aboutsummaryrefslogtreecommitdiffstats
path: root/routers/api/v1/user
Commit message (Collapse)AuthorAgeFilesLines
* Enhance routers for the Actions variable operations (#33547) (#33553)Lunny Xiao8 days1-1/+5
| | | | | | | Backport #33547 Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Move GetFeeds to service layer (#32526)Lunny Xiao2024-11-291-1/+2
| | | Move GetFeeds from models to service layer, no code change.
* refactor: remove redundant err declarations (#32381)Oleksandr Redko2024-10-301-1/+0
|
* Fix bug when a token is given public only (#32204)Lunny Xiao2024-10-081-0/+6
|
* Add support for searching users by email (#30908)yp053272024-10-041-5/+6
| | | | | | | Fix #30898 we have an option `SearchByEmail`, so enable it, then we can search user by email. Also added a test for it.
* Fix incorrect `/tokens` api (#32085)KN4CK3R2024-09-201-0/+5
| | | | | | | | | | Fixes #32078 - Add missing scopes output. - Disallow empty scope. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* add skip secondary authorization option for public oauth2 clients (#31454)Denys Konovalov2024-07-191-9/+11
|
* Refactor names (#31405)wxiaoguang2024-06-197-21/+21
| | | | | | | This PR only does "renaming": * `Route` should be `Router` (and chi router is also called "router") * `Params` should be `PathParam` (to distingush it from URL query param, and to match `FormString`) * Use lower case for private functions to avoid exposing or abusing
* Fix bug on avatar (#31008)Lunny Xiao2024-05-191-0/+2
| | | Co-authored-by: silverwind <me@silverwind.io>
* Don't only list code-enabled repositories when using repository API (#30817)Kemal Zebari2024-05-031-3/+1
| | | | | We should be listing all repositories by default. Fixes #28483.
* Add setting to disable user features when user login type is not plain (#29615)Jack Hay2024-03-292-4/+5
| | | | | | | | | ## Changes - Adds setting `EXTERNAL_USER_DISABLE_FEATURES` to disable any supported user features when login type is not plain - In general, this is necessary for SSO implementations to avoid inconsistencies between the external account management and the linked account - Adds helper functions to encourage correct use
* Add API for `Variables` (#29520)sillyguodong2024-03-281-0/+250
| | | | | | | close #27801 --------- Co-authored-by: silverwind <me@silverwind.io>
* Add user blocking (#29028)KN4CK3R2024-03-044-20/+141
| | | | | | | | | | | | | | | | | | | | | | Fixes #17453 This PR adds the abbility to block a user from a personal account or organization to restrict how the blocked user can interact with the blocker. The docs explain what's the consequence of blocking a user. Screenshots: ![grafik](https://github.com/go-gitea/gitea/assets/1666336/4ed884f3-e06a-4862-afd3-3b8aa2488dc6) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ae6d4981-f252-4f50-a429-04f0f9f1cdf1) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ca153599-5b0f-4b4a-90fe-18bdfd6f0b6b) --------- Co-authored-by: Lauris BH <lauris@nix.lv>
* Allow options to disable user ssh keys configuration from the interface on ↵Lunny Xiao2024-03-041-0/+11
| | | | | | | | | | | app.ini (#29447) Follow #29275 Extract from #20549 Fix #24716 --------- Co-authored-by: delvh <dev.lh@web.de>
* Allow options to disable user gpg keys configuration from the interface on ↵Lunny Xiao2024-03-021-0/+11
| | | | | | | | app.ini (#29486) Follow #29447 Fix #29454 Extract from #20549
* Move context from modules to services (#29440)Lunny Xiao2024-02-2715-15/+15
| | | | | | | | | | | | | | | Since `modules/context` has to depend on `models` and many other packages, it should be moved from `modules/context` to `services/context` according to design principles. There is no logic code change on this PR, only move packages. - Move `code.gitea.io/gitea/modules/context` to `code.gitea.io/gitea/services/context` - Move `code.gitea.io/gitea/modules/contexttest` to `code.gitea.io/gitea/services/contexttest` because of depending on context - Move `code.gitea.io/gitea/modules/upload` to `code.gitea.io/gitea/services/context/upload` because of depending on context
* Unify user update methods (#28733)KN4CK3R2024-02-042-56/+30
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Move more functions to db.Find (#28419)Lunny Xiao2024-01-151-9/+18
| | | | | | | | | Following #28220 This PR move more functions to use `db.Find`. --------- Co-authored-by: delvh <dev.lh@web.de>
* Add get actions runner registration token for API routes, repo, org, user ↵Lunny Xiao2023-12-271-0/+26
| | | | | | | | | | and global level (#27144) Replace #23761 --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix comment permissions (#28213)Lunny Xiao2023-11-253-1/+10
| | | | This PR will fix some missed checks for private repositories' data on web routes and API routes.
