aboutsummaryrefslogtreecommitdiffstats
path: root/routers/api/v1
Commit message (Collapse)AuthorAgeFilesLines
* Match api migration behavior to web behavior (#23552) (#23572)release/v1.18Giteabot2023-03-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | Backport #23552 by @atomaka When attempting to migrate a repository via the API endpoint comments are always included. This can create a problem if your source repository has issues or pull requests but you do not want to import them into Gitea that displays as something like: > Error 500: We were unable to perform the request due to server-side problems. 'comment references non existent IssueIndex 4 There are only two ways to resolve this: 1. Migrate using the web interface 2. Migrate using the API including at issues or pull requests. This PR matches the behavior of the API migration router to the web migration router. Co-authored-by: Andrew Tomaka <atomaka@atomaka.com> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Handle missing `README` in create repos API (#23387) (#23509)Zettat1232023-03-162-0/+22
| | | | | | | | | Backport #23387 Close #22934 In `/user/repos` API (and other APIs related to creating repos), user can specify a readme template for auto init. At present, if the specified template does not exist, a `500` will be returned . This PR improved the logic and will return a `400` instead of `500`.
* Add force_merge to merge request and fix checking mergable (#23010) (#23032)Jason Song2023-02-211-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | Backport #23010. Fix #23000. The bug was introduced in #22633, and it seems that it has been noticed: https://github.com/go-gitea/gitea/pull/22633#discussion_r1095395359 . However, #22633 did nothing wrong, the logic should be "check if they is admin only when `force` is true". So we should provide the `ForceMerge` when merging from UI. After this, an admin can also send a normal merge request with `ForceMerge` false. So it fixes a potential bug: if the admin doesn't want to do a force merge, they just see the green "Merge" button and click it. At the same time, the status of the PR changed, and it shouldn't be merged now, so the admin could send an unexpected force merge. In addition, I updated `ForceMerge *bool` to `ForceMerge bool`, I don't see the reason to use a pointer. And fixed the logic of CheckPullMergable to handle auto merge and force merge correctly.
* Provide the ability to set password hash algorithm parameters (#22942) (#22943)zeripath2023-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Backport #22942 This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters In addition it takes the opportunity to adjust the settings for `pbkdf2` in order to make the hashing a little stronger. The majority of this work was inspired by PR #14751 and I would like to thank @boppy for their work on this. Thanks to @gusted for the suggestion to adjust the `pbkdf2` hashing parameters. Close #14751 --------- Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Prevent panic on looking at api "git" endpoints for empty repos (#22457) ↵zeripath2023-01-151-1/+1
| | | | | | | | | | | | | | (#22458) Backport #22457 The API endpoints for "git" can panic if they are called on an empty repo. We can simply allow empty repos for these endpoints without worry as they should just work. Fix #22452 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add `sync_on_commit` option for push mirrors api (#22271) (#22292)Chongyi Zheng2022-12-311-4/+5
| | | Backport of #22271
* Use complete SHA to create and query commit status (#22244) (#22257)Jason Song2022-12-282-0/+30
| | | | | | | | | | | | | Backport #22244. Fix #13485. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove ReverseProxy authentication from the API (#22219) (#22251)Lunny Xiao2022-12-271-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | backport from #22219 Since we changed the /api/v1/ routes to disallow session authentication we also removed their reliance on CSRF. However, we left the ReverseProxy authentication here - but this means that POSTs to the API are no longer protected by CSRF. Now, ReverseProxy authentication is a kind of session authentication, and is therefore inconsistent with the removal of session from the API. This PR proposes that we simply remove the ReverseProxy authentication from the API and therefore users of the API must explicitly use tokens or basic authentication. Replace #22077 Close #22221 Close #22077 Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* Allow empty assignees on pull request edit (#22150) (#22214)KN4CK3R2022-12-221-0/+5
| | | | | Backport of #22150 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix ListBranches to handle empty case (#21921) (#22024)Lunny Xiao2022-12-041-26/+34
| | | | | | | | Fix #21910 Backport #21921 Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Add support for HEAD requests in Maven registry (#21834) (#21929)KN4CK3R2022-11-251-1/+5
| | | | | Backport of #21834 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Load GitRepo in API before deleting issue (#21720) (#21796)Jason Song2022-11-131-1/+1
| | | | | | | | | | | | | | Backport #21720. Fix #20921. The `ctx.Repo.GitRepo` has been used in deleting issues when the issue is a PR. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Fix 500 on PR files API (#21602) (#21607)qwerty2872022-10-261-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | Fixes an 500 error/panic if using the changed PR files API with pages that should return empty lists because there are no items anymore. `start-end` is then < 0 which ends in panic. Backport https://github.com/go-gitea/gitea/pull/21602 <!-- Please check the following: 1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for bug fixes. 2. Read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md 3. Describe what your pull request does and which issue you're targeting (if any) --> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: delvh <dev.lh@web.de>
* Replace all instances of fmt.Errorf(%v) with fmt.Errorf(%w) (#21551)delvh2022-10-245-6/+6
