feat: upgrade the plugin to Gitlab 17.10

Author: ilijamt

README.md

@@ -17,7 +17,7 @@ through Vault.
 - Gitlab Personal Access Tokens - https://docs.gitlab.com/ee/api/personal_access_tokens.html
 - Gitlab Project Access Tokens - https://docs.gitlab.com/ee/api/project_access_tokens.html
 - Gitlab Group Access Tokens - https://docs.gitlab.com/ee/api/group_access_tokens.html
-- Gitlab User Service Account Tokens - https://docs.gitlab.com/ee/api/users.html#create-service-account-user
+- Gitlab User Service Account Tokens - https://docs.gitlab.com/api/user_service_accounts/
 - Gitlab Group Service Account Tokens - https://docs.gitlab.com/ee/api/group_service_accounts.html
 - Gitlab Pipeline Project Trigger Tokens - https://docs.gitlab.com/ee/api/pipeline_triggers.html
 - Gitlab Group/Project Deploy Tokens - https://docs.gitlab.com/ee/user/project/deploy_tokens
@@ -34,7 +34,7 @@ To learn specifically about how plugins work, see documentation on [Vault plugin
 
 ## GitLab
 
-- GitLab CE/EE - Self Managed
+- GitLab CE/EE - Self Managed (tested against 17.10.3)
 - gitlab.com (cannot use personal access token, and user service account)
 - Dedicated Instance (cannot use personal access token, and user service account)
 

defs_test.go

@@ -3,7 +3,6 @@
 package gitlab_test
 
 import (
-	"context"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -12,13 +11,13 @@ import (
 )
 
 func TestEmptyGitlabClientFromContext(t *testing.T) {
-	c, ok := gitlab.GitlabClientFromContext(context.Background())
+	c, ok := gitlab.GitlabClientFromContext(t.Context())
 	require.False(t, ok)
 	require.Nil(t, c)
 }
 
 func TestEmptyHttpClientFromContext(t *testing.T) {
-	c, ok := gitlab.HttpClientFromContext(context.Background())
+	c, ok := gitlab.HttpClientFromContext(t.Context())
 	require.False(t, ok)
 	require.Nil(t, c)
 }

gitlab_client_test.go

@@ -3,7 +3,6 @@
 package gitlab_test
 
 import (
-	"context"
 	"io"
 	"net/http"
 	"testing"
@@ -45,7 +44,7 @@ func TestGitlabClient(t *testing.T) {
 	})
 
 	t.Run("revoke service account token with empty token", func(t *testing.T) {
-		var ctx = context.Background()
+		var ctx = t.Context()
 		var client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
 			Token:   "token",
 			BaseURL: "https://example.com",
@@ -58,12 +57,13 @@ func TestGitlabClient(t *testing.T) {
 }
 
 func TestGitlabClient_InvalidToken(t *testing.T) {
-	ctx, timeExpiresAt := ctxTestTime(context.Background(), t.Name())
+	var tokenName = "super-secret-token"
+	ctx, timeExpiresAt := ctxTestTime(t.Context(), t.Name(), tokenName)
 	var err error
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "super-secret-token",
+		Token:   tokenName,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -101,12 +101,12 @@ func TestGitlabClient_InvalidToken(t *testing.T) {
 }
 
 func TestGitlabClient_RevokeToken_NotFound(t *testing.T) {
-	var ctx = context.Background()
+	var ctx = t.Context()
 	var err error
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken("admin_user_root").Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -120,12 +120,13 @@ func TestGitlabClient_RevokeToken_NotFound(t *testing.T) {
 }
 
 func TestGitlabClient_GetGroupIdByPath(t *testing.T) {
-	var ctx = context.Background()
+	var ctx = t.Context()
 	var err error
+	var tokenName = "admin_user_root"
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken(tokenName).Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -134,19 +135,19 @@ func TestGitlabClient_GetGroupIdByPath(t *testing.T) {
 
 	groupId, err := client.GetGroupIdByPath(ctx, "test")
 	require.NoError(t, err)
-	require.EqualValues(t, 37, groupId)
+	require.EqualValues(t, 3, groupId)
 
