pygitweb 0.1.0__py3-none-any.whl

pygitweb/change_queue_routes_test.py

@@ -0,0 +1,146 @@
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Generator
+from pathlib import Path
+from unittest.mock import patch
+
+import httpx
+import pygit2
+import pytest
+from httpx import ASGITransport
+
+from pygitweb.change_queue import CHANGE_QUEUE
+from pygitweb.config import settings
+from pygitweb.main import app
+
+
+def _create_initial_commit(repo: pygit2.Repository, repo_dir: Path) -> None:
+	(repo_dir / "README.md").write_text("seed\n", encoding="utf-8")
+	index = repo.index
+	index.add("README.md")
+	index.write()
+	tree = index.write_tree()
+	sig = pygit2.Signature("tester", "tester@example.com")
+	repo.create_commit("HEAD", sig, sig, "initial", tree, [])
+
+
+@pytest.fixture(scope="module")
+def updates_env(tmp_path_factory: pytest.TempPathFactory) -> Generator[dict[str, str], None, None]:
+	root: Path = tmp_path_factory.mktemp("updates-routes")
+	alpha_dir: Path = root / "alpha"
+	alpha_dir.mkdir()
+	_create_initial_commit(pygit2.init_repository(str(alpha_dir), bare=False), alpha_dir)
+	beta_dir: Path = root / "group" / "beta"
+	beta_dir.mkdir(parents=True)
+	_create_initial_commit(pygit2.init_repository(str(beta_dir), bare=False), beta_dir)
+	with (
+		patch.object(settings, "PROJECTROOT", str(root)),
+		patch.object(settings, "PROJECTS_LIST", str(root)),
+		patch.object(settings, "PROJECT_MAXDEPTH", 3),
+		patch.object(settings, "STRICT_EXPORT", False),
+		patch.object(settings, "EXPORT_OK", ""),
+		patch.object(settings, "LIST_ALL", True),
+		patch.object(settings, "AUTH", False),
+		patch.object(settings, "MAXLOAD", None),
+	):
+		yield {"root": str(root), "alpha": "alpha", "beta": "group/beta"}
+
+
+def _client() -> httpx.AsyncClient:
+	return httpx.AsyncClient(transport=ASGITransport(app=app), base_url="http://test")
+
+
+class TestUpdatesLongPoll:
+	def test_updates_returns_200_empty_after_timeout(self, updates_env: dict[str, str]) -> None:
+		async def scenario() -> tuple[int, bytes]:
+			async with _client() as client:
+				with patch.object(CHANGE_QUEUE, "DEFAULT_TIMEOUT_SECONDS", 0.05):
+					resp = await client.get(
+						f"/project/{updates_env['alpha']}",
+						params={"a": "log", "updates": "true"},
+					)
+				return resp.status_code, resp.content
+
+		status, body = asyncio.run(scenario())
+		assert status == 200
+		assert body == b""
+
+	def test_updates_returns_200_empty_when_shutting_down(self, updates_env: dict[str, str]) -> None:
+		async def scenario() -> tuple[int, bytes]:
