunQueryDsl ;
78use googletest:: prelude:: * ;
@@ -13,13 +14,34 @@ static URL: &str = "/api/github/secret-scanning/verify";
1314// Test request and signature from https://docs.github.com/en/developers/overview/secret-scanning-partner-program#create-a-secret-alert-service
1415static GITHUB_ALERT : & [ u8 ] =
1516 br#"[{"token":"some_token","type":"some_type","url":"some_url","source":"some_source"}]"# ;
17+
1618static GITHUB_PUBLIC_KEY_IDENTIFIER : & str =
1719 "f9525bf080f75b3506ca1ead061add62b8633a346606dc5fe544e29231c6ee0d" ;
20+
21+ /// Test key from https://docs.github.com/en/developers/overview/secret-scanning-partner-program#create-a-secret-alert-service
22+ static GITHUB_PUBLIC_KEY : & str = "-----BEGIN PUBLIC KEY-----\n MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsz9ugWDj5jK5ELBK42ynytbo38gP\n HzZFI03Exwz8Lh/tCfL3YxwMdLjB+bMznsanlhK0RwcGP3IDb34kQDIo3Q==\n -----END PUBLIC KEY-----" ;
23+
1824static GITHUB_PUBLIC_KEY_SIGNATURE : & str = "MEUCIFLZzeK++IhS+y276SRk2Pe5LfDrfvTXu6iwKKcFGCrvAiEAhHN2kDOhy2I6eGkOFmxNkOJ+L2y8oQ9A2T9GGJo6WJY=" ;
1925
26+ fn github_mock ( ) -> MockGitHubClient {
27+ let mut mock = MockGitHubClient :: new ( ) ;
28+
29+ mock. expect_public_keys ( ) . returning ( |_, _| {
30+ let key = GitHubPublicKey {
31+ key_identifier : GITHUB_PUBLIC_KEY_IDENTIFIER . to_string ( ) ,
32+ key : GITHUB_PUBLIC_KEY . to_string ( ) ,
33+ is_current : true ,
34+ } ;
35+
36+ Ok ( vec ! [ key] )
37+ } ) ;
38+
39+ mock
40+ }
41+
2042#[ tokio:: test( flavor = "multi_thread" ) ]
2143async fn github_secret_alert_revokes_token ( ) {
22- let ( app, anon, user, token) = TestApp :: init ( ) . with_token ( ) ;
44+ let ( app, anon, user, token) = TestApp :: init ( ) . with_github ( github_mock ( ) ) . with_token ( ) ;
2345 let mut conn = app. async_db_conn ( ) . await ;
2446
2547 // Ensure no emails were sent up to this point
@@ -77,7 +99,7 @@ async fn github_secret_alert_revokes_token() {
7799
78100#[ tokio:: test( flavor = "multi_thread" ) ]
79101async fn github_secret_alert_for_revoked_token ( ) {
80- let ( app, anon, user, token) = TestApp :: init ( ) . with_token ( ) ;
102+ let ( app, anon, user, token) = TestApp :: init ( ) . with_github ( github_mock ( ) ) . with_token ( ) ;
81103 let mut conn = app. async_db_conn ( ) . await ;
82104
83105 // Ensure no emails were sent up to this point
@@ -138,7 +160,7 @@ async fn github_secret_alert_for_revoked_token() {
138160
139161#[ tokio:: test( flavor = "multi_thread" ) ]
140162async fn github_secret_alert_for_unknown_token ( ) {
141- let ( app, anon, user, token) = TestApp :: init ( ) . with_token ( ) ;
163+ let ( app, anon, user, token) = TestApp :: init ( ) . with_github ( github_mock ( ) ) . with_token ( ) ;
142164 let mut conn = app. async_db_conn ( ) . await ;
143165
144166 // Ensure no emails were sent up to this point
@@ -180,7 +202,7 @@ async fn github_secret_alert_for_unknown_token() {
180202
181203#[ tokio:: test( flavor = "multi_thread" ) ]
182204async fn github_secret_alert_invalid_signature_fails ( ) {
183- let ( _, anon) = TestApp :: init ( ) . empty ( ) ;
205+ let ( _, anon) = TestApp :: init ( ) . with_github ( github_mock ( ) ) . empty ( ) ;
184206
185207 // No headers or request body
186208 let request = anon. post_request ( URL ) ;
0 commit comments