Switch Gitea connection validation to repository access

tests/Feature/Git/GiteaProviderTest.php

@@ -15,6 +15,27 @@ class GiteaProviderTest extends TestCase
 {
     use RefreshDatabase;
 
+    /**
+     * Ensure the provider can verify repository read access with minimal payload.
+     */
+    public function test_provider_can_verify_repository_read_access(): void
+    {
+        Http::preventStrayRequests();
+        Http::fake([
+            'https://git.example.test/api/v1/user/repos*' => Http::response([]),
+        ]);
+
+        app(GiteaProviderClient::class)->verifyRepositoryAccess(
+            'https://git.example.test',
+            'repo-token',
+        );
+
+        Http::assertSent(function ($request): bool {
+            return $request->url() === 'https://git.example.test/api/v1/user/repos?limit=1&page=1'
+                && $request->hasHeader('Authorization', 'token repo-token');
+        });
+    }
+
     /**
      * Ensure the provider authenticates against the Gitea user endpoint.
      */

tests/Feature/Settings/GitConnectionTest.php

@@ -37,17 +37,16 @@ class GitConnectionTest extends TestCase
     }
 
     /**
-     * Ensure a user can add a verified Gitea connection from settings.
+     * Ensure a user can add a verified Gitea connection with repository-only access.
      */
-    public function test_users_can_store_verified_gitea_connections(): void
+    public function test_users_can_store_verified_gitea_connections_with_repository_only_access(): void
     {
         Http::preventStrayRequests();
         Http::fake([
+            'https://git.example.test/api/v1/user/repos*' => Http::response([]),
             'https://git.example.test/api/v1/user' => Http::response([
-                'id' => 101,
-                'login' => 'nico',
-                'full_name' => 'Nico Example',
-            ]),
+                'message' => 'Forbidden',
+            ], 403),
         ]);
 
         $user = User::factory()->create();
@@ -61,6 +60,42 @@ class GitConnectionTest extends TestCase
             ->assertRedirect(route('git-connections.edit'))
             ->assertSessionHas('status', 'Git connection was added.');
 
+        $this->assertDatabaseHas('user_git_connections', [
+            'user_id' => $user->id,
+            'provider' => GitProviderKey::Gitea->value,
+            'base_url' => 'https://git.example.test',
+            'provider_user_id' => '',
+            'account_login' => 'git.example.test',
+            'account_name' => null,
+        ]);
+    }
+
+    /**
+     * Ensure a user connection stores authenticated user metadata when it is available.
+     */
+    public function test_users_can_store_authenticated_user_metadata_when_available(): void
+    {
+        Http::preventStrayRequests();
+        Http::fake([
+            'https://git.example.test/api/v1/user/repos*' => Http::response([]),
+            'https://git.example.test/api/v1/user' => Http::response([
+                'id' => 101,
+                'login' => 'nico',
+                'full_name' => 'Nico Example',
+            ]),
+        ]);
+
+        $user = User::factory()->create();
+
+        $this->actingAs($user)
+            ->post(route('git-connections.store'), [
+                'provider' => 'gitea',
+                'base_url' => 'https://git.example.test',
+                'api_token' => 'super-secret-token',
+            ])
+            ->assertRedirect(route('git-connections.edit'))
+            ->assertSessionHas('status', 'Git connection was added.');
+
         $this->assertDatabaseHas('user_git_connections', [
             'user_id' => $user->id,
             'provider' => GitProviderKey::Gitea->value,
@@ -72,13 +107,13 @@ class GitConnectionTest extends TestCase
     }
 
     /**
-     * Ensure invalid provider credentials are rejected with a validation error.
+     * Ensure invalid repository credentials are rejected with a validation error.
      */
     public function test_invalid_provider_credentials_are_rejected(): void
     {
         Http::preventStrayRequests();
         Http::fake([
-            'https://git.example.test/api/v1/user' => Http::response([
+            'https://git.example.test/api/v1/user/repos*' => Http::response([
                 'message' => 'Unauthorized',
             ], 401),
         ]);
@@ -103,6 +138,7 @@ class GitConnectionTest extends TestCase
     {
         Http::preventStrayRequests();
         Http::fake([
+            'https://git.internal.test/api/v1/user/repos*' => Http::response([]),
             'https://git.internal.test/api/v1/user' => Http::response([
                 'id' => 202,
                 'login' => 'updated-user',