
This patch is mainly intended to fix forgejo/forgejo#7721, and to fix forgejo/forgejo#9019. It also changes the evaluation of 0 limits to prevent all writes, instead of allowing one write and then failing on subsequent writes after the limit has been exceeded. This matches the expectation of the existing tests, and I believe it will better match the expectations of users. Tests have been updated accordingly where necessary, and some additional test coverage added. The fixes in this PR depend on each other in order for the quota system to function correctly, so I'm submitting them as a single PR instead of individually. ## Test Cases ### Quota subjects not covered by their parent subjects Before enabling quotas, create a test user and test repository for that user. Enable quotas, and set a default total to some large value. (Do not use unit suffixes forgejo/forgejo#8996) ```ini [quota] ENABLED = true [quota.default] TOTAL = 1073741824 ``` With the test user, navigate to "Storage overview" and verify that the quota group "Global quota" is the only group listed, containing the rule "Default", and displays the configured limit, and that the limit has not been exceeded (eg. `42 MiB / 1 GiB`). The default quota rule has the subject `size:all`, so any write action should be allowed. #### Attempt to create a new repository. Expected result: Repository is created. Actual result: Error 413, You have exhausted your quota. #### Attempt to create a new file in the existing repository. Expected result: File is created. Actual result: Error 413, You have exhausted your quota. #### Create an issue on the test repository, and attempt to upload an image to the issue. Expected result: Image is uploaded. Actual Result: Quota exceeded. Displays error message: `JavaScript promise rejection: can't access property "submitted", oi[ji.uuid] is undefined. Open browser console to see more details.` ### Unlimited quota rules incorrectly allow all writes With quotas enabled, [Use the API](https://forgejo.org/docs/latest/admin/advanced/quota/#advanced-usage-via-api) to create a quota group containing a single rule with a subject of `sizelfs`, and a limit of `-1` (Unlimited). Add the test user to this group. ```json { "name": "git-lfs-unlimited", "rules": [ { "name": "git-lfs-unlimited", "limit": -1, "subjects": ["size
lfs"] } ] } ``` With the test user, navigate to "Storage overview" and verify that the user has been added to this group, that it is the only group the user is assigned to, and that the rule limit displays as "Unlimited". The user should only have the ability to write to Git LFS storage, all other writes should be denied. #### Attempt to create a new repository. Expected result: Error 413, You have exhausted your quota. Actual result: Repository is created. #### Attempt to create a new file in the test repository. Expected result: Error 413, You have exhausted your quota. Actual result: File is created. #### Create an issue on the test repository, and attempt to upload an image to the issue. Expected Result: Quota exceeded. Actual result: Image is uploaded. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9033 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: Brook Miles <brook@noreply.codeberg.org> Co-committed-by: Brook Miles <brook@noreply.codeberg.org>
315 lines
7.7 KiB
Go
315 lines
7.7 KiB
Go
// Copyright 2024 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package quota_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
quota_model "forgejo.org/models/quota"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func makeFullyUsed() quota_model.Used {
|
|
return quota_model.Used{
|
|
Size: quota_model.UsedSize{
|
|
Repos: quota_model.UsedSizeRepos{
|
|
Public: 1024,
|
|
Private: 1024,
|
|
},
|
|
Git: quota_model.UsedSizeGit{
|
|
LFS: 1024,
|
|
},
|
|
Assets: quota_model.UsedSizeAssets{
|
|
Attachments: quota_model.UsedSizeAssetsAttachments{
|
|
Issues: 1024,
