[auth] Hide global SSO rewrite in local repo

If the user uses SSO (and thus has SSO rewrite rules) for their global
config, a repo which locally uses an email that doesn't use SSO needs
an override.

Bug: b/390219533
Change-Id: I639dae4c1a45bbd2c17180855c22260979b0dbc2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6177780
Reviewed-by: Josip Sokcevic <sokcevic@chromium.org>
Commit-Queue: Allen Li <ayatane@chromium.org>

git_auth.py

@@ -36,7 +36,7 @@ class ConfigChanger(object):
     #
     # Increment this when making changes to the config, so that reliant
     # code can determine whether the config needs to be re-applied.
-    VERSION: int = 3
+    VERSION: int = 4
 
     def __init__(
         self,
@@ -166,15 +166,20 @@ class ConfigChanger(object):
     def _apply_sso(self, cwd: str) -> None:
         """Apply config changes relating to SSO."""
         sso_key: str = f'url.sso://{self._shortname}/.insteadOf'
+        http_key: str = f'url.{self._remote_url}.insteadOf'
         if self.mode == ConfigMode.NEW_AUTH:
             self._set_config(cwd, 'protocol.sso.allow', None)
             self._set_config(cwd, sso_key, None, modify_all=True)
+            # Shadow a potential global SSO rewrite rule.
+            self._set_config(cwd, http_key, self._remote_url, modify_all=True)
         elif self.mode == ConfigMode.NEW_AUTH_SSO:
             self._set_config(cwd, 'protocol.sso.allow', 'always')
             self._set_config(cwd, sso_key, self._base_url, modify_all=True)
+            self._set_config(cwd, http_key, None, modify_all=True)
         elif self.mode == ConfigMode.NO_AUTH:
             self._set_config(cwd, 'protocol.sso.allow', None)
             self._set_config(cwd, sso_key, None, modify_all=True)
+            self._set_config(cwd, http_key, None, modify_all=True)
         else:
             raise TypeError(f'Invalid mode {self.mode!r}')
 

tests/git_auth_test.py

@@ -20,6 +20,8 @@ import scm_mock
 
 class TestConfigChanger(unittest.TestCase):
 
+    maxDiff = None
+
     def setUp(self):
         self._global_state_view: Iterable[tuple[str,
                                                 list[str]]] = scm_mock.GIT(self)
@@ -39,6 +41,10 @@ class TestConfigChanger(unittest.TestCase):
                 'credential.https://chromium.googlesource.com/.helper':
                 ['', 'luci'],
                 'http.cookiefile': [''],
+                'url.https://chromium.googlesource.com/chromium/tools/depot_tools.git.insteadof':
+                [
+                    'https://chromium.googlesource.com/chromium/tools/depot_tools.git'
+                ],
             },
         }
         self.assertEqual(scm.GIT._dump_config_state(), want)
@@ -86,6 +92,10 @@ class TestConfigChanger(unittest.TestCase):
                 'credential.https://chromium.googlesource.com/.helper':
                 ['', 'luci'],
                 'http.cookiefile': [''],
+                'url.https://chromium.googlesource.com/chromium/tools/depot_tools.git.insteadof':
+                [
+                    'https://chromium.googlesource.com/chromium/tools/depot_tools.git'
+                ],
             },
         }
         self.assertEqual(scm.GIT._dump_config_state(), want)