+			async with _client() as client:
+				app.state.shutting_down = True
+				try:
+					resp = await client.get(
+						f"/project/{updates_env['alpha']}",
+						params={"a": "log", "updates": "true"},
+					)
+					return resp.status_code, resp.content
+				finally:
+					app.state.shutting_down = False
+
+		status, body = asyncio.run(scenario())
+		assert status == 200
+		assert body == b""
+
+	def test_updates_returns_data_after_notify(self, updates_env: dict[str, str]) -> None:
+		async def scenario() -> tuple[int, str]:
+			async with _client() as client:
+				poll: asyncio.Task[httpx.Response] = asyncio.create_task(
+					client.get(
+						f"/project/{updates_env['alpha']}",
+						params={"a": "log", "updates": "true"},
+					)
+				)
+				await asyncio.sleep(0.05)
+				notify_resp = await client.post(
+					"/_internal/notify",
+					params={"project": updates_env["alpha"]},
+				)
+				assert notify_resp.status_code == 200
+				assert notify_resp.json()["waiters_woken"] == 1
+				resp: httpx.Response = await poll
+				return resp.status_code, resp.text
+
+		status, body = asyncio.run(scenario())
+		assert status == 200
+		assert "Log" in body
+
+	def test_updates_with_pf_wakes_on_any_matching_project(self, updates_env: dict[str, str]) -> None:
+		async def scenario() -> int:
+			async with _client() as client:
+				poll: asyncio.Task[httpx.Response] = asyncio.create_task(
+					client.get(
+						f"/project/{updates_env['alpha']}",
+						params={"a": "heads", "updates": "true", "pf": "group"},
+					)
+				)
+				await asyncio.sleep(0.05)
+				notify_resp = await client.post(
+					"/_internal/notify",
+					params={"project": updates_env["beta"]},
+				)
+				assert notify_resp.status_code == 200
+				assert notify_resp.json()["waiters_woken"] == 1
+				return (await poll).status_code
+
+		assert asyncio.run(scenario()) == 200
+
+	def test_updates_rejected_for_unsupported_action(self, updates_env: dict[str, str]) -> None:
+		async def scenario() -> int:
+			async with _client() as client:
+				resp = await client.get(
+					f"/project/{updates_env['alpha']}",
+					params={"a": "tree", "updates": "true"},
+				)
+				return resp.status_code
+
+		assert asyncio.run(scenario()) == 400
+
+	def test_notify_unknown_project_returns_404(self, updates_env: dict[str, str]) -> None:
+		async def scenario() -> int:
+			async with _client() as client:
+				resp = await client.post("/_internal/notify", params={"project": "no-such-project"})
+				return resp.status_code
+
+		assert asyncio.run(scenario()) == 404

