feat: update gitea vendor

package/gitea/source/tests/integration/api_repo_hook_test.go

@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -38,19 +38,25 @@ func TestAPICreateHook(t *testing.T) {
 	}).AddTokenAuth(token)
 	resp := MakeRequest(t, req, http.StatusCreated)
 
-	var apiHook *api.Hook
-	DecodeJSON(t, resp, &apiHook)
+	apiHook := DecodeJSON(t, resp, &api.Hook{})
 	assert.Equal(t, "http://example.com/", apiHook.Config["url"])
-	assert.Equal(t, "Bearer s3cr3t", apiHook.AuthorizationHeader)
+	// the stored authorization header is a secret and must never be returned by the API
+	assert.Empty(t, apiHook.AuthorizationHeader)
 	assert.Equal(t, "CI notifications", apiHook.Name)
 
+	// a read-scoped token must not be able to read back the authorization header
+	readToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository)
+	getReq := NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/%s/hooks/%d", owner.Name, repo.Name, apiHook.ID)).
+		AddTokenAuth(readToken)
+	getResp := MakeRequest(t, getReq, http.StatusOK)
+	assert.NotContains(t, getResp.Body.String(), "s3cr3t")
+
 	newName := "Deploy hook"
 	patchReq := NewRequestWithJSON(t, "PATCH", fmt.Sprintf("/api/v1/repos/%s/%s/hooks/%d", owner.Name, repo.Name, apiHook.ID), api.EditHookOption{
 		Name: &newName,
 	}).AddTokenAuth(token)
 	patchResp := MakeRequest(t, patchReq, http.StatusOK)
-	var patched *api.Hook
-	DecodeJSON(t, patchResp, &patched)
+	patched := DecodeJSON(t, patchResp, &api.Hook{})
 	assert.Equal(t, newName, patched.Name)
 
 	hooksURL := fmt.Sprintf("/api/v1/repos/%s/%s/hooks", owner.Name, repo.Name)
@@ -64,8 +70,7 @@ func TestAPICreateHook(t *testing.T) {
 		},
 	}).AddTokenAuth(token)
 	resp2 := MakeRequest(t, req2, http.StatusCreated)
-	var created *api.Hook
-	DecodeJSON(t, resp2, &created)
+	created := DecodeJSON(t, resp2, &api.Hook{})
 	assert.Empty(t, created.Name)
 
 	hookURL := fmt.Sprintf("/api/v1/repos/%s/%s/hooks/%d", owner.Name, repo.Name, created.ID)
@@ -80,8 +85,7 @@ func TestAPICreateHook(t *testing.T) {
 	// PATCH without Name field: name must remain "original"
 	patchReq2 := NewRequestWithJSON(t, "PATCH", hookURL, api.EditHookOption{}).AddTokenAuth(token)
 	patchResp2 := MakeRequest(t, patchReq2, http.StatusOK)
-	var notCleared *api.Hook
-	DecodeJSON(t, patchResp2, &notCleared)
+	notCleared := DecodeJSON(t, patchResp2, &api.Hook{})
 	assert.Equal(t, "original", notCleared.Name)
 
 	// PATCH with Name: "" explicitly: Name should be cleared to ""
@@ -89,7 +93,6 @@ func TestAPICreateHook(t *testing.T) {
 		Name: new(""),
 	}).AddTokenAuth(token)
 	clearResp := MakeRequest(t, clearReq, http.StatusOK)
-	var cleared *api.Hook
-	DecodeJSON(t, clearResp, &cleared)
+	cleared := DecodeJSON(t, clearResp, &api.Hook{})
 	assert.Empty(t, cleared.Name)
 }