summaryrefslogtreecommitdiffstats
path: root/routers/api/v1
Commit message (Collapse)AuthorAgeFilesLines
* Fix api error message if fork exists (#24487) (#24493)Giteabot2023-05-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #24487 by @fnetX On the @Forgejo instance of Codeberg, we discovered that forking a repo which is already forked now returns a 500 Internal Server Error, which is unexpected. This is an attempt at fixing this. The error message in the log: ~~~ 2023/05/02 08:36:30 .../api/v1/repo/fork.go:147:CreateFork() [E] [6450cb8e-113] ForkRepository: repository is already forked by user [uname: ...., repo path: .../..., fork path: .../...] ~~~ The service that is used for forking returns a custom error message which is not checked against. About the order of options: The case that the fork already exists should be more common, followed by the case that a repo with the same name already exists for other reasons. The case that the global repo limit is hit is probably not the likeliest. --------- Co-authored-by: Otto Richter (fnetX) <git@fralix.ovh>
* Fix typo in API route (#24310) (#24332)Giteabot2023-04-251-1/+1
| | | | | | | | Backport #24310 by @silverwind Continuation of https://github.com/go-gitea/gitea/pull/23995 Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bilogic <946010+bilogic@users.noreply.github.com>
* Fix access token issue on some public endpoints (#24194) (#24259)Giteabot2023-04-211-6/+6
| | | | | | | | | | Backport #24194 by @harryzcy - [x] Identify endpoints that should be public - [x] Update integration tests Fix #24159 Co-authored-by: harryzcy <harry@harryzheng.com>
* Fix issue attachment handling (#24202) (#24221)wxiaoguang2023-04-201-2/+2
| | | | | | | | | | | | | | Backport #24202 Close #24195 Fix the bug: 1. The old code doesn't handle `removedfile` event correctly 2. The old code doesn't provide attachments for type=CommentTypeReview --------- Co-authored-by: silverwind <me@silverwind.io>
* Fix protected branch for API (#24013) (#24027)Giteabot2023-04-101-4/+8
| | | | | | | Backport #24013 by @lunny Fix #23998 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Use User.ID instead of User.Name in ActivityPub API for Person IRI (#23823) ↵Giteabot2023-04-032-9/+16
| | | | | | | | | | | | | | (#23905) Backport #23823 by @wxiaoguang Thanks to @trwnh Close #23802 The ActivityPub id is an HTTPS URI that should remain constant, even if the user changes their name. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Match api migration behavior to web behavior (#23552) (#23573)Giteabot2023-03-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | Backport #23552 by @atomaka When attempting to migrate a repository via the API endpoint comments are always included. This can create a problem if your source repository has issues or pull requests but you do not want to import them into Gitea that displays as something like: > Error 500: We were unable to perform the request due to server-side problems. 'comment references non existent IssueIndex 4 There are only two ways to resolve this: 1. Migrate using the web interface 2. Migrate using the API including at issues or pull requests. This PR matches the behavior of the API migration router to the web migration router. Co-authored-by: Andrew Tomaka <atomaka@atomaka.com> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Handle missing `README` in create repos API (#23387) (#23510)Zettat1232023-03-162-0/+13
| | | | | | | | | | | Backport #23387 Close #22934 In `/user/repos` API (and other APIs related to creating repos), user can specify a readme template for auto init. At present, if the specified template does not exist, a `500` will be returned . This PR improved the logic and will return a `400` instead of `500`. Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Purge API comment (#23451) (#23452)Giteabot2023-03-131-0/+4
| | | | | | | | | | | | | Backport #23451 by @jolheiser This PR just adds the `purge` query parameter to the swagger docs for admin user delete. I considered using the same verbiage we have in the UI, but that seemed more verbose than descriptions we use elsewhere in swagger. I'm fine if that's preferred, though, just let me know. 🙂 Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Preserve file size when creating attachments (#23406) (#23426)Giteabot2023-03-123-3/+3
| | | | | | | | | | | | | | Backport #23406 by @baez90 When creating attachments (issue, release, repo) the file size (being part of the multipart file header) is passed through the chain of creating an attachment to ensure the MinIO client can stream the file directly instead of having to read it to memory completely at first. Fixes #23393 Co-authored-by: Peter <peter.kurfer@googlemail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix panic when getting notes by ref (#23372) (#23377)Giteabot2023-03-081-1/+11
| | | | | | | | | | | | | | | | | | Backport #23372 Fix #23357 . Now the `/repos/{owner}/{repo}/git/notes/{sha}` API supports getting notes by a ref or sha (https://try.gitea.io/api/swagger#/repository/repoGetNote). But the `GetNote` func can only accept commit ID. https://github.com/go-gitea/gitea/blob/a12f5757372f751d25f9e5ca1f168f6920ded894/modules/git/notes_nogogit.go#L18 So we need to convert the query parameter to commit ID before calling `GetNote`. Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Add loading yaml label template files (#22976) (#23232)Giteabot2023-03-013-47/+41
| | | | | | | | | | | | Backport #22976 Extract from #11669 and enhancement to #22585 to support exclusive scoped labels in label templates * Move label template functionality to label module * Fix handling of color codes * Add Advanced label template Co-authored-by: Lauris BH <lauris@nix.lv>
* Add force_merge to merge request and fix checking mergable (#23010)Jason Song2023-02-211-4/+11
| | | Fix #23000.