pygitweb/change_queue_test.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+import asyncio
+
+from pygitweb.change_queue import ChangeQueue
+
+
+class TestChangeQueue:
+	def test_notify_wakes_waiter_with_project_name(self) -> None:
+		async def scenario() -> tuple[int, str | None, int]:
+			queue: ChangeQueue = ChangeQueue()
+			waiter: asyncio.Task[str | None] = asyncio.create_task(queue.wait_for_changes(["alpha"], timeout=2.0))
+			await asyncio.sleep(0)
+			woken: int = await queue.notify("alpha")
+			result: str | None = await waiter
+			leftover: int = await queue.waiter_count()
+			return woken, result, leftover
+
+		woken, result, leftover = asyncio.run(scenario())
+		assert woken == 1
+		assert result == "alpha"
+		assert leftover == 0
+
+	def test_wait_returns_none_on_timeout(self) -> None:
+		async def scenario() -> tuple[str | None, int]:
+			queue: ChangeQueue = ChangeQueue()
+			outcome: str | None = await queue.wait_for_changes(["alpha"], timeout=0.05)
+			leftover: int = await queue.waiter_count("alpha")
+			return outcome, leftover
+
+		outcome, leftover = asyncio.run(scenario())
+		assert outcome is None
+		assert leftover == 0
+
+	def test_notify_only_wakes_subscribed_waiters(self) -> None:
+		async def scenario() -> tuple[int, str | None]:
+			queue: ChangeQueue = ChangeQueue()
+			waiter: asyncio.Task[str | None] = asyncio.create_task(queue.wait_for_changes(["alpha"], timeout=0.2))
+			await asyncio.sleep(0)
+			woken: int = await queue.notify("beta")
+			outcome: str | None = await waiter
+			return woken, outcome
+
+		woken, outcome = asyncio.run(scenario())
+		assert woken == 0
+		assert outcome is None
+
+	def test_wait_for_multiple_projects_wakes_on_any(self) -> None:
+		async def scenario() -> tuple[str | None, int]:
+			queue: ChangeQueue = ChangeQueue()
+			waiter: asyncio.Task[str | None] = asyncio.create_task(
+				queue.wait_for_changes(["alpha", "group/beta"], timeout=2.0)
+			)
+			await asyncio.sleep(0)
+			await queue.notify("group/beta")
+			outcome: str | None = await waiter
+			leftover: int = await queue.waiter_count()
+			return outcome, leftover
+
+		outcome, leftover = asyncio.run(scenario())
+		assert outcome == "group/beta"
+		assert leftover == 0
+
+	def test_notify_returns_zero_when_no_waiters(self) -> None:
+		async def scenario() -> int:
+			queue: ChangeQueue = ChangeQueue()
+			return await queue.notify("alpha")
+
+		assert asyncio.run(scenario()) == 0
+
+	def test_wait_returns_none_when_shutdown_event_set(self) -> None:
+		async def scenario() -> str | None:
+			queue: ChangeQueue = ChangeQueue()
+			sd: asyncio.Event = asyncio.Event()
+			sd.set()
+			return await queue.wait_for_changes(["alpha"], timeout=2.0, shutdown_event=sd)
+
+		assert asyncio.run(scenario()) is None
+
+	def test_wait_returns_none_when_shutdown_beats_notify(self) -> None:
+		async def scenario() -> str | None:
+			queue: ChangeQueue = ChangeQueue()
+			sd: asyncio.Event = asyncio.Event()
+			waiter: asyncio.Task[str | None] = asyncio.create_task(
+				queue.wait_for_changes(["alpha"], timeout=2.0, shutdown_event=sd)
+			)
+			await asyncio.sleep(0)
+			sd.set()
+			return await waiter
+
+		assert asyncio.run(scenario()) is None

