rubygems-update 3.1.6 → 3.3.22

data/test/rubygems/test_gem_commands_signin_command.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
-require 'rubygems/test_case'
-require 'rubygems/commands/signin_command'
-require 'rubygems/installer'
+require_relative "helper"
+require "rubygems/commands/signin_command"
+require "rubygems/installer"
 
 class TestGemCommandsSigninCommand < Gem::TestCase
-
   def setup
     super
 
+    credential_setup
+
     Gem.configuration.rubygems_api_key = nil
     Gem.configuration.api_keys.clear
 
@@ -15,36 +16,43 @@ class TestGemCommandsSigninCommand < Gem::TestCase
   end
 
   def teardown
-    credentials_path = Gem.configuration.credentials_path
-    File.delete(credentials_path)  if File.exist?(credentials_path)
+    credential_teardown
+
     super
   end
 
   def test_execute_when_not_already_signed_in
-    sign_in_ui = util_capture() { @cmd.execute }
+    sign_in_ui = util_capture { @cmd.execute }
+    assert_match %r{Signed in.}, sign_in_ui.output
+  end
+
+  def test_execute_when_not_already_signed_in_and_not_preexisting_credentials_folder
+    FileUtils.rm Gem.configuration.credentials_path
+
+    sign_in_ui = util_capture { @cmd.execute }
     assert_match %r{Signed in.}, sign_in_ui.output
   end
 
   def test_execute_when_already_signed_in_with_same_host
-    host = 'http://some-gemcutter-compatible-host.org'
+    host = "http://some-gemcutter-compatible-host.org"
 
     util_capture(nil, host) { @cmd.execute }
-    old_credentials = YAML.load_file Gem.configuration.credentials_path
+    old_credentials = load_yaml_file Gem.configuration.credentials_path
 
     util_capture(nil, host) { @cmd.execute }
-    new_credentials = YAML.load_file Gem.configuration.credentials_path
+    new_credentials = load_yaml_file Gem.configuration.credentials_path
 
     assert_equal old_credentials[host], new_credentials[host]
   end
 
   def test_execute_when_already_signed_in_with_different_host
-    api_key = 'a5fdbb6ba150cbb83aad2bb2fede64cf04045xxxx'
+    api_key = "a5fdbb6ba150cbb83aad2bb2fede64cf04045xxxx"
 
     util_capture(nil, nil, api_key) { @cmd.execute }
-    host = 'http://some-gemcutter-compatible-host.org'
+    host = "http://some-gemcutter-compatible-host.org"
 
     util_capture(nil, host, api_key) { @cmd.execute }
-    credentials = YAML.load_file Gem.configuration.credentials_path
+    credentials = load_yaml_file Gem.configuration.credentials_path
 
     assert_equal credentials[:rubygems_api_key], api_key
 
@@ -52,42 +60,169 @@ class TestGemCommandsSigninCommand < Gem::TestCase
   end
 
   def test_execute_with_host_supplied
-    host = 'http://some-gemcutter-compatible-host.org'
+    host = "http://some-gemcutter-compatible-host.org"
 
     sign_in_ui = util_capture(nil, host) { @cmd.execute }
     assert_match %r{Enter your #{host} credentials.}, sign_in_ui.output
     assert_match %r{Signed in.}, sign_in_ui.output
 
-    api_key     = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    credentials = YAML.load_file Gem.configuration.credentials_path
+    api_key     = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903"
+    credentials = load_yaml_file Gem.configuration.credentials_path
     assert_equal api_key, credentials[host]
   end
 
   def test_execute_with_valid_creds_set_for_default_host
-    util_capture {@cmd.execute}
+    util_capture { @cmd.execute }
+
+    api_key     = "a5fdbb6ba150cbb83aad2bb2fede64cf040453903"
+    credentials = load_yaml_file Gem.configuration.credentials_path
+
+    assert_equal api_key, credentials[:rubygems_api_key]
+  end
+
+  def test_execute_with_key_name_and_scope
+    email     = "you@example.com"
+    password  = "secret"
+    api_key   = "1234"
+    fetcher   = Gem::RemoteFetcher.fetcher
+
+    key_name_ui = Gem::MockGemUi.new "#{email}\n#{password}\ntest-key\n\ny\n\n\n\n\n\n"
+    util_capture(key_name_ui, nil, api_key, fetcher) { @cmd.execute }
+
+    user = ENV["USER"] || ENV["USERNAME"]
 
