mirror of
https://gitcode.com/gitea/gitea.git
synced 2025-06-04 11:17:34 +08:00
.devcontainer
.gitea
.github
assets
build
cmd
contrib
custom
docker
docs
models
modules
options
public
routers
services
actions
agit
asymkey
attachment
auth
automerge
context
contexttest
convert
cron
doctor
externalaccount
feed
forms
admin.go
auth_form.go
org.go
package_form.go
repo_branch_form.go
repo_form.go
repo_form_test.go
repo_tag_form.go
runner.go
user_form.go
user_form_auth_openid.go
user_form_hidden_comments.go
user_form_test.go
gitdiff
indexer
issue
lfs
mailer
markup
migrations
mirror
notify
org
packages
pull
release
repository
secrets
task
uinotification
user
webhook
wiki
snap
templates
tests
web_src
.air.toml
.changelog.yml
.dockerignore
.editorconfig
.eslintrc.yaml
.gitattributes
.gitignore
.gitpod.yml
.golangci.yml
.ignore
.markdownlint.yaml
.npmrc
.spectral.yaml
.stylelintrc.yaml
.yamllint.yaml
BSDmakefile
CHANGELOG.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
DCO
Dockerfile
Dockerfile.rootless
LICENSE
MAINTAINERS
Makefile
README.md
README_ZH.md
SECURITY.md
build.go
go.mod
go.sum
main.go
package-lock.json
package.json
playwright.config.js
poetry.lock
poetry.toml
pyproject.toml
tailwind.config.js
vitest.config.js
webpack.config.js

## Changes - Adds the following high level access scopes, each with `read` and `write` levels: - `activitypub` - `admin` (hidden if user is not a site admin) - `misc` - `notification` - `organization` - `package` - `issue` - `repository` - `user` - Adds new middleware function `tokenRequiresScopes()` in addition to `reqToken()` - `tokenRequiresScopes()` is used for each high-level api section - _if_ a scoped token is present, checks that the required scope is included based on the section and HTTP method - `reqToken()` is used for individual routes - checks that required authentication is present (but does not check scope levels as this will already have been handled by `tokenRequiresScopes()` - Adds migration to convert old scoped access tokens to the new set of scopes - Updates the user interface for scope selection ### User interface example <img width="903" alt="Screen Shot 2023-05-31 at 1 56 55 PM" src="https://github.com/go-gitea/gitea/assets/23248839/654766ec-2143-4f59-9037-3b51600e32f3"> <img width="917" alt="Screen Shot 2023-05-31 at 1 56 43 PM" src="https://github.com/go-gitea/gitea/assets/23248839/1ad64081-012c-4a73-b393-66b30352654c"> ## tokenRequiresScopes Design Decision - `tokenRequiresScopes()` was added to more reliably cover api routes. For an incoming request, this function uses the given scope category (say `AccessTokenScopeCategoryOrganization`) and the HTTP method (say `DELETE`) and verifies that any scoped tokens in use include `delete:organization`. - `reqToken()` is used to enforce auth for individual routes that require it. If a scoped token is not present for a request, `tokenRequiresScopes()` will not return an error ## TODO - [x] Alphabetize scope categories - [x] Change 'public repos only' to a radio button (private vs public). Also expand this to organizations - [X] Disable token creation if no scopes selected. Alternatively, show warning - [x] `reqToken()` is missing from many `POST/DELETE` routes in the api. `tokenRequiresScopes()` only checks that a given token has the correct scope, `reqToken()` must be used to check that a token (or some other auth) is present. - _This should be addressed in this PR_ - [x] The migration should be reviewed very carefully in order to minimize access changes to existing user tokens. - _This should be addressed in this PR_ - [x] Link to api to swagger documentation, clarify what read/write/delete levels correspond to - [x] Review cases where more than one scope is needed as this directly deviates from the api definition. - _This should be addressed in this PR_ - For example: ```go