mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-12-27 01:44:10 -05:00
e1fe3bbdc0
This is an implementation of a quota engine, and the API routes to manage its settings. This does *not* contain any enforcement code: this is just the bedrock, the engine itself. The goal of the engine is to be flexible and future proof: to be nimble enough to build on it further, without having to rewrite large parts of it. It might feel a little more complicated than necessary, because the goal was to be able to support scenarios only very few Forgejo instances need, scenarios the vast majority of mostly smaller instances simply do not care about. The goal is to support both big and small, and for that, we need a solid, flexible foundation. There are thee big parts to the engine: counting quota use, setting limits, and evaluating whether the usage is within the limits. Sounds simple on paper, less so in practice! Quota counting ============== Quota is counted based on repo ownership, whenever possible, because repo owners are in ultimate control over the resources they use: they can delete repos, attachments, everything, even if they don't *own* those themselves. They can clean up, and will always have the permission and access required to do so. Would we count quota based on the owning user, that could lead to situations where a user is unable to free up space, because they uploaded a big attachment to a repo that has been taken private since. It's both more fair, and much safer to count quota against repo owners. This means that if user A uploads an attachment to an issue opened against organization O, that will count towards the quota of organization O, rather than user A. One's quota usage stats can be queried using the `/user/quota` API endpoint. To figure out what's eating into it, the `/user/repos?order_by=size`, `/user/quota/attachments`, `/user/quota/artifacts`, and `/user/quota/packages` endpoints should be consulted. There's also `/user/quota/check?subject=<...>` to check whether the signed-in user is within a particular quota limit. Quotas are counted based on sizes stored in the database. Setting quota limits ==================== There are different "subjects" one can limit usage for. At this time, only size-based limits are implemented, which are: - `size:all`: As the name would imply, the total size of everything Forgejo tracks. - `size:repos:all`: The total size of all repositories (not including LFS). - `size:repos:public`: The total size of all public repositories (not including LFS). - `size:repos:private`: The total size of all private repositories (not including LFS). - `sizeall`: The total size of all git data (including all repositories, and LFS). - `size
846 lines
29 KiB
Go
846 lines
29 KiB
Go
// Copyright 2024 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "code.gitea.io/gitea/models/auth"
|
|
"code.gitea.io/gitea/models/db"
|
|
quota_model "code.gitea.io/gitea/models/quota"
|
|
"code.gitea.io/gitea/models/unittest"
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
api "code.gitea.io/gitea/modules/structs"
|
|
"code.gitea.io/gitea/modules/test"
|
|
"code.gitea.io/gitea/routers"
|
|
"code.gitea.io/gitea/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAPIQuotaDisabled(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.Quota.Enabled, false)()
|
|
defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
session := loginUser(t, user.Name)
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/user/quota")
|
|
session.MakeRequest(t, req, http.StatusNotFound)
|
|
}
|
|
|
|
func apiCreateUser(t *testing.T, username string) func() {
|
|
t.Helper()
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
session := loginUser(t, admin.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeAll)
|
|
|
|
mustChangePassword := false
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/users", api.CreateUserOption{
|
|
Email: "api+" + username + "@example.com",
|
|
Username: username,
|
|
Password: "password",
|
|
MustChangePassword: &mustChangePassword,
|
|
}).AddTokenAuth(token)
|
|
session.MakeRequest(t, req, http.StatusCreated)
|
|
|
|
return func() {
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/users/"+username+"?purge=true").AddTokenAuth(token)
|
|
session.MakeRequest(t, req, http.StatusNoContent)
|
|
}
|
|
}
|
|
|
|
func TestAPIQuotaCreateGroupWithRules(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.Quota.Enabled, true)()
|
|
defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
|
|
|
|
// Create two rules in advance
|
|
unlimited := int64(-1)
|
|
defer createQuotaRule(t, api.CreateQuotaRuleOptions{
|
|
Name: "unlimited",
|
|
Limit: &unlimited,
|
|
Subjects: []string{"size:all"},
|
|
})()
|
|
zero := int64(0)
|
|
defer createQuotaRule(t, api.CreateQuotaRuleOptions{
|
|
Name: "deny-git-lfs",
|
|
Limit: &zero,
|
|
Subjects: []string{"size:git:lfs"},
|
|
})()
|
|
|
|
// Log in as admin
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
adminSession := loginUser(t, admin.Name)
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeAll)
|
|
|
|
// Create a new group, with rules specified
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/groups", api.CreateQuotaGroupOptions{
