pygitweb 0.2.0__tar.gz → 0.2.1__tar.gz

{pygitweb-0.2.0 → pygitweb-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pygitweb
-Version: 0.2.0
+Version: 0.2.1
 Summary: Gitweb reimplementation with FastAPI and Pygit2
 License-Expression: MIT
 Requires-Python: >=3.11
@@ -40,7 +40,7 @@ environment variables, and optionally a `.env` file in the working directory via
 
 ## Routes
 
-Load the `/docs` page for a detailed view of routes (below the readme) if in debug mode. 
+Load the `/docs` page for a detailed view of routes (below the readme). 
 
 **No-project routes**
 
@@ -68,8 +68,8 @@ Load the `/docs` page for a detailed view of routes (below the readme) if in deb
 | heads | `updates`, `pf` | `GET /project/{project}?a=heads` | List branch heads. Supports long-poll subscribe. |
 | tags | `updates`, `pf` | `GET /project/{project}?a=tags` | List all tags. Supports long-poll subscribe. |
 | tag | `h` | `GET /project/{project}?a=tag&h=...` | Single tag view (tag ref or hash). |
-| commit | — | `GET /project/{project}?a=commit` | Commit information. |
-| commitdiff | — | `GET /project/{project}?a=commitdiff` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
+| commit | `h` | `GET /project/{project}?a=commit&h=...` | Commit information. |
+| commitdiff | `h` | `GET /project/{project}?a=commitdiff&h=...` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
 | patch | `h` | `GET /project/{project}?a=patch&h=...` | Single-commit patch (plain text). |
 | patches | `h`, `hb` | `GET /project/{project}?a=patches&h=...&hb=...` | Multi-commit patches for range `hb..h` (plain text). |
 | blobdiff | `h`, `hb`, `f`, `fp` | `GET /project/{project}?a=blobdiff&h=...&hb=...&f=...&fp=...` | Blob diff (two versions of a file) rendered with diff2html. |
@@ -120,16 +120,16 @@ subscribe to the project's change queue. The request is held for up to 30 second
   just the URL project (the action is still rendered for the URL project).
 
 The notify endpoint is intended for loopback use by `pygittools` post-receive hooks (see
-`pygittools/hook_samples/post-receive.notify`); production deployments should restrict it
-at the reverse proxy.
+`pygittools/hook_samples/post-receive.notify`). The server enforces loopback-only access and
+rejects unknown projects; production deployments should still restrict it at the reverse proxy.
 
 ## Hook management
 
-The project summary page exposes an **Update Hook** row that installs / removes the
-`update` bundle: `post-receive.notify` (feeds the change queue when refs are pushed) and
-`post-commit.notify` (feeds the change queue when a working clone of this repo records
-a local commit). Either is sufficient to wake long-poll subscribers; installing both
-covers server-side and client-side commit paths.
+The project summary page exposes a **Hooks** row that lists installed hooks and lets you
+install or remove pygittools samples, including the `update` bundle: `post-receive.notify`
+(feeds the change queue when refs are pushed) and `post-commit.notify` (feeds the change
+queue when a working clone of this repo records a local commit). Either is sufficient to
+wake long-poll subscribers; installing both covers server-side and client-side commit paths.
 
 The same operations are available programmatically via
 `POST /project/{name}/hook?name=<sample-or-bundle>&op=<...>`. Bundle status is

{pygitweb-0.2.0 → pygitweb-0.2.1}/README.md

@@ -20,7 +20,7 @@ environment variables, and optionally a `.env` file in the working directory via
 
 ## Routes
 
-Load the `/docs` page for a detailed view of routes (below the readme) if in debug mode. 
+Load the `/docs` page for a detailed view of routes (below the readme). 
 
