ui-ci: let a ci-filter decide whether the tab is shown

cgit cannot know whether the ref being viewed actually has a pipeline, so
the "ci" tab is offered for every ref and only reveals a missing one once
followed. Probing the ci system from cgit is not an option: the tab is
part of the page header, so it would mean a blocking request for every
page of every repository, cgit links no http client, and job pages are
usually not readable anonymously.

Add a ci filter instead, which receives the ref, whether it is a branch or
a tag, and the expanded url, and answers with its exit status. This keeps
credentials, timeouts and caching in a script, where they belong;
filters/ci-jenkins.sh demonstrates all three against Jenkins' REST API.

The verdict is memoized, so the filter runs once per request rather than
once for the tab and again for the redirect, and it governs the page as
well as the tab, so a hidden tab cannot be reached by typing the url.

Signed-off-by: Saya Andy <saya.andy@posteo.com>

2 files changed, 122 insertions, 0 deletions

diff --git a/tests/t0112-ci.sh b/tests/t0112-ci.sh
index d8673e4..33609d6 100644
--- a/tests/t0112-ci.sh
+++ b/tests/t0112-ci.sh
@@ -10,6 +10,7 @@ cat >cgitrc.ci <<EOF
 virtual-root=/
 cache-root=$PWD/cache
 cache-size=0
+enable-filter-overrides=1
 
 repo.url=tagonly
 repo.path=$PWD/repos/foo/.git
@@ -27,8 +28,20 @@ repo.path=$PWD/repos/foo/.git
 repo.url=override
 repo.path=$PWD/repos/foo/.git
 repo.ci-url=https://ci.example.org/override/\$repo/\$\$/\$ref
+
+repo.url=filtered
+repo.path=$PWD/repos/foo/.git
+repo.ci-filter=exec:$PWD/ci-filter.sh
 EOF
 
+# Records its arguments and only accepts tags.
+cat >ci-filter.sh <<EOF
+#!/bin/sh
+printf '%s|%s|%s\n' "\$1" "\$2" "\$3" >>"$PWD/ci-filter.log"
+test "\$2" = tag
+EOF
+chmod +x ci-filter.sh
+
 git --git-dir="$PWD/repos/foo/.git" tag v0.17.3.2 master
 
 cgit_ci()
@@ -80,4 +93,35 @@ test_expect_success 'no ci tab without a ci url' '
 	! grep ">ci</a>" tmp
 '
 
+test_expect_success 'ci filter accepts a tag' '
+	rm -f ci-filter.log &&
+	cgit_ci "filtered/ci&h=v0.17.3.2" >tmp &&
+	grep "^Location: https://ci.example.org/job/filtered/view/tags/job/v0.17.3.2$" tmp &&
+	echo "v0.17.3.2|tag|https://ci.example.org/job/filtered/view/tags/job/v0.17.3.2" >expected &&
+	test_cmp expected ci-filter.log
+'
+
+test_expect_success 'ci filter rejects a branch' '
+	rm -f ci-filter.log &&
+	cgit_ci "filtered/ci&h=master" >tmp &&
+	grep "^Status: 404 Not found$" tmp &&
+	echo "master|branch|https://ci.example.org/job/filtered/job/master" >expected &&
+	test_cmp expected ci-filter.log
+'
+
+test_expect_success "ci filter hides the tab and is consulted once" '
+	rm -f ci-filter.log &&
+	cgit_ci "filtered/refs&h=master" >tmp &&
+	! grep ">ci</a>" tmp &&
+	test_line_count = 1 ci-filter.log &&
+	cgit_ci "filtered/refs&h=v0.17.3.2" >tmp &&
+	grep "href=./filtered/ci/?h=v0.17.3.2.>ci</a>" tmp
+'
+
+test_expect_success 'ci filter is not consulted without a ci url' '
+	rm -f ci-filter.log &&
+	cgit_url "foo/refs" >tmp &&
+	test_path_is_missing ci-filter.log
+'
+
 test_done
diff --git a/tests/t0113-ci-lua.sh b/tests/t0113-ci-lua.sh
new file mode 100644
index 0000000..1e095b1
--- /dev/null
+++ b/tests/t0113-ci-lua.sh
@@ -0,0 +1,78 @@
+#!/bin/sh
+
+test_description='Check ci filter written in Lua'
+. ./setup.sh
+
+if test $CGIT_HAS_LUA -ne 1
+then
+	skip_all='Skipping Lua ci filter tests: Lua support not compiled in'
+	test_done
+	exit
+fi
+
+cat >cgitrc.cilua <<EOF
+virtual-root=/
+cache-root=$PWD/cache
+cache-size=0
+
+ci-url=https://ci.example.org/job/\$slug/job/\$ref
+ci-filter=lua:$PWD/ci-filter.lua
+
+repo.url=foo
+repo.path=$PWD/repos/foo/.git
+EOF
+
+# Accepts tags only, and records its arguments.
+cat >ci-filter.lua <<EOF
+function filter_open(ref, refkind, url)
+	local log = io.open("$PWD/ci-filter.log", "a")
+	log:write(ref .. "|" .. refkind .. "|" .. url .. "\n")
+	log:close()
+	accepted = (refkind == "tag")
+end
+
+function filter_write(buffer)
+end
+
+function filter_close()
+	if accepted then
+		return 0
+	end
+	return 1
+end
+EOF
+
+git --git-dir="$PWD/repos/foo/.git" tag v1.0 master
+
+cgit_ci()
+{
+	CGIT_CONFIG="$PWD/cgitrc.cilua" QUERY_STRING="url=$1" cgit
+}
+
+test_expect_success 'Lua ci filter accepts a tag' '
+	rm -f ci-filter.log &&
+	cgit_ci "foo/ci&h=v1.0" >tmp &&
+	grep "^Location: https://ci.example.org/job/foo/job/v1.0$" tmp &&
+	echo "v1.0|tag|https://ci.example.org/job/foo/job/v1.0" >expected &&
+	test_cmp expected ci-filter.log
+'
+
+test_expect_success 'Lua ci filter rejects a branch' '
+	cgit_ci "foo/ci&h=master" >tmp &&
+	grep "^Status: 404 Not found$" tmp
+'
+
+test_expect_success 'Lua ci filter controls the tab' '
+	cgit_ci "foo/refs&h=v1.0" >tmp &&
+	grep "href=./foo/ci/?h=v1.0.>ci</a>" tmp &&
+	cgit_ci "foo/refs&h=master" >tmp &&
+	! grep ">ci</a>" tmp
+'
+
+test_expect_success 'page is still rendered correctly around the filter' '
+	cgit_ci "foo/refs&h=v1.0" >tmp &&
+	grep "</html>" tmp &&
+	! grep "|tag|" tmp
+'
+
+test_done