xianyun_backends/kustomize/

remote.rs

//! Remote kustomize target helpers.
//!
//! Ported from `internal/backends/kustomize/remote.go`. Not yet
//! implemented.

/// Ported from `IsRemoteTarget`. Reports whether `path` is a kustomize
/// remote target: a URL whose scheme kustomize can resolve
/// (`http`/`https`/`ssh`/`file`). Everything else is a local path.
#[must_use]
pub fn is_remote_target(path: &str) -> bool {
    matches!(
        url_scheme(path).to_lowercase().as_str(),
        "http" | "https" | "ssh" | "file"
    )
}

/// Ported from `URLScheme`. Returns the URL scheme of `path`, or empty
/// when `path` has none or does not parse as a URL. Only paths
/// containing "://" count as URLs, so a local path with a colon in its
/// first segment (`overlays:v2/dev`, `c:/x`) stays a local path.
#[must_use]
pub fn url_scheme(path: &str) -> String {
    if !path.contains("://") {
        return String::new();
    }

    match url::Url::parse(path) {
        Ok(parsed) => parsed.scheme().to_string(),
        Err(_) => String::new(),
    }
}

/// Ported from `RedactCredentials`. Returns `target` safe for logging:
/// credentials embedded in a URL-form remote target's userinfo are
/// removed, leaving scheme, host, path, and query. The whole userinfo
/// goes, not just the password, because tokens are commonly passed as a
/// bare username. Local paths are returned unchanged.
#[must_use]
pub fn redact_credentials(target: &str) -> String {
    if !target.contains("://") {
        return target.to_string();
    }

    let Ok(mut parsed) = url::Url::parse(target) else {
        return "<unparseable kustomize target>".to_string();
    };

    if parsed.cannot_be_a_base() {
        // Opaque, e.g. `git::https://...`: could still embed credentials
        // in a form the parser cannot expose, so fail closed rather than
        // echo it.
        return "<unparseable kustomize target>".to_string();
    }

    if parsed.set_password(None).is_err() || parsed.set_username("").is_err() {
        return "<unparseable kustomize target>".to_string();
    }

    parsed.to_string()
}

/// Ported from `HasPinnedRef`. Reports whether a remote target carries
/// an explicit git ref (`?ref=` or its synonym `?version=`). An unpinned
/// target builds whatever the repository's default branch points at,
/// which is not reproducible.
#[must_use]
pub fn has_pinned_ref(target: &str) -> bool {
    let Some((_, query)) = target.split_once('?') else {
        return false;
    };

    url::form_urlencoded::parse(query.as_bytes())
        .any(|(key, value)| (key == "ref" || key == "version") && !value.is_empty())
}

#[cfg(test)]
mod tests {
    use super::*;

    // --- Ported from remote_test.go: TestIsRemoteTarget ---

    struct IsRemoteCase {
        name: &'static str,
        target: &'static str,
        want: bool,
    }

    #[test]
    fn is_remote_target_cases() {
        let cases = [
            IsRemoteCase {
                name: "https URL with subdir delimiter",
                target: "https://gitlab.com/group/subgroup/repo.git//overlays/dev?ref=v1.2.0",
                want: true,
            },
            IsRemoteCase {
                name: "http URL",
                target: "http://example.com/org/repo",
                want: true,
            },
            IsRemoteCase {
                name: "ssh URL with port",
                target: "ssh://git@gitlab.example.com:2222/org/repo.git//dir",
                want: true,
            },
            IsRemoteCase {
                name: "file URL is a git clone target",
                target: "file:///abs/path/to/repo//overlay?ref=v1",
                want: true,
            },
            IsRemoteCase {
                name: "scheme is case-insensitive",
                target: "HTTPS://gitlab.com/org/repo.git//dir?ref=v1",
                want: true,
            },
            IsRemoteCase {
                name: "scp-style is not a url",
                target: "git@gitlab.com:group/repo.git//overlays/dev?ref=v1",
                want: false,
            },
            IsRemoteCase {
                name: "go-getter git prefix is not supported",
                target: "git::https://example.com/org/repo",
                want: false,
            },
            IsRemoteCase {
                name: "bare github shorthand is not a url",
                target: "github.com/owner/repo/overlays/dev?ref=v1.2.0",
                want: false,
            },
            IsRemoteCase {
                name: "unsupported scheme is not a remote target",
                target: "s3://bucket/org/repo",
                want: false,
            },
            IsRemoteCase {
                name: "relative directory",
                target: "./overlays/dev",
                want: false,
            },
            IsRemoteCase {
                name: "bare relative directory",
                target: "overlays/dev",
                want: false,
            },
            IsRemoteCase {
                name: "absolute path",
                target: "/abs/overlays/dev",
                want: false,
            },
            IsRemoteCase {
                name: "builtin overlay reference",
                target: "builtin:dev-ca",
                want: false,
            },
            IsRemoteCase {
                name: "empty path",
                target: "",
                want: false,
            },
        ];

        for case in cases {
            assert_eq!(is_remote_target(case.target), case.want, "{}", case.name);
        }
    }

