From 9ef613b156ee3ef79e73fdb0835b5ad5020d0a1a Mon Sep 17 00:00:00 2001
From: Diego Herrera <dherrera@redhat.com>
Date: Nov 23 2024 04:40:54 +0000
Subject: [PATCH 1/3] Add repo check to ACL tests


Signed-off-by: Diego Herrera <dherrera@redhat.com>

---

diff --git a/pagure_distgit_tests/test_dist_git_auth.py b/pagure_distgit_tests/test_dist_git_auth.py
index 1fd5381..c380027 100644
--- a/pagure_distgit_tests/test_dist_git_auth.py
+++ b/pagure_distgit_tests/test_dist_git_auth.py
@@ -401,9 +401,9 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
         "PR_ONLY": False,
         "ACL_BLOCK_UNSPECIFIED": False,
         "BLACKLIST_RES": ["refs/heads/c[0-9]+.*"],
-        "UNSPECIFIED_BLACKLIST_RES": ["refs/heads/f[0-9]+"],
+        "UNSPECIFIED_BLACKLIST_RES": ["refs/heads/f[0-9]+", "refs/heads/epel[0-9]+"],
         "RCM_GROUP": "relenggroup",
-        "RCM_BRANCHES": ["refs/heads/f[0-9]+"],
+        "RCM_BRANCHES": ["refs/heads/f[0-9]+", "refs/heads/epel[0-9]+"],
         "ACL_PROTECTED_NAMESPACES": ["rpms", "modules", "container"],
         "PDC_URL": "invalid://",
         "BODHI_URL": "invalid://",
@@ -505,6 +505,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
 
     @patch("dist_git_auth.requests")
     def test_protected_supported_branch_committer(self, mock_requests):
+        repodir = os.path.join(self.path, "repos")
+        repos = tests.create_projects_git(repodir, bare=True)
+        tests.add_content_git_repo(repos[0], branch="f39")
+        repodir = os.path.join(self.path, "repos", "test.git")
         project = self.create_namespaced_project("rpms", "test")
         res = Mock()
         res.ok = True
@@ -544,7 +548,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
                 username="pingou",
                 refname="refs/heads/f39",
                 pull_request=None,
-                repodir=None,
+                repodir=repodir,
                 repotype="main",
                 revfrom=None,
                 revto=None,
@@ -557,6 +561,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
     @patch("dist_git_auth.requests")
     def test_protected_supported_branch_non_committer(self, mock_requests):
         project = self.create_namespaced_project("rpms", "test")
+        repodir = os.path.join(self.path, "repos")
+        repos = tests.create_projects_git(repodir, bare=True)
+        tests.add_content_git_repo(repos[0], branch="f39")
+        repodir = os.path.join(self.path, "repos", "test.git")
         res = Mock()
         res.ok = True
         res.json.return_value = {
@@ -595,7 +603,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
                 username="foo",
                 refname="refs/heads/f39",
                 pull_request=None,
-                repodir=None,
+                repodir=repodir,
                 repotype="main",
                 revfrom=None,
                 revto=None,
@@ -608,6 +616,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
     @patch("dist_git_auth.requests")
     def test_protected_supported_branch_epel_minor(self, mock_requests):
         project = self.create_namespaced_project("rpms", "test")
+        repodir = os.path.join(self.path, "repos")
+        repos = tests.create_projects_git(repodir, bare=True)
+        tests.add_content_git_repo(repos[0], branch="epel10.1")
+        repodir = os.path.join(self.path, "repos", "test.git")
         res = Mock()
         res.ok = True
         res.json.return_value = {
@@ -646,7 +658,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
                 username="foo",
                 refname="refs/heads/epel10.1",
                 pull_request=None,
-                repodir=None,
+                repodir=repodir,
                 repotype="main",
                 revfrom=None,
                 revto=None,
@@ -659,6 +671,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
     @patch("dist_git_auth.requests")
     def test_protected_supported_branch_epel(self, mock_requests):
         project = self.create_namespaced_project("rpms", "test")
+        repodir = os.path.join(self.path, "repos")
+        repos = tests.create_projects_git(repodir, bare=True)
+        tests.add_content_git_repo(repos[0], branch="epel10")
+        repodir = os.path.join(self.path, "repos", "test.git")
         res = Mock()
         res.ok = True
         res.json.return_value = {
@@ -697,7 +713,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
                 username="foo",
                 refname="refs/heads/epel10",
                 pull_request=None,
-                repodir=None,
+                repodir=repodir,
                 repotype="main",
                 revfrom=None,
                 revto=None,

From fa45f63d85b6748af33b60d72459d83d255654c6 Mon Sep 17 00:00:00 2001
From: Diego Herrera <dherrera@redhat.com>
Date: Nov 23 2024 04:45:06 +0000
Subject: [PATCH 2/3] Add test case for restricting users creating branches for unspecified blacklisted names


Signed-off-by: Diego Herrera <dherrera@redhat.com>

---

diff --git a/pagure_distgit_tests/test_dist_git_auth.py b/pagure_distgit_tests/test_dist_git_auth.py
index c380027..6f3b47a 100644
--- a/pagure_distgit_tests/test_dist_git_auth.py
+++ b/pagure_distgit_tests/test_dist_git_auth.py
@@ -751,6 +751,114 @@ class DistGitAuthTestsFedora(DistGitAuthTests):
 
         self.expect_info_msg("Unspecified ref refs/heads/f28 is blocked")
 
