summaryrefslogtreecommitdiffstats
path: root/routers/api/v1/api.go
Commit message (Collapse)AuthorAgeFilesLines
* feat(api): enhance Actions Secrets Management API for repository (#30656)Bo-Yi Wu2024-04-261-41/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | - Add endpoint to list repository action secrets in API routes - Implement `ListActionsSecrets` function to retrieve action secrets from the database - Update Swagger documentation to include the new `/repos/{owner}/{repo}/actions/secrets` endpoint - Add `actions` package import and define new routes for actions, secrets, variables, and runners in `api.go`. - Refactor action-related API functions into `Action` struct methods in `org/action.go` and `repo/action.go`. - Remove `actionAPI` struct and related functions, replacing them with `NewAction()` calls. - Rename `variables.go` to `action.go` in `org` directory. - Delete `runners.go` and `secrets.go` in both `org` and `repo` directories, consolidating their content into `action.go`. - Update copyright year and add new imports in `org/action.go`. - Implement `API` interface in `services/actions/interface.go` for action-related methods. - Remove individual action-related functions and replace them with methods on the `Action` struct in `repo/action.go`. --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Signed-off-by: appleboy <appleboy.tw@gmail.com>
* Clarify permission "HasAccess" behavior (#30585)wxiaoguang2024-04-201-2/+2
| | | | | | | | | | | | | | | Follow #30495 "HasAccess" behavior wasn't clear, to make it clear: * Use a new name `HasAnyUnitAccess`, it will be easier to review related code and permission problems. * Separate everyone access mode to a separate field, then all calls to HasAccess are reverted to old behavior before #30495. * Add new tests. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Allow everyone to read or write a wiki by a repo unit setting (#30495)wxiaoguang2024-04-171-5/+1
| | | | | Replace #6312 Help #5833 Wiki solution for #639
* feat(api): implement branch/commit comparison API (#30349)Bo-Yi Wu2024-04-161-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | - Add new `Compare` struct to represent comparison between two commits - Introduce new API endpoint `/compare/*` to get commit comparison information - Create new file `repo_compare.go` with the `Compare` struct definition - Add new file `compare.go` in `routers/api/v1/repo` to handle comparison logic - Add new file `compare.go` in `routers/common` to define `CompareInfo` struct - Refactor `ParseCompareInfo` function to use `common.CompareInfo` struct - Update Swagger documentation to include the new API endpoint for commit comparison - Remove duplicate `CompareInfo` struct from `routers/web/repo/compare.go` - Adjust base path in Swagger template to be relative (`/api/v1`) GitHub API https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#compare-two-commits --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add API for `Variables` (#29520)sillyguodong2024-03-281-0/+27
| | | | | | | close #27801 --------- Co-authored-by: silverwind <me@silverwind.io>
* Add user blocking (#29028)KN4CK3R2024-03-041-1/+19
| | | | | | | | | | | | | | | | | | | | | | Fixes #17453 This PR adds the abbility to block a user from a personal account or organization to restrict how the blocked user can interact with the blocker. The docs explain what's the consequence of blocking a user. Screenshots: ![grafik](https://github.com/go-gitea/gitea/assets/1666336/4ed884f3-e06a-4862-afd3-3b8aa2488dc6) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ae6d4981-f252-4f50-a429-04f0f9f1cdf1) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ca153599-5b0f-4b4a-90fe-18bdfd6f0b6b) --------- Co-authored-by: Lauris BH <lauris@nix.lv>
* Add admin API route for managing user's badges (#23106)techknowlogick2024-03-011-0/+3
| | | | | | | Fix #22785 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Move context from modules to services (#29440)Lunny Xiao2024-02-271-10/+9
| | | | | | | | | | | | | | | Since `modules/context` has to depend on `models` and many other packages, it should be moved from `modules/context` to `services/context` according to design principles. There is no logic code change on this PR, only move packages. - Move `code.gitea.io/gitea/modules/context` to `code.gitea.io/gitea/services/context` - Move `code.gitea.io/gitea/modules/contexttest` to `code.gitea.io/gitea/services/contexttest` because of depending on context - Move `code.gitea.io/gitea/modules/upload` to `code.gitea.io/gitea/services/context/upload` because of depending on context
* Add API to get PR by base/head (#29242)qwerty2872024-02-261-0/+1
| | | | | | | Closes https://github.com/go-gitea/gitea/issues/16289 Add a new API `/repos/{owner}/{repo}/pulls/{base}/{head}` to get a PR by its base and head branch.