 **No-project routes**
 
@@ -48,8 +48,8 @@ Load the `/docs` page for a detailed view of routes (below the readme) if in deb
 | heads | `updates`, `pf` | `GET /project/{project}?a=heads` | List branch heads. Supports long-poll subscribe. |
 | tags | `updates`, `pf` | `GET /project/{project}?a=tags` | List all tags. Supports long-poll subscribe. |
 | tag | `h` | `GET /project/{project}?a=tag&h=...` | Single tag view (tag ref or hash). |
-| commit | — | `GET /project/{project}?a=commit` | Commit information. |
-| commitdiff | — | `GET /project/{project}?a=commitdiff` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
+| commit | `h` | `GET /project/{project}?a=commit&h=...` | Commit information. |
+| commitdiff | `h` | `GET /project/{project}?a=commitdiff&h=...` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
 | patch | `h` | `GET /project/{project}?a=patch&h=...` | Single-commit patch (plain text). |
 | patches | `h`, `hb` | `GET /project/{project}?a=patches&h=...&hb=...` | Multi-commit patches for range `hb..h` (plain text). |
 | blobdiff | `h`, `hb`, `f`, `fp` | `GET /project/{project}?a=blobdiff&h=...&hb=...&f=...&fp=...` | Blob diff (two versions of a file) rendered with diff2html. |
@@ -100,16 +100,16 @@ subscribe to the project's change queue. The request is held for up to 30 second
   just the URL project (the action is still rendered for the URL project).
 
 The notify endpoint is intended for loopback use by `pygittools` post-receive hooks (see
-`pygittools/hook_samples/post-receive.notify`); production deployments should restrict it
-at the reverse proxy.
+`pygittools/hook_samples/post-receive.notify`). The server enforces loopback-only access and
+rejects unknown projects; production deployments should still restrict it at the reverse proxy.
 
 ## Hook management
 
-The project summary page exposes an **Update Hook** row that installs / removes the
-`update` bundle: `post-receive.notify` (feeds the change queue when refs are pushed) and
-`post-commit.notify` (feeds the change queue when a working clone of this repo records
-a local commit). Either is sufficient to wake long-poll subscribers; installing both
-covers server-side and client-side commit paths.
+The project summary page exposes a **Hooks** row that lists installed hooks and lets you
+install or remove pygittools samples, including the `update` bundle: `post-receive.notify`
+(feeds the change queue when refs are pushed) and `post-commit.notify` (feeds the change
+queue when a working clone of this repo records a local commit). Either is sufficient to
+wake long-poll subscribers; installing both covers server-side and client-side commit paths.
 
 The same operations are available programmatically via
 `POST /project/{name}/hook?name=<sample-or-bundle>&op=<...>`. Bundle status is

{pygitweb-0.2.0 → pygitweb-0.2.1}/auth_test.py

@@ -1,3 +1,4 @@
+import asyncio
 import json
 import os
 import sys
@@ -6,11 +7,20 @@ from pathlib import Path
 from unittest.mock import AsyncMock, patch
 
 import pytest
+from fastapi import HTTPException
 from fastapi.testclient import TestClient
 
 from pygitweb.auth import ACCESS_TOKEN_COOKIE_NAME
 from pygitweb.auth_config import AuthConfig, LocalUser, init_auth_config, write_auth_config
-from pygitweb.auth_oauth import OAUTH_STATE_COOKIE_NAME, _seal_oauth_state, is_oauth_email_allowed
+from pygitweb.auth_oauth import (
+	OAUTH_STATE_COOKIE_NAME,
+	_exchange_code,
+	_fetch_github_profile,
+	_fetch_google_profile,
+	_fetch_profile,
+	_seal_oauth_state,
+	is_oauth_email_allowed,
+)
 from pygitweb.config import Settings, settings
 from pygitweb.conftest import clear_client_cookies
 from pygitweb.gravatar import gravatar_url
@@ -19,6 +29,19 @@ from pygitweb.password_hash import hash_password, verify_password
 from pygitweb.permissions import PERMISSION_ADD_PROJECTS, PermissionsMap
 from pygitweb.sessions import get_session
 
