Host workspace repositories on Central Gitea

test/resource-lock.test.ts

@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  formatQuixosLock,
+  nixGitInput,
+  parseQuixosLock,
+  retentionTagForCommit,
+} from "../src/resource-lock/index.js";
+
+const quixosCommit = "1".repeat(40);
+const namedCommit = "2".repeat(40);
+const packageCommit = "3".repeat(64);
+const fixture = `quixos-lock version 1 {
+  quixos source {
+    repository "https://gitea.example/quixos/quixos.git";
+    commit "${quixosCommit}";
+  }
+
+  interface Named source {
+    repository "https://repos.example/alice/interface-named.git";
+    commit "${namedCommit}";
+  }
+
+  package TodoRuntime source {
+    repository "ssh://git@repos.example/alice/package-todo-runtime.git";
+    commit "${packageCommit}";
+  }
+}
+`;
+
+test("parses and canonically formats a Git-only repository lock", () => {
+  const parsed = parseQuixosLock(fixture, "quixos.lock");
+  assert.equal(parsed.ok, true);
+  if (!parsed.ok) return;
+  assert.equal(parsed.lock.formatVersion, 1);
+  assert.equal(parsed.lock.quixos.commit, quixosCommit);
+  assert.deepEqual(
+    parsed.lock.resources.map(({ kind, binding }) => ({ kind, binding })),
+    [
+      { kind: "interface", binding: "Named" },
+      { kind: "package", binding: "TodoRuntime" },
+    ],
+  );
+  assert.deepEqual(parseQuixosLock(formatQuixosLock(parsed.lock)), {
+    ok: true,
+    lock: parsed.lock,
+    diagnostics: [],
+  });
+});
+
+test("derives immutable retention and Nix inputs without storing extra identity", () => {
+  const source = {
+    resolver: "git" as const,
+    repository: "https://repos.example/alice/interface-named.git",
+    commit: namedCommit,
+  };
+  const ref = `refs/tags/quixos-reachability/${namedCommit}`;
+  assert.equal(retentionTagForCommit(namedCommit.toUpperCase()), ref);
+  assert.deepEqual(nixGitInput(source), {
+    type: "git",
+    url: source.repository,
+    ref,
+    rev: namedCommit,
+  });
+});
+
+test("rejects mutable revisions, embedded credentials, and duplicate bindings", () => {
+  const parsed = parseQuixosLock(`quixos-lock version 1 {
+    quixos source {
+      repository "https://user:secret@example/quixos.git";
+      commit "main";
+    }
+    interface Named source {
+      repository "file:///tmp/named";
+      commit "${namedCommit}";
+    }
+    interface Named source {
+      repository "https://repos.example/named.git";
+      commit "${namedCommit}";
+    }
+  }`);
+  assert.equal(parsed.ok, false);
+  if (parsed.ok) return;
+  assert.deepEqual(
+    new Set(parsed.diagnostics.map((entry) => entry.code)),
+    new Set([
+      "invalid-git-commit",
+      "embedded-git-credential",
+      "unsupported-git-transport",
+      "duplicate-resource-binding",
+    ]),
+  );
+});