pygitweb 0.2.0__tar.gz → 0.2.2__tar.gz

{pygitweb-0.2.0 → pygitweb-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pygitweb
-Version: 0.2.0
+Version: 0.2.2
 Summary: Gitweb reimplementation with FastAPI and Pygit2
 License-Expression: MIT
 Requires-Python: >=3.11
@@ -40,7 +40,7 @@ environment variables, and optionally a `.env` file in the working directory via
 
 ## Routes
 
-Load the `/docs` page for a detailed view of routes (below the readme) if in debug mode. 
+Load the `/docs` page for a detailed view of routes (below the readme). 
 
 **No-project routes**
 
@@ -68,8 +68,8 @@ Load the `/docs` page for a detailed view of routes (below the readme) if in deb
 | heads | `updates`, `pf` | `GET /project/{project}?a=heads` | List branch heads. Supports long-poll subscribe. |
 | tags | `updates`, `pf` | `GET /project/{project}?a=tags` | List all tags. Supports long-poll subscribe. |
 | tag | `h` | `GET /project/{project}?a=tag&h=...` | Single tag view (tag ref or hash). |
-| commit | — | `GET /project/{project}?a=commit` | Commit information. |
-| commitdiff | — | `GET /project/{project}?a=commitdiff` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
+| commit | `h` | `GET /project/{project}?a=commit&h=...` | Commit information. |
+| commitdiff | `h` | `GET /project/{project}?a=commitdiff&h=...` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
 | patch | `h` | `GET /project/{project}?a=patch&h=...` | Single-commit patch (plain text). |
 | patches | `h`, `hb` | `GET /project/{project}?a=patches&h=...&hb=...` | Multi-commit patches for range `hb..h` (plain text). |
 | blobdiff | `h`, `hb`, `f`, `fp` | `GET /project/{project}?a=blobdiff&h=...&hb=...&f=...&fp=...` | Blob diff (two versions of a file) rendered with diff2html. |
@@ -120,16 +120,16 @@ subscribe to the project's change queue. The request is held for up to 30 second
   just the URL project (the action is still rendered for the URL project).
 
 The notify endpoint is intended for loopback use by `pygittools` post-receive hooks (see
-`pygittools/hook_samples/post-receive.notify`); production deployments should restrict it
-at the reverse proxy.
+`pygittools/hook_samples/post-receive.notify`). The server enforces loopback-only access and
+rejects unknown projects; production deployments should still restrict it at the reverse proxy.
 
 ## Hook management
 
-The project summary page exposes an **Update Hook** row that installs / removes the
-`update` bundle: `post-receive.notify` (feeds the change queue when refs are pushed) and
-`post-commit.notify` (feeds the change queue when a working clone of this repo records
-a local commit). Either is sufficient to wake long-poll subscribers; installing both
-covers server-side and client-side commit paths.
+The project summary page exposes a **Hooks** row that lists installed hooks and lets you
+install or remove pygittools samples, including the `update` bundle: `post-receive.notify`
+(feeds the change queue when refs are pushed) and `post-commit.notify` (feeds the change
+queue when a working clone of this repo records a local commit). Either is sufficient to
+wake long-poll subscribers; installing both covers server-side and client-side commit paths.
 
 The same operations are available programmatically via
 `POST /project/{name}/hook?name=<sample-or-bundle>&op=<...>`. Bundle status is

{pygitweb-0.2.0 → pygitweb-0.2.2}/README.md

@@ -20,7 +20,7 @@ environment variables, and optionally a `.env` file in the working directory via
 
 ## Routes
 
-Load the `/docs` page for a detailed view of routes (below the readme) if in debug mode. 
+Load the `/docs` page for a detailed view of routes (below the readme). 
 
 **No-project routes**
 
@@ -48,8 +48,8 @@ Load the `/docs` page for a detailed view of routes (below the readme) if in deb
 | heads | `updates`, `pf` | `GET /project/{project}?a=heads` | List branch heads. Supports long-poll subscribe. |
 | tags | `updates`, `pf` | `GET /project/{project}?a=tags` | List all tags. Supports long-poll subscribe. |
 | tag | `h` | `GET /project/{project}?a=tag&h=...` | Single tag view (tag ref or hash). |
-| commit | — | `GET /project/{project}?a=commit` | Commit information. |
-| commitdiff | — | `GET /project/{project}?a=commitdiff` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
+| commit | `h` | `GET /project/{project}?a=commit&h=...` | Commit information. |
+| commitdiff | `h` | `GET /project/{project}?a=commitdiff&h=...` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
 | patch | `h` | `GET /project/{project}?a=patch&h=...` | Single-commit patch (plain text). |
 | patches | `h`, `hb` | `GET /project/{project}?a=patches&h=...&hb=...` | Multi-commit patches for range `hb..h` (plain text). |
 | blobdiff | `h`, `hb`, `f`, `fp` | `GET /project/{project}?a=blobdiff&h=...&hb=...&f=...&fp=...` | Blob diff (two versions of a file) rendered with diff2html. |
@@ -100,16 +100,16 @@ subscribe to the project's change queue. The request is held for up to 30 second
   just the URL project (the action is still rendered for the URL project).
 