+
+class _DummyResponse:
+	def __init__(self, payload: object, is_success: bool = True) -> None:
+		self._payload = payload
+		self.is_success = is_success
+
+	def raise_for_status(self) -> None:
+		return None
+
+	def json(self) -> object:
+		return self._payload
+
+
 _LOCAL_ADMIN = AuthConfig(
 	auth_mode="local",
 	local_users=[LocalUser(user="admin", password="secret")],
@@ -388,3 +411,151 @@ def test_authenticate_local_user_pass_hash() -> None:
 	assert user is not None
 	assert user.username == "admin"
 	assert authenticate_local_user("admin", "wrong") is None
+
+
+def test_exchange_code_success(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse({"access_token": "tok", "other": "x"})
+
+	client = AsyncMock()
+	client.post.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			out = await _exchange_code(
+				oauth_auth_config,
+				code="auth-code",
+				code_verifier="verifier",
+			)
+		assert out["access_token"] == "tok"
+
+	asyncio.run(runner())
+
+
+def test_exchange_code_rejects_non_mapping(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse(["not-a-dict"])
+
+	client = AsyncMock()
+	client.post.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _exchange_code(
+				oauth_auth_config,
+				code="auth-code",
+				code_verifier="verifier",
+			)
+
+	asyncio.run(runner())
+
+
+def test_fetch_google_profile_success(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse({"sub": "123", "email": "user@example.com"})
+
+	client = AsyncMock()
+	client.get.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			profile = await _fetch_google_profile("access-token")
+		assert profile["email"] == "user@example.com"
+
+	asyncio.run(runner())
+
+
+def test_fetch_google_profile_rejects_non_mapping(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse("not-a-dict")
+
+	client = AsyncMock()
+	client.get.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _fetch_google_profile("access-token")
+
+	asyncio.run(runner())
+
+
+def test_fetch_github_profile_uses_primary_verified_email() -> None:
+	resp_user = _DummyResponse({"login": "octocat", "email": None})
+	resp_emails = _DummyResponse([
+		{"email": "secondary@example.com", "primary": False, "verified": True},
+		{"email": "primary@example.com", "primary": True, "verified": True},
+	])
+
+	client = AsyncMock()
+	client.get.side_effect = (resp_user, resp_emails)
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			profile = await _fetch_github_profile("access-token")
+		assert profile["email"] == "primary@example.com"
+
+	asyncio.run(runner())
+
+
+def test_fetch_github_profile_rejects_non_mapping() -> None:
+	resp_user = _DummyResponse("not-a-dict")
+
+	client = AsyncMock()
+	client.get.return_value = resp_user
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _fetch_github_profile("access-token")
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_google(oauth_auth_config: AuthConfig) -> None:
+	token_payload = {"access_token": "tok"}
+	profile: dict[str, object] = {"sub": "123"}
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth._fetch_google_profile", new_callable=AsyncMock, return_value=profile):
+			out = await _fetch_profile(oauth_auth_config, token_payload)
+		assert out is profile
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_github() -> None:
+	cfg = _OAUTH_CFG.model_copy(update={"oauth_provider": "github"})
+	token_payload = {"access_token": "tok"}
+	profile: dict[str, object] = {"id": "123"}
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth._fetch_github_profile", new_callable=AsyncMock, return_value=profile):
+			out = await _fetch_profile(cfg, token_payload)
+		assert out is profile
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_missing_access_token(oauth_auth_config: AuthConfig) -> None:
+	async def runner() -> None:
+		with pytest.raises(HTTPException):
+			await _fetch_profile(oauth_auth_config, {})
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_unknown_provider() -> None:
+	cfg = _OAUTH_CFG.model_copy(update={"oauth_provider": "other"})
+
+	async def runner() -> None:
+		with pytest.raises(HTTPException):
+			await _fetch_profile(cfg, {"access_token": "tok"})
+
+	asyncio.run(runner())

{pygitweb-0.2.0 → pygitweb-0.2.1}/main.py

@@ -10,6 +10,7 @@ import os
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from datetime import UTC, datetime
+from importlib.resources import files
 from pathlib import Path
 from typing import Annotated, Literal
 from urllib.parse import quote, urlencode
@@ -163,8 +164,7 @@ async def app_lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 		clear_all_sessions()
 
 
-with open("pygitweb/README.md", encoding="utf-8") as _readme_file:
-	_app_description = _readme_file.read()
+_app_description = (files("pygitweb") / "README.md").read_text(encoding="utf-8")
 
 app = FastAPI(
 	debug=(settings.AUTH is False),

{pygitweb-0.2.0 → pygitweb-0.2.1}/pygitweb.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pygitweb
-Version: 0.2.0
+Version: 0.2.1
 Summary: Gitweb reimplementation with FastAPI and Pygit2
 License-Expression: MIT
 Requires-Python: >=3.11
@@ -40,7 +40,7 @@ environment variables, and optionally a `.env` file in the working directory via
 
 ## Routes
 
-Load the `/docs` page for a detailed view of routes (below the readme) if in debug mode. 
+Load the `/docs` page for a detailed view of routes (below the readme). 
 
