michal/tit

Browse tree · Show commit · Download archive

Diff

b68b95d1480e → f4cc94e28e56

@@ -280,3 +280,15 @@
 codes, audit events, and clone access. Read the
 [SSH repository command architectural decision record](docs/adr/0015-ssh-repository-commands.md)
 for the command and authorization rules.
+
+## Milestone 3 gate
+
+Run the complete account and authorization gate:
+
+```text
+./scripts/check-m3
+```
+
+This command tests one Web and SSH identity, account recovery, key revocation,
+sessions, repository roles, private route isolation, push policy, audit history,
+and repository creation from the Web UI and SSH.

@@ -1,0 +1,7 @@
+#!/bin/sh
+set -eu
+
+./scripts/check
+cargo test --locked --release --test auth --test account_lifecycle --test web_session --test repository_policy
+cargo test --locked --release --test git_push_ssh
+cargo test --locked --release --test serve

@@ -490,6 +490,31 @@
     wait_for_listener(ssh, &mut server);
     let discovery = http_get(http, "/alice/private.git/info/refs?service=git-upload-pack");
     assert!(discovery.starts_with("HTTP/1.1 404"), "{discovery}");
+    let home = http_get(http, "/");
+    assert!(home.starts_with("HTTP/1.1 200"));
+    assert!(!home.contains("/alice/private"));
+    for route in [
+        "/alice/private",
+        "/alice/private/refs",
+        "/alice/private/atom.xml",
+        "/alice/private/rss.xml",
+        "/alice/private/search?q=serve&ref=HEAD",
+        "/alice/private/commit/main",
+        "/alice/private/diff/main/main",
+        "/alice/private/tree/main",
+        "/alice/private/tree/main/nested",
+        "/alice/private/blob/main/README.md",
+        "/alice/private/raw/main/README.md",
+        "/alice/private/blame/main/README.md",
+        "/alice/private/archive/main.tar",
+    ] {
+        let response = http_get(http, route);
+        assert!(
+            response.starts_with("HTTP/1.1 404"),
+            "route leaked: {route}"
+        );
+        assert!(!response.contains("serve fixture"), "route leaked: {route}");
+    }
 
     let ssh_command = format!(
         "ssh -F /dev/null -i {} -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null",