 The notify endpoint is intended for loopback use by `pygittools` post-receive hooks (see
-`pygittools/hook_samples/post-receive.notify`); production deployments should restrict it
-at the reverse proxy.
+`pygittools/hook_samples/post-receive.notify`). The server enforces loopback-only access and
+rejects unknown projects; production deployments should still restrict it at the reverse proxy.
 
 ## Hook management
 
-The project summary page exposes an **Update Hook** row that installs / removes the
-`update` bundle: `post-receive.notify` (feeds the change queue when refs are pushed) and
-`post-commit.notify` (feeds the change queue when a working clone of this repo records
-a local commit). Either is sufficient to wake long-poll subscribers; installing both
-covers server-side and client-side commit paths.
+The project summary page exposes a **Hooks** row that lists installed hooks and lets you
+install or remove pygittools samples, including the `update` bundle: `post-receive.notify`
+(feeds the change queue when refs are pushed) and `post-commit.notify` (feeds the change
+queue when a working clone of this repo records a local commit). Either is sufficient to
+wake long-poll subscribers; installing both covers server-side and client-side commit paths.
 
 The same operations are available programmatically via
 `POST /project/{name}/hook?name=<sample-or-bundle>&op=<...>`. Bundle status is

{pygitweb-0.2.0 → pygitweb-0.2.2}/actions.py

@@ -20,6 +20,7 @@ from fastapi.responses import HTMLResponse, JSONResponse, PlainTextResponse, Res
 from python_ripgrep import PySortMode, PySortModeKind
 from python_ripgrep import search as rg_search
 
+from pygitweb.auth import can_read_branch
 from pygitweb.config import BLOB_LANG, settings
 from pygitweb.formatting import age_string, sanitize, to_utf8
 from pygitweb.git_helpers import (
@@ -972,13 +973,17 @@ def git_history(
 	)
 
 
-def git_heads(project: str) -> HTMLResponse:
+def git_heads(project: str, token: str | None) -> HTMLResponse:
 	"""Heads (branches) list page. Port of git_heads."""
 	heads_list = git_get_heads_list(project)
-	if not heads_list:
+	if settings.AUTH:
+		visible_heads = [(name, ref, oid) for name, ref, oid in heads_list if can_read_branch(project, ref, token)]
+	else:
+		visible_heads = heads_list
+	if not visible_heads:
 		raise HTTPException(status_code=404, detail="No heads found")
 	rows = []
-	for name, _ref, oid in heads_list:
+	for name, _ref, oid in visible_heads:
 		oid_short = oid[:7] if oid else ""
 		commit_link = f"/project/{project}?a=commit&h={quote(oid, safe='')}"
 		tree_link = f"/project/{project}?a=tree&h={quote(oid, safe='')}"

{pygitweb-0.2.0 → pygitweb-0.2.2}/auth.py

@@ -32,7 +32,7 @@ from pygitweb.auth_oauth import OAUTH_STATE_COOKIE_NAME, oauth_router
 from pygitweb.config import settings
 from pygitweb.gravatar import gravatar_url
 from pygitweb.password_hash import verify_password
-from pygitweb.permissions import Permission, PermissionPrincipal
+from pygitweb.permissions import Permission, PermissionPrincipal, has_branch_read_permission
 from pygitweb.projects import git_get_project_owner
 from pygitweb.sessions import create_session, get_session, revoke_session
 from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env
@@ -65,6 +65,23 @@ def principal_from_session(token: str | None) -> PermissionPrincipal | None:
 	return PermissionPrincipal(username=rec.username, email=rec.email)
 
