diff --git a/pygitweb/src/pygitweb/auth.py b/pygitweb/src/pygitweb/auth.py index 3c3db35..d46fff7 100644 --- a/pygitweb/src/pygitweb/auth.py +++ b/pygitweb/src/pygitweb/auth.py @@ -87,7 +87,7 @@ class SmartHttpCredentials: class PresentedHttpKey: principal: PermissionPrincipal readonly: bool - tail: str + key_id: str expired: bool @@ -344,8 +344,8 @@ def _key_owner_name(principal: PermissionPrincipal) -> str: def _http_key_actor(matched: PresentedHttpKey) -> str: owner = _key_owner_name(matched.principal) if matched.expired: - return f"{owner} {matched.tail} (EXPIRED)" - return f"{owner} {matched.tail}" + return f"{owner} {matched.key_id} (EXPIRED)" + return f"{owner} {matched.key_id}" def match_presented_http_key(username: str, password: str) -> PresentedHttpKey | None: @@ -353,7 +353,6 @@ def match_presented_http_key(username: str, password: str) -> PresentedHttpKey | presented_secret = password.strip() if not presented_user or not presented_secret: return None - tail = presented_secret[-4:] now = datetime.now(UTC) expired_match: PresentedHttpKey | None = None for entry in auth_config.local_users: @@ -368,11 +367,16 @@ def match_presented_http_key(username: str, password: str) -> PresentedHttpKey | expired_match = PresentedHttpKey( principal=principal, readonly=key.readonly, - tail=tail, + key_id=key.id, expired=True, ) continue - return PresentedHttpKey(principal=principal, readonly=key.readonly, tail=tail, expired=False) + return PresentedHttpKey( + principal=principal, + readonly=key.readonly, + key_id=key.id, + expired=False, + ) return expired_match diff --git a/pygitweb/src/pygitweb/smart_http_test.py b/pygitweb/src/pygitweb/smart_http_test.py index cce9c5b..5d41eb8 100644 --- a/pygitweb/src/pygitweb/smart_http_test.py +++ b/pygitweb/src/pygitweb/smart_http_test.py @@ -816,10 +816,12 @@ class TestSmartHttpLogFile: def test_append_keeps_earlier_lines_and_restricts_mode(self, tmp_path: Path) -> None: path = tmp_path / ".pygitweb" / "smart_http.log" with patch("pygitweb.smart_http.smart_http_log_path", return_value=path): - append_smart_http_log("203.0.113.8", "alice@example.com abcd", project="demo", operation="git-upload-pack") + append_smart_http_log( + "203.0.113.8", "alice@example.com laptop", project="demo", operation="git-upload-pack" + ) append_smart_http_log("203.0.113.9", "INVALID_KEY", project="demo", operation="git-receive-pack") lines = path.read_text(encoding="utf-8").splitlines() - assert lines[0].endswith(" 203.0.113.8 demo git-upload-pack alice@example.com abcd") + assert lines[0].endswith(" 203.0.113.8 demo git-upload-pack alice@example.com laptop") assert lines[1].endswith(" 203.0.113.9 demo git-receive-pack INVALID_KEY") assert path.read_bytes().endswith(b"INVALID_KEY\n") if sys.platform != "win32": @@ -827,7 +829,7 @@ class TestSmartHttpLogFile: class TestSmartHttpAccessLog: - def test_each_route_logs_owner_email_and_key_tail(self, http_repo_env: dict[str, str]) -> None: + def test_each_route_logs_owner_email_and_key_id(self, http_repo_env: dict[str, str]) -> None: client = TestClient(app) project = http_repo_env["project"] with _auth_enabled(_user_with_keys()): @@ -865,10 +867,10 @@ class TestSmartHttpAccessLog: "git-receive-pack", ) for line, operation in zip(lines, operations, strict=True): - _assert_log_line(line, "alice@example.com -key", project=project, operation=operation) + _assert_log_line(line, "alice@example.com laptop", project=project, operation=operation) assert _WRITE_KEY not in line - def test_broken_key_logs_invalid_key_and_expired_key_marks_tail(self, http_repo_env: dict[str, str]) -> None: + def test_broken_key_logs_invalid_key_and_expired_key_marks_id(self, http_repo_env: dict[str, str]) -> None: now = datetime.now(UTC) cfg = _user_with_keys() user = cfg.local_users[0] @@ -915,10 +917,10 @@ class TestSmartHttpAccessLog: lines = _log_lines(http_repo_env)[before:] assert len(lines) == 4 operation = "info/refs?service=git-upload-pack" - _assert_log_line(lines[0], "alice@example.com -key (EXPIRED)", project=project, operation=operation) + _assert_log_line(lines[0], "alice@example.com old (EXPIRED)", project=project, operation=operation) _assert_log_line(lines[1], "INVALID_KEY", project=project, operation=operation) _assert_log_line(lines[2], "INVALID_KEY", project=project, operation=operation) - _assert_log_line(lines[3], "alice@example.com -key", project=project, operation=operation) + _assert_log_line(lines[3], "alice@example.com ci", project=project, operation=operation) logged = "\n".join(lines) assert _WRITE_KEY not in logged assert _READ_KEY not in logged @@ -955,7 +957,7 @@ class TestSmartHttpAccessLog: _assert_log_line(lines[1], "alice", project=project, operation="git-upload-pack") _assert_log_line(lines[2], None, project=project, operation="info/refs?service=git-receive-pack") _assert_log_line( - lines[3], "alice@example.com -key", project=project, operation="info/refs?service=git-upload-pack" + lines[3], "alice@example.com laptop", project=project, operation="info/refs?service=git-upload-pack" ) def test_open_fetch_logs_ip_only(self, http_repo_env: dict[str, str]) -> None: @@ -972,7 +974,7 @@ class TestSmartHttpAccessLog: lines[0], None, project=http_repo_env["project"], operation="info/refs?service=git-upload-pack" ) - def test_session_logs_email_without_a_key_tail(self, http_repo_env: dict[str, str]) -> None: + def test_session_logs_email_without_a_key_id(self, http_repo_env: dict[str, str]) -> None: client = TestClient(app) with _auth_enabled(_user_with_keys()): token = create_session("alice", email="alice@example.com", auth_method="local") @@ -1017,7 +1019,7 @@ class TestSmartHttpAccessLog: assert len(lines) == 1 _assert_log_line( lines[0], - "bob cret", + "bob bob-key", project=http_repo_env["project"], operation="info/refs?service=git-upload-pack", )