    // --- Ported from remote_test.go: TestURLScheme ---

    struct UrlSchemeCase {
        name: &'static str,
        target: &'static str,
        want: &'static str,
    }

    #[test]
    fn url_scheme_cases() {
        let cases = [
            UrlSchemeCase {
                name: "supported scheme",
                target: "https://gitlab.com/org/repo.git//dir?ref=v1",
                want: "https",
            },
            UrlSchemeCase {
                name: "unsupported scheme",
                target: "s3://bucket/org/repo",
                want: "s3",
            },
            UrlSchemeCase {
                name: "go-getter git prefix parses as git scheme",
                target: "git::https://example.com/org/repo",
                want: "git",
            },
            UrlSchemeCase {
                name: "relative path has no scheme",
                target: "./overlays/dev",
                want: "",
            },
            UrlSchemeCase {
                name: "scp-style target has no scheme",
                target: "git@gitlab.com:group/repo.git//dir",
                want: "",
            },
            UrlSchemeCase {
                name: "relative path with colon in first segment is not a url",
                target: "overlays:v2/dev",
                want: "",
            },
            UrlSchemeCase {
                name: "windows-style drive path is not a url",
                target: "c:/overlays/dev",
                want: "",
            },
        ];

        for case in cases {
            assert_eq!(url_scheme(case.target), case.want, "{}", case.name);
        }
    }

    // --- Ported from remote_test.go: TestRedactCredentials ---

    struct RedactCase {
        name: &'static str,
        target: &'static str,
        want: &'static str,
    }

    #[test]
    fn redact_credentials_cases() {
        let cases = [
            RedactCase {
                name: "user and password stripped",
                target: "https://gitlab-ci-token:secret@gitlab.com/org/repo.git//dir?ref=v1",
                want: "https://gitlab.com/org/repo.git//dir?ref=v1",
            },
            RedactCase {
                name: "token as bare username stripped",
                target: "https://glpat-secret@gitlab.com/org/repo.git//dir",
                want: "https://gitlab.com/org/repo.git//dir",
            },
            RedactCase {
                name: "url without credentials unchanged",
                target: "https://gitlab.com/org/repo.git//dir?ref=v1",
                want: "https://gitlab.com/org/repo.git//dir?ref=v1",
            },
            RedactCase {
                name: "opaque url fails closed",
                target: "git::https://user:secret@example.com/org/repo",
                want: "<unparseable kustomize target>",
            },
            RedactCase {
                name: "local path unchanged",
                target: "./overlays/dev",
                want: "./overlays/dev",
            },
            RedactCase {
                name: "builtin reference unchanged",
                target: "builtin:dev-ca",
                want: "builtin:dev-ca",
            },
        ];

        for case in cases {
            assert_eq!(redact_credentials(case.target), case.want, "{}", case.name);
        }
    }

    // --- Ported from remote_test.go: TestHasPinnedRef ---

    struct HasPinnedRefCase {
        name: &'static str,
        target: &'static str,
        want: bool,
    }

    #[test]
    fn has_pinned_ref_cases() {
        let cases = [
            HasPinnedRefCase {
                name: "ref query param",
                target: "https://gitlab.com/org/repo.git//dir?ref=v1.2.0",
                want: true,
            },
            HasPinnedRefCase {
                name: "version query param is a ref synonym",
                target: "https://gitlab.com/org/repo.git//dir?version=v2.0.0",
                want: true,
            },
            HasPinnedRefCase {
                name: "ref alongside other params",
                target: "https://gitlab.com/org/repo.git//dir?timeout=90&ref=main",
                want: true,
            },
            HasPinnedRefCase {
                name: "no query string",
                target: "https://gitlab.com/org/repo.git//dir",
                want: false,
            },
            HasPinnedRefCase {
                name: "query without ref",
                target: "https://gitlab.com/org/repo.git//dir?timeout=90&submodules=false",
                want: false,
            },
            HasPinnedRefCase {
                name: "empty ref",
                target: "https://gitlab.com/org/repo.git//dir?ref=",
                want: false,
            },
        ];

        for case in cases {
            assert_eq!(has_pinned_ref(case.target), case.want, "{}", case.name);
        }
    }

