awoooi/apps/api/tests/test_gitea_webhook.py

"""
ADR-059: Gitea Webhook 整合測試
===================================
測試 Gitea Webhook → OpenClaw AI 代碼審查整合

測試策略 (遵循 feedback_no_mock_testing.md):
- 使用 ASGITransport 撞擊真實端點
- 不使用 Mock，直接測試 HTTP 層
- 驗證 HMAC 簽章邏輯 (X-Gitea-Signature)

🔴 IMPORTANT: 禁止 Mock 測試！
"""

import hashlib
import hmac
import json

import httpx
import pytest
from fastapi import FastAPI
from httpx import ASGITransport

# 2026-04-05 Claude Code: 改用最小化 app，只掛載 gitea_webhook router
# 原 `from src.main import app` 會 import 整個應用，觸發 sqlalchemy.ext.asyncio
# C extension (asyncpg.protocol.protocol) 在 CI runner 上 segfault (exit 139)
# gitea_webhook router 的 import chain 不走 DB，可獨立測試
from src.api.v1.gitea_webhook import router as gitea_webhook_router

app = FastAPI()
app.include_router(gitea_webhook_router, prefix="/api/v1")

# 環境變數設定已移至 conftest.py (解決 E402)


# =============================================================================
# Test Fixtures
# =============================================================================

@pytest.fixture
def webhook_secret():
    """測試用 Webhook Secret"""
    return "test-secret-key-12345"


@pytest.fixture
def sample_pr_payload():
    """範例 PR Payload"""
    return {
        "action": "opened",
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {
            "login": "test-user",
            "id": 1,
            "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        },
        "pull_request": {
            "id": 1,
            "number": 42,
            "title": "Add new feature",
            "body": "This PR adds a new feature",
            "state": "open",
            "html_url": "https://github.com/test-owner/test-repo/pull/42",
            "diff_url": "https://github.com/test-owner/test-repo/pull/42.diff",
            "user": {
                "login": "test-user",
                "id": 1,
            },
            "head": {"ref": "feature-branch", "sha": "abc123"},
            "base": {"ref": "main", "sha": "def456"},
            "additions": 50,
            "deletions": 10,
            "changed_files": 3,
        },
    }


@pytest.fixture
def sample_push_payload():
    """範例 Push Payload"""
    return {
        "ref": "refs/heads/main",
        "before": "0000000000000000000000000000000000000000",
        "after": "abc1234567890abcdef1234567890abcdef12345",
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {
            "login": "test-user",
            "id": 1,
        },
        "pusher": {
            "name": "test-user",
            "email": "test@example.com",
        },
        "commits": [
            {
                "id": "abc1234567890abcdef1234567890abcdef12345",
                "message": "feat: add new feature",
                "timestamp": "2026-03-26T10:00:00+08:00",
                "url": "https://github.com/test-owner/test-repo/commit/abc123",
                "author": {"name": "Test User", "email": "test@example.com"},
                "added": ["new_file.py"],
                "removed": [],
                "modified": ["existing_file.py"],
            }
        ],
    }


@pytest.fixture
def ping_payload():
    """Ping 事件 Payload"""
    return {
        "zen": "Responsive is better than fast.",
        "hook_id": 12345,
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {
            "login": "test-user",
            "id": 1,
        },
    }


def generate_signature(secret: str, body: bytes) -> str:
    """生成 Gitea Webhook 簽章 (X-Gitea-Signature)

    Gitea 送出純 hex（無 sha256= 前綴），與 GitHub 不同。
    2026-04-05 ogt: 修正為純 hex 格式
    """
    return hmac.new(
        secret.encode(),
        body,
        hashlib.sha256,
    ).hexdigest()


def prepare_request(secret: str, payload: dict) -> tuple[bytes, str]:
    """準備請求 body 和簽章"""
    body = json.dumps(payload, separators=(',', ':')).encode()
    signature = generate_signature(secret, body)
    return body, signature


# =============================================================================
# HMAC 簽章驗證測試
# =============================================================================

@pytest.mark.asyncio
async def test_webhook_missing_signature(sample_pr_payload):
    """測試: 缺少簽章應該被拒絕"""
    body = json.dumps(sample_pr_payload, separators=(',', ':')).encode()

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                # 故意不提供 X-Gitea-Signature
            },
        )

        # 在 dev 環境下，缺少 secret 但配置了 secret，應該要求簽章
        # 由於我們設定了 GITEA_WEBHOOK_SECRET，缺少簽章應該返回 401
        assert response.status_code == 401


@pytest.mark.asyncio
async def test_webhook_invalid_signature(sample_pr_payload):
    """測試: 無效簽章應該被拒絕"""
    body = json.dumps(sample_pr_payload, separators=(',', ':')).encode()