 **No-project routes**
 
@@ -68,8 +68,8 @@ Load the `/docs` page for a detailed view of routes (below the readme) if in deb
 | heads | `updates`, `pf` | `GET /project/{project}?a=heads` | List branch heads. Supports long-poll subscribe. |
 | tags | `updates`, `pf` | `GET /project/{project}?a=tags` | List all tags. Supports long-poll subscribe. |
 | tag | `h` | `GET /project/{project}?a=tag&h=...` | Single tag view (tag ref or hash). |
-| commit | — | `GET /project/{project}?a=commit` | Commit information. |
-| commitdiff | — | `GET /project/{project}?a=commitdiff` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
+| commit | `h` | `GET /project/{project}?a=commit&h=...` | Commit information. |
+| commitdiff | `h` | `GET /project/{project}?a=commitdiff&h=...` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
 | patch | `h` | `GET /project/{project}?a=patch&h=...` | Single-commit patch (plain text). |
 | patches | `h`, `hb` | `GET /project/{project}?a=patches&h=...&hb=...` | Multi-commit patches for range `hb..h` (plain text). |
 | blobdiff | `h`, `hb`, `f`, `fp` | `GET /project/{project}?a=blobdiff&h=...&hb=...&f=...&fp=...` | Blob diff (two versions of a file) rendered with diff2html. |
@@ -120,16 +120,16 @@ subscribe to the project's change queue. The request is held for up to 30 second
   just the URL project (the action is still rendered for the URL project).
 
 The notify endpoint is intended for loopback use by `pygittools` post-receive hooks (see
-`pygittools/hook_samples/post-receive.notify`); production deployments should restrict it
-at the reverse proxy.
+`pygittools/hook_samples/post-receive.notify`). The server enforces loopback-only access and
+rejects unknown projects; production deployments should still restrict it at the reverse proxy.
 
 ## Hook management
 
-The project summary page exposes an **Update Hook** row that installs / removes the
-`update` bundle: `post-receive.notify` (feeds the change queue when refs are pushed) and
-`post-commit.notify` (feeds the change queue when a working clone of this repo records
-a local commit). Either is sufficient to wake long-poll subscribers; installing both
-covers server-side and client-side commit paths.
+The project summary page exposes a **Hooks** row that lists installed hooks and lets you
+install or remove pygittools samples, including the `update` bundle: `post-receive.notify`
+(feeds the change queue when refs are pushed) and `post-commit.notify` (feeds the change
+queue when a working clone of this repo records a local commit). Either is sufficient to
+wake long-poll subscribers; installing both covers server-side and client-side commit paths.
 
 The same operations are available programmatically via
 `POST /project/{name}/hook?name=<sample-or-bundle>&op=<...>`. Bundle status is

{pygitweb-0.2.0 → pygitweb-0.2.1}/pygitweb.egg-info/SOURCES.txt

@@ -57,6 +57,7 @@ templates_env.py
 timeline_cache.py
 validation.py
 validation_test.py
+./README.md
 ./__init__.py
 ./__meta__.py
 ./actions.py

{pygitweb-0.2.0 → pygitweb-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pygitweb"
-version = "0.2.0"
+version = "0.2.1"
 description = "Gitweb reimplementation with FastAPI and Pygit2"
 readme = "README.md"
 license = "MIT"
@@ -30,7 +30,7 @@ packages = ["pygitweb", "pygitweb.api", "pygitweb.api.plugins"]
 pygitweb = "."
 
 [tool.setuptools.package-data]
-pygitweb = ["templates/**/*", "static/**/*", "*.schema.json"]
+pygitweb = ["README.md", "templates/**/*", "static/**/*", "*.schema.json"]
 
 [tool.uv.sources]
 pygittools = { workspace = true }