* Add API to get merged PR of a commit (#29243)qwerty2872024-02-241-0/+1
| | | | | | | | Adds a new API `/repos/{owner}/{repo}/commits/{sha}/pull` that allows you to get the merged PR associated to a commit. --------- Co-authored-by: 6543 <6543@obermui.de>
* Refactor more code in templates (#29236)wxiaoguang2024-02-181-2/+2
| | | | | | | | Follow #29165. * Introduce JSONTemplate to help to render JSON templates * Introduce JSEscapeSafe for templates. Now only use `{{ ... | JSEscape}}` instead of `{{ ... | JSEscape | Safe}}` * Simplify "UserLocationMapURL" useage
* Refactor issue template parsing and fix API endpoint (#29069)wxiaoguang2024-02-121-1/+1
| | | | | | | | | | | | | | | | The old code `GetTemplatesFromDefaultBranch(...) ([]*api.IssueTemplate, map[string]error)` doesn't really follow Golang's habits, then the second returned value might be misused. For example, the API function `GetIssueTemplates` incorrectly checked the second returned value and always responds 500 error. This PR refactors GetTemplatesFromDefaultBranch to ParseTemplatesFromDefaultBranch and clarifies its behavior, and fixes the API endpoint bug, and adds some tests. And by the way, add proper prefix `X-` for the header generated in `checkDeprecatedAuthMethods`, because non-standard HTTP headers should have `X-` prefix, and it is also consistent with the new code in `GetIssueTemplates`
* Don't run push mirrors for archived repos (#27140)JakobDev2024-01-241-4/+4
| | | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/612 At the moment push mirrors are still run if a repo is archived. This PR fixes this.
* Require token for GET subscription endpoint (#28765)Jack Hay2024-01-121-3/+3
| | | | | | | Fixes #28756 ## Changes - Require and check API token for `GET /repos/{owner}/{repo}/subscription` in order to populate `ctx.Doer`.
* Add get actions runner registration token for API routes, repo, org, user ↵Lunny Xiao2023-12-271-14/+35
| | | | | | | | | | and global level (#27144) Replace #23761 --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Refactor CORS handler (#28587)wxiaoguang2023-12-251-3/+1
| | | | | | | | | | | The CORS code has been unmaintained for long time, and the behavior is not correct. This PR tries to improve it. The key point is written as comment in code. And add more tests. Fix #28515 Fix #27642 Fix #17098
* Do some missing checks (#28423)Lunny Xiao2023-12-121-1/+19
|
* Deprecate query string auth tokens (#28390)Jack Hay2023-12-121-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>
* Fix comment permissions (#28213)Lunny Xiao2023-11-251-2/+2
| | | | This PR will fix some missed checks for private repositories' data on web routes and API routes.
* Fix swagger title (#28164)yp053272023-11-221-1/+1
| | | | ![image](https://github.com/go-gitea/gitea/assets/18380374/380859b2-a643-42fd-b53e-78c93c05c826) Don't know why there's a `.` behind. 🤔
* Unify two factor check (#27915)KN4CK3R2023-11-061-36/+0
| | | | | | | | Fixes #27819 We have support for two factor logins with the normal web login and with basic auth. For basic auth the two factor check was implemented at three different places and you need to know that this check is necessary. This PR moves the check into the basic auth itself.
* Fix bad method call when deleting user secrets via API (#27829)Jean-Baptiste Gomond2023-10-291-1/+1
| | | | | Fixed a little mistake when you deleting user secrets via the API. Found it when working on #27725. It should be backported to 1.21 I think.