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": "sha256=invalid_signature_here",
            },
        )

        assert response.status_code == 401


@pytest.mark.asyncio
async def test_webhook_valid_signature(sample_pr_payload, webhook_secret):
    """測試: 有效簽章應該被接受"""
    body, signature = prepare_request(webhook_secret, sample_pr_payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        # 應該返回 202 Accepted
        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "accepted"
        assert data["event_type"] == "pull_request"
        assert data["review_id"] is not None


# =============================================================================
# 倉庫白名單測試
# =============================================================================

@pytest.mark.asyncio
async def test_webhook_repo_not_in_whitelist(webhook_secret):
    """測試: 不在白名單的倉庫應該被忽略"""
    payload = {
        "action": "opened",
        "repository": {
            "id": 999999,
            "name": "unauthorized-repo",
            "full_name": "unknown-owner/unauthorized-repo",  # 不在白名單
            "private": False,
            "html_url": "https://github.com/unknown-owner/unauthorized-repo",
        },
        "sender": {
            "login": "hacker",
            "id": 999,
        },
        "pull_request": {
            "id": 1,
            "number": 1,
            "title": "Malicious PR",
            "state": "open",
            "html_url": "https://github.com/unknown-owner/unauthorized-repo/pull/1",
            "diff_url": "https://github.com/unknown-owner/unauthorized-repo/pull/1.diff",
            "user": {"login": "hacker", "id": 999},
            "head": {"ref": "evil", "sha": "bad123"},
            "base": {"ref": "main", "sha": "good456"},
        },
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "ignored"
        assert "not in whitelist" in data["message"]


# =============================================================================
# 事件類型測試
# =============================================================================

@pytest.mark.asyncio
async def test_webhook_ping_event(ping_payload, webhook_secret):
    """測試: Ping 事件應該回應 Pong"""
    body, signature = prepare_request(webhook_secret, ping_payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "ping",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "accepted"
        assert "Pong" in data["message"]
        assert data["event_type"] == "ping"


@pytest.mark.asyncio
async def test_webhook_push_event(sample_push_payload, webhook_secret):
    """測試: Push 到主分支應該觸發審查"""
    body, signature = prepare_request(webhook_secret, sample_push_payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "push",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "accepted"
        assert data["event_type"] == "push"
        assert data["review_id"] is not None


@pytest.mark.asyncio
async def test_webhook_push_non_default_branch(webhook_secret):
    """測試: Push 到非主分支應該被忽略"""
    payload = {
        "ref": "refs/heads/feature-branch",  # 非主分支
        "before": "0000000000000000000000000000000000000000",
        "after": "abc123",
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "test-user", "id": 1},
        "commits": [
            {
                "id": "abc123",
                "message": "feature commit",
                "timestamp": "2026-03-26T10:00:00+08:00",
                "url": "https://github.com/test-owner/test-repo/commit/abc123",
                "author": {"name": "Test", "email": "test@example.com"},
            }
        ],
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "push",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "ignored"
        assert "non-default branch" in data["message"]


@pytest.mark.asyncio
async def test_webhook_unsupported_event(webhook_secret):
    """測試: 不支援的事件類型應該被忽略"""
    payload = {
        "action": "added",
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "test-user", "id": 1},
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "star",  # 不支援的事件
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "ignored"
        assert "not supported" in data["message"]


@pytest.mark.asyncio
async def test_webhook_pr_unsupported_action(webhook_secret):
    """測試: PR 不支援的 action 應該被忽略"""
    payload = {
        "action": "closed",  # 我們只處理 opened, synchronize, reopened
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "test-user", "id": 1},
        "pull_request": {
            "id": 1,
            "number": 42,
            "title": "Closed PR",
            "state": "closed",
            "html_url": "https://github.com/test-owner/test-repo/pull/42",
            "diff_url": "https://github.com/test-owner/test-repo/pull/42.diff",
            "user": {"login": "test-user", "id": 1},
            "head": {"ref": "feature", "sha": "abc"},
            "base": {"ref": "main", "sha": "def"},
        },
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "ignored"
        assert "not supported" in data["message"]


# =============================================================================
# Task C: Gitea CI/CD 告警轉發 Telegram 測試 (2026-04-25)
# =============================================================================

@pytest.mark.asyncio
async def test_webhook_pr_closed_not_merged_ignored(webhook_secret):
    """測試: PR closed 但未合併 (merged=False) 應該被忽略（不發通知）"""
    payload = {
        "action": "closed",
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "test-user", "id": 1},
        "pull_request": {
            "id": 1,
            "number": 42,
            "title": "Closed without merge",
            "state": "closed",
            "merged": False,  # 明確標記未合併
            "html_url": "https://github.com/test-owner/test-repo/pull/42",
            "diff_url": "https://github.com/test-owner/test-repo/pull/42.diff",
            "user": {"login": "test-user", "id": 1},
            "head": {"ref": "feature", "sha": "abc"},
            "base": {"ref": "main", "sha": "def"},
        },
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "ignored"
        assert "not supported" in data["message"]