|
|
Name: "group-with-rules",
|
|
Rules: []api.CreateQuotaRuleOptions{
|
|
// First: an existing group, unlimited, name only
|
|
{
|
|
Name: "unlimited",
|
|
},
|
|
// Second: an existing group, deny-git-lfs, with different params
|
|
{
|
|
Name: "deny-git-lfs",
|
|
Limit: &unlimited,
|
|
},
|
|
// Third: an entirely new group
|
|
{
|
|
Name: "new-rule",
|
|
Subjects: []string{"size:assets:all"},
|
|
},
|
|
},
|
|
}).AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusCreated)
|
|
defer func() {
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/group-with-rules").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequest(t, "DELETE", "/api/v1/admin/quota/rules/new-rule").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
}()
|
|
|
|
// Verify that we created a group with rules included
|
|
var q api.QuotaGroup
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Equal(t, "group-with-rules", q.Name)
|
|
assert.Len(t, q.Rules, 3)
|
|
|
|
// Verify that the previously existing rules are unchanged
|
|
rule, err := quota_model.GetRuleByName(db.DefaultContext, "unlimited")
|
|
require.NoError(t, err)
|
|
assert.NotNil(t, rule)
|
|
assert.EqualValues(t, -1, rule.Limit)
|
|
assert.EqualValues(t, quota_model.LimitSubjects{quota_model.LimitSubjectSizeAll}, rule.Subjects)
|
|
|
|
rule, err = quota_model.GetRuleByName(db.DefaultContext, "deny-git-lfs")
|
|
require.NoError(t, err)
|
|
assert.NotNil(t, rule)
|
|
assert.EqualValues(t, 0, rule.Limit)
|
|
assert.EqualValues(t, quota_model.LimitSubjects{quota_model.LimitSubjectSizeGitLFS}, rule.Subjects)
|
|
|
|
// Verify that the new rule was also created
|
|
rule, err = quota_model.GetRuleByName(db.DefaultContext, "new-rule")
|
|
require.NoError(t, err)
|
|
assert.NotNil(t, rule)
|
|
assert.EqualValues(t, 0, rule.Limit)
|
|
assert.EqualValues(t, quota_model.LimitSubjects{quota_model.LimitSubjectSizeAssetsAll}, rule.Subjects)
|
|
|
|
t.Run("invalid rule spec", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/groups", api.CreateQuotaGroupOptions{
|
|
Name: "group-with-invalid-rule-spec",
|
|
Rules: []api.CreateQuotaRuleOptions{
|
|
{
|
|
Name: "rule-with-wrong-spec",
|
|
Subjects: []string{"valid:false"},
|
|
},
|
|
},
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
})
|
|
}
|
|
|
|
func TestAPIQuotaEmptyState(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.Quota.Enabled, true)()
|
|
defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
|
|
|
|
username := "quota-empty-user"
|
|
defer apiCreateUser(t, username)()
|
|
session := loginUser(t, username)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeAll)
|
|
|
|
t.Run("#/admin/users/quota-empty-user/quota", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
adminSession := loginUser(t, admin.Name)
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeAll)
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/admin/users/quota-empty-user/quota").AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaInfo
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.EqualValues(t, api.QuotaUsed{}, q.Used)
|
|
assert.Empty(t, q.Groups)
|
|
})
|
|
|
|
t.Run("#/user/quota", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/user/quota").AddTokenAuth(token)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaInfo
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.EqualValues(t, api.QuotaUsed{}, q.Used)
|
|
assert.Empty(t, q.Groups)
|
|
|
|
t.Run("#/user/quota/artifacts", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/user/quota/artifacts").AddTokenAuth(token)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaUsedArtifactList
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Empty(t, q)
|
|
})
|
|
|
|
t.Run("#/user/quota/attachments", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/user/quota/attachments").AddTokenAuth(token)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaUsedAttachmentList
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Empty(t, q)
|
|
})
|
|
|
|
t.Run("#/user/quota/packages", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/user/quota/packages").AddTokenAuth(token)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaUsedPackageList
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Empty(t, q)
|
|
})
|
|
})
|
|
}
|
|
|
|
func createQuotaRule(t *testing.T, opts api.CreateQuotaRuleOptions) func() {
|
|
t.Helper()
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
adminSession := loginUser(t, admin.Name)
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeAll)
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/rules", opts).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusCreated)
|
|
|
|
return func() {
|
|
req := NewRequestf(t, "DELETE", "/api/v1/admin/quota/rules/%s", opts.Name).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
}
|
|
}
|
|
|
|
func createQuotaGroup(t *testing.T, name string) func() {
|
|
t.Helper()
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
adminSession := loginUser(t, admin.Name)
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeAll)
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/groups", api.CreateQuotaGroupOptions{
