Support scoped access tokens (#20908)

This PR adds the support for scopes of access tokens, mimicking the
design of GitHub OAuth scopes.

The changes of the core logic are in `models/auth` that `AccessToken`
struct will have a `Scope` field. The normalized (no duplication of
scope), comma-separated scope string will be stored in `access_token`
table in the database.
In `services/auth`, the scope will be stored in context, which will be
used by `reqToken` middleware in API calls. Only OAuth2 tokens will have
granular token scopes, while others like BasicAuth will default to scope
`all`.
A large amount of work happens in `routers/api/v1/api.go` and the
corresponding `tests/integration` tests, that is adding necessary scopes
to each of the API calls as they fit.


- [x] Add `Scope` field to `AccessToken`
- [x] Add access control to all API endpoints
- [x] Update frontend & backend for when creating tokens
- [x] Add a database migration for `scope` column (enable 'all' access
to past tokens)

I'm aiming to complete it before Gitea 1.19 release.

Fixes #4300

1 files changed, 201 insertions, 0 deletions

diff --git a/templates/user/settings/applications.tmpl b/templates/user/settings/applications.tmpl
index e05cebb0e4..c108f20b5b 100644
--- a/templates/user/settings/applications.tmpl
+++ b/templates/user/settings/applications.tmpl
@@ -41,6 +41,207 @@
 					<label for="name">{{.locale.Tr "settings.token_name"}}</label>
 					<input id="name" name="name" value="{{.name}}" autofocus required>
 				</div>
+				<details class="ui optional field">
+					<summary class="p-2">
+						{{.locale.Tr "settings.select_scopes"}}
+					</summary>
+					<div class="field pl-2">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="repo">
+							<label>repo</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="repo:status">
+								<label>repo:status</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="public:repo">
+								<label>public_repo</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="admin:org">
+							<label>admin:org</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="write:org">
+								<label>write:org</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="read:public_key">
+								<label>read:public_key</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="admin:public_key">
+							<label>admin:public_key</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="write:public_key">
+								<label>write:public_key</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="read:public_key">
+								<label>read:public_key</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="admin:repo_hook">
+							<label>admin:repo_hook</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="write:repo_hook">
+								<label>write:repo_hook</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="read:repo_hook">
+								<label>read:repo_hook</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="admin:org_hook">
+							<label>admin:org_hook</label>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="notification">
+							<label>notification</label>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="user">
+							<label>user</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="read:user">
+								<label>read:user</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="user:email">
+								<label>user:email</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="user:follow">
+								<label>user:follow</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="delete:repo">
+							<label>delete_repo</label>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="package">
+							<label>package</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="write:package">
+								<label>write:package</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="read:package">
+								<label>read:package</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="delete:package">
+								<label>delete:package</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="admin:gpg_key">
+							<label>admin:gpg_key</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="write:gpg_key">
+								<label>write:gpg_key</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="read:gpg_key">
+								<label>read:gpg_key</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="admin:application">
+							<label>admin:application</label>
+						</div>
+					</div>
+					<div class="field pl-4">
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="write:application">
+								<label>write:application</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input class="enable-system" type="checkbox" name="scope" value="read:application">
+								<label>read:application</label>
+							</div>
+						</div>
+					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="sudo">
+							<label>sudo</label>
+						</div>
+					</div>
+				</details>
 				<button class="ui green button">
 					{{.locale.Tr "settings.generate_token"}}
 				</button>