@pytest.mark.asyncio
async def test_webhook_pr_merged_accepted(webhook_secret):
    """測試: PR merged (action=closed + merged=True) 應該回 accepted 並排入通知"""
    payload = {
        "action": "closed",
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "test-user", "id": 1},
        "pull_request": {
            "id": 1,
            "number": 99,
            "title": "feat: add CI/CD Telegram notifications",
            "state": "closed",
            "merged": True,  # 合併完成
            "html_url": "https://github.com/test-owner/test-repo/pull/99",
            "diff_url": "https://github.com/test-owner/test-repo/pull/99.diff",
            "user": {"login": "test-user", "id": 1},
            "head": {"ref": "feat/ci-telegram", "sha": "abc123"},
            "base": {"ref": "main", "sha": "def456"},
            "additions": 150,
            "deletions": 20,
            "changed_files": 5,
        },
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "accepted"
        assert "merge notification" in data["message"]
        assert data["event_type"] == "pull_request"


@pytest.mark.asyncio
async def test_webhook_workflow_run_failure_accepted(webhook_secret):
    """測試: workflow_run failure 應該回 accepted 並排入 incident + Telegram 通知"""
    payload = {
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "ci-bot", "id": 2},
        "workflow_run": {
            "id": 9001,
            "name": "CI Build",
            "status": "failure",
            "conclusion": "failure",
            "head_sha": "deadbeef12345678",
            "head_branch": "main",
            "html_url": "https://github.com/test-owner/test-repo/actions/runs/9001",
        },
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "workflow_run",
                "X-Gitea-Delivery": "test-delivery-wf",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "accepted"
        assert data["event_type"] == "workflow_run"
        assert "CI Build" in data["message"]


@pytest.mark.asyncio
async def test_webhook_workflow_run_success_ignored(webhook_secret):
    """測試: workflow_run success 應該被忽略（只關心失敗）"""
    payload = {
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "ci-bot", "id": 2},
        "workflow_run": {
            "id": 9002,
            "name": "CI Build",
            "status": "success",
            "conclusion": "success",
            "head_sha": "aabbccdd12345678",
            "head_branch": "main",
            "html_url": "https://github.com/test-owner/test-repo/actions/runs/9002",
        },
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "workflow_run",
                "X-Gitea-Delivery": "test-delivery-wf-ok",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "ignored"
        assert "not a failure" in data["message"]


@pytest.mark.asyncio
async def test_webhook_deploy_failure_detected(webhook_secret):
    """測試: workflow name 含 deploy → 事件標記為部署失敗（不同於構建失敗）"""
    payload = {
        "repository": {
            "id": 123456,
            "name": "test-repo",
            "full_name": "test-owner/test-repo",
            "private": False,
            "html_url": "https://github.com/test-owner/test-repo",
        },
        "sender": {"login": "ci-bot", "id": 2},
        "workflow_run": {
            "id": 9003,
            "name": "Deploy to Production",  # 含 deploy
            "status": "failure",
            "conclusion": "failure",
            "head_sha": "feed1234abcd5678",
            "head_branch": "main",
            "html_url": "https://github.com/test-owner/test-repo/actions/runs/9003",
        },
    }

    body, signature = prepare_request(webhook_secret, payload)

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "workflow_run",
                "X-Gitea-Delivery": "test-delivery-deploy",
                "X-Gitea-Signature": signature,
            },
        )

        assert response.status_code == 202
        data = response.json()
        assert data["status"] == "accepted"
        assert data["event_type"] == "workflow_run"


# =============================================================================
# 簽章格式測試
# =============================================================================

@pytest.mark.asyncio
async def test_webhook_wrong_signature_format(sample_pr_payload):
    """測試: 錯誤的簽章格式應該被拒絕"""
    body = json.dumps(sample_pr_payload, separators=(',', ':')).encode()

    async with httpx.AsyncClient(
        transport=ASGITransport(app=app),
        base_url="http://test",
    ) as client:
        response = await client.post(
            "/api/v1/webhooks/gitea",
            content=body,
            headers={
                "Content-Type": "application/json",
                "X-Gitea-Event": "pull_request",
                "X-Gitea-Delivery": "test-delivery-id",
                "X-Gitea-Signature": "md5=wrong_format",  # 錯誤格式
            },
        )

        assert response.status_code == 401


# =============================================================================
# 執行測試
# =============================================================================

if __name__ == "__main__":
    pytest.main([__file__, "-v"])