|
|
Name: name,
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusCreated)
|
|
|
|
return func() {
|
|
req := NewRequestf(t, "DELETE", "/api/v1/admin/quota/groups/%s", name).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
}
|
|
}
|
|
|
|
func TestAPIQuotaAdminRoutesRules(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.Quota.Enabled, true)()
|
|
defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
adminSession := loginUser(t, admin.Name)
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeAll)
|
|
|
|
zero := int64(0)
|
|
oneKb := int64(1024)
|
|
|
|
t.Run("adminCreateQuotaRule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/rules", api.CreateQuotaRuleOptions{
|
|
Name: "deny-all",
|
|
Limit: &zero,
|
|
Subjects: []string{"size:all"},
|
|
}).AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusCreated)
|
|
defer func() {
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
}()
|
|
|
|
var q api.QuotaRuleInfo
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Equal(t, "deny-all", q.Name)
|
|
assert.EqualValues(t, 0, q.Limit)
|
|
assert.EqualValues(t, []string{"size:all"}, q.Subjects)
|
|
|
|
rule, err := quota_model.GetRuleByName(db.DefaultContext, "deny-all")
|
|
require.NoError(t, err)
|
|
assert.EqualValues(t, 0, rule.Limit)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("missing options", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/rules", nil).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
})
|
|
|
|
t.Run("invalid subjects", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/rules", api.CreateQuotaRuleOptions{
|
|
Name: "invalid-subjects",
|
|
Limit: &zero,
|
|
Subjects: []string{"valid:false"},
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
})
|
|
|
|
t.Run("trying to add an existing rule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
rule := api.CreateQuotaRuleOptions{
|
|
Name: "double-rule",
|
|
Limit: &zero,
|
|
}
|
|
|
|
defer createQuotaRule(t, rule)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/rules", rule).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusConflict)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminDeleteQuotaRule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
createQuotaRule(t, api.CreateQuotaRuleOptions{
|
|
Name: "deny-all",
|
|
Limit: &zero,
|
|
Subjects: []string{"size:all"},
|
|
})
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
rule, err := quota_model.GetRuleByName(db.DefaultContext, "deny-all")
|
|
require.NoError(t, err)
|
|
assert.Nil(t, rule)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("nonexistent rule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/rules/does-not-exist").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminEditQuotaRule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
defer createQuotaRule(t, api.CreateQuotaRuleOptions{
|
|
Name: "deny-all",
|
|
Limit: &zero,
|
|
Subjects: []string{"size:all"},
|
|
})()
|
|
|
|
req := NewRequestWithJSON(t, "PATCH", "/api/v1/admin/quota/rules/deny-all", api.EditQuotaRuleOptions{
|
|
Limit: &oneKb,
|
|
}).AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaRuleInfo
|
|
DecodeJSON(t, resp, &q)
|
|
assert.EqualValues(t, 1024, q.Limit)
|
|
|
|
rule, err := quota_model.GetRuleByName(db.DefaultContext, "deny-all")
|
|
require.NoError(t, err)
|
|
assert.EqualValues(t, 1024, rule.Limit)
|
|
|
|
t.Run("no options", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "PATCH", "/api/v1/admin/quota/rules/deny-all", nil).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusOK)
|
|
})
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("nonexistent rule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "PATCH", "/api/v1/admin/quota/rules/does-not-exist", api.EditQuotaRuleOptions{
|
|
Limit: &oneKb,
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("invalid subjects", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "PATCH", "/api/v1/admin/quota/rules/deny-all", api.EditQuotaRuleOptions{
|
|
Subjects: &[]string{"valid:false"},
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminListQuotaRules", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
defer createQuotaRule(t, api.CreateQuotaRuleOptions{
|
|
Name: "deny-all",
|
|
Limit: &zero,
|
|
Subjects: []string{"size:all"},
|
|
})()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/admin/quota/rules").AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var rules []api.QuotaRuleInfo
|
|
DecodeJSON(t, resp, &rules)
|
|
|
|
assert.Len(t, rules, 1)
|
|
assert.Equal(t, "deny-all", rules[0].Name)
|
|
assert.EqualValues(t, 0, rules[0].Limit)
|
|
})
|
|
}
|
|
|
|
func TestAPIQuotaAdminRoutesGroups(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.Quota.Enabled, true)()
|
|
defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
adminSession := loginUser(t, admin.Name)
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeAll)
|
|
|
|
zero := int64(0)
|
|
|
|
ruleDenyAll := api.CreateQuotaRuleOptions{
|
|
Name: "deny-all",
|
|
Limit: &zero,
|
|
Subjects: []string{"size:all"},
|
|
}
|
|
|
|
username := "quota-test-user"
|
|
defer apiCreateUser(t, username)()
|
|
|
|
