feat: separate enterprise work and personal routes

deployment/enterprise-domain-bootstrap/enterprise-lighthouse/enterprise_identity_service.test.py

@@ -3,7 +3,9 @@ import json
 import os
 import tempfile
 import unittest
+import urllib.error
 from pathlib import Path
+from unittest import mock
 
 ROOT = Path(__file__).parent
 REGISTRY = ROOT / "registry" / "enterprise-identity-registry.json"
@@ -60,6 +62,53 @@ class EnterpriseIdentityTests(unittest.TestCase):
         self.assertIn("/user/settings/change_password", source)
         self.assertNotIn("FORGEJO_ADMIN_TOKEN", source)
 
+    def test_receipt_id_and_repository_path_are_stable_without_exposing_idempotency_key(self):
+        first = service.stable_receipt_id("GH-RESP", "TCS-GL-0007∞", "responsibility-1234567890")
+        second = service.stable_receipt_id("GH-RESP", "TCS-GL-0007∞", "responsibility-1234567890")
+        self.assertEqual(first, second)
+        self.assertRegex(first, r"^GH-RESP-[A-F0-9]{32}$")
+        self.assertNotIn("1234567890", first)
+        self.assertEqual(
+            service.repository_receipt_path("responsibility", first),
+            f".guanghu/receipts/responsibility/{first}.json",
+        )
+
+    def test_repository_projection_uses_the_humans_own_forgejo_authority(self):
+        registry = service.load_registry()
+        human = service.find_human(registry, "TCS-GL-0007∞")
+        receipt_id = service.stable_receipt_id("GH-REL", human["human_number"], "relationship-1234567890")
+        receipt = service.signed_receipt(
+            {"receipt_id": receipt_id, "human_number": human["human_number"], "username": "feimao"}
+        )
+
+        class Response:
+            status = 201
+            def __enter__(self): return self
+            def __exit__(self, *_): return False
+            def read(self):
+                return json.dumps({"commit": {"sha": "a" * 40}}).encode()
+
+        with mock.patch.object(service.urllib.request, "urlopen", return_value=Response()) as opened:
+            projection = service.project_receipt_to_repository(
+                human, "feimao", "one-use-secret", "relationship", receipt
+            )
+        request = opened.call_args.args[0]
+        self.assertEqual(projection["repository"], "feimao/guanghu-zero-sense-work")
+        self.assertIn("/repos/feimao/guanghu-zero-sense-work/contents/", request.full_url)
+        self.assertTrue(request.headers["Authorization"].startswith("Basic "))
+        self.assertNotIn("one-use-secret", request.data.decode())
+
+    def test_repository_projection_refuses_cross_owner_repository(self):
+        human = {"repository": "juzi/guanghu-zero-sense-work"}
+        with self.assertRaisesRegex(RuntimeError, "owner"):
+            service.project_receipt_to_repository(
+                human,
+                "feimao",
+                "secret",
+                "relationship",
+                {"receipt_id": "GH-REL-" + "A" * 32},
+            )
+
 
 if __name__ == "__main__":
     unittest.main()