-    api_key     = 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    credentials = YAML.load_file Gem.configuration.credentials_path
+    assert_match "API Key name [#{Socket.gethostname}-#{user}", key_name_ui.output
+    assert_match "index_rubygems [yN]", key_name_ui.output
+    assert_match "push_rubygem [yN]", key_name_ui.output
+    assert_match "yank_rubygem [yN]", key_name_ui.output
+    assert_match "add_owner [yN]", key_name_ui.output
+    assert_match "remove_owner [yN]", key_name_ui.output
+    assert_match "access_webhooks [yN]", key_name_ui.output
+    assert_match "show_dashboard [yN]", key_name_ui.output
+    assert_equal "name=test-key&push_rubygem=true", fetcher.last_request.body
 
+    credentials = load_yaml_file Gem.configuration.credentials_path
     assert_equal api_key, credentials[:rubygems_api_key]
   end
 
+  def test_execute_with_key_name_scope_and_mfa_level_of_ui_only
+    email     = "you@example.com"
+    password  = "secret"
+    api_key   = "1234"
+    fetcher   = Gem::RemoteFetcher.fetcher
+    mfa_level = "ui_only"
+
+    key_name_ui = Gem::MockGemUi.new "#{email}\n#{password}\ntest-key\n\ny\n\n\n\n\n\ny"
+    util_capture(key_name_ui, nil, api_key, fetcher, mfa_level) { @cmd.execute }
+
+    user = ENV["USER"] || ENV["USERNAME"]
+
+    assert_match "API Key name [#{Socket.gethostname}-#{user}", key_name_ui.output
+    assert_match "index_rubygems [yN]", key_name_ui.output
+    assert_match "push_rubygem [yN]", key_name_ui.output
+    assert_match "yank_rubygem [yN]", key_name_ui.output
+    assert_match "add_owner [yN]", key_name_ui.output
+    assert_match "remove_owner [yN]", key_name_ui.output
+    assert_match "access_webhooks [yN]", key_name_ui.output
+    assert_match "show_dashboard [yN]", key_name_ui.output
+    assert_match "Would you like to enable MFA for this key? (strongly recommended) [yn]", key_name_ui.output
+    assert_equal "name=test-key&push_rubygem=true&mfa=true", fetcher.last_request.body
+
+    credentials = load_yaml_file Gem.configuration.credentials_path
+    assert_equal api_key, credentials[:rubygems_api_key]
+  end
+
+  def test_execute_with_key_name_scope_and_mfa_level_of_gem_signin
+    email     = "you@example.com"
+    password  = "secret"
+    api_key   = "1234"
+    fetcher   = Gem::RemoteFetcher.fetcher
+    mfa_level = "ui_and_gem_signin"
+
+    key_name_ui = Gem::MockGemUi.new "#{email}\n#{password}\ntest-key\n\ny\n\n\n\n\n\ny"
+    util_capture(key_name_ui, nil, api_key, fetcher, mfa_level) { @cmd.execute }
+
+    user = ENV["USER"] || ENV["USERNAME"]
+
+    assert_match "API Key name [#{Socket.gethostname}-#{user}", key_name_ui.output
+    assert_match "index_rubygems [yN]", key_name_ui.output
+    assert_match "push_rubygem [yN]", key_name_ui.output
+    assert_match "yank_rubygem [yN]", key_name_ui.output
+    assert_match "add_owner [yN]", key_name_ui.output
+    assert_match "remove_owner [yN]", key_name_ui.output
+    assert_match "access_webhooks [yN]", key_name_ui.output
+    assert_match "show_dashboard [yN]", key_name_ui.output
+    assert_match "Would you like to enable MFA for this key? (strongly recommended) [yn]", key_name_ui.output
+    assert_equal "name=test-key&push_rubygem=true&mfa=true", fetcher.last_request.body
+
+    credentials = load_yaml_file Gem.configuration.credentials_path
+    assert_equal api_key, credentials[:rubygems_api_key]
+  end
+
+  def test_execute_with_warnings
+    email     = "you@example.com"
+    password  = "secret"
+    api_key   = "1234"
+    fetcher   = Gem::RemoteFetcher.fetcher
+    mfa_level = "disabled"
+    warning   = "/[WARNING/] For protection of your account and gems"
+
+    key_name_ui = Gem::MockGemUi.new "#{email}\n#{password}\ntest-key\n\ny\n\n\n\n\n\ny"
+    util_capture(key_name_ui, nil, api_key, fetcher, mfa_level, warning) { @cmd.execute }
+
+    assert_match warning, key_name_ui.output
+  end
+
+  def test_execute_on_gemserver_without_profile_me_endpoint
+    host = "http://some-gemcutter-compatible-host.org"
+
+    email     = "you@example.com"
+    password  = "secret"
+    api_key   = "1234"
+    fetcher   = Gem::RemoteFetcher.fetcher
+
+    key_name_ui = Gem::MockGemUi.new "#{email}\n#{password}\ntest-key\n\ny\n\n\n\n\n\ny"
+
+    # Set the expected response for the Web-API supplied
+    ENV["RUBYGEMS_HOST"]       = host
+    data_key                   = "#{ENV['RUBYGEMS_HOST']}/api/v1/api_key"
+    fetcher.data[data_key]     = [api_key, 200, "OK"]
+
+    use_ui key_name_ui do
+      @cmd.execute
+    end
+
+    user = ENV["USER"] || ENV["USERNAME"]
+
+    assert_match "API Key name [#{Socket.gethostname}-#{user}", key_name_ui.output
+    assert_match "index_rubygems [yN]", key_name_ui.output
+    assert_match "push_rubygem [yN]", key_name_ui.output
+    assert_match "yank_rubygem [yN]", key_name_ui.output
+    assert_match "add_owner [yN]", key_name_ui.output
+    assert_match "remove_owner [yN]", key_name_ui.output
+    assert_match "access_webhooks [yN]", key_name_ui.output
+    assert_match "show_dashboard [yN]", key_name_ui.output
+    assert_equal "name=test-key&push_rubygem=true", fetcher.last_request.body
+  end
+
   # Utility method to capture IO/UI within the block passed
 