pygitweb/comments_permissions_test.py

@@ -0,0 +1,140 @@
+from __future__ import annotations
+
+from collections.abc import Generator
+from pathlib import Path
+from unittest.mock import patch
+
+import pygit2
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from pygittools.tasks import BOARD_REF_PREFIX, TASK_REF_PREFIX, Board, Task
+from pygitweb.auth_config import AuthConfig, LocalUser
+from pygitweb.config import settings
+from pygitweb.conftest import client_as_user
+from pygitweb.permissions import Permission, PermissionsMap, permission_key
+from pygitweb.tasks import EMPTY_TREE_OID, comment_router
+
+_COMMENTS_AUTH = AuthConfig(
+	auth_mode="local",
+	local_users=[LocalUser(user="admin", password="secret"), LocalUser(user="viewer", password="secret")],
+	oauth_permissions=PermissionsMap.model_validate({
+		"*": [],
+		permission_key(Permission.COMMENTS, "demo"): ["viewer"],
+		permission_key(Permission.TASKS, "demo"): ["admin"],
+	}),
+)
+
+
+def _build_client() -> TestClient:
+	app = FastAPI()
+	app.include_router(comment_router, prefix="/comments")
+	return TestClient(app)
+
+
+def _create_initial_commit(repo: pygit2.Repository, repo_dir: Path) -> None:
+	(repo_dir / "README.md").write_text("seed\n", encoding="utf-8")
+	index = repo.index
+	index.add("README.md")
+	index.write()
+	tree = index.write_tree()
+	sig = pygit2.Signature("tester", "tester@example.com")
+	repo.create_commit("HEAD", sig, sig, "initial", tree, [])
+
+
+@pytest.fixture
+def comment_env(tmp_path: Path) -> Generator[dict[str, str], None, None]:
+	repo_dir = tmp_path / "demo"
+	repo = pygit2.init_repository(str(repo_dir), bare=False)
+	_create_initial_commit(repo, repo_dir)
+	board_ref = f"{BOARD_REF_PREFIX}Tasks"
+	board = Board(EMPTY_TREE_OID, board_ref, tagger="", description="")
+	task_ref = f"{TASK_REF_PREFIX}task_1"
+	task = Task(EMPTY_TREE_OID, task_ref, tagger="", title="Task", description="")
+	task_oid = task.write(repo)
+	board.tasks = [str(task_oid)]
+	board.update_message()
+	board.write(repo)
+	with (
+		patch.object(settings, "PROJECTROOT", str(tmp_path)),
+		patch.object(settings, "PROJECTS_LIST", str(tmp_path)),
+		patch.object(settings, "STRICT_EXPORT", False),
+		patch.object(settings, "EXPORT_OK", ""),
+		patch.object(settings, "LIST_ALL", True),
+		patch("pygitweb.auth_config.auth_config", _COMMENTS_AUTH),
+		patch("pygitweb.auth.auth_config", _COMMENTS_AUTH),
+	):
+		client = _build_client()
+		yield {
+			"client": client,
+			"project": "demo",
+			"board": "Tasks",
+			"task": task_ref,
+		}
+
+
+def test_comment_create_open_when_auth_disabled(comment_env: dict[str, str]) -> None:
+	client = comment_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", False):
+		r = client.post(
+			"/comments/create",
+			params={
+				"project": comment_env["project"],
+				"board": comment_env["board"],
+				"task": comment_env["task"],
+				"content": "note",
+			},
+		)
+	assert r.status_code == 200
+
+
+def test_comment_create_401_without_login(comment_env: dict[str, str]) -> None:
+	client = comment_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", True):
+		r = client.post(
+			"/comments/create",
+			params={
+				"project": comment_env["project"],
+				"board": comment_env["board"],
+				"task": comment_env["task"],
+				"content": "note",
+			},
+		)
+	assert r.status_code == 401
+
+
+def test_comment_create_allowed_with_comments_grant_only(comment_env: dict[str, str]) -> None:
+	"""User with COMMENTS but not TASKS can add a comment."""
+	client = comment_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", True), client_as_user(client, "viewer"):
+		r = client.post(
+			"/comments/create",
+			params={
+				"project": comment_env["project"],
+				"board": comment_env["board"],
+				"task": comment_env["task"],
+				"content": "from viewer",
+			},
+		)
+	assert r.status_code == 200
+
+
+def test_comment_create_forbidden_without_comments_grant(comment_env: dict[str, str]) -> None:
+	"""User with TASKS but not COMMENTS cannot add a comment."""
+	client = comment_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", True), client_as_user(client, "admin"):
+		r = client.post(
+			"/comments/create",
+			params={
+				"project": comment_env["project"],
+				"board": comment_env["board"],
+				"task": comment_env["task"],
+				"content": "from admin",
+			},
+		)
+	assert r.status_code == 403