m.Group("/users/{username}/orgs", func() { m.Get("", reqToken(), org.ListUserOrgs) m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions) }, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser, auth_model.AccessTokenScopeCategoryOrganization), context_service.UserAssignmentAPI()) ``` ## Future improvements - [ ] Add required scopes to swagger documentation - [ ] Redesign `reqToken()` to be opt-out rather than opt-in - [ ] Subdivide scopes like `repository` - [ ] Once a token is created, if it has no scopes, we should display text instead of an empty bullet point - [ ] If the 'public repos only' option is selected, should read categories be selected by default Closes #24501 Closes #24799 Co-authored-by: Jonathan Tran <jon@allspice.io> Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
132 lines
2.8 KiB
Go
132 lines
2.8 KiB
Go
// Copyright 2018 The Gogs Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package forms
|
|
|
|
import (
|
|
"strconv"
|
|
"testing"
|
|
|
|
auth_model "code.gitea.io/gitea/models/auth"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
|
|
"github.com/gobwas/glob"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestRegisterForm_IsDomainAllowed_Empty(t *testing.T) {
|
|
oldService := setting.Service
|
|
defer func() {
|
|
setting.Service = oldService
|
|
}()
|
|
|
|
setting.Service.EmailDomainAllowList = nil
|
|
|
|
form := RegisterForm{}
|
|
|
|
assert.True(t, form.IsEmailDomainAllowed())
|
|
}
|
|
|
|
func TestRegisterForm_IsDomainAllowed_InvalidEmail(t *testing.T) {
|
|
oldService := setting.Service
|
|
defer func() {
|
|
setting.Service = oldService
|
|
}()
|
|
|
|
setting.Service.EmailDomainAllowList = []glob.Glob{glob.MustCompile("gitea.io")}
|
|
|
|
tt := []struct {
|
|
email string
|
|
}{
|
|
{"invalid-email"},
|
|
{"gitea.io"},
|
|
}
|
|
|
|
for _, v := range tt {
|
|
form := RegisterForm{Email: v.email}
|
|
|
|
assert.False(t, form.IsEmailDomainAllowed())
|
|
}
|
|
}
|
|
|
|
func TestRegisterForm_IsDomainAllowed_AllowedEmail(t *testing.T) {
|
|
oldService := setting.Service
|
|
defer func() {
|
|
setting.Service = oldService
|
|
}()
|
|
|
|
setting.Service.EmailDomainAllowList = []glob.Glob{glob.MustCompile("gitea.io"), glob.MustCompile("*.allow")}
|
|
|
|
tt := []struct {
|
|
email string
|
|
valid bool
|
|
}{
|
|
{"security@gitea.io", true},
|
|
{"security@gITea.io", true},
|
|
{"invalid", false},
|
|
{"seee@example.com", false},
|
|
|
|
{"user@my.allow", true},
|
|
{"user@my.allow1", false},
|
|
}
|
|
|
|
for _, v := range tt {
|
|
form := RegisterForm{Email: v.email}
|
|
|
|
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
|
|
}
|
|
}
|
|
|
|
func TestRegisterForm_IsDomainAllowed_BlockedEmail(t *testing.T) {
|
|
oldService := setting.Service
|
|
defer func() {
|
|
setting.Service = oldService
|
|
}()
|
|
|
|
setting.Service.EmailDomainAllowList = nil
|
|
setting.Service.EmailDomainBlockList = []glob.Glob{glob.MustCompile("gitea.io"), glob.MustCompile("*.block")}
|
|
|
|
tt := []struct {
|
|
email string
|
|
valid bool
|
|
}{
|
|
{"security@gitea.io", false},
|
|
{"security@gitea.example", true},
|
|
{"invalid", true},
|
|
|
|
{"user@my.block", false},
|
|
{"user@my.block1", true},
|
|
}
|
|
|
|
for _, v := range tt {
|
|
form := RegisterForm{Email: v.email}
|
|
|
|
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
|
|
}
|
|
}
|
|
|
|
func TestNewAccessTokenForm_GetScope(t *testing.T) {
|
|
tests := []struct {
|
|
form NewAccessTokenForm
|
|
scope auth_model.AccessTokenScope
|
|
expectedErr error
|
|
}{
|
|
{
|
|
form: NewAccessTokenForm{Name: "test", Scope: []string{"read:repository"}},
|
|
scope: "read:repository",
|
|
},
|
|
{
|
|
form: NewAccessTokenForm{Name: "test", Scope: []string{"read:repository", "write:user"}},
|
|
scope: "read:repository,write:user",
|
|
},
|
|
}
|
|
|
|
for i, test := range tests {
|
|
t.Run(strconv.Itoa(i), func(t *testing.T) {
|
|
scope, err := test.form.GetScope()
|
|
assert.Equal(t, test.expectedErr, err)
|
|
assert.Equal(t, test.scope, scope)
|
|
})
|
|
}
|
|
}
|