t.Run("adminCreateQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/groups", api.CreateQuotaGroupOptions{
|
|
Name: "default",
|
|
}).AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusCreated)
|
|
defer func() {
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/default").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
}()
|
|
|
|
var q api.QuotaGroup
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Equal(t, "default", q.Name)
|
|
assert.Empty(t, q.Rules)
|
|
|
|
group, err := quota_model.GetGroupByName(db.DefaultContext, "default")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "default", group.Name)
|
|
assert.Empty(t, group.Rules)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("missing options", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/groups", nil).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
})
|
|
|
|
t.Run("trying to add an existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
defer createQuotaGroup(t, "duplicate")()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/quota/groups", api.CreateQuotaGroupOptions{
|
|
Name: "duplicate",
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusConflict)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminDeleteQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
createQuotaGroup(t, "default")
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/default").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
group, err := quota_model.GetGroupByName(db.DefaultContext, "default")
|
|
require.NoError(t, err)
|
|
assert.Nil(t, group)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/does-not-exist").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminAddRuleToQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
defer createQuotaRule(t, ruleDenyAll)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
group, err := quota_model.GetGroupByName(db.DefaultContext, "default")
|
|
require.NoError(t, err)
|
|
assert.Len(t, group.Rules, 1)
|
|
assert.Equal(t, "deny-all", group.Rules[0].Name)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/does-not-exist/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("non-existing rule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/rules/does-not-exist").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminRemoveRuleFromQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
defer createQuotaRule(t, ruleDenyAll)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/default/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
group, err := quota_model.GetGroupByName(db.DefaultContext, "default")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "default", group.Name)
|
|
assert.Empty(t, group.Rules)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/does-not-exist/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("non-existing rule", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/default/rules/does-not-exist").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("rule not in group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaRule(t, api.CreateQuotaRuleOptions{
|
|
Name: "rule-not-in-group",
|
|
Limit: &zero,
|
|
})()
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/default/rules/rule-not-in-group").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminGetQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
defer createQuotaRule(t, ruleDenyAll)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequest(t, "GET", "/api/v1/admin/quota/groups/default").AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaGroup
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Equal(t, "default", q.Name)
|
|
assert.Len(t, q.Rules, 1)
|
|
assert.Equal(t, "deny-all", q.Rules[0].Name)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/admin/quota/groups/does-not-exist").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminListQuotaGroups", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
defer createQuotaRule(t, ruleDenyAll)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/rules/deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequest(t, "GET", "/api/v1/admin/quota/groups").AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaGroupList
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Len(t, q, 1)
|
|
assert.Equal(t, "default", q[0].Name)
|
|
assert.Len(t, q[0].Rules, 1)
|
|
assert.Equal(t, "deny-all", q[0].Rules[0].Name)
|
|
})
|
|
|
|
t.Run("adminAddUserToQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
|
|
req := NewRequestf(t, "PUT", "/api/v1/admin/quota/groups/default/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: username})
|
|
|
|
groups, err := quota_model.GetGroupsForUser(db.DefaultContext, user.ID)
|
|
require.NoError(t, err)
|
|
assert.Len(t, groups, 1)
|
|
assert.Equal(t, "default", groups[0].Name)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestf(t, "PUT", "/api/v1/admin/quota/groups/does-not-exist/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("non-existing user", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/users/this-user-does-not-exist").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("user already added", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/users/user1").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequest(t, "PUT", "/api/v1/admin/quota/groups/default/users/user1").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusConflict)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminRemoveUserFromQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