* Add scopes to API to create token and display them (#22989)zeripath2023-02-201-2/+11
| | | | | | | | The API to create tokens is missing the ability to set the required scopes for tokens, and to show them on the API and on the UI. This PR adds this functionality. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix panic when call api (/repos/{owner}/{repo}/pulls/{index}/files) (#22921)sillyguodong2023-02-201-2/+4
| | | | | | | | | | | | | | | Close: #22910 --- I'm confused about that why does the api (`GET /repos/{owner}/{repo}/pulls/{index}/files`) require caller to pass the parameters `limit` and `page`. In my case, the caller only needs to pass a `skip-to` to paging. This is consistent with the api `GET /{owner}/{repo}/pulls/{index}/files` So, I deleted the code related to `listOptions` --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Refactor the setting to make unit test easier (#22405)Lunny Xiao2023-02-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | Some bugs caused by less unit tests in fundamental packages. This PR refactor `setting` package so that create a unit test will be easier than before. - All `LoadFromXXX` files has been splited as two functions, one is `InitProviderFromXXX` and `LoadCommonSettings`. The first functions will only include the code to create or new a ini file. The second function will load common settings. - It also renames all functions in setting from `newXXXService` to `loadXXXSetting` or `loadXXXFrom` to make the function name less confusing. - Move `XORMLog` to `SQLLog` because it's a better name for that. Maybe we should finally move these `loadXXXSetting` into the `XXXInit` function? Any idea? --------- Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: delvh <dev.lh@web.de>
* Rename `GetUnits` to `LoadUnits` (#22970)yp053272023-02-191-1/+1
| | | | | | | Same as https://github.com/go-gitea/gitea/pull/22967 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Provide the ability to set password hash algorithm parameters (#22942)zeripath2023-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters In addition it takes the opportunity to adjust the settings for `pbkdf2` in order to make the hashing a little stronger. The majority of this work was inspired by PR #14751 and I would like to thank @boppy for their work on this. Thanks to @gusted for the suggestion to adjust the `pbkdf2` hashing parameters. Close #14751 --------- Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Scoped labels (#22585)Brecht Van Lommel2023-02-182-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new "exclusive" option per label. This makes it so that when the label is named `scope/name`, no other label with the same `scope/` prefix can be set on an issue. The scope is determined by the last occurence of `/`, so for example `scope/alpha/name` and `scope/beta/name` are considered to be in different scopes and can coexist. Exclusive scopes are not enforced by any database rules, however they are enforced when editing labels at the models level, automatically removing any existing labels in the same scope when either attaching a new label or replacing all labels. In menus use a circle instead of checkbox to indicate they function as radio buttons per scope. Issue filtering by label ensures that only a single scoped label is selected at a time. Clicking with alt key can be used to remove a scoped label, both when editing individual issues and batch editing. Label rendering refactor for consistency and code simplification: * Labels now consistently have the same shape, emojis and tooltips everywhere. This includes the label list and label assignment menus. * In label list, show description below label same as label menus. * Don't use exactly black/white text colors to look a bit nicer. * Simplify text color computation. There is no point computing luminance in linear color space, as this is a perceptual problem and sRGB is closer to perceptually linear. * Increase height of label assignment menus to show more labels. Showing only 3-4 labels at a time leads to a lot of scrolling. * Render all labels with a new RenderLabel template helper function. Label creation and editing in multiline modal menu: * Change label creation to open a modal menu like label editing. * Change menu layout to place name, description and colors on separate lines. * Don't color cancel button red in label editing modal menu. * Align text to the left in model menu for better readability and consistent with settings layout elsewhere. Custom exclusive scoped label rendering: * Display scoped label prefix and suffix with slightly darker and lighter background color respectively, and a slanted edge between them similar to