+    @patch("dist_git_auth.requests")
+    def test_protected_create_unspecified_blacklisted_branch_fail(self, mock_requests):
+        project = self.create_namespaced_project("rpms", "test")
+        repodir = os.path.join(self.path, "repos")
+        repos = tests.create_projects_git(repodir, bare=True)
+        repodir = os.path.join(self.path, "repos", "test.git")
+        res = Mock()
+        res.ok = True
+        res.json.return_value = {
+            "pages": 1,
+            "releases": [
+                {
+                    "name": "EPEL-10.0",
+                    "long_name": "Fedora EPEL 10.0",
+                    "version": "10.0",
+                    "id_prefix": "FEDORA-EPEL",
+                    "branch": "epel10",
+                    "dist_tag": "epel10.0",
+                    "stable_tag": "epel10.0",
+                    "testing_tag": "epel10.0-testing",
+                    "candidate_tag": "epel10.0-testing-candidate",
+                    "pending_signing_tag": "epel10.0-signing-pending",
+                    "pending_testing_tag": "epel10.0-testing-pending",
+                    "pending_stable_tag": "epel10.0-pending",
+                    "override_tag": "epel10.0-override",
+                    "mail_template": "fedora_epel_legacy_errata_template",
+                    "state": "current",
+                    "composed_by_bodhi": True,
+                    "create_automatic_updates": False,
+                    "package_manager": "unspecified",
+                    "testing_repository": None,
+                    "eol": None,
+                },
+            ],
+        }
+
+        mock_requests.get.return_value = res
+
+        self.assertFalse(
+            self.dga.check_acl(
+                self.session,
+                project=project,
+                username="pingou",
+                refname="refs/heads/epel10",
+                pull_request=None,
+                repodir=repodir,
+                repotype="main",
+                revfrom=None,
+                revto=None,
+                is_internal=False,
+            )
+        )
+
+        self.expect_info_msg("Unspecified ref refs/heads/epel10 is blocked")
+
+    @patch("dist_git_auth.requests")
+    def test_protected_create_unspecified_blacklisted_branch_success(self, mock_requests):
+        project = self.create_namespaced_project("rpms", "test")
+        repodir = os.path.join(self.path, "repos")
+        repos = tests.create_projects_git(repodir, bare=True)
+        repodir = os.path.join(self.path, "repos", "test.git")
+        res = Mock()
+        res.ok = True
+        res.json.return_value = {
+            "pages": 1,
+            "releases": [
+                {
+                    "name": "EPEL-10.0",
+                    "long_name": "Fedora EPEL 10.0",
+                    "version": "10.0",
+                    "id_prefix": "FEDORA-EPEL",
+                    "branch": "epel10",
+                    "dist_tag": "epel10.0",
+                    "stable_tag": "epel10.0",
+                    "testing_tag": "epel10.0-testing",
+                    "candidate_tag": "epel10.0-testing-candidate",
+                    "pending_signing_tag": "epel10.0-signing-pending",
+                    "pending_testing_tag": "epel10.0-testing-pending",
+                    "pending_stable_tag": "epel10.0-pending",
+                    "override_tag": "epel10.0-override",
+                    "mail_template": "fedora_epel_legacy_errata_template",
+                    "state": "current",
+                    "composed_by_bodhi": True,
+                    "create_automatic_updates": False,
+                    "package_manager": "unspecified",
+                    "testing_repository": None,
+                    "eol": None,
+                },
+            ],
+        }
+
+        mock_requests.get.return_value = res
+
+        self.assertTrue(
+            self.dga.check_acl(
+                self.session,
+                project=project,
+                username="releng",
+                refname="refs/heads/epel10",
+                pull_request=None,
+                repodir=repodir,
+                repotype="main",
+                revfrom=None,
+                revto=None,
+                is_internal=False,
+            )
+        )
+
     def test_is_not_retired_package(self):
         projects = tests.create_projects_git(os.path.join(self.path, "repos"), bare=True)
         tests.add_content_git_repo(projects[0])

From 56515d7ba6a1763ba0dd1be6e68d18eb66158572 Mon Sep 17 00:00:00 2001
From: Diego Herrera <dherrera@redhat.com>
Date: Nov 23 2024 04:49:11 +0000
Subject: [PATCH 3/3] Restricting users creating branches for unspecified blacklisted names


Signed-off-by: Diego Herrera <dherrera@redhat.com>

---

diff --git a/dist_git_auth.py b/dist_git_auth.py
index 546ee7f..9234fad 100644
--- a/dist_git_auth.py
+++ b/dist_git_auth.py
@@ -81,6 +81,11 @@ class DistGitAuth(GitAuthHelper):
         cmd = ["ls-tree", branch, "--name-only", "--", "dead.package"]
         return read_git_output(cmd, abspath) != "dead.package"
 
+    def branch_exists(self, branch, abspath):
+        """Returns if the branch is already created"""
+        cmd = ["show-ref", "refs/heads/" + branch]
+        return len(read_git_output(cmd, abspath)) > 0
+
     def is_supported_branch(self, project, refname, repodir):
         """Returns whether a specific branch is currently supported for Fedora
 
@@ -135,6 +140,10 @@ class DistGitAuth(GitAuthHelper):
                 else:
                     return None
 
+        if not self.branch_exists(refname, repodir):
+            # If branch doesn't exist, return None
+            return None
+
         # Branch can be supported, but package can be retired,
         # in that case don't push
         active = self.is_not_retired_package(refname, repodir)

