tests/git/systemGitAdapter.test.ts - master - raiden/obsidian-git-encrypt

tests/git/systemGitAdapter.test.ts
100 строк3 KB
Robert Kuzhin
feat: harden encrypted sync transactions
09 авг 2026, 13:46
09 авг 2026, 13:46cf0c0dc
import { mkdtemp, mkdir, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import path from "node:path";

import { afterEach, describe, expect, it } from "vitest";

import {
  createGitEnvironment,
  GitConfigurationError,
  isTransientGitError,
  SystemGitAdapter,
} from "../../src/git/index.js";

const temporaryRoots: string[] = [];

afterEach(async () => {
  await Promise.all(temporaryRoots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
});

describe("SystemGitAdapter configuration", () => {
  it.each([
    "fatal: unable to access: Could not resolve host",
    "error: RPC failed; HTTP 503",
    "send-pack: unexpected disconnect; the remote end hung up unexpectedly",
    "Connection reset by peer",
    "The requested URL returned error: 502",
  ])("classifies a transient transport failure", (message) => {
    expect(isTransientGitError(message)).toBe(true);
  });

  it.each([
    "Authentication failed",
    "Permission denied (publickey)",
    "rejected non-fast-forward",
    "repository not found",
  ])("does not retry a permanent failure", (message) => {
    expect(isTransientGitError(message)).toBe(false);
  });

  it("rejects option-like remotes and unsafe branch names", async () => {
    const root = await temporaryRoot();
    await expect(SystemGitAdapter.open(root, { remoteUrl: "--upload-pack=evil" })).rejects.toBeInstanceOf(
      GitConfigurationError,
    );
    await expect(SystemGitAdapter.open(root, { branch: "../escape" })).rejects.toBeInstanceOf(
      GitConfigurationError,
    );
    await expect(
      SystemGitAdapter.open(root, { remoteUrl: "https://user:token@example.invalid/vault.git" }),
    ).rejects.toBeInstanceOf(GitConfigurationError);
  });

  it("removes environment variables that can redirect Git outside the validated root", () => {
    const environment = createGitEnvironment({
      PATH: "/usr/bin",
      GIT_DIR: "/outside/repository.git",
      GIT_WORK_TREE: "/outside/plaintext",
      GIT_INDEX_FILE: "/outside/index",
      GIT_OBJECT_DIRECTORY: "/outside/objects",
      GIT_ALTERNATE_OBJECT_DIRECTORIES: "/outside/alternate",
      GIT_CONFIG_COUNT: "1",
      GIT_CONFIG_GLOBAL: "/outside/config",
      GIT_CONFIG_KEY_0: "core.worktree",
      GIT_CONFIG_VALUE_0: "/outside/plaintext",
      GIT_TEMPLATE_DIR: "/outside/template",
      GIT_TRACE: "/outside/git-trace.log",
      GIT_SSH_COMMAND: "ssh -F /safe/config",
    });

    expect(environment).toMatchObject({
      PATH: "/usr/bin",
      GIT_SSH_COMMAND: "ssh -F /safe/config",
      GIT_NO_REPLACE_OBJECTS: "1",
      GIT_TERMINAL_PROMPT: "0",
      LC_ALL: "C",
    });
    for (const name of [
      "GIT_DIR",
      "GIT_WORK_TREE",
      "GIT_INDEX_FILE",
      "GIT_OBJECT_DIRECTORY",
      "GIT_ALTERNATE_OBJECT_DIRECTORIES",
      "GIT_CONFIG_COUNT",
      "GIT_CONFIG_GLOBAL",
      "GIT_CONFIG_KEY_0",
      "GIT_CONFIG_VALUE_0",
      "GIT_TEMPLATE_DIR",
      "GIT_TRACE",
    ]) {
      expect(environment).not.toHaveProperty(name);
    }
  });
});

async function temporaryRoot(): Promise<string> {
  const root = await mkdtemp(path.join(tmpdir(), "obsidian-encrypted-git-git-unit-"));
  temporaryRoots.push(root);
  await mkdir(path.join(root, "objects"));
  return root;
}