 
+def _anonymous_principal_for_permissions() -> PermissionPrincipal | None:
+	for entry in auth_config.local_users:
+		if getattr(entry, "assume_anonymous", False):
+			return PermissionPrincipal(username=entry.user, email=entry.email)
+	return None
+
+
+def _principal_identity_for_permissions(token: str | None) -> str | None:
+	principal = principal_from_session(token)
+	if principal is not None:
+		return principal.identity
+	anonymous = _anonymous_principal_for_permissions()
+	if anonymous is not None:
+		return anonymous.identity
+	return None
+
+
 def has_permission(
 	permission: Permission,
 	project: str | None = None,
@@ -73,10 +90,10 @@ def has_permission(
 ) -> bool:
 	if not settings.AUTH:
 		return True
-	principal = principal_from_session(token)
-	if principal is None:
+	identity = _principal_identity_for_permissions(token)
+	if identity is None:
 		return False
-	return auth_config.oauth_permissions.has_permission(principal.identity, permission, project)
+	return auth_config.oauth_permissions.has_permission(identity, permission, project)
 
 
 def _owner_matches(project: str, token: str | None) -> bool:
@@ -111,6 +128,17 @@ def can_write_project(project: str, token: str | None) -> bool:
 	return has_permission(Permission.WRITE, project, token=token)
 
 
+def can_read_branch(project: str, ref_name: str, token: str | None) -> bool:
+	if not settings.AUTH:
+		return True
+	if _owner_matches(project, token):
+		return True
+	identity = _principal_identity_for_permissions(token)
+	if identity is None:
+		return False
+	return has_branch_read_permission(auth_config.oauth_permissions, identity, project, ref_name)
+
+
 def ensure_read_project(project: str, token: str | None) -> None:
 	if can_read_project(project, token):
 		return

{pygitweb-0.2.0 → pygitweb-0.2.2}/auth.schema.json

@@ -60,7 +60,7 @@
         "additionalProperties": {
           "type": "array",
           "items": { "type": "string" },
-          "description": "Scoped keys: pgw.read.{scope}, pgw.write.{scope}, pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project path). Principal * matches any authenticated user."
+          "description": "Scoped keys: pgw.read.{scope}, pgw.write.{scope}, pgw.read_branch.{scope}, pgw.write_branch.{scope}, pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project or project/branch path). Principal * matches any authenticated user."
         }
       },
       "local_users": {
@@ -94,6 +94,10 @@
               "type": "string",
               "format": "email",
               "description": "Optional e-mail for Gravatar and permission grants by principal e-mail."
+            },
+            "assume_anonymous": {
+              "type": "boolean",
+              "description": "If true, unauthenticated requests assume this user for read permissions (e.g. public viewer role)."
             }
           }
         }

{pygitweb-0.2.0 → pygitweb-0.2.2}/auth_config.py

@@ -12,14 +12,16 @@ import secrets
 import stat
 import sys
 from pathlib import Path
-from typing import Literal
+from typing import TYPE_CHECKING, Literal
 
 from pydantic import BaseModel, ConfigDict, Field, field_serializer, field_validator
 
-from pygitweb.config import Settings
 from pygitweb.password_hash import hash_password
 from pygitweb.permissions import PermissionsMap
 
+if TYPE_CHECKING:
+	from pygitweb.config import Settings
+
 DEFAULT_AUTH_CONFIG_PATH = Path.home() / ".pygitweb" / "auth.json"
 _AUTH_CONFIG_MODE = 0o600
 
@@ -70,6 +72,7 @@ class LocalUser(BaseModel):
 	password: str | None = Field(default=None, alias="pass", serialization_alias="pass")
 	pass_hash: str = ""
 	email: str | None = None
+	assume_anonymous: bool = False
 
 	@field_validator("email", mode="before")
 	@classmethod
@@ -91,7 +94,7 @@ class AuthConfig(BaseModel):
 	oauth_client_id: str = ""
 	oauth_client_secret: str = ""
 	oauth_redirect_uri: str = ""
-	oauth_username_from: OAuthUsernameFrom = "email"
+	oauth_username_from: OAuthUsernameFrom = "preffered_username"
 	oauth_allowed_emails: list[str] = Field(default_factory=list)
 	oauth_permissions: PermissionsMap = Field(default_factory=PermissionsMap.empty)
 	local_users: list[LocalUser] = Field(default_factory=list)
@@ -132,7 +135,7 @@ def default_auth_config(*, admin_password: str, salt: str) -> AuthConfig:
 		oauth_client_id="",
 		oauth_client_secret="",
 		oauth_redirect_uri="",
-		oauth_username_from="email",
+		oauth_username_from="preffered_username",
 		oauth_allowed_emails=[],
 		oauth_permissions=PermissionsMap.default_access(),
 		local_users=[LocalUser(user="admin", pass_hash=hash_password(admin_password, config_salt=salt))],