-  def util_capture(ui_stub = nil, host = nil, api_key = nil)
-    api_key ||= 'a5fdbb6ba150cbb83aad2bb2fede64cf040453903'
-    response  = [api_key, 200, 'OK']
-    email     = 'you@example.com'
-    password  = 'secret'
-    fetcher   = Gem::FakeFetcher.new
+  def util_capture(ui_stub = nil, host = nil, api_key = nil, fetcher = Gem::FakeFetcher.new, mfa_level = "disabled", warning = nil)
+    api_key        ||= "a5fdbb6ba150cbb83aad2bb2fede64cf040453903"
+    response         = [api_key, 200, "OK"]
+    profile_response = [ "mfa: #{mfa_level}\nwarning: #{warning}" , 200, "OK"]
+    email            = "you@example.com"
+    password         = "secret"
 
     # Set the expected response for the Web-API supplied
-    ENV['RUBYGEMS_HOST']       = host || Gem::DEFAULT_HOST
+    ENV["RUBYGEMS_HOST"]       = host || Gem::DEFAULT_HOST
     data_key                   = "#{ENV['RUBYGEMS_HOST']}/api/v1/api_key"
     fetcher.data[data_key]     = response
+    profile                    = "#{ENV['RUBYGEMS_HOST']}/api/v1/profile/me.yaml"
+    fetcher.data[profile]      = profile_response
     Gem::RemoteFetcher.fetcher = fetcher
 
-    sign_in_ui = ui_stub || Gem::MockGemUi.new("#{email}\n#{password}\n")
+    sign_in_ui = ui_stub || Gem::MockGemUi.new("#{email}\n#{password}\n\n\n\n\n\n\n\n\n")
 
     use_ui sign_in_ui do
       yield
@@ -95,5 +230,4 @@ class TestGemCommandsSigninCommand < Gem::TestCase
 
     sign_in_ui
   end
-
 end

data/test/rubygems/test_gem_commands_signout_command.rb

@@ -1,21 +1,15 @@
 # frozen_string_literal: true
 
-require 'rubygems/test_case'
-require 'rubygems/commands/signout_command'
-require 'rubygems/installer'
+require_relative "helper"
+require "rubygems/commands/signout_command"
+require "rubygems/installer"
 
 class TestGemCommandsSignoutCommand < Gem::TestCase
-
   def setup
     super
     @cmd = Gem::Commands::SignoutCommand.new
   end
 