 	_, err = client.GetGroupIdByPath(ctx, "nonexistent")
 	require.ErrorIs(t, err, gitlab.ErrInvalidValue)
 }
 
 func TestGitlabClient_GetUserIdByUsername(t *testing.T) {
-	var ctx = context.Background()
+	var ctx = t.Context()
 	var err error
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken("admin_user_root").Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -160,11 +161,11 @@ func TestGitlabClient_GetUserIdByUsername(t *testing.T) {
 
 func TestGitlabClient_GetUserIdByUsernameDoesNotMatch(t *testing.T) {
 	var err error
-	var ctx = context.Background()
+	var ctx = t.Context()
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken("admin_user_root").Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -181,12 +182,12 @@ func TestGitlabClient_GetUserIdByUsernameDoesNotMatch(t *testing.T) {
 }
 
 func TestGitlabClient_Revoke_NonExistingTokens(t *testing.T) {
-	var ctx = context.Background()
+	var ctx = t.Context()
 	var err error
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken("admin_user_root").Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -200,11 +201,11 @@ func TestGitlabClient_Revoke_NonExistingTokens(t *testing.T) {
 
 func TestGitlabClient_CurrentTokenInfo(t *testing.T) {
 	var err error
-	var ctx = context.Background()
+	var ctx = t.Context()
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken("admin_user_root").Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -219,11 +220,11 @@ func TestGitlabClient_CurrentTokenInfo(t *testing.T) {
 
 func TestGitlabClient_Metadata(t *testing.T) {
 	var err error
-	var ctx = context.Background()
+	var ctx = t.Context()
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken("admin_user_root").Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -237,11 +238,12 @@ func TestGitlabClient_Metadata(t *testing.T) {
 
 func TestGitlabClient_CreateAccessToken_And_Revoke(t *testing.T) {
 	var err error
-	ctx, timeExpiresAt := ctxTestTime(context.Background(), t.Name())
+	var tokenName = "admin_user_root"
+	ctx, timeExpiresAt := ctxTestTime(t.Context(), t.Name(), tokenName)
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-random-token",
+		Token:   getGitlabToken(tokenName).Token,
 		BaseURL: url,
 	}, httpClient, nil)
 	require.NoError(t, err)
@@ -293,18 +295,19 @@ func TestGitlabClient_CreateAccessToken_And_Revoke(t *testing.T) {
 
 func TestGitlabClient_RotateCurrentToken(t *testing.T) {
 	var err error
-	var ctx = context.Background()
+	var ctx = t.Context()
 	httpClient, url := getClient(t, "unit")
 	var client gitlab.Client
+	var tokenName = "admin_user_auto_rotate_token_1"
 	client, err = gitlab.NewGitlabClient(&gitlab.EntryConfig{
-		Token:   "glpat-secret-admin-token-ar1",
+		Token:   getGitlabToken(tokenName).Token,
 		BaseURL: url,
 	}, httpClient, logging.NewVaultLoggerWithWriter(io.Discard, log.Trace))
 
 	require.NoError(t, err)
 	require.NotNil(t, client)
 	require.True(t, client.Valid(ctx))
-	ctx, _ = ctxTestTime(ctx, t.Name())
+	ctx, _ = ctxTestTime(ctx, t.Name(), tokenName)
 	newToken, oldToken, err := client.RotateCurrentToken(ctx)
 	require.NoError(t, err)
 	require.NotNil(t, newToken)

gitlab_record_client_test.go

@@ -19,6 +19,7 @@ func getClient(t *testing.T, target string) (client *http.Client, u string) {
 	filename := fmt.Sprintf("testdata/%s/%s", target, sanitizePath(t.Name()))
 	r, err := recorder.New(filename,
 		[]recorder.Option{
+			recorder.WithSkipRequestLatency(false),
 			recorder.WithMode(recorder.ModeRecordOnce),
 			recorder.WithMatcher(
 				cassette.NewDefaultMatcher(

helpers_test.go

@@ -5,6 +5,7 @@ package gitlab_test
 import (
 	"cmp"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -575,20 +576,45 @@ func sanitizePath(path string) string {
 
 func getCtxGitlabClient(t *testing.T, target string) context.Context {
 	httpClient, _ := getClient(t, target)
-	return gitlab.HttpClientNewContext(context.Background(), httpClient)
+	return gitlab.HttpClientNewContext(t.Context(), httpClient)
 }
 