    // --- Ported from remote_integration_test.go: TestClient_Build_remoteTarget ---
    //
    // `Client::build` (`mod.rs`) now shells out to the real `kustomize`
    // binary for every target. For a remote target (`is_remote_target`
    // reports `true`), it passes the raw target string straight through
    // to `kustomize build`, never touching the injected `FileSystem` at
    // all -- kustomize's own machinery resolves the shallow git clone
    // and the `?ref=` pin itself, the same as Go's `krusty` library
    // does internally. `UntouchedFileSystem` below panics if `build`
    // ever calls it, proving the remote-target path really does bypass
    // `FileSystem`/staging.

    /// A [`crate::kustomize::FileSystem`] that panics on every call, to
    /// prove a remote-target build never touches it.
    struct UntouchedFileSystem;

    impl crate::kustomize::FileSystem for UntouchedFileSystem {
        fn write_file(&self, _path: &str, _content: &[u8]) -> std::io::Result<()> {
            panic!("a remote-target build must not touch FileSystem::write_file")
        }

        fn read_file(&self, _path: &str) -> std::io::Result<Vec<u8>> {
            panic!("a remote-target build must not touch FileSystem::read_file")
        }

        fn walk(&self, _dir: &str) -> std::io::Result<Vec<String>> {
            panic!("a remote-target build must not touch FileSystem::walk")
        }
    }

    #[test]
    fn client_build_remote_target() {
        use std::process::Command;
        use std::sync::Arc;

        use crate::kustomize::fixtures::{
            NAME_PREFIX_KUSTOMIZATION, SETTINGS_CONFIG_MAP, assert_dev_prefixed_config_map,
        };
        use crate::kustomize::{Backend, Client};

        // Ported from the Go test's `GIT_DIR`/etc cleanup: these
        // redirection variables (an inherited `GIT_INDEX_FILE` in
        // particular, which `pre-commit` exports) interfere with
        // kustomize's own internal clone, making it write the fixture
        // repository's file list into the *outer* repository's index
        // instead of its own.
        let saved_env: Vec<(&str, Option<String>)> = [
            "GIT_DIR",
            "GIT_INDEX_FILE",
            "GIT_WORK_TREE",
            "GIT_OBJECT_DIRECTORY",
            "GIT_COMMON_DIR",
        ]
        .iter()
        .map(|name| (*name, std::env::var(name).ok()))
        .collect();
        for (name, _) in &saved_env {
            // SAFETY: this test function isn't run concurrently with any
            // other test that reads/writes these GIT_* variables (none
            // elsewhere in this crate does); restored unconditionally
            // below before the function returns.
            unsafe {
                std::env::remove_var(name);
            }
        }

        let repo = tempfile::tempdir().expect("create tempdir");
        let run_git = |args: &[&str]| {
            let output = Command::new("git")
                .arg("-C")
                .arg(repo.path())
                .args(args)
                .output()
                .expect("git binary must be on PATH");
            assert!(
                output.status.success(),
                "git {args:?} failed: {}",
                String::from_utf8_lossy(&output.stderr)
            );
        };

        let overlay = repo.path().join("overlay");
        std::fs::create_dir_all(&overlay).expect("create overlay dir");
        std::fs::write(
            overlay.join("kustomization.yaml"),
            NAME_PREFIX_KUSTOMIZATION,
        )
        .expect("write kustomization.yaml");
        std::fs::write(overlay.join("configmap.yaml"), SETTINGS_CONFIG_MAP)
            .expect("write configmap.yaml");

        run_git(&["init", "-q"]);
        run_git(&["add", "."]);
        run_git(&[
            "-c",
            "user.email=test@example.com",
            "-c",
            "user.name=Test",
            "commit",
            "-q",
            "-m",
            "overlay",
        ]);
        run_git(&["tag", "v1.0.0"]);

        let client = Client::with_fs(
            Arc::new(UntouchedFileSystem),
            Arc::new(xianyun_executor::exec::Client::new()),
        );

        let target = format!("file://{}//overlay?ref=v1.0.0", repo.path().display());
        let got = client
            .build(&target)
            .expect("remote target must build successfully");

        assert_dev_prefixed_config_map(&got, "the remote overlay's namePrefix must be applied");

        for (name, value) in saved_env {
            // SAFETY: restoring the GIT_* variables this same function
            // cleared above, on the same thread, before returning.
            match value {
                Some(value) => unsafe { std::env::set_var(name, value) },
                None => unsafe { std::env::remove_var(name) },
            }
        }
    }
}