-  def teardown
-    super
-    File.delete Gem.configuration.credentials_path if File.exist?(Gem.configuration.credentials_path)
-  end
-
   def test_execute_when_user_is_signed_in
     FileUtils.mkdir_p File.dirname(Gem.configuration.credentials_path)
     FileUtils::touch Gem.configuration.credentials_path
@@ -33,5 +27,4 @@ class TestGemCommandsSignoutCommand < Gem::TestCase
 
     assert_match %r{You are not currently signed in}, @sign_out_ui.error
   end
-
 end

data/test/rubygems/test_gem_commands_sources_command.rb

@@ -1,9 +1,8 @@
 # frozen_string_literal: true
-require 'rubygems/test_case'
-require 'rubygems/commands/sources_command'
+require_relative "helper"
+require "rubygems/commands/sources_command"
 
 class TestGemCommandsSourcesCommand < Gem::TestCase
-
   def setup
     super
 
@@ -21,7 +20,7 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
   end
 
   def test_initialize_proxy
-    assert @cmd.handles?(['--http-proxy', 'http://proxy.example.com'])
+    assert @cmd.handles?(["--http-proxy", "http://proxy.example.com"])
   end
 
   def test_execute
@@ -38,12 +37,12 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_add
     spec_fetcher do |fetcher|
-      fetcher.spec 'a', 1
+      fetcher.spec "a", 1
     end
 
     specs = Gem::Specification.map do |spec|
@@ -71,7 +70,7 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_add_allow_typo_squatting_source
@@ -108,6 +107,36 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
     assert_empty ui.error
   end
 
+  def test_execute_add_allow_typo_squatting_source_forced
+    rubygems_org = "https://rubyems.org"
+
+    spec_fetcher do |fetcher|
+      fetcher.spec("a", 1)
+    end
+
+    specs = Gem::Specification.map do |spec|
+      [spec.name, spec.version, spec.original_platform]
+    end
+
+    specs_dump_gz = StringIO.new
+    Zlib::GzipWriter.wrap(specs_dump_gz) do |io|
+      Marshal.dump(specs, io)
+    end
+
+    @fetcher.data["#{rubygems_org}/specs.#{@marshal_version}.gz"] = specs_dump_gz.string
+    @cmd.handle_options %W[--force --add #{rubygems_org}]
+
+    @cmd.execute
+
+    expected = "https://rubyems.org added to sources\n"
+    assert_equal expected, ui.output
+
+    source = Gem::Source.new(rubygems_org)
+    assert Gem.sources.include?(source)
+
+    assert_empty ui.error
+  end
+
   def test_execute_add_deny_typo_squatting_source
     rubygems_org = "https://rubyems.org"
 
@@ -132,8 +161,7 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
     ui = Gem::MockGemUi.new("n")
 
     use_ui ui do
-
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -153,13 +181,13 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
 
     uri = "http://beta-gems.example.com/specs.#{@marshal_version}.gz"
     @fetcher.data[uri] = proc do
-      raise Gem::RemoteFetcher::FetchError.new('it died', uri)
+      raise Gem::RemoteFetcher::FetchError.new("it died", uri)
     end
 
     @cmd.handle_options %w[--add http://beta-gems.example.com]
 
     use_ui @ui do
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -170,7 +198,57 @@ Error fetching http://beta-gems.example.com:
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
+  end
+
+  def test_execute_add_existent_source_invalid_uri
+    spec_fetcher
+
+    uri = "https://u:p@example.com/specs.#{@marshal_version}.gz"
+
+    @cmd.handle_options %w[--add https://u:p@example.com]
+    @fetcher.data[uri] = proc do
+      raise Gem::RemoteFetcher::FetchError.new("it died", uri)
+    end
+
+    use_ui @ui do
+      assert_raise Gem::MockGemUi::TermError do
+        @cmd.execute
+      end
+    end
+
+    expected = <<-EOF
+Error fetching https://u:REDACTED@example.com:
+\tit died (https://u:REDACTED@example.com/specs.#{@marshal_version}.gz)
+    EOF
+
+    assert_equal expected, @ui.output
+    assert_equal "", @ui.error
+  end
+
+  def test_execute_add_existent_source_invalid_uri_with_error_by_chance_including_the_uri_password
+    spec_fetcher
+
+    uri = "https://u:secret@example.com/specs.#{@marshal_version}.gz"
+
+    @cmd.handle_options %w[--add https://u:secret@example.com]
+    @fetcher.data[uri] = proc do
+      raise Gem::RemoteFetcher::FetchError.new("it secretly died", uri)
+    end
+
+    use_ui @ui do
+      assert_raise Gem::MockGemUi::TermError do
+        @cmd.execute
+      end
+    end
+
+    expected = <<-EOF
+Error fetching https://u:REDACTED@example.com:
+\tit secretly died (https://u:REDACTED@example.com/specs.#{@marshal_version}.gz)
+    EOF
+
+    assert_equal expected, @ui.output
+    assert_equal "", @ui.error
   end
 
   def test_execute_add_redundant_source
@@ -189,7 +267,7 @@ source #{@gem_repo} already present in the cache
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_add_redundant_source_trailing_slash
@@ -209,7 +287,7 @@ source #{@gem_repo} already present in the cache
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
 