{pygitweb-0.2.0 → pygitweb-0.2.2}/auth_oauth.py

@@ -323,10 +323,9 @@ async def oauth_callback(
 	if not is_oauth_email_allowed(auth_config, email):
 		raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Email is not allowed to sign in")
 	username = oauth_username_from_profile(auth_config, profile)
-	subject = _profile_subject(profile)
 	sid = create_session(
 		username,
-		subject=subject,
+		subject=username,
 		email=email,
 		auth_method="oauth",
 	)

{pygitweb-0.2.0 → pygitweb-0.2.2}/auth_test.py

@@ -1,16 +1,29 @@
+import asyncio
 import json
 import os
 import sys
 from collections.abc import Generator
 from pathlib import Path
 from unittest.mock import AsyncMock, patch
+from urllib.parse import parse_qs, urlparse
 
+import httpx
 import pytest
+from fastapi import FastAPI, HTTPException, Request
 from fastapi.testclient import TestClient
+from httpx import ASGITransport
 
 from pygitweb.auth import ACCESS_TOKEN_COOKIE_NAME
 from pygitweb.auth_config import AuthConfig, LocalUser, init_auth_config, write_auth_config
-from pygitweb.auth_oauth import OAUTH_STATE_COOKIE_NAME, _seal_oauth_state, is_oauth_email_allowed
+from pygitweb.auth_oauth import (
+	OAUTH_STATE_COOKIE_NAME,
+	_exchange_code,
+	_fetch_github_profile,
+	_fetch_google_profile,
+	_fetch_profile,
+	_seal_oauth_state,
+	is_oauth_email_allowed,
+)
 from pygitweb.config import Settings, settings
 from pygitweb.conftest import clear_client_cookies
 from pygitweb.gravatar import gravatar_url
@@ -19,12 +32,68 @@ from pygitweb.password_hash import hash_password, verify_password
 from pygitweb.permissions import PERMISSION_ADD_PROJECTS, PermissionsMap
 from pygitweb.sessions import get_session
 
+_REAL_ASYNC_CLIENT = httpx.AsyncClient
+
+
+class _DummyResponse:
+	def __init__(self, payload: object, is_success: bool = True) -> None:
+		self._payload = payload
+		self.is_success = is_success
+
+	def raise_for_status(self) -> None:
+		return None
+
+	def json(self) -> object:
+		return self._payload
+
+
 _LOCAL_ADMIN = AuthConfig(
 	auth_mode="local",
 	local_users=[LocalUser(user="admin", password="secret")],
 )
 
 
+def _build_test_idp_app(
+	email: str = "user@example.com",
+	preferred_username: str = "oauthuser",
+) -> FastAPI:
+	idp = FastAPI()
+
+	@idp.post("/token")
+	async def google_token(request: Request) -> dict[str, str]:
+		form = await request.form()
+		grant_type = str(form.get("grant_type") or "")
+		code = str(form.get("code") or "")
+		if grant_type != "authorization_code" or code != "auth-code":
+			return {"error": "invalid_grant"}
+		return {"access_token": "idp-access-token"}
+
+	@idp.post("/login/oauth/access_token")
+	async def github_token(request: Request) -> dict[str, str]:
+		form = await request.form()
+		code = str(form.get("code") or "")
+		if code != "auth-code":
+			return {"error": "bad_code"}
+		return {"access_token": "idp-access-token"}
+
+	@idp.get("/v1/userinfo")
+	async def google_userinfo() -> dict[str, str]:
+		return {"sub": "oauth-sub-1", "email": email, "preferred_username": preferred_username}
+
+	@idp.get("/user")
+	async def github_user() -> dict[str, object]:
+		return {"id": "123", "login": preferred_username, "email": None}
+
+	@idp.get("/user/emails")
+	async def github_emails() -> list[dict[str, object]]:
+		return [
+			{"email": email, "primary": True, "verified": True},
+			{"email": "other@example.com", "primary": False, "verified": True},
+		]
+
+	return idp
+
+
 @pytest.fixture
 def client() -> Generator[TestClient, None, None]:
 	with TestClient(app) as c:
@@ -271,6 +340,32 @@ def test_oauth_allowed_emails_exact_match() -> None:
 	assert not is_oauth_email_allowed(cfg, "other@example.com")
 
