1
0
mirror of https://gitcode.com/gitea/gitea.git synced 2025-06-04 11:17:34 +08:00
Files
.devcontainer
.gitea
.github
assets
build
cmd
contrib
custom
docker
docs
models
modules
options
public
routers
services
actions
agit
asymkey
attachment
auth
automerge
context
contexttest
convert
cron
doctor
externalaccount
feed
forms
admin.go
auth_form.go
org.go
package_form.go
repo_branch_form.go
repo_form.go
repo_form_test.go
repo_tag_form.go
runner.go
user_form.go
user_form_auth_openid.go
user_form_hidden_comments.go
user_form_test.go
gitdiff
indexer
issue
lfs
mailer
markup
migrations
mirror
notify
org
packages
pull
release
repository
secrets
task
uinotification
user
webhook
wiki
snap
templates
tests
web_src
.air.toml
.changelog.yml
.dockerignore
.editorconfig
.eslintrc.yaml
.gitattributes
.gitignore
.gitpod.yml
.golangci.yml
.ignore
.markdownlint.yaml
.npmrc
.spectral.yaml
.stylelintrc.yaml
.yamllint.yaml
BSDmakefile
CHANGELOG.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
DCO
Dockerfile
Dockerfile.rootless
LICENSE
MAINTAINERS
Makefile
README.md
README_ZH.md
SECURITY.md
build.go
go.mod
go.sum
main.go
package-lock.json
package.json
playwright.config.js
poetry.lock
poetry.toml
pyproject.toml
tailwind.config.js
vitest.config.js
webpack.config.js
gitea/services/forms/user_form_test.go
Jack Hay 18de83b2a3 Redesign Scoped Access Tokens ()
## Changes
- Adds the following high level access scopes, each with `read` and
`write` levels:
    - `activitypub`
    - `admin` (hidden if user is not a site admin)
    - `misc`
    - `notification`
    - `organization`
    - `package`
    - `issue`
    - `repository`
    - `user`
- Adds new middleware function `tokenRequiresScopes()` in addition to
`reqToken()`
  -  `tokenRequiresScopes()` is used for each high-level api section
- _if_ a scoped token is present, checks that the required scope is
included based on the section and HTTP method
  - `reqToken()` is used for individual routes
- checks that required authentication is present (but does not check
scope levels as this will already have been handled by
`tokenRequiresScopes()`
- Adds migration to convert old scoped access tokens to the new set of
scopes
- Updates the user interface for scope selection

### User interface example
<img width="903" alt="Screen Shot 2023-05-31 at 1 56 55 PM"
src="https://github.com/go-gitea/gitea/assets/23248839/654766ec-2143-4f59-9037-3b51600e32f3">
<img width="917" alt="Screen Shot 2023-05-31 at 1 56 43 PM"
src="https://github.com/go-gitea/gitea/assets/23248839/1ad64081-012c-4a73-b393-66b30352654c">

## tokenRequiresScopes  Design Decision
- `tokenRequiresScopes()` was added to more reliably cover api routes.
For an incoming request, this function uses the given scope category
(say `AccessTokenScopeCategoryOrganization`) and the HTTP method (say
`DELETE`) and verifies that any scoped tokens in use include
`delete:organization`.
- `reqToken()` is used to enforce auth for individual routes that
require it. If a scoped token is not present for a request,
`tokenRequiresScopes()` will not return an error

## TODO
- [x] Alphabetize scope categories
- [x] Change 'public repos only' to a radio button (private vs public).
Also expand this to organizations
- [X] Disable token creation if no scopes selected. Alternatively, show
warning
- [x] `reqToken()` is missing from many `POST/DELETE` routes in the api.
`tokenRequiresScopes()` only checks that a given token has the correct
scope, `reqToken()` must be used to check that a token (or some other
auth) is present.
   -  _This should be addressed in this PR_
- [x] The migration should be reviewed very carefully in order to
minimize access changes to existing user tokens.
   - _This should be addressed in this PR_
- [x] Link to api to swagger documentation, clarify what
read/write/delete levels correspond to
- [x] Review cases where more than one scope is needed as this directly
deviates from the api definition.
   - _This should be addressed in this PR_
   - For example: 
   ```go
	m.Group("/users/{username}/orgs", func() {
		m.Get("", reqToken(), org.ListUserOrgs)
		m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions)
}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser,
auth_model.AccessTokenScopeCategoryOrganization),
context_service.UserAssignmentAPI())
   ```