| | | | | | | | | Found using `find . -type f -name '*.go' -print -exec vim {} -c ':%s/fmt\.Errorf(\(.*\)%v\(.*\)err/fmt.Errorf(\1%w\2err/g' -c ':wq' \;` Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Record OAuth client type at registration (#21316)M Hickford2022-10-241-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OAuth spec [defines two types of client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1), confidential and public. Previously Gitea assumed all clients to be confidential. > OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to > maintain the confidentiality of their client credentials): > > confidential > Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with > restricted access to the client credentials), or capable of secure client authentication using other means. > > **public > Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.** > > The client type designation is based on the authorization server's definition of secure authentication and its acceptable exposure levels of client credentials. The authorization server SHOULD NOT make assumptions about the client type. https://datatracker.ietf.org/doc/html/rfc8252#section-8.4 > Authorization servers MUST record the client type in the client registration details in order to identify and process requests accordingly. Require PKCE for public clients: https://datatracker.ietf.org/doc/html/rfc8252#section-8.1 > Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message Fixes #21299 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add link to user profile in markdown mention only if user exists (#21533)Yarden Shoham2022-10-231-0/+7
| | | | | | | | | | | Previously mentioning a user would link to its profile, regardless of whether the user existed. This change tests if the user exists and only if it does - a link to its profile is added. * Fixes #3444 Signed-off-by: Yarden Shoham <hrsi88@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Decouple HookTask from Repository (#17940)KN4CK3R2022-10-212-2/+1
| | | | | | | | | | | | | At the moment a repository reference is needed for webhooks. With the upcoming package PR we need to send webhooks without a repository reference. For example a package is uploaded to an organization. In theory this enables the usage of webhooks for future user actions. This PR removes the repository id from `HookTask` and changes how the hooks are processed (see `services/webhook/deliver.go`). In a follow up PR I want to remove the usage of the `UniqueQueue´ and replace it with a normal queue because there is no reason to be unique. Co-authored-by: 6543 <6543@obermui.de>
* Display total commit count in hook message (#21400)KN4CK3R2022-10-171-9/+10
| | | | | | | | | Fixes #21379 The commits are capped by `setting.UI.FeedMaxCommitNum` so `len(commits)` is not the correct number. So this PR adds a new `TotalCommits` field. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Make external issue tracker regexp configurable via API (#21338)Andrew Imeson2022-10-071-3/+4
| | | | | Fixes #21336 Signed-off-by: Andrew Imeson <andrew@andrewimeson.com>
* Add `stat` to `ToCommit` function for speed (#21337)Gennady Kovshenin2022-10-063-4/+11
| | | | | | | | | Calls to ToCommit are very slow due to fetching diffs, analyzing files. This patch lets us supply `stat` as false to speed fetching a commit when we don't need the diff. /v1/repo/commits has a default `stat` set as true now. Set to false to experience fetching thousands of commits per second instead of 2-5 per second.
* Add API endpoint to get changed files of a PR (#21177)qwerty2872022-09-293-0/+159
| | | | | | | | | | This adds an api endpoint `/files` to PRs that allows to get a list of changed files. built upon #18228, reviews there are included closes https://github.com/go-gitea/gitea/issues/654 Co-authored-by: Anton Bracke <anton@ju60.de> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Better repo API unit checks (#21130)John Olheiser2022-09-281-8/+23
| | | | | | | | | | | | | | | | | | | | This PR would presumably Fix #20522 Fix #18773 Fix #19069 Fix #21077 Fix #13622 ----- 1. Check whether unit type is currently enabled 2. Check if it _will_ be enabled via opt 3. Allow modification as necessary Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: 6543 <6543@obermui.de>
* [API] teamSearch show teams with no members if user is admin (#21204)65432022-09-191-1/+5
| | | close #21176
* Webhook for Wiki changes (#20219)Aaron F2022-09-042-0/+7
| | | | | | | | | | | | | | | | | | | Add support for triggering webhook notifications on wiki changes. This PR contains frontend and backend for webhook notifications on wiki actions (create a new page, rename a page, edit a page and delete a page). The frontend got a new checkbox under the Custom Event -> Repository Events section. There is only one checkbox for create/edit/rename/delete actions, because it makes no sense to separate it and others like releases or packages follow the same schema. ![image](https://user-images.githubusercontent.com/121972/177018803-26851196-831f-4fde-9a4c-9e639b0e0d6b.png) The actions itself are separated, so that different notifications will be executed (with the "action" field). All the webhook receivers implement the new interface method (Wiki) and the corresponding tests. When implementing this, I encounter a little bug on editing a wiki page. Creating and editing a wiki page is technically the same action and will be handled by the ```updateWikiPage``` function. But the function need to know if it is a new wiki page or just a change. This distinction is done by the ```action``` parameter, but this will not be sent by the frontend (on form submit). This PR will fix this by adding the ```action``` parameter with the values ```_new``` or ```_edit```, which will be used by the ```updateWikiPage``` function. I've done integration tests with matrix and gitea (http). ![image](https://user-images.githubusercontent.com/121972/177018795-eb5cdc01-9ba3-483e-a6b7-ed0e313a71fb.png) Fix #16457 Signed-off-by: Aaron Fischer <mail@aaron-fischer.net>
* Add more checks in migration code (#21011)zeripath2022-09-042-4/+2
| | | | | | | | | | | | When migrating add several more important sanity checks: * SHAs must be SHAs * Refs must be valid Refs * URLs must be reasonable Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <matti@mdranta.net>
* Fill the specified ref in webhook test payload (#20961)Jason Song2022-09-041-4/+12
| | | | | The webhook payload should use the right ref when it‘s specified in the testing request. The compare URL should not be empty, a URL like `compare/A...A` seems useless in most cases but is helpful when testing.
