test_sanitized_commit_messages.py

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
import pytest

from landoapi.phabricator import PhabricatorClient
from landoapi.secapproval import SECURE_COMMENT_TEMPLATE


@pytest.fixture(autouse=True)
def preamble(app, monkeypatch):
    # All API acceptance tests need the 'app' fixture to function.

    # Mock a valid API token.
    monkeypatch.setattr(
        "landoapi.decorators.PhabricatorClient.verify_api_token",
        lambda *args, **kwargs: True,
    )


@pytest.fixture
def authed_headers(auth0_mock):
    """Return a set of Auth0 and Phabricator auth'd headers."""
    headers = auth0_mock.mock_headers.copy()
    headers.append(("X-Phabricator-API-Key", "custom-key"))
    return headers


def monogram(revision):
    """Returns the monogram for a Phabricator API revision object.

    For example, a revision with ID 567 returns "D567".
    """
    return f"D{revision['id']}"


def test_integrated_request_sec_approval(
    client, authed_headers, db, phabdouble, secure_project, sec_approval_project
):
    revision = phabdouble.revision(projects=[secure_project])
    response = client.post(
        "/requestSecApproval",
        json={"revision_id": monogram(revision), "sanitized_message": "obscure"},
        headers=authed_headers,
    )

    assert response.status_code == 200


def test_integrated_public_revisions_cannot_be_submitted_for_sec_approval(
    client, authed_headers, phabdouble
):
    public_project = phabdouble.project("public")
    revision = phabdouble.revision(projects=[public_project])
    response = client.post(
        "/requestSecApproval",
        json={"revision_id": monogram(revision), "sanitized_message": "oops"},
        headers=authed_headers,
    )

    assert response.status_code == 400


def test_integrated_empty_commit_message_is_an_error(
    client, authed_headers, phabdouble, secure_project, sec_approval_project
):
    revision = phabdouble.revision(projects=[secure_project])
    response = client.post(
        "/requestSecApproval",
        json={"revision_id": monogram(revision), "sanitized_message": ""},
        headers=authed_headers,
    )

    assert response.status_code == 400


def test_integrated_secure_stack_has_alternate_commit_message(
    db,
    client,
    phabdouble,
    mock_repo_config,
    secure_project,
    authed_headers,
    monkeypatch,
):
    # Build a specially formatted sec-approval request comment.
    sanitized_title = "my secure commit title"
    sec_approval_comment = SECURE_COMMENT_TEMPLATE.format(message=sanitized_title)
    mock_comment = phabdouble.comment(sec_approval_comment)

    # Build a secure revision.
    secure_revision = phabdouble.revision(
        repo=phabdouble.repo(),
        projects=[secure_project],
        title="my insecure revision title",
    )

    # Add the two sec-approval request transactions to Phabricator. This also links
    # the sec-approval request comment to the secure revision.
    comment_txn = phabdouble.api_object_for(
        phabdouble.transaction("comment", secure_revision, comments=[mock_comment])
    )
    review_txn = phabdouble.api_object_for(
        phabdouble.transaction("reviewers.add", secure_revision)
    )

    # PhabricatorDouble does not return valid transaction data after editing a
    # revision to ask for sec-approval. Instead of using the PhabricatorDouble fake
    # API call to get the transactions we want we'll use a traditional mock to get
    # them.
    def fake_send_message_for_review(revision_phid, message, phabclient):
        # Respond with the two transactions that should be generated by a successful
        # sec-approval request.
        return [comment_txn, review_txn]

    monkeypatch.setattr(
        "landoapi.api.revisions.send_sanitized_commit_message_for_review",
        fake_send_message_for_review,
    )

    # Post the sec-approval request so that it gets saved into the database.
    response = client.post(
        "/requestSecApproval",
        json={
            "revision_id": f"D{secure_revision['id']}",
            "sanitized_message": sanitized_title,
        },
        headers=authed_headers,
    )
    assert response == 200

    # Request the revision from Lando. It should have our new title and summary.
    response = client.get("/stacks/D{}".format(secure_revision["id"]))
    assert response == 200

    revision = PhabricatorClient.single(response.json, "revisions")
    assert revision["is_secure"]
    assert revision["is_using_secure_commit_message"]
    assert revision["title"] == sanitized_title
    assert revision["summary"] == ""


def test_integrated_secure_stack_without_sec_approval_does_not_use_secure_message(
    db, client, phabdouble, mock_repo_config, secure_project
):
    # Build a plain old secure message, no sec-approval requests made.
    secure_revision = phabdouble.revision(
        repo=phabdouble.repo(), projects=[secure_project]
    )

    response = client.get("/stacks/D{}".format(secure_revision["id"]))
    assert response == 200

    revision = PhabricatorClient.single(response.json, "revisions")
    assert revision["is_secure"]
    assert not revision["is_using_secure_commit_message"]