pear-git-v3 / test / git-http-basic.test.js

// Unit: HTTP Basic → personal-access-token extraction for the git push gate
// (classic-git-auth Phase 1). The allowPush 401/403/200 decision is exercised
// end-to-end in the HTTP route tests; here we pin the credential parsing,
// which is the error-prone part (base64, user:pass split, token-in-username).

import test from 'brittle'
import b4a from 'b4a'
import { parseBasicToken } from '../lib/handlers/repos.js'

function basic (userColonPass) {
  return { headers: { authorization: 'Basic ' + b4a.toString(b4a.from(userColonPass, 'utf8'), 'base64') } }
}

test('parseBasicToken: token in password field (typical)', (t) => {
  t.is(parseBasicToken(basic('alice:pgv3_abc123')), 'pgv3_abc123', 'password is the token')
})

test('parseBasicToken: token in username field (x-oauth-basic style)', (t) => {
  t.is(parseBasicToken(basic('pgv3_xyz:x-oauth-basic')), 'pgv3_xyz', 'falls back to username token')
  t.is(parseBasicToken(basic('pgv3_xyz:')), 'pgv3_xyz', 'empty password, token in username')
})

test('parseBasicToken: non-token password is returned verbatim (rejected downstream)', (t) => {
  t.is(parseBasicToken(basic('alice:hunter2')), 'hunter2', 'returns the password; resolveToken will reject it')
})

test('parseBasicToken: no/!Basic header → null', (t) => {
  t.is(parseBasicToken({ headers: {} }), null, 'no header')
  t.is(parseBasicToken({ headers: { authorization: 'Bearer pgv3_abc' } }), null, 'Bearer is not Basic')
  t.is(parseBasicToken(null), null, 'no req')
})

test('parseBasicToken: header with no colon treats whole string as username', (t) => {
  t.is(parseBasicToken(basic('pgv3_nocolon')), 'pgv3_nocolon', 'no colon → username path')
})