* Fix org team endpoint (#27721)Nanguan Lin2023-10-221-4/+4
| | | Fix #27711
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-141-1/+1
| | | Last part of #27065
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-111-2/+3
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-251-2/+2
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Updates to the API for archived repos (#27149)JakobDev2023-09-211-12/+12
|
* Fix token endpoints ignore specified account (#27080)CaiCandong2023-09-181-1/+11
| | | | | | | | | Fix #26234 close #26323 close #27040 --------- Co-authored-by: silverwind <me@silverwind.io>
* Make SSPI auth mockable (#27036)wxiaoguang2023-09-171-1/+4
| | | | | | Before, the SSPI auth is only complied for Windows, it's difficult to test and it breaks a lot. Now, make the SSPI auth mockable and testable.
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-151-1/+1
| | | Next step of #27065
* Extract auth middleware from service (#27028)KN4CK3R2023-09-121-2/+103
| | | | | | Related #27027 Extract the router logic from `services/auth/middleware.go` into `routers/web` <-> `routers/common` <-> `routers/api`.
* Add reverseproxy auth for API back with default disabled (#26703)Lunny Xiao2023-09-071-2/+8
| | | | | | | | | | | | | | | This feature was removed by #22219 to avoid possible CSRF attack. This PR takes reverseproxy auth for API back but with default disabled. To prevent possbile CSRF attack, the responsibility will be the reverseproxy but not Gitea itself. For those want to enable this `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`, they should know what they are doing. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Add missing `reqToken()` to notifications endpoints (#26914)JakobDev2023-09-051-3/+3
| | | | | | | | They currently throw a Internal Server Error when you use them without a token. Now they correctly return a `token is required` error. This is no security issue. If you use this endpoints with a token that don't have the correct permission, you get the correct error. This is not affected by this PR.
* feat(API): add routes and functions for managing user's secrets (#26909)Bo-Yi Wu2023-09-051-0/+7
| | | | | | | | | | | | | - Add routes for creating or updating a user's actions secrets in `routers/api/v1/api.go` - Add a new file `routers/api/v1/user/action.go` with functions for creating or updating a user's secrets and deleting a user's secret - Modify the `templates/swagger/v1_json.tmpl` file to include the routes for creating or updating a user's secrets and deleting a user's secret --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* feat(API): add secret deletion functionality for repository (#26808)Bo-Yi Wu2023-09-011-2/+3
| | | | | | | | | | | | | | | - Modify the `CreateOrUpdateSecret` function in `api.go` to include a `Delete` operation for the secret - Modify the `DeleteOrgSecret` function in `action.go` to include a `DeleteSecret` operation for the organization - Modify the `DeleteSecret` function in `action.go` to include a `DeleteSecret` operation for the repository - Modify the `v1_json.tmpl` template file to update the `operationId` and `summary` for the `deleteSecret` operation in both the organization and repository sections --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
* feat(API): add route and implementation for creating/updating repository ↵Bo-Yi Wu2023-08-291-1/+5
| | | | | | | | | | | | | | | | | | secret (#26766) spec: https://docs.github.com/en/rest/actions/secrets?apiVersion=2022-11-28#create-or-update-a-repository-secret - Add a new route for creating or updating a secret value in a repository - Create a new file `routers/api/v1/repo/action.go` with the implementation of the `CreateOrUpdateSecret` function - Update the Swagger documentation for the `updateRepoSecret` operation in the `v1_json.tmpl` template file --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* refactor(API): refactor secret creation and update functionality (#26751)Bo-Yi Wu2023-08-281-2/+1
| | | | | | | | | | | | | | | | | | | | According to the GitHub API Spec: https://docs.github.com/en/rest/actions/secrets?apiVersion=2022-11-28#create-or-update-an-organization-secret Merge the Create and Update secret into a single API. - Remove the `CreateSecretOption` struct and replace it with `CreateOrUpdateSecretOption` in `modules/structs/secret.go` - Update the `CreateOrUpdateOrgSecret` function in `routers/api/v1/org/action.go` to use `CreateOrUpdateSecretOption` instead of `UpdateSecretOption` - Remove the `CreateOrgSecret` function in `routers/api/v1/org/action.go` and replace it with `CreateOrUpdateOrgSecret` - Update the Swagger documentation in `routers/api/v1/swagger/options.go` and `templates/swagger/v1_json.tmpl` to reflect the changes in the struct names and function names Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