* Go 1.19 format (#20758)John Olheiser2022-08-306-61/+53
| | | | | | | | | | | | | | | | | | | | | | | | * 1.19 gofumpt Signed-off-by: jolheiser <john.olheiser@gmail.com> * Change CSV test Signed-off-by: jolheiser <john.olheiser@gmail.com> * Commit whitespace fixes from @zeripath Co-authored-by: zeripath <art27@cantab.net> * Update emoji Signed-off-by: jolheiser <john.olheiser@gmail.com> * bump swagger & fix generate-swagger Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv>
* fix hard-coded timeout and error panic in API archive download endpoint (#20925)Peter Gardfjäll2022-08-291-2/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix hard-coded timeout and error panic in API archive download endpoint This commit updates the `GET /api/v1/repos/{owner}/{repo}/archive/{archive}` endpoint which prior to this PR had a couple of issues. 1. The endpoint had a hard-coded 20s timeout for the archiver to complete after which a 500 (Internal Server Error) was returned to client. For a scripted API client there was no clear way of telling that the operation timed out and that it should retry. 2. Whenever the timeout _did occur_, the code used to panic. This was caused by the API endpoint "delegating" to the same call path as the web, which uses a slightly different way of reporting errors (HTML rather than JSON for example). More specifically, `api/v1/repo/file.go#GetArchive` just called through to `web/repo/repo.go#Download`, which expects the `Context` to have a `Render` field set, but which is `nil` for API calls. Hence, a `nil` pointer error. The code addresses (1) by dropping the hard-coded timeout. Instead, any timeout/cancelation on the incoming `Context` is used. The code addresses (2) by updating the API endpoint to use a separate call path for the API-triggered archive download. This avoids producing HTML-errors on errors (it now produces JSON errors). Signed-off-by: Peter Gardfjäll <peter.gardfjall.work@gmail.com>
* Add support for Vagrant packages (#20930)KN4CK3R2022-08-291-1/+1
| | | | | | | | | | | | | | | | | | * Add support for Vagrant boxes. * Add authentication. * Add tests. * Add integration tests. * Add docs. * Add icons. * Update routers/api/packages/api.go Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: 6543 <6543@obermui.de>
* Share HTML template renderers and create a watcher framework (#20218)zeripath2022-08-282-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | The recovery, API, Web and package frameworks all create their own HTML Renderers. This increases the memory requirements of Gitea unnecessarily with duplicate templates being kept in memory. Further the reloading framework in dev mode for these involves locking and recompiling all of the templates on each load. This will potentially hide concurrency issues and it is inefficient. This PR stores the templates renderer in the context and stores this context in the NormalRoutes, it then creates a fsnotify.Watcher framework to watch files. The watching framework is then extended to the mailer templates which were previously not being reloaded in dev. Then the locales are simplified to a similar structure. Fix #20210 Fix #20211 Fix #20217 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Move some files into models' sub packages (#20262)Lunny Xiao2022-08-2519-99/+103
| | | | | | | | | | | | | | | | | | | | | | | | | * Move some files into models' sub packages * Move functions * merge main branch * Fix check * fix check * Fix some tests * Fix lint * Fix lint * Revert lint changes * Fix error comments * Fix lint Co-authored-by: 6543 <6543@obermui.de>
* Return 404 NotFound if requested attachment does not exist (#20886)zeripath2022-08-241-0/+20
| | | | | | | | | Add code to test if GetAttachmentByID returns an ErrAttachmentNotExist error and return NotFound instead of InternalServerError Fix #20884 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Pad GPG Key ID with preceding zeroes (#20878)zeripath2022-08-211-0/+7
|
* Fix owners cannot create organization repos bug (#20841)Lunny Xiao2022-08-181-1/+1
| | | | | | | | | | | * Fix owners cannot create organization repos bug * Fix api * Update routers/api/v1/org/team.go Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Gusted <williamzijl7@hotmail.com>
* Remove follow from commits by file (#20765)zeripath2022-08-141-2/+2