pygitweb/config.py

@@ -0,0 +1,185 @@
+"""
+PyGitWeb configuration: env-driven settings via pydantic-settings, constants, and loadavg.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+from pydantic import Field, field_validator, model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+# Actions (most identical to gitweb.perl actions)
+ACTIONS: set[str] = {
+	"blame",
+	"blame_incremental",
+	"blame_data",
+	"blame_raw",
+	"blobdiff",
+	"blobpatch",
+	"blob",
+	"blob_plain",
+	"commitdiff",
+	"commit",
+	"heads",
+	"history",
+	"log",
+	"patch",
+	"patches",
+	"remotes",
+	"rss",
+	"atom",
+	"search",
+	"search_help",
+	"shortlog",
+	"summary",
+	"tag",
+	"tags",
+	"tree",
+	"snapshot",
+	"object",
+	"opml",
+	"project_list",
+	"project_index",
+}
+
+# Map file extension to highlight.js language
+BLOB_LANG: dict[str, str] = {
+	"py": "python",
+	"js": "javascript",
+	"ts": "typescript",
+	"jsx": "javascript",
+	"tsx": "typescript",
+	"html": "html",
+	"htm": "html",
+	"css": "css",
+	"scss": "scss",
+	"json": "json",
+	"md": "markdown",
+	"sh": "bash",
+	"bash": "bash",
+	"yml": "yaml",
+	"yaml": "yaml",
+	"xml": "xml",
+	"go": "go",
+	"rs": "rust",
+	"java": "java",
+	"c": "c",
+	"h": "c",
+	"cpp": "cpp",
+	"cc": "cpp",
+	"cxx": "cpp",
+	"sql": "sql",
+	"r": "r",
+	"rb": "ruby",
+	"php": "php",
+	"swift": "swift",
+	"kt": "kotlin",
+	"vue": "xml",
+	"toml": "toml",
+	"ini": "ini",
+	"cfg": "ini",
+	"dockerfile": "dockerfile",
+}
+
+
+class Settings(BaseSettings):
+	"""
+	Runtime settings from ~/.pygitweb/settings.json (or PYGITWEB_SETTINGS_CONFIG),
+	PYGITWEB_* env vars, and optionally a .env file. On first run the file is created
+	from the environment. When the file exists, env vars override file values (with a warning).
+
+	When AUTH is true, PyGitWeb uses OAuth2 password flow (POST /token), Bearer tokens,
+	and browser login. Local credentials live in the auth JSON file (see PYGITWEB_AUTH_CONFIG).
+
+	If PYGITWEB_AUTH is omitted entirely (or empty), authentication defaults to enabled
+	and a random password is written to the auth config file on first run (see stderr).
+	Set PYGITWEB_AUTH=0 or PYGITWEB_AUTH=1 explicitly as needed.
+	"""
+
+	model_config = SettingsConfigDict(
+		env_prefix="PYGITWEB_",
+		env_file=".env",
+		env_file_encoding="utf-8",
+		case_sensitive=False,
+		validate_assignment=True,
+		extra="ignore",
+	)
+
+	PROJECTROOT: str = Field(default_factory=lambda: str(Path.home()))
+	PROJECTS_LIST: str = ""  # falls back to PROJECTROOT when blank
+	PROJECT_MAXDEPTH: int = 1
+	SITE_NAME: str = "PyGitWeb"
+	EXPORT_OK: str = ""
+	LIST_ALL: bool = True
+	STRICT_EXPORT: bool = False
+	GIT: str = "git"
+	MAXLOAD: float | None = None
+
+	AUTH: bool | None = None
+	AUTH_CONFIG: str = ""
+	SETTINGS_CONFIG: str = ""
+
+	@field_validator("AUTH", mode="before")
+	@classmethod
+	def _coerce_auth(cls, v: object) -> bool | None:
+		if v is None:
+			return None
+		if isinstance(v, str) and v.strip() == "":
+			return None
+		if isinstance(v, bool):
+			return v
+		if isinstance(v, int):
+			return v != 0
+		if isinstance(v, str):
+			s = v.strip().lower()
+			if s in ("none", "false", "0", "no", "off"):
+				return False
+			if s in ("true", "1", "yes", "on"):
+				return True
+			return None
+		return bool(v)
+
+	@model_validator(mode="after")
+	def _defaults(self) -> Settings:
+		if not self.PROJECTS_LIST:
+			self.PROJECTS_LIST = self.PROJECTROOT
+		return self
+
+
+def _finalize_auth_settings(s: Settings) -> None:
+	implicit_auth = s.AUTH is None
+	if implicit_auth:
+		s.AUTH = True
+	if implicit_auth and s.AUTH:
+		cfg_path = Path(s.AUTH_CONFIG).expanduser() if s.AUTH_CONFIG else Path.home() / ".pygitweb" / "auth.json"
+		print(
+			"WARNING: PyGitWeb: PYGITWEB_AUTH was not set; authentication defaults to ON.\n"
+			"         Set PYGITWEB_AUTH=0 to disable, or PYGITWEB_AUTH=1 and configure "
+			f"{cfg_path}.\n",
+			file=sys.stderr,
+		)
+
+
+from pygitweb.settings_config import init_settings  # noqa: E402
+
+settings = init_settings()
+
+from pygitweb.auth_config import init_auth_config  # noqa: E402
+
+auth_config = init_auth_config(settings)
+
+
+def get_loadavg() -> float:
+	"""First element of load average, or 0 if unavailable. Port of get_loadavg."""
+	try:
+		return os.getloadavg()[0]
+	except (OSError, AttributeError):
+		pass
+	try:
+		with open("/proc/loadavg") as f:
+			return float(f.read().split()[0])
+	except (OSError, ValueError):
+		return 0.0