|
|
Releases: 1024,
|
|
},
|
|
Artifacts: 1024,
|
|
Packages: quota_model.UsedSizeAssetsPackages{
|
|
All: 1024,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func makePartiallyUsed() quota_model.Used {
|
|
return quota_model.Used{
|
|
Size: quota_model.UsedSize{
|
|
Repos: quota_model.UsedSizeRepos{
|
|
Public: 1024,
|
|
},
|
|
Assets: quota_model.UsedSizeAssets{
|
|
Attachments: quota_model.UsedSizeAssetsAttachments{
|
|
Releases: 1024,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func setUsed(used quota_model.Used, subject quota_model.LimitSubject, value int64) *quota_model.Used {
|
|
switch subject {
|
|
case quota_model.LimitSubjectSizeReposPublic:
|
|
used.Size.Repos.Public = value
|
|
return &used
|
|
case quota_model.LimitSubjectSizeReposPrivate:
|
|
used.Size.Repos.Private = value
|
|
return &used
|
|
case quota_model.LimitSubjectSizeGitLFS:
|
|
used.Size.Git.LFS = value
|
|
return &used
|
|
case quota_model.LimitSubjectSizeAssetsAttachmentsIssues:
|
|
used.Size.Assets.Attachments.Issues = value
|
|
return &used
|
|
case quota_model.LimitSubjectSizeAssetsAttachmentsReleases:
|
|
used.Size.Assets.Attachments.Releases = value
|
|
return &used
|
|
case quota_model.LimitSubjectSizeAssetsArtifacts:
|
|
used.Size.Assets.Artifacts = value
|
|
return &used
|
|
case quota_model.LimitSubjectSizeAssetsPackagesAll:
|
|
used.Size.Assets.Packages.All = value
|
|
return &used
|
|
case quota_model.LimitSubjectSizeWiki:
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func assertEvaluation(t *testing.T, rule quota_model.Rule, used quota_model.Used, subject quota_model.LimitSubject, expected bool) {
|
|
t.Helper()
|
|
|
|
t.Run(subject.String(), func(t *testing.T) {
|
|
match, allow := rule.Evaluate(used, subject)
|
|
assert.True(t, match)
|
|
assert.Equal(t, expected, allow)
|
|
})
|
|
}
|
|
|
|
func TestQuotaRuleNoMatch(t *testing.T) {
|
|
testSets := []struct {
|
|
name string
|
|
limit int64
|
|
}{
|
|
{"unlimited", -1},
|
|
{"limit-0", 0},
|
|
{"limit-1k", 1024},
|
|
{"limit-1M", 1024 * 1024},
|
|
}
|
|
|
|
for _, testSet := range testSets {
|
|
t.Run(testSet.name, func(t *testing.T) {
|
|
rule := quota_model.Rule{
|
|
Limit: testSet.limit,
|
|
Subjects: quota_model.LimitSubjects{
|
|
quota_model.LimitSubjectSizeAssetsAttachmentsAll,
|
|
},
|
|
}
|
|
used := quota_model.Used{}
|
|
used.Size.Repos.Public = 4096
|
|
|
|
match, allow := rule.Evaluate(used, quota_model.LimitSubjectSizeReposAll)
|
|
|
|
// We have a rule for "size:assets:attachments:all", and query for
|
|
// "size:repos:all". We don't cover that subject, so the rule does not match
|
|
// regardless of the limit.
|
|
assert.False(t, match)
|
|
assert.False(t, allow)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestQuotaRuleDirectEvaluation(t *testing.T) {
|
|
// This function is meant to test direct rule evaluation: cases where we set
|
|
// a rule for a subject, and we evaluate against the same subject.
|
|
|
|
runTest := func(t *testing.T, subject quota_model.LimitSubject, limit, used int64, expected bool) {
|
|
t.Helper()
|
|
|
|
rule := quota_model.Rule{
|
|
Limit: limit,
|
|
Subjects: quota_model.LimitSubjects{
|
|
subject,
|
|
},
|
|
}
|
|
usedObj := setUsed(quota_model.Used{}, subject, used)
|
|
if usedObj == nil {
|
|
return
|
|
}
|
|
|
|
assertEvaluation(t, rule, *usedObj, subject, expected)
|
|
}
|
|
|
|
t.Run("limit:0", func(t *testing.T) {
|
|
// With limit:0, any usage will fail evaluation, including 0
|
|
t.Run("used:0", func(t *testing.T) {
|
|
for subject := quota_model.LimitSubjectFirst; subject <= quota_model.LimitSubjectLast; subject++ {
|
|
runTest(t, subject, 0, 0, false)
|
|
}
|
|
})
|
|
t.Run("used:512", func(t *testing.T) {
|
|
for subject := quota_model.LimitSubjectFirst; subject <= quota_model.LimitSubjectLast; subject++ {
|
|
runTest(t, subject, 0, 512, false)
|
|
}
|
|
})
|
|
})
|
|
|
|
t.Run("limit:unlimited", func(t *testing.T) {
|
|