 
+def test_anonymous_user_assumes_local_public_role_for_read_permissions() -> None:
+	from pygitweb.auth import can_read_project
+
+	cfg = AuthConfig(
+		auth_mode="local",
+		local_users=[
+			LocalUser(
+				user="public",
+				password="secret",
+				email="public@example.com",
+				assume_anonymous=True,
+			),
+		],
+		oauth_permissions=PermissionsMap.model_validate({
+			"*": [],
+			"pgw.read.secret": ["public@example.com"],
+		}),
+	)
+	with (
+		patch.object(settings, "AUTH", True),
+		patch("pygitweb.auth.auth_config", cfg),
+	):
+		assert can_read_project("secret", None)
+		assert not can_read_project("other", None)
+
+
 _OAUTH_CFG = AuthConfig(
 	auth_mode="oauth",
 	oauth_provider="google",
@@ -322,15 +417,50 @@ def test_oauth_callback_creates_session(client: TestClient, oauth_auth_config: A
 		assert r.status_code == 303
 		rec = get_session(r.cookies["pygitweb_access_token"])
 		assert rec is not None
-		assert rec.username == "user@example.com"
-		assert rec.subject == "oauth-sub-1"
+		assert rec.username == "oauthuser"
+		assert rec.subject == "oauthuser"
 		assert rec.email == "user@example.com"
 		assert rec.auth_method == "oauth"
-		assert client.get("/users/me").json()["username"] == "user@example.com"
+		assert client.get("/users/me").json()["username"] == "oauthuser"
 		status = client.get("/auth/status").json()
-		assert status["username"] == "user@example.com"
+		assert status["username"] == "oauthuser"
 		assert status["gravatar_url"] == gravatar_url("user@example.com")
-	clear_client_cookies(client)
+		clear_client_cookies(client)
+
+
+def test_oauth_flow_with_asgi_idp(client: TestClient, oauth_auth_config: AuthConfig) -> None:
+	idp_app = _build_test_idp_app()
+
+	async def runner() -> None:
+		transport = ASGITransport(app=idp_app)
+
+		def _idp_client_factory(*_: object, **__: object) -> httpx.AsyncClient:
+			return _REAL_ASYNC_CLIENT(transport=transport, base_url="https://idp.test")
+
+		with (
+			patch.object(settings, "AUTH", True),
+			patch("pygitweb.auth_oauth.httpx.AsyncClient", side_effect=_idp_client_factory),
+		):
+			start = client.get("/auth/oauth/start", params={"next": "/boards"}, follow_redirects=False)
+			assert start.status_code == 303
+			location = start.headers["location"]
+			state_values = parse_qs(urlparse(location).query).get("state", [])
+			assert state_values
+			state = state_values[0]
+			callback = client.get(
+				"/auth/oauth/callback",
+				params={"code": "auth-code", "state": state},
+				follow_redirects=False,
+			)
+			assert callback.status_code == 303
+			rec = get_session(callback.cookies[ACCESS_TOKEN_COOKIE_NAME])
+			assert rec is not None
+			assert rec.username == "oauthuser"
+			assert rec.subject == "oauthuser"
+			assert rec.email == "user@example.com"
+			assert rec.auth_method == "oauth"
+
+	asyncio.run(runner())
 
