summaryrefslogtreecommitdiffstats
path: root/modules/context/api.go
Commit message (Collapse)AuthorAgeFilesLines
* refactor auth interface to return error when verify failure (#22119) (#22259)Lunny Xiao2022-12-291-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | backport #22119 This PR changed the Auth interface signature from `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User` to `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)`. There is a new return argument `error` which means the verification condition matched but verify process failed, we should stop the auth process. Before this PR, when return a `nil` user, we don't know the reason why it returned `nil`. If the match condition is not satisfied or it verified failure? For these two different results, we should have different handler. If the match condition is not satisfied, we should try next auth method and if there is no more auth method, it's an anonymous user. If the condition matched but verify failed, the auth process should be stop and return immediately. This will fix #20563 Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Jason Song <i@wolfogre.com>
* Use complete SHA to create and query commit status (#22244) (#22257)Jason Song2022-12-281-1/+1
| | | | | | | | | | | | | Backport #22244. Fix #13485. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add Cache-Control header to html and api responses, add no-transform (#20432)silverwind2022-07-231-0/+2
| | | | | | | | | | | | `no-transform` allegedly disables CloudFlare auto-minify and we did not set caching headers on html or api requests, which seems good to have regardless. Transformation is still allowed for asset requests. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Add more linters to improve code readability (#19989)Wim2022-06-201-1/+1
| | | | | | | | | | Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)
* Call MultipartForm.RemoveAll when request finishes (#19606)wxiaoguang2022-05-051-0/+1
|
* Federation: return useful statistic information for nodeinfo (#19561)65432022-05-021-0/+2
| | | Add statistic information for total user count, active user count, issue count and comment count for `/nodeinfo`
* Use router param for filepath in GetRawFile (#19499)John Olheiser2022-04-261-0/+1
| | | | | | | | | | | | * Use router param for filepath Signed-off-by: jolheiser <john.olheiser@gmail.com> * Move TreePath back into RepoRefForAPI Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de>
* RepoAssignment ensure to close before overwrite (#19449)65432022-04-211-41/+40
| | | | | | | * check if GitRepo already open and close if * only run RepoAssignment once * refactor context helper for api to open GitRepo
* Remove dependent on session auth for api/v1 routers (#19321)Lunny Xiao2022-04-081-22/+3
| | | | | | | | | | | * Remove dependent on session auth for api/v1 routers * Remove unnecessary session on API context * remove missed header * fix test * fix missed api/v1
* Never use /api/v1 from Gitea UI Pages (#19318)Lunny Xiao2022-04-071-16/+0
| | | | | | | | | | | | | Reusing `/api/v1` from Gitea UI Pages have pros and cons. Pros: 1) Less code copy Cons: 1) API/v1 have to support shared session with page requests. 2) You need to consider for each other when you want to change something about api/v1 or page. This PR moves all dependencies to API/v1 from UI Pages. Partially replace #16052
* Make git.OpenRepository accept Context (#19260)65432022-03-301-2/+2
| | | | | * OpenRepositoryCtx -> OpenRepository * OpenRepository -> openRepositoryWithDefaultContext, only for internal usage
* Update HTTP status codes to modern codes (#18063)KN4CK3R2022-03-231-2/+2
| | | | | | * 2xx/3xx/4xx/5xx -> http.Status... * http.StatusFound -> http.StatusTemporaryRedirect * http.StatusMovedPermanently -> http.StatusPermanentRedirect
* Renamed ctx.User to ctx.Doer. (#19161)KN4CK3R2022-03-221-10/+10
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* format with gofumpt (#18184)65432022-01-201-11/+10
| | | | | | | | | | | * gofumpt -w -l . * gofumpt -w -l -extra . * Add linter * manual fix * change make fmt
* Propagate context and ensure git commands run in request context (#17868)zeripath2022-01-191-25/+23
| | | | | | | | | This PR continues the work in #17125 by progressively ensuring that git commands run within the request context. This now means that the if there is a git repo already open in the context it will be used instead of reopening it. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Refactor auth package (#17962)Lunny Xiao2022-01-021-7/+7