* feat(API): update and delete secret for managing organization secrets (#26660)Bo-Yi Wu2023-08-241-0/+3
| | | | | | | | | | | | | | | | | | - Add `UpdateSecret` function to modify org or user repo secret - Add `DeleteSecret` function to delete secret from an organization - Add `UpdateSecretOption` struct for updating secret options - Add `UpdateOrgSecret` function to update a secret in an organization - Add `DeleteOrgSecret` function to delete a secret in an organization GitHub API 1. Update Org Secret: https://docs.github.com/en/rest/actions/secrets?apiVersion=2022-11-28#create-or-update-an-organization-secret 2. Delete Org Secret: https://docs.github.com/en/rest/actions/secrets?apiVersion=2022-11-28#delete-an-organization-secret --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
* feat: implement organization secret creation API (#26566)Bo-Yi Wu2023-08-221-0/+1
| | | | | | | | | | | | | - Add a new `CreateSecretOption` struct for creating secrets - Implement a `CreateOrgSecret` function to create a secret in an organization - Add a new route in `api.go` to handle the creation of organization secrets - Update the Swagger template to include the new `CreateOrgSecret` API endpoint --------- Signed-off-by: appleboy <appleboy.tw@gmail.com>
* Add API route to list org secrets (#26485)Bo-Yi Wu2023-08-151-0/+3
| | | | | | | | | | | | | | | | | | | - Add a new function `CountOrgSecrets` in the file `models/secret/secret.go` - Add a new file `modules/structs/secret.go` - Add a new function `ListActionsSecrets` in the file `routers/api/v1/api.go` - Add a new file `routers/api/v1/org/action.go` - Add a new function `listActionsSecrets` in the file `routers/api/v1/org/action.go` go-sdk: https://gitea.com/gitea/go-sdk/pulls/629 --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <matti@mdranta.net> Co-authored-by: Giteabot <teabot@gitea.io>
* Remove "misc" scope check from public API endpoints (#26134)wxiaoguang2023-07-261-2/+2
| | | Fix #26035
* Add context parameter to some database functions (#26055)Lunny Xiao2023-07-221-1/+1
| | | | | To avoid deadlock problem, almost database related functions should be have ctx as the first parameter. This PR do a refactor for some of these functions.
* For API attachments, use API URL (#25639)Lunny Xiao2023-07-101-3/+3
| | | | | | | Fix #25257 --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Add API for changing Avatars (#25369)JakobDev2023-06-291-0/+13
| | | | | | | | | | | | This adds an API for uploading and Deleting Avatars for of Users, Repos and Organisations. I'm not sure, if this should also be added to the Admin API. Resolves #25344 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io>
* Fix bugs related to notification endpoints (#25548)Zettat1232023-06-281-2/+2
|
* Refactor web package and context package (#25298)wxiaoguang2023-06-181-8/+2
| | | | | | | | | | | | | 1. The "web" package shouldn't depends on "modules/context" package, instead, let each "web context" register themselves to the "web" package. 2. The old Init/Free doesn't make sense, so simplify it * The ctx in "Init(ctx)" is never used, and shouldn't be used that way * The "Free" is never called and shouldn't be called because the SSPI instance is shared --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Redesign Scoped Access Tokens (#24767)Jack Hay2023-06-041-305/+372
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Adds the following high level access scopes, each with `read` and `write` levels: - `activitypub` - `admin` (hidden if user is not a site admin) - `misc` - `notification` - `organization` - `package` - `issue` - `repository` - `user` - Adds new middleware function `tokenRequiresScopes()` in addition to `reqToken()` - `tokenRequiresScopes()` is used for each high-level api section - _if_ a scoped token is present, checks that the required scope is included based on the section and HTTP method - `reqToken()` is used for individual routes - checks that required authentication is present (but does not check scope levels as this will already have been handled by `tokenRequiresScopes()` - Adds migration to convert old scoped access tokens to the new set of scopes - Updates the user interface for scope selection ### User interface example <img width="903" alt="Screen Shot 2023-05-31 at 1 56 55 PM" src="https://github.com/go-gitea/gitea/assets/23248839/654766ec-2143-4f59-9037-3b51600e32f3"> <img