## Future improvements
- [ ] Add required scopes to swagger documentation
- [ ] Redesign `reqToken()` to be opt-out rather than opt-in
- [ ] Subdivide scopes like `repository`
- [ ] Once a token is created, if it has no scopes, we should display
text instead of an empty bullet point
- [ ] If the 'public repos only' option is selected, should read
categories be selected by default

Closes 
Closes 

Co-authored-by: Jonathan Tran <jon@allspice.io>
Co-authored-by: Kyle D <kdumontnu@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
2023-06-04 20:57:16 +02:00

132 lines
2.8 KiB
Go

// Copyright 2018 The Gogs Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package forms
import (
"strconv"
"testing"
auth_model "code.gitea.io/gitea/models/auth"
"code.gitea.io/gitea/modules/setting"
"github.com/gobwas/glob"
"github.com/stretchr/testify/assert"
)
func TestRegisterForm_IsDomainAllowed_Empty(t *testing.T) {
oldService := setting.Service
defer func() {
setting.Service = oldService
}()
setting.Service.EmailDomainAllowList = nil
form := RegisterForm{}
assert.True(t, form.IsEmailDomainAllowed())
}
func TestRegisterForm_IsDomainAllowed_InvalidEmail(t *testing.T) {
oldService := setting.Service
defer func() {
setting.Service = oldService
}()
setting.Service.EmailDomainAllowList = []glob.Glob{glob.MustCompile("gitea.io")}
tt := []struct {
email string
}{
{"invalid-email"},
{"gitea.io"},
}
for _, v := range tt {
form := RegisterForm{Email: v.email}
assert.False(t, form.IsEmailDomainAllowed())
}
}
func TestRegisterForm_IsDomainAllowed_AllowedEmail(t *testing.T) {
oldService := setting.Service
defer func() {
setting.Service = oldService
}()
setting.Service.EmailDomainAllowList = []glob.Glob{glob.MustCompile("gitea.io"), glob.MustCompile("*.allow")}
tt := []struct {
email string
valid bool
}{
{"security@gitea.io", true},
{"security@gITea.io", true},
{"invalid", false},
{"seee@example.com", false},
{"user@my.allow", true},
{"user@my.allow1", false},
}
for _, v := range tt {
form := RegisterForm{Email: v.email}
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
}
}
func TestRegisterForm_IsDomainAllowed_BlockedEmail(t *testing.T) {
oldService := setting.Service
defer func() {
setting.Service = oldService
}()
setting.Service.EmailDomainAllowList = nil
setting.Service.EmailDomainBlockList = []glob.Glob{glob.MustCompile("gitea.io"), glob.MustCompile("*.block")}
tt := []struct {
email string
valid bool
}{
{"security@gitea.io", false},
{"security@gitea.example", true},
{"invalid", true},
{"user@my.block", false},
{"user@my.block1", true},
}
for _, v := range tt {
form := RegisterForm{Email: v.email}
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
}
}
func TestNewAccessTokenForm_GetScope(t *testing.T) {
tests := []struct {
form NewAccessTokenForm
scope auth_model.AccessTokenScope
expectedErr error
}{
{
form: NewAccessTokenForm{Name: "test", Scope: []string{"read:repository"}},
scope: "read:repository",
},
{
form: NewAccessTokenForm{Name: "test", Scope: []string{"read:repository", "write:user"}},
scope: "read:repository,write:user",
},
}
for i, test := range tests {
t.Run(strconv.Itoa(i), func(t *testing.T) {
scope, err := test.form.GetScope()
assert.Equal(t, test.expectedErr, err)
assert.Equal(t, test.scope, scope)
})
}
}