|
* Handle invalid issues (#18111)Gusted2021-12-281-9/+14
| | | | | | | | | | | | | | | | | | | | | | | * Handle invalid issues - When you hover over a issue reference, and the issue doesn't exist, it will just hang on the loading animation. - This patch fixes that by showing them the pop-up with a "Error occured" message. * Add I18N * refactor * fix comment for lint * fix unit test for i18n * fix unit test for i18n * add comments Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor HTTP request context (#17979)wxiaoguang2021-12-151-5/+5
|
* Move repository model into models/repo (#17933)Lunny Xiao2021-12-101-3/+3
| | | | | | | | | | | | | | | * Some refactors related repository model * Move more methods out of repository * Move repository into models/repo * Fix test * Fix test * some improvements * Remove unnecessary function
* Reset locale on login (#17734)zeripath2021-11-201-0/+3
| | | | | | | | | When logging in reset the user's locale to ensure that it matches their preferred locale. Fix #15612 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Extract constant names out for the ReverseProxy and Basic authentication ↵zeripath2021-11-201-1/+1
| | | | | | | | | methods (#17735) In order to reduce load on the GC extract out the constant names of the Basic and ReverseProxy methods. As mentioned in https://github.com/go-gitea/gitea/pull/15119#discussion_r730352176 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Use a variable but a function for IsProd because of a slight performance ↵Lunny Xiao2021-10-201-2/+2
| | | | increment (#17368)
* Move twofactor to models/login (#17143)Lunny Xiao2021-09-251-2/+3
|
* Make LDAP be able to skip local 2FA (#16954)zeripath2021-09-171-0/+4
| | | | | | This PR extends #16594 to allow LDAP to be able to be set to skip local 2FA too. The technique used here would be extensible to PAM and SMTP sources. Signed-off-by: Andrew Thornton <art27@cantab.net>
* [API] generalize list header (#16551)65432021-08-121-0/+17
| | | | | | | | | | | | | * Add info about list endpoints to CONTRIBUTING.md * Let all list endpoints return X-Total-Count header * Add TODOs for GetCombinedCommitStatusByRef * Fix models/issue_stopwatch.go * Rrefactor models.ListDeployKeys * Introduce helper func and use them for SetLinkHeader related func
* Allow setting X-FRAME-OPTIONS (#16643)zeripath2021-08-061-1/+1
| | | | | | | | | | | | | | | * Allow setting X-FRAME-OPTIONS This PR provides a mechanism to set the X-FRAME-OPTIONS header. Fix #7951 Signed-off-by: Andrew Thornton <art27@cantab.net> * Update docs/content/doc/advanced/config-cheat-sheet.en-us.md Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Pass down SignedUserName down to AccessLogger context (#16605)zeripath2021-08-041-0/+11
| | | | | | | | | | | | | | | | | | | | * Pass down SignedUserName down to AccessLogger context Unfortunately when the AccessLogger was moved back before the contexters the SignedUserName reporting was lost. This is due to Request.WithContext leading to a shallow copy of the Request and the modules/context/Context being within that request. This PR adds a new context variable of a string pointer which is set and handled in the contexters. Fix #16600 Signed-off-by: Andrew Thornton <art27@cantab.net> * handle nil ptr issue Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Rename context.Query to context.Form (#16562)Lunny Xiao2021-07-291-1/+1
|
* Refactor: Move login out of models (#16199)zeripath2021-07-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `models` does far too much. In particular it handles all `UserSignin`. It shouldn't be responsible for calling LDAP, SMTP or PAM for signing in. Therefore we should move this code out of `models`. This code has to depend on `models` - therefore it belongs in `services`. There is a package in `services` called `auth` and clearly this functionality belongs in there. Plan: - [x] Change `auth.Auth` to `auth.Method` - as they represent methods of authentication. - [x] Move `models.UserSignIn` into `auth` - [x] Move `models.ExternalUserLogin` - [x] Move most of the `LoginVia*` methods to `auth` or subpackages - [x] Move Resynchronize functionality to `auth` - Involved some restructuring of `models/ssh_key.go` to reduce the size of this massive file and simplify its files. - [x] Move the rest of the LDAP functionality in to the ldap subpackage - [x] Re-factor the login sources to express an interfaces `auth.Source`? - I've done