|
|
req := NewRequestf(t, "PUT", "/api/v1/admin/quota/groups/default/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequestf(t, "DELETE", "/api/v1/admin/quota/groups/default/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: username})
|
|
groups, err := quota_model.GetGroupsForUser(db.DefaultContext, user.ID)
|
|
require.NoError(t, err)
|
|
assert.Empty(t, groups)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestf(t, "DELETE", "/api/v1/admin/quota/groups/does-not-exist/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("non-existing user", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/default/users/does-not-exist").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("user not in group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "DELETE", "/api/v1/admin/quota/groups/default/users/user1").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminListUsersInQuotaGroup", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
|
|
req := NewRequestf(t, "PUT", "/api/v1/admin/quota/groups/default/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequest(t, "GET", "/api/v1/admin/quota/groups/default/users").AddTokenAuth(adminToken)
|
|
resp := adminSession.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q []api.User
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Len(t, q, 1)
|
|
assert.Equal(t, username, q[0].UserName)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/admin/quota/groups/does-not-exist/users").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("adminSetUserQuotaGroups", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
defer createQuotaGroup(t, "default")()
|
|
defer createQuotaGroup(t, "test-1")()
|
|
defer createQuotaGroup(t, "test-2")()
|
|
|
|
req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/admin/users/%s/quota/groups", username), api.SetUserQuotaGroupsOptions{
|
|
Groups: &[]string{"default", "test-1", "test-2"},
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: username})
|
|
|
|
groups, err := quota_model.GetGroupsForUser(db.DefaultContext, user.ID)
|
|
require.NoError(t, err)
|
|
assert.Len(t, groups, 3)
|
|
|
|
t.Run("unhappy path", func(t *testing.T) {
|
|
t.Run("non-existing user", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/admin/users/does-not-exist/quota/groups", api.SetUserQuotaGroupsOptions{
|
|
Groups: &[]string{"default", "test-1", "test-2"},
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("non-existing group", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/admin/users/%s/quota/groups", username), api.SetUserQuotaGroupsOptions{
|
|
Groups: &[]string{"default", "test-1", "test-2", "this-group-does-not-exist"},
|
|
}).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
})
|
|
})
|
|
})
|
|
}
|
|
|
|
func TestAPIQuotaUserRoutes(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.Quota.Enabled, true)()
|
|
defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
|
|
adminSession := loginUser(t, admin.Name)
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeAll)
|
|
|
|
// Create a test user
|
|
username := "quota-test-user-routes"
|
|
defer apiCreateUser(t, username)()
|
|
session := loginUser(t, username)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeAll)
|
|
|
|
// Set up rules & groups for the user
|
|
defer createQuotaGroup(t, "user-routes-deny")()
|
|
defer createQuotaGroup(t, "user-routes-1kb")()
|
|
|
|
zero := int64(0)
|
|
ruleDenyAll := api.CreateQuotaRuleOptions{
|
|
Name: "user-routes-deny-all",
|
|
Limit: &zero,
|
|
Subjects: []string{"size:all"},
|
|
}
|
|
defer createQuotaRule(t, ruleDenyAll)()
|
|
oneKb := int64(1024)
|
|
rule1KbStuff := api.CreateQuotaRuleOptions{
|
|
Name: "user-routes-1kb",
|
|
Limit: &oneKb,
|
|
Subjects: []string{"size:assets:attachments:releases", "size:assets:packages:all", "size:git:lfs"},
|
|
}
|
|
defer createQuotaRule(t, rule1KbStuff)()
|
|
|
|
req := NewRequest(t, "PUT", "/api/v1/admin/quota/groups/user-routes-deny/rules/user-routes-deny-all").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
req = NewRequest(t, "PUT", "/api/v1/admin/quota/groups/user-routes-1kb/rules/user-routes-1kb").AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
req = NewRequestf(t, "PUT", "/api/v1/admin/quota/groups/user-routes-deny/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
req = NewRequestf(t, "PUT", "/api/v1/admin/quota/groups/user-routes-1kb/users/%s", username).AddTokenAuth(adminToken)
|
|
adminSession.MakeRequest(t, req, http.StatusNoContent)
|
|
|
|
t.Run("userGetQuota", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", "/api/v1/user/quota").AddTokenAuth(token)
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
var q api.QuotaInfo
|
|
DecodeJSON(t, resp, &q)
|
|
|
|
assert.Len(t, q.Groups, 2)
|
|
assert.Len(t, q.Groups[0].Rules, 1)
|
|
assert.Len(t, q.Groups[1].Rules, 1)
|
|
})
|
|
}
|