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-242-20/+21
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Enable system users search via the API (#28013)Earl Warren2023-11-131-12/+26
| | | | | Refs: https://codeberg.org/forgejo/forgejo/issues/1403 (cherry picked from commit dd4d17c159eaf8b642aa9e6105b0532e25972bb7)
* Replace more db.DefaultContext (#27628)Lunny Xiao2023-10-151-1/+1
| | | Target #27065
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-142-7/+7
| | | Last part of #27065
* Fix permissions for Token DELETE endpoint to match GET and POST (#27610)Evan Tobin2023-10-141-1/+1
| | | | | | | | Fixes #27598 In #27080, the logic for the tokens endpoints were updated to allow admins to create and view tokens in other accounts. However, the same functionality was not added to the DELETE endpoint. This PR makes the DELETE endpoint function the same as the other token endpoints and adds unit tests
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-112-9/+9
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-254-9/+9
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Fix token endpoints ignore specified account (#27080)CaiCandong2023-09-181-3/+9
| | | | | | | | | Fix #26234 close #26323 close #27040 --------- Co-authored-by: silverwind <me@silverwind.io>
* Next round of `db.DefaultContext` refactor (#27089)JakobDev2023-09-161-3/+3
| | | Part of #27065
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-153-9/+9
| | | Next step of #27065
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-142-4/+4
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add missing 404 response to Swagger (#27038)JakobDev2023-09-136-0/+28
| | | | | Most middleware throw a 404 in case something is not found e.g. a Repo that is not existing. But most API endpoints don't include the 404 response in their documentation. This PR changes this.
* Refactor secrets modification logic (#26873)KN4CK3R2023-09-051-26/+24
| | | | - Share code between web and api - Add some tests
* feat(API): add routes and functions for managing user's secrets (#26909)Bo-Yi Wu2023-09-051-0/+105
| | | | | | | | | | | | | - Add routes for creating or updating a user's actions secrets in `routers/api/v1/api.go` - Add a new file `routers/api/v1/user/action.go` with functions for creating or updating a user's secrets and deleting a user's secret - Modify the `templates/swagger/v1_json.tmpl` file to include the routes for creating or updating a user's secrets and deleting a user's secret --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Remove `db.DefaultContext` in `routers/` and `cmd/` (#26076)delvh2023-07-231-2/+1
| | | | | | Now, the only remaining usages of `models.db.DefaultContext` are in - `modules` - `models` - `services`
* Replace `interface{}` with `any` (#25686)silverwind2023-07-041-2/+2
| | | | | Result of running `perl -p -i -e 's#interface\{\}#any#g' **/*` and `make fmt`. Basically the same [as golang did](https://github.com/golang/go/commit/2580d0e08d5e9f979b943758d3c49877fb2324cb).
* Add API for changing Avatars (#25369)JakobDev2023-06-291-0/+63
| | | | | | | | | | | | This adds an API for uploading and Deleting Avatars for of Users, Repos and Organisations. I'm not sure, if this should also be added to the Admin API. Resolves #25344 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io>
* Fix `Permission` in API returned repository struct (#25388)Jason Song2023-06-223-11/+12
| | | | | | | | | | | | | | | | | | | | | | | The old code generates `structs.Repository.Permissions` with only `access.Permission.AccessMode`, however, it should check the units too, or the value could be incorrect. For example, `structs.Repository.Permissions.Push` could be false even the doer has write access to code unit. Should fix https://github.com/renovatebot/renovate/issues/14059#issuecomment-1047961128 (Not reported by it, I just found it when I was looking into this bug) --- Review tips: The major changes are - `modules/structs/repo.go` https://github.com/go-gitea/gitea/pull/25388/files#diff-870406f6857117f8b03611c43fca0ab9ed6d6e76a2d0069a7c1f17e8fa9092f7 - `services/convert/repository.go` https://github.com/go-gitea/gitea/pull/25388/files#diff-7736f6d2ae894c9edb7729a80ab89aa183b888a26a811a0c1fdebd18726a7101 And other changes are passive.
* Decouple the different contexts from each other (#24786)wxiaoguang2023-05-211-1/+1
| | | | | | | | | | | | | | | | | | | | Replace #16455 Close #21803 Mixing different Gitea contexts together causes some problems: 1. Unable to respond proper content when error occurs, eg: Web should respond HTML while API should respond JSON 2. Unclear dependency, eg: it's unclear when Context is used in APIContext, which fields should be initialized, which methods are necessary. To make things clear, this PR introduces a Base context, it only provides basic Req/Resp/Data features. This PR mainly moves code. There are still many legacy problems and TODOs in code, leave unrelated changes to future PRs.