this through some smaller interfaces Authenticator and Synchronizable - which would allow us to extend things in future - [x] Now LDAP is out of models - need to think about modules/auth/ldap and I think all of that functionality might just be moveable - [x] Similarly a lot Oauth2 functionality need not be in models too and should be moved to services/auth/source/oauth2 - [x] modules/auth/oauth2/oauth2.go uses xorm... This is naughty - probably need to move this into models. - [x] models/oauth2.go - mostly should be in modules/auth/oauth2 or services/auth/source/oauth2 - [x] More simplifications of login_source.go may need to be done - Allow wiring in of notify registration - *this can now easily be done - but I think we should do it in another PR* - see #16178 - More refactors...? - OpenID should probably become an auth Method but I think that can be left for another PR - Methods should also probably be cleaned up - again another PR I think. - SSPI still needs more refactors.* Rename auth.Auth auth.Method * Restructure ssh_key.go - move functions from models/user.go that relate to ssh_key to ssh_key - split ssh_key.go to try create clearer function domains for allow for future refactors here. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add sso.Group, context.Auth, context.APIAuth to allow auth special routes ↵Lunny Xiao2021-06-091-15/+21
| | | | | | | | | | | (#16086) * Add sso.Group, context.Auth, context.APIAuth to allow auth special routes * Remove unnecessary check * Rename sso -> auth * remove unused method of Auth interface
* [refactor] replace int with httpStatusCodes (#15282)65432021-04-051-4/+4
| | | | | | | | | | | * replace "200" (int) with "http.StatusOK" (const) * ctx.Error & ctx.HTML * ctx.JSON Part1 * ctx.JSON Part2 * ctx.JSON Part3
* Move middlewares to web/middleware (#14480)Lunny Xiao2021-01-301-2/+2
| | | Co-authored-by: 6543 <6543@obermui.de>
* Update docs and comments to remove macaron (#14491)Lunny Xiao2021-01-291-2/+2
|
* Move macaron to chi (#14293)Lunny Xiao2021-01-261-37/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | Use [chi](https://github.com/go-chi/chi) instead of the forked [macaron](https://gitea.com/macaron/macaron). Since macaron and chi have conflicts with session share, this big PR becomes a have-to thing. According my previous idea, we can replace macaron step by step but I'm wrong. :( Below is a list of big changes on this PR. - [x] Define `context.ResponseWriter` interface with an implementation `context.Response`. - [x] Use chi instead of macaron, and also a customize `Route` to wrap chi so that the router usage is similar as before. - [x] Create different routers for `web`, `api`, `internal` and `install` so that the codes will be more clear and no magic . - [x] Use https://github.com/unrolled/render instead of macaron's internal render - [x] Use https://github.com/NYTimes/gziphandler instead of https://gitea.com/macaron/gzip - [x] Use https://gitea.com/go-chi/session which is a modified version of https://gitea.com/macaron/session and removed `nodb` support since it will not be maintained. **BREAK** - [x] Use https://gitea.com/go-chi/captcha which is a modified version of https://gitea.com/macaron/captcha - [x] Use https://gitea.com/go-chi/cache which is a modified version of https://gitea.com/macaron/cache - [x] Use https://gitea.com/go-chi/binding which is a modified version of https://gitea.com/macaron/binding - [x] Use https://github.com/go-chi/cors instead of https://gitea.com/macaron/cors - [x] Dropped https://gitea.com/macaron/i18n and make a new one in `code.gitea.io/gitea/modules/translation` - [x] Move validation form structs from `code.gitea.io/gitea/modules/auth` to `code.gitea.io/gitea/modules/forms` to avoid dependency cycle. - [x] Removed macaron log service because it's not need any more. **BREAK** - [x] All form structs have to be get by `web.GetForm(ctx)` in the route function but not as a function parameter on routes definition. - [x] Move Git HTTP protocol implementation to use routers directly. - [x] Fix the problem that chi routes don't support trailing slash but macaron did. - [x] `/api/v1/swagger` now will be redirect to `/api/swagger` but not render directly so that `APIContext` will not create a html render. Notices: - Chi router don't support request with trailing slash - Integration test `TestUserHeatmap` maybe mysql version related. It's failed on my macOS(mysql 5.7.29 installed via brew) but succeed on CI. Co-authored-by: 6543 <6543@obermui.de>
