feat: harden server pull deployments and git hygiene

2026-07-28 08:27:09 +02:00
parent d4d77c827a
commit 56efd1a00c
33 changed files with 2390 additions and 633 deletions
@@ -170,3 +170,27 @@ test('creates conservative default branch protection rules', async () => {
  assert.equal(request.options.body.enable_force_push, false);
  assert.equal(request.options.body.rule_name, 'main');
 });
+
+test('creates repository-scoped read-only deploy keys and reuses only safe matches', async () => {
+  const service = new GiteaService(makeStore());
+  const publicKey = `ssh-ed25519 ${Buffer.from('public-key-material').toString('base64')} forgeflow:test`;
+  const requests = [];
+  service.request = async (pathname, options = {}) => {
+    requests.push({ pathname, options });
+    if (!options.method) return { data: [] };
+    return { data: { id: 41, key: publicKey, read_only: true } };
+  };
+  const created = await service.ensureReadOnlyDeployKey({ owner: 'jens', repo: 'app', title: 'ForgeFlow', publicKey });
+  assert.equal(created.created, true);
+  assert.equal(requests[1].options.body.read_only, true);
+
+  service.request = async () => ({ data: [{ id: 41, key: publicKey, read_only: true }] });
+  const reused = await service.ensureReadOnlyDeployKey({ owner: 'jens', repo: 'app', title: 'ForgeFlow', publicKey });
+  assert.equal(reused.created, false);
+
+  service.request = async () => ({ data: [{ id: 41, key: publicKey, read_only: false }] });
+  await assert.rejects(
+    () => service.ensureReadOnlyDeployKey({ owner: 'jens', repo: 'app', title: 'ForgeFlow', publicKey }),
+    (error) => error.code === 'DEPLOY_KEY_NOT_READ_ONLY',
+  );
+});