* Add activity feeds API (#23494)Zettat1232023-04-041-0/+57
| | | | | Close #5666 Add APIs for getting activity feeds.
* Use context for `RepositoryList.LoadAttributes` (#23435)yp053272023-03-131-1/+1
|
* Add user webhooks (#21563)KN4CK3R2023-03-101-0/+154
| | | | | | | Currently we can add webhooks for organizations but not for users. This PR adds the latter. You can access it from the current users settings. ![grafik](https://user-images.githubusercontent.com/1666336/197391408-15dfdc23-b476-4d0c-82f7-9bc9b065988f.png)
* Add scopes to API to create token and display them (#22989)zeripath2023-02-201-2/+11
| | | | | | | | The API to create tokens is missing the ability to set the required scopes for tokens, and to show them on the API and on the UI. This PR adds this functionality. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Rename `repo.GetOwner` to `repo.LoadOwner` (#22967)yp053272023-02-181-2/+2
| | | | | | | Fixes https://github.com/go-gitea/gitea/issues/22963 --------- Co-authored-by: Yarden Shoham <hrsi88@gmail.com>
* Add context cache as a request level cache (#22294)Lunny Xiao2023-02-153-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid duplicated load of the same data in an HTTP request, we can set a context cache to do that. i.e. Some pages may load a user from a database with the same id in different areas on the same page. But the code is hidden in two different deep logic. How should we share the user? As a result of this PR, now if both entry functions accept `context.Context` as the first parameter and we just need to refactor `GetUserByID` to reuse the user from the context cache. Then it will not be loaded twice on an HTTP request. But of course, sometimes we would like to reload an object from the database, that's why `RemoveContextData` is also exposed. The core context cache is here. It defines a new context ```go type cacheContext struct { ctx context.Context data map[any]map[any]any lock sync.RWMutex } var cacheContextKey = struct{}{} func WithCacheContext(ctx context.Context) context.Context { return context.WithValue(ctx, cacheContextKey, &cacheContext{ ctx: ctx, data: make(map[any]map[any]any), }) } ``` Then you can use the below 4 methods to read/write/del the data within the same context. ```go func GetContextData(ctx context.Context, tp, key any) any func SetContextData(ctx context.Context, tp, key, value any) func RemoveContextData(ctx context.Context, tp, key any) func GetWithContextCache[T any](ctx context.Context, cacheGroupKey string, cacheTargetID any, f func() (T, error)) (T, error) ``` Then let's take a look at how `system.GetString` implement it. ```go func GetSetting(ctx context.Context, key string) (string, error) { return cache.GetWithContextCache(ctx, contextCacheKey, key, func() (string, error) { return cache.GetString(genSettingCacheKey(key), func() (string, error) { res, err := GetSettingNoCache(ctx, key) if err != nil { return "", err } return res.SettingValue, nil }) }) } ``` First, it will check if context data include the setting object with the key. If not, it will query from the global cache which may be memory or a Redis cache. If not, it will get the object from the database. In the end, if the object gets from the global cache or database, it will be set into the context cache. An object stored in the context cache will only be destroyed after the context disappeared.
* Move `convert` package to services (#22264)KN4CK3R2022-12-2910-10/+10
| | | | | | | | | | Addition to #22256 The `convert` package relies heavily on different models which is [disallowed by our definition of modules](https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md#design-guideline). This helps to prevent possible import cycles. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* refactor some functions to support ctx as first parameter (#21878)Lunny Xiao2022-12-034-5/+6
| | | | Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lauris BH <lauris@nix.lv>
* Implement FSFE REUSE for golang files (#21840)flynnnnnnnnnn2022-11-2711-22/+11
| | | | | | | | | Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Add `context.Context` to more methods (#21546)KN4CK3R2022-11-193-13/+15
| | | | | | | This PR adds a context parameter to a bunch of methods. Some helper `xxxCtx()` methods got replaced with the normal name now. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Record OAuth client type at registration (#21316)M Hickford2022-10-241-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OAuth spec [defines two types of client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1), confidential and public. Previously Gitea assumed all clients to be confidential. > OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to > maintain the confidentiality of their client credentials): > > confidential > Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with > restricted access to the client credentials), or capable of secure client authentication using other means. > > **public > Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.** > > The client type designation is based on the authorization server's definition of secure authentication and its acceptable exposure levels of client credentials. The authorization server SHOULD NOT make assumptions about the client type. https://datatracker.ietf.org/doc/html/rfc8252#section-8.4 > Authorization servers MUST record the client type in the client registration details in order to identify and process requests accordingly. Require PKCE for public clients: https://datatracker.ietf.org/doc/html/rfc8252#section-8.1 > Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message Fixes #21299 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-19 00:43:59 +0000