// With no limits, any usage will succeed evaluation
|
|
t.Run("used:512", func(t *testing.T) {
|
|
for subject := quota_model.LimitSubjectFirst; subject <= quota_model.LimitSubjectLast; subject++ {
|
|
runTest(t, subject, -1, 512, true)
|
|
}
|
|
})
|
|
})
|
|
|
|
t.Run("limit:1024", func(t *testing.T) {
|
|
// With a set limit, usage below the limit succeeds
|
|
t.Run("used:512", func(t *testing.T) {
|
|
for subject := quota_model.LimitSubjectFirst; subject <= quota_model.LimitSubjectLast; subject++ {
|
|
runTest(t, subject, 1024, 512, true)
|
|
}
|
|
})
|
|
|
|
// With a set limit, usage above the limit fails
|
|
t.Run("used:2048", func(t *testing.T) {
|
|
for subject := quota_model.LimitSubjectFirst; subject <= quota_model.LimitSubjectLast; subject++ {
|
|
runTest(t, subject, 1024, 2048, false)
|
|
}
|
|
})
|
|
})
|
|
}
|
|
|
|
func TestQuotaRuleCombined(t *testing.T) {
|
|
used := quota_model.Used{
|
|
Size: quota_model.UsedSize{
|
|
Repos: quota_model.UsedSizeRepos{
|
|
Public: 4096,
|
|
},
|
|
Git: quota_model.UsedSizeGit{
|
|
LFS: 256,
|
|
},
|
|
Assets: quota_model.UsedSizeAssets{
|
|
Attachments: quota_model.UsedSizeAssetsAttachments{
|
|
Issues: 2048,
|
|
Releases: 256,
|
|
},
|
|
Packages: quota_model.UsedSizeAssetsPackages{
|
|
All: 2560,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
expectMatch := map[quota_model.LimitSubject]bool{
|
|
quota_model.LimitSubjectSizeGitLFS: true,
|
|
quota_model.LimitSubjectSizeAssetsAttachmentsReleases: true,
|
|
quota_model.LimitSubjectSizeAssetsPackagesAll: true,
|
|
}
|
|
|
|
testSets := []struct {
|
|
name string
|
|
limit int64
|
|
expectAllow bool
|
|
}{
|
|
{"unlimited", -1, true},
|
|
{"limit-allow", 1024 * 1024, true},
|
|
{"limit-deny", 1024, false},
|
|
}
|
|
|
|
for _, testSet := range testSets {
|
|
t.Run(testSet.name, func(t *testing.T) {
|
|
rule := quota_model.Rule{
|
|
Limit: testSet.limit,
|
|
Subjects: quota_model.LimitSubjects{
|
|
quota_model.LimitSubjectSizeGitLFS,
|
|
quota_model.LimitSubjectSizeAssetsAttachmentsReleases,
|
|
quota_model.LimitSubjectSizeAssetsPackagesAll,
|
|
},
|
|
}
|
|
|
|
for subject := quota_model.LimitSubjectFirst; subject <= quota_model.LimitSubjectLast; subject++ {
|
|
t.Run(subject.String(), func(t *testing.T) {
|
|
match, allow := rule.Evaluate(used, subject)
|
|
|
|
assert.Equal(t, expectMatch[subject], match)
|
|
if expectMatch[subject] {
|
|
assert.Equal(t, testSet.expectAllow, allow)
|
|
} else {
|
|
assert.False(t, allow)
|
|
}
|
|
})
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestQuotaRuleSizeAll(t *testing.T) {
|
|
type Test struct {
|
|
name string
|
|
limit int64
|
|
expectAllow bool
|
|
}
|
|
|
|
usedSets := []struct {
|
|
name string
|
|
used quota_model.Used
|
|
testSets []Test
|
|
}{
|
|
{
|
|
"empty",
|
|
quota_model.Used{},
|
|
[]Test{
|
|
{"unlimited", -1, true},
|
|
{"limit-1M", 1024 * 1024, true},
|
|
{"limit-5k", 5 * 1024, true},
|
|
{"limit-0", 0, false},
|
|
},
|
|
},
|
|
{
|
|
"partial",
|
|
makePartiallyUsed(),
|
|
[]Test{
|
|
{"unlimited", -1, true},
|
|
{"limit-1M", 1024 * 1024, true},
|
|
{"limit-5k", 5 * 1024, true},
|
|
{"limit-0", 0, false},
|
|
},
|
|
},
|
|
{
|
|
"full",
|
|
makeFullyUsed(),
|
|
[]Test{
|
|
{"unlimited", -1, true},
|
|
{"limit-1M", 1024 * 1024, true},
|
|
{"limit-5k", 5 * 1024, false},
|
|
{"limit-0", 0, false},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, usedSet := range usedSets {
|
|
t.Run(usedSet.name, func(t *testing.T) {
|
|
testSets := usedSet.testSets
|
|
used := usedSet.used
|
|
|
|
for _, testSet := range testSets {
|
|
t.Run(testSet.name, func(t *testing.T) {
|
|
rule := quota_model.Rule{
|
|
Limit: testSet.limit,
|
|
Subjects: quota_model.LimitSubjects{
|
|
quota_model.LimitSubjectSizeAll,
|
|
},
|
|
}
|
|
|
|
match, allow := rule.Evaluate(used, quota_model.LimitSubjectSizeAll)
|
|
assert.True(t, match)
|
|
assert.Equal(t, testSet.expectAllow, allow)
|
|
})
|
|
}
|
|
})
|
|
}
|
|
}
|