pygitweb/conftest.py

@@ -0,0 +1,43 @@
+"""Pytest fixtures for pygitweb (test env vars are set in the repo-root conftest.py)."""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Generator
+from contextlib import contextmanager
+
+import pytest
+from fastapi.testclient import TestClient
+
+
+def clear_client_cookies(client: TestClient) -> None:
+	client.cookies.clear()
+
+
+def set_client_session(client: TestClient, username: str) -> None:
+	from pygitweb.auth import ACCESS_TOKEN_COOKIE_NAME
+	from pygitweb.sessions import create_session
+
+	client.cookies.set(ACCESS_TOKEN_COOKIE_NAME, create_session(username, auth_method="local"))
+
+
+@contextmanager
+def client_as_user(client: TestClient, username: str) -> Generator[None, None, None]:
+	set_client_session(client, username)
+	try:
+		yield
+	finally:
+		clear_client_cookies(client)
+
+
+@pytest.fixture(autouse=True)
+def _reset_pygitweb_app_lifecycle_state() -> None:
+	"""Starlette TestClient lifespan sets shutting_down on exit; httpx ASGITransport never runs lifespan.
+
+	Stale state made long-poll tests see ``shutting_down`` and skip ``wait_for_changes``, so notify woke 0 waiters.
+	"""
+	from pygitweb.main import app
+
+	app.state.shutting_down = False
+	app.state.shutdown_event = asyncio.Event()
+	yield

pygitweb/dependencies.py

@@ -0,0 +1,87 @@
+"""
+FastAPI dependencies for shared request validation (exported repositories, etc.).
+"""
+
+from __future__ import annotations
+
+from typing import Annotated, Any
+
+from fastapi import Depends, Form, HTTPException, Query
+
+from pygitweb.config import settings
+from pygitweb.projects import git_get_projects_list, project_in_list
+from pygitweb.validation import is_valid_project
+
+
+def _visible_projects_list() -> list[dict[str, Any]]:
+	return git_get_projects_list(
+		filter_path="",
+		paranoid=settings.STRICT_EXPORT,
+		export_ok=settings.EXPORT_OK,
+	)
+
+
+def project_visible_in_list(project: str) -> bool:
+	"""True if ``project`` appears in the same listing as the project picker."""
+	return project_in_list(project, _visible_projects_list)
+
+
+def require_valid_project(project: str) -> str:
+	"""Reject empty or unknown project paths (export_ok, strict list, etc.)."""
+	if not project or project == "":
+		raise HTTPException(status_code=400, detail="Project needed")
+	if not is_valid_project(
+		project,
+		settings.PROJECTROOT,
+		settings.EXPORT_OK,
+		settings.STRICT_EXPORT,
+		project_visible_in_list,
+	):
+		raise HTTPException(status_code=404, detail="No such project")
+	return project
+
+
+def require_valid_project_name(name: str) -> str:
+	"""Same as ``require_valid_project`` for a path parameter named ``name``."""
+	return require_valid_project(name)
+
+
+def require_valid_project_from_query(
+	project: Annotated[str, Query(..., description="Project path")],
+) -> str:
+	return require_valid_project(project)
+
+
+def require_valid_project_form(project: Annotated[str, Form()]) -> str:
+	return require_valid_project(project)
+
+
+def require_notify_project(
+	project: Annotated[str | None, Query(alias="project", description="Repository path")] = None,
+) -> str:
+	"""Internal notify: project must appear in the visible list (hook / long-poll contract)."""
+	if not project or not project.strip():
+		raise HTTPException(status_code=400, detail="project query parameter required")
+	p = project.strip()
+	if not project_visible_in_list(p):
+		raise HTTPException(status_code=404, detail="No such project")
+	return p
+
+
+def board_create_resolved_project(
+	p: Annotated[str | None, Query(alias="p")] = None,
+	project: Annotated[str | None, Query(alias="project")] = None,
+) -> str:
+	"""Resolve ``?p=`` / ``?project=`` then validate as a normal project path."""
+	chosen = (project or p or "").strip()
+	if not chosen:
+		raise HTTPException(status_code=400, detail="Project needed (use ?project= or ?p=)")
+	return require_valid_project(chosen)
+
+
+ValidatedPathProject = Annotated[str, Depends(require_valid_project)]
+ValidatedQueryProject = Annotated[str, Depends(require_valid_project_from_query)]
+ValidatedSettingsProject = Annotated[str, Depends(require_valid_project_name)]
+ValidatedBoardCreateProject = Annotated[str, Depends(board_create_resolved_project)]
+ValidatedNotifyProject = Annotated[str, Depends(require_notify_project)]
+ValidatedFormProject = Annotated[str, Depends(require_valid_project_form)]