     # Re-add pre-existing gem source (w/o slash)
     repo_without_slash = "http://gems.example.com"
@@ -226,7 +304,7 @@ http://gems.example.com added to sources
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
 
     # Re-add original gem source (w/ slash)
     @cmd.handle_options %W[--add #{repo_with_slash}]
@@ -243,14 +321,14 @@ source http://gems.example.com/ already present in the cache
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_add_http_rubygems_org
-    http_rubygems_org = 'http://rubygems.org/'
+    http_rubygems_org = "http://rubygems.org/"
 
     spec_fetcher do |fetcher|
-      fetcher.spec 'a', 1
+      fetcher.spec "a", 1
     end
 
     specs = Gem::Specification.map do |spec|
@@ -270,7 +348,7 @@ source http://gems.example.com/ already present in the cache
     ui = Gem::MockGemUi.new "n"
 
     use_ui ui do
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -284,11 +362,41 @@ source http://gems.example.com/ already present in the cache
     assert_empty @ui.error
   end
 
+  def test_execute_add_http_rubygems_org_forced
+    rubygems_org = "http://rubygems.org"
+
+    spec_fetcher do |fetcher|
+      fetcher.spec("a", 1)
+    end
+
+    specs = Gem::Specification.map do |spec|
+      [spec.name, spec.version, spec.original_platform]
+    end
+
+    specs_dump_gz = StringIO.new
+    Zlib::GzipWriter.wrap(specs_dump_gz) do |io|
+      Marshal.dump(specs, io)
+    end
+
+    @fetcher.data["#{rubygems_org}/specs.#{@marshal_version}.gz"] = specs_dump_gz.string
+    @cmd.handle_options %W[--force --add #{rubygems_org}]
+
+    @cmd.execute
+
+    expected = "http://rubygems.org added to sources\n"
+    assert_equal expected, ui.output
+
+    source = Gem::Source.new(rubygems_org)
+    assert Gem.sources.include?(source)
+
+    assert_empty ui.error
+  end
+
   def test_execute_add_https_rubygems_org
-    https_rubygems_org = 'https://rubygems.org/'
+    https_rubygems_org = "https://rubygems.org/"
 
     spec_fetcher do |fetcher|
-      fetcher.spec 'a', 1
+      fetcher.spec "a", 1
     end
 
     specs = Gem::Specification.map do |spec|
@@ -308,7 +416,7 @@ source http://gems.example.com/ already present in the cache
     ui = Gem::MockGemUi.new "n"
 
     use_ui ui do
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -326,7 +434,7 @@ source http://gems.example.com/ already present in the cache
     @cmd.handle_options %w[--add beta-gems.example.com]
 
     use_ui @ui do
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -338,7 +446,7 @@ beta-gems.example.com is not a URI
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_clear_all
@@ -353,10 +461,10 @@ beta-gems.example.com is not a URI
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
 
     dir = Gem.spec_cache_dir
-    refute File.exist?(dir), 'cache dir removed'
+    refute File.exist?(dir), "cache dir removed"
   end
 
   def test_execute_list
@@ -373,7 +481,7 @@ beta-gems.example.com is not a URI
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_remove
@@ -386,7 +494,7 @@ beta-gems.example.com is not a URI
     expected = "#{@gem_repo} removed from sources\n"
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_remove_no_network
@@ -405,14 +513,14 @@ beta-gems.example.com is not a URI
     expected = "#{@gem_repo} removed from sources\n"
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_update
     @cmd.handle_options %w[--update]
 
     spec_fetcher do |fetcher|
-      fetcher.gem 'a', 1
+      fetcher.gem "a", 1
     end
 
     use_ui @ui do
@@ -420,7 +528,6 @@ beta-gems.example.com is not a URI
     end
 
     assert_equal "source cache successfully updated\n", @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
-
 end