| | | | | | | | | | | | | | The use of `--follow` makes getting these commits very slow on large repositories as it results in searching the whole commit tree for a blob. Now as nice as the results of `--follow` are, I am uncertain whether it is really of sufficient importance to keep around. Fix #20764 Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* refactor webhook *NewPost (#20729)oliverpool2022-08-111-3/+3
| | | | | | | | | | | | | | | * refactor webhook *NewPost * remove empty values * always show errs.Message * remove utils.IsValidSlackChannel * move IsValidSlackChannel to services/webhook package * binding: handle empty Message case * make IsValidSlackChannel more strict
* Add support for Pub packages (#20560)KN4CK3R2022-08-071-1/+1
| | | | | | | | | | | * Added support for Pub packages. * Update docs/content/doc/packages/overview.en-us.md Co-authored-by: Gergely Nagy <algernon@users.noreply.github.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Gergely Nagy <algernon@users.noreply.github.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Use correct page size for link header pagination (#20546)Norwin2022-08-021-1/+1
| | | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add new API endpoints for push mirrors management (#19841)Mohamed Sekour2022-07-304-0/+352
| | | | | | | | | | | - Add a new push mirror to specific repository - Sync now ( send all the changes to the configured push mirrors ) - Get list of all push mirrors of a repository - Get a push mirror by ID - Delete push mirror by ID Signed-off-by: Mohamed Sekour <mohamed.sekour@exfo.com> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* Add latest commit's SHA to content response (#20398)Gusted2022-07-301-11/+2
| | | | | | | | | | | | | | | | | | | | | | | | * Add latest commit's SHA to content response - When requesting the contents of a filepath, add the latest commit's SHA to the requested file. - Resolves #12840 * Add swagger * Fix NPE * Fix tests * Hook into LastCommitCache * Move AddLastCommitCache to a common nogogit and gogit file Signed-off-by: Andrew Thornton <art27@cantab.net> * Prevent NPE Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Hide internal package versions (#20492)KN4CK3R2022-07-271-4/+6
| | | | | * Hide internal versions from most searches. * Added test.
* Slightly simplify LastCommitCache (#20444)zeripath2022-07-252-9/+23
| | | | | | | | | | | The LastCommitCache code is a little complex and there is unnecessary duplication between the gogit and nogogit variants. This PR adds the LastCommitCache as a field to the git.Repository and pre-creates it in the ReferencesGit helpers etc. There has been some simplification and unification of the variant code. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add "X-Gitea-Object-Type" header for GET `/raw/` & `/media/` API (#20438)65432022-07-211-4/+10
|
* Dismiss prior pull reviews if done via web in review dismiss (#20197)65432022-07-191-4/+4
|
* Set target on create release with existing tag (#20381)Gusted2022-07-151-0/+1
| | | | | | When you create a new release(e.g. via Tea) and specify a tag that already exists on the repository, Gitea will instead use the `UpdateRelease` functionality. However it currently doesn't set the Target field. This PR fixes that.
* Add option to purge users (#18064)zeripath2022-07-141-1/+1
| | | | | | | Add the ability to purge users when deleting them. Close #15588 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add missing return for when topic isn't found (#20351)Gusted2022-07-131-0/+1
| | | Add missing return to DeleteTopic API when the topic is not found.
* Add write check for creating Commit status (#20332)Gusted2022-07-121-1/+1
| | | | | | - Add write code checks for creating new commit status - Regression #5314 Co-authored-by: zeripath <art27@cantab.net>
* Add spectral linter for Swagger (#20321)silverwind2022-07-112-4/+1
| | | | | | | | | | [spectral](https://github.com/stoplightio/spectral) lints openapi/swagger files for mistakes of which it has identified a few and which I've fixed. I had to put it into `lint-frontend` because it depends on node_modules so can not run on Drone during the backend target. I plan to refactor these targets later to `lint-js` and `lint-go` so that they are categorized based on the tool dependencies.
* Implement sync push mirror on commit (#19411)Chongyi Zheng2022-07-081-2/+2
| | | | | | | | | Support synchronizing with the push mirrors whenever new commits are pushed or synced from pull mirror. Related Issues: #18220 Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-23 09:43:41 +0000