width="917" alt="Screen Shot 2023-05-31 at 1 56 43 PM" src="https://github.com/go-gitea/gitea/assets/23248839/1ad64081-012c-4a73-b393-66b30352654c"> ## tokenRequiresScopes Design Decision - `tokenRequiresScopes()` was added to more reliably cover api routes. For an incoming request, this function uses the given scope category (say `AccessTokenScopeCategoryOrganization`) and the HTTP method (say `DELETE`) and verifies that any scoped tokens in use include `delete:organization`. - `reqToken()` is used to enforce auth for individual routes that require it. If a scoped token is not present for a request, `tokenRequiresScopes()` will not return an error ## TODO - [x] Alphabetize scope categories - [x] Change 'public repos only' to a radio button (private vs public). Also expand this to organizations - [X] Disable token creation if no scopes selected. Alternatively, show warning - [x] `reqToken()` is missing from many `POST/DELETE` routes in the api. `tokenRequiresScopes()` only checks that a given token has the correct scope, `reqToken()` must be used to check that a token (or some other auth) is present. - _This should be addressed in this PR_ - [x] The migration should be reviewed very carefully in order to minimize access changes to existing user tokens. - _This should be addressed in this PR_ - [x] Link to api to swagger documentation, clarify what read/write/delete levels correspond to - [x] Review cases where more than one scope is needed as this directly deviates from the api definition. - _This should be addressed in this PR_ - For example: ```go m.Group("/users/{username}/orgs", func() { m.Get("", reqToken(), org.ListUserOrgs) m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions) }, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser, auth_model.AccessTokenScopeCategoryOrganization), context_service.UserAssignmentAPI()) ``` ## Future improvements - [ ] Add required scopes to swagger documentation - [ ] Redesign `reqToken()` to be opt-out rather than opt-in - [ ] Subdivide scopes like `repository` - [ ] Once a token is created, if it has no scopes, we should display text instead of an empty bullet point - [ ] If the 'public repos only' option is selected, should read categories be selected by default Closes #24501 Closes #24799 Co-authored-by: Jonathan Tran <jon@allspice.io> Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* API endpoint for changing/creating/deleting multiple files (#24887)Denys Konovalov2023-05-291-0/+1
| | | | | | | | | | | This PR creates an API endpoint for creating/updating/deleting multiple files in one API call similar to the solution provided by [GitLab](https://docs.gitlab.com/ee/api/commits.html#create-a-commit-with-multiple-files-and-actions). To archive this, the CreateOrUpdateRepoFile and DeleteRepoFIle functions in files service are unified into one function supporting multiple files and actions. Resolves #14619
* Add the ability to pin Issues (#24406)JakobDev2023-05-251-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the ability to pin important Issues and Pull Requests. You can also move pinned Issues around to change their Position. Resolves #2175. ## Screenshots ![grafik](https://user-images.githubusercontent.com/15185051/235123207-0aa39869-bb48-45c3-abe2-ba1e836046ec.png) ![grafik](https://user-images.githubusercontent.com/15185051/235123297-152a16ea-a857-451d-9a42-61f2cd54dd75.png) ![grafik](https://user-images.githubusercontent.com/15185051/235640782-cbfe25ec-6254-479a-a3de-133e585d7a2d.png) The Design was mostly copied from the Projects Board. ## Implementation This uses a new `pin_order` Column in the `issue` table. If the value is set to 0, the Issue is not pinned. If it's set to a bigger value, the value is the Position. 1 means it's the first pinned Issue, 2 means it's the second one etc. This is dived into Issues and Pull requests for each Repo. ## TODO - [x] You can currently pin as many Issues as you want. Maybe we should add a Limit, which is configurable. GitHub uses 3, but I prefer 6, as this is better for bigger Projects, but I'm open for suggestions. - [x] Pin and Unpin events need to be added to the Issue history. - [x] Tests - [x] Migration **The feature itself is currently fully working, so tester who may find weird edge cases are very welcome!** --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io>
* Add API for Label templates (#24602)JakobDev2023-05-231-0/+2
| | | | This adds API that allows getting the Label templates of the Gitea Instance
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-04 05:58:47 +0000