 func getCtxGitlabClientWithUrl(t *testing.T, target string) (context.Context, string) {
 	httpClient, url := getClient(t, target)
-	return gitlab.HttpClientNewContext(context.Background(), httpClient), url
-}
-
-func ctxTestTime(ctx context.Context, tn string) (_ context.Context, t time.Time) {
-	switch tn {
-	case "TestGitlabClient_RotateCurrentToken", "TestWithGitlabUser_RotateToken":
-		t = time.Date(2024, 12, 12, 0, 0, 0, 0, time.UTC)
-	default:
-		t = time.Date(2025, 3, 12, 0, 0, 0, 0, time.UTC)
+	return gitlab.HttpClientNewContext(t.Context(), httpClient), url
+}
+
+func parseTimeFromFile(name string) (t time.Time, err error) {
+	var buff []byte
+	if buff, err = os.ReadFile(fmt.Sprintf("./testdata/%s", name)); err != nil {
+		return t, err
+	}
+	return time.Parse(time.RFC3339, string(buff))
+}
+
+func ctxTestTime(ctx context.Context, testName string, tokenName string) (_ context.Context, t time.Time) {
+	var token = getGitlabToken(tokenName)
+	if token.Empty() {
+		var err error
+		switch testName {
+		case "TestGitlabClient_InvalidToken":
+			// no token for this test
+		case "TestWithGitlabUser_RotateToken":
+			if t, err = parseTimeFromFile("gitlab-com"); err != nil {
+				panic(err)
+			}
+		case "TestWithServiceAccountUser",
+			"TestWithServiceAccountGroup",
+			"TestWithServiceAccountUserFail_dedicated",
+			"TestWithServiceAccountUserFail_saas":
+			if t, err = parseTimeFromFile("gitlab-selfhosted"); err != nil {
+				panic(err)
+			}
+		default:
+			panic(fmt.Errorf("unknown test name %s", testName))
+		}
+	} else {
+		t = token.CreatedAtTime()
 	}
 	return gitlab.WithStaticTime(ctx, t), t
 }
@@ -604,3 +630,42 @@ func filterSlice[T any, Slice ~[]T](collection Slice, predicate func(item T, ind
 
 	return result
 }
+
+type generatedToken struct {
+	ID        string `json:"id"`
+	Token     string `json:"token"`
+	CreatedAt string `json:"created_at"`
+}
+
+func (g generatedToken) Empty() bool {
+	return generatedToken{} == g
+}
+
+const (
+	gitlabTimeLayout = "2006-01-02 15:04:05.000 -0700 MST"
+)
+
+func (g generatedToken) CreatedAtTime() (t time.Time) {
+	t, _ = time.Parse(gitlabTimeLayout, g.CreatedAt)
+	return t
+}
+
+type generatedTokens map[string]generatedToken
+
+var loadTokens = sync.OnceValues(func() (t generatedTokens, err error) {
+	var payload []byte
+	if payload, err = os.ReadFile("./testdata/tokens.json"); err != nil {
+		return t, err
+	}
+
+	err = json.Unmarshal(payload, &t)
+	return t, err
+})
+
+func getGitlabToken(name string) generatedToken {
+	var tokens, _ = loadTokens()
+	if token, ok := tokens[name]; ok {
+		return token
+	}
+	return generatedToken{}
+}

local-env/README.md

@@ -1,22 +1,23 @@
-Local Environment
------------------
+## Local Environment
 
-To be able to run the tests against a real Gitlab instance, just run.
+To run tests against a real GitLab instance, follow the steps below.
 
-```shell
-bash initial-setup.sh
-```
+### Initial Setup
 
-This should setup a Gitlab instance that is fully configured for the tests locally. 
+1. **Run the setup script:**
 
-As configuring takes quite a bit of time. After the first start you can run the command bellow.
+   This command will set up a GitLab instance that is fully configured for testing locally.
 
-```shell
-bash backup-volumes.sh
+```bash
+bash initial-setup.sh
 ```
 
-And to restore it back to the original setting 
+   **Note:** Setting up the GitLab instance might take some time. After the setup, a complete backup of the PostgreSQL database will be created to facilitate quick restoration if needed.
 
-```shell
+### Restoring the Environment
+
+If you need to restore the GitLab instance back to its original configuration, use the following command:
+
+```bash
 bash restore-volumes.sh
-```
+```

local-env/backup-volumes.sh

@@ -2,6 +2,7 @@
 
 set -x
 
+rm backup.tar
 docker compose stop
 docker run --rm --volumes-from vpsg-web-1 -v $(pwd):/backup ubuntu tar cvf /backup/backup.tar /etc/gitlab /var/opt/gitlab/postgresql/
 docker compose up -d

local-env/docker-compose.yml

@@ -1,7 +1,7 @@
 name: vpsg
 services:
   web:
-    image: 'gitlab/gitlab-ce:16.11.6-ce.0'
+    image: 'gitlab/gitlab-ce:17.10.3-ce.0'
     environment:
       GITLAB_OMNIBUS_CONFIG: |
         gitlab_rails['gitlab_shell_ssh_port'] = 2224