 
 def test_auth_status_no_gravatar_for_local_login(client: TestClient, local_auth_config: AuthConfig) -> None:
@@ -388,3 +518,151 @@ def test_authenticate_local_user_pass_hash() -> None:
 	assert user is not None
 	assert user.username == "admin"
 	assert authenticate_local_user("admin", "wrong") is None
+
+
+def test_exchange_code_success(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse({"access_token": "tok", "other": "x"})
+
+	client = AsyncMock()
+	client.post.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			out = await _exchange_code(
+				oauth_auth_config,
+				code="auth-code",
+				code_verifier="verifier",
+			)
+		assert out["access_token"] == "tok"
+
+	asyncio.run(runner())
+
+
+def test_exchange_code_rejects_non_mapping(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse(["not-a-dict"])
+
+	client = AsyncMock()
+	client.post.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _exchange_code(
+				oauth_auth_config,
+				code="auth-code",
+				code_verifier="verifier",
+			)
+
+	asyncio.run(runner())
+
+
+def test_fetch_google_profile_success(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse({"sub": "123", "email": "user@example.com"})
+
+	client = AsyncMock()
+	client.get.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			profile = await _fetch_google_profile("access-token")
+		assert profile["email"] == "user@example.com"
+
+	asyncio.run(runner())
+
+
+def test_fetch_google_profile_rejects_non_mapping(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse("not-a-dict")
+
+	client = AsyncMock()
+	client.get.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _fetch_google_profile("access-token")
+
+	asyncio.run(runner())
+
+
+def test_fetch_github_profile_uses_primary_verified_email() -> None:
+	resp_user = _DummyResponse({"login": "octocat", "email": None})
+	resp_emails = _DummyResponse([
+		{"email": "secondary@example.com", "primary": False, "verified": True},
+		{"email": "primary@example.com", "primary": True, "verified": True},
+	])
+
+	client = AsyncMock()
+	client.get.side_effect = (resp_user, resp_emails)
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			profile = await _fetch_github_profile("access-token")
+		assert profile["email"] == "primary@example.com"
+
+	asyncio.run(runner())
+
+
+def test_fetch_github_profile_rejects_non_mapping() -> None:
+	resp_user = _DummyResponse("not-a-dict")
+
+	client = AsyncMock()
+	client.get.return_value = resp_user
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _fetch_github_profile("access-token")
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_google(oauth_auth_config: AuthConfig) -> None:
+	token_payload = {"access_token": "tok"}
+	profile: dict[str, object] = {"sub": "123"}
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth._fetch_google_profile", new_callable=AsyncMock, return_value=profile):
+			out = await _fetch_profile(oauth_auth_config, token_payload)
+		assert out is profile
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_github() -> None:
+	cfg = _OAUTH_CFG.model_copy(update={"oauth_provider": "github"})
+	token_payload = {"access_token": "tok"}
+	profile: dict[str, object] = {"id": "123"}
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth._fetch_github_profile", new_callable=AsyncMock, return_value=profile):
+			out = await _fetch_profile(cfg, token_payload)
+		assert out is profile
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_missing_access_token(oauth_auth_config: AuthConfig) -> None:
+	async def runner() -> None:
+		with pytest.raises(HTTPException):
+			await _fetch_profile(oauth_auth_config, {})
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_unknown_provider() -> None:
+	cfg = _OAUTH_CFG.model_copy(update={"oauth_provider": "other"})
+
+	async def runner() -> None:
+		with pytest.raises(HTTPException):
+			await _fetch_profile(cfg, {"access_token": "tok"})
+
+	asyncio.run(runner())

{pygitweb-0.2.0 → pygitweb-0.2.2}/hooks_install.py

@@ -34,6 +34,7 @@ _SAMPLE_LABELS: dict[str, str] = {
 	"pre-commit.ruff": "Ruff Pre-commit",
 	"commit-msg.pattern": "Commit Message Pattern",
 	"pre-receive.protected-pattern": "Protected Branch Commit Messages",
+	"pre-receive.branch-permissions": "Branch Write Permissions",
 	"post-commit.push-remotes": "Post-commit Push Remotes",
 }
 

{pygitweb-0.2.0 → pygitweb-0.2.2}/main.py

@@ -10,6 +10,7 @@ import os
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from datetime import UTC, datetime
+from importlib.resources import files
 from pathlib import Path
 from typing import Annotated, Literal
 from urllib.parse import quote, urlencode
@@ -163,8 +164,7 @@ async def app_lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 		clear_all_sessions()
 
 
-with open("pygitweb/README.md", encoding="utf-8") as _readme_file:
-	_app_description = _readme_file.read()
+_app_description = (files("pygitweb") / "README.md").read_text(encoding="utf-8")
 
 app = FastAPI(
 	debug=(settings.AUTH is False),
@@ -751,6 +751,7 @@ async def internal_notify(
 async def dispatch(
 	request: Request,
 	project: ValidatedReadableProject,
+	token: Annotated[str | None, Depends(access_token_from_request)],
 	a: Annotated[str | None, Query(alias="a")] = None,
 	h: Annotated[str | None, Query(alias="h")] = None,
 	hb: Annotated[str | None, Query(alias="hb")] = None,
@@ -845,7 +846,7 @@ async def dispatch(
 		p, pc = parse_pagination(page, pagecount)
 		return git_history(project, hash_param, file_name, request, p, pc)
 	if action == "heads":
-		return git_heads(project)
+		return git_heads(project, token)
 	if action == "tags":
 		p, pc = parse_pagination(page, pagecount)
 		return git_tags(project, request, p, pc)