* just overload to not get it by mistake again ... (#14440)65432021-01-231-0/+5
|
* Send error message when CSRF token is missing (#13676)Kevin Zúñiga2020-11-231-1/+1
|
* [API] Only Return Json (#13511)65432020-11-141-0/+58
| | | | | | | | | | | | | | | | | * Let Branch and Raw Endpoint return json error if not found * Revert "RM RepoRefByTypeForAPI and move needed parts into GetRawFile directly" This reverts commit d826d08577b23765cb3c257e7a861191d1aa9a04. * more similar to RepoRefByType * dedub-code * API should just speak JSON * nice name Co-authored-by: zeripath <art27@cantab.net>
* Delete tag API (#13358)John Olheiser2020-10-301-0/+4
| | | | | | | | | | | | | | | | | | | * Delete tag API Signed-off-by: jolheiser <john.olheiser@gmail.com> * Wording Signed-off-by: jolheiser <john.olheiser@gmail.com> * Add conflict response and fix API tests Signed-off-by: jolheiser <john.olheiser@gmail.com> * Fix other test Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* [API] If User is Admin, show 500 error message on PROD mode too (#13115)65432020-10-121-2/+2
| | | | | | | | | * API: show admin 500 error message on PROD mode too * a nit * dont miss InternalServerError Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix typo (#12013)successgo2020-06-221-1/+1
| | | | | | | | | | | * Fix typo of MSSQL * Fix typo: validates * Fix typo * fix comment with space Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Provide diff and patch API endpoints (#11751)zeripath2020-06-051-0/+4
| | | | | | | | | | | | | | | | | | | | | * Provide diff and patch API endpoints The diff and patch endpoints on the main routes are not accessible by token therefore we provide new API based endpoints for these Fix #10923 Signed-off-by: Andrew Thornton <art27@cantab.net> * placate swagger Signed-off-by: Andrew Thornton <art27@cantab.net> * Make the response an actual string Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv>
* [API] on 500 error only show message if gitea in dev mode (#11641)65432020-06-031-0/+4
| | | | | | | * add API specific InternalServerError() * return 500 error msg only if not Production mode * rm unnessesary change
* Return json on 500 error from API (#11574)65432020-05-281-4/+21
| | | | | | | | | | | | | | | * add API specific InternalServerError() Co-authored-by: zeripath <art27@cantab.net> * return 500 error msg only if not Production mode * Revert "return 500 error msg only if not Production mode" This reverts commit 8467b2cee674ad205b452780ca88abb1b27643c8. * InternalServerError Co-authored-by: zeripath <art27@cantab.net>
* api.Context.NotFound(...) should tolerate nil (#11288)zeripath2020-05-051-0/+5
| | | | | | | | | | | | | There is an unfortunate signature change with the api.Context NotFound function; whereas the normal modules/context/Context NotFound function requires an error or nil, the api.Context variant will panic with an NPE if a nil is provided. This PR will allow api.Context.NotFound to tolerate a being passed a nil. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lauris BH <lauris@nix.lv>
* Swagger info corrections (#9441)65432019-12-201-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * use numbers and not http.Status___ enum * fix test * add many missing swagger responses * code format * Deletion Sould return 204 ... * error handling improvements * if special error type ... then add it to swagger too * one smal nit * invalidTopicsError is []string * valid swagger specification 2.0 - if you add responses swagger can tell you if you do it right :+1: * use ctx.InternalServerError * Revert "use numbers and not http.Status___ enum" This reverts commit b1ff386e2418ed6a7f183e756b13277d701278ef. * use http.Status* enum everywhere
* Add Close() method to gogitRepository (#8901)zeripath2019-11-131-0/+9
| | | | | | | | | In investigating #7947 it has become clear that the storage component of go-git repositories needs closing. This PR adds this Close function and adds the Close functions as necessary. In TransferOwnership the ctx.Repo.GitRepo is closed if it is open to help prevent the risk of multiple open files. Fixes #7947
* Use gitea forked macaron (#7933)Tamal Saha2019-08-231-3/+2
| | | Signed-off-by: Tamal Saha <tamal@appscode.com>
* fix API link header (#7298)Lunny Xiao2019-06-261-7/+34
|
* API error cleanup (#7186)John Olheiser2019-06-121-11/+2
|
* Unifies pagination template usage (#6531) (#6533)Mario Lubenka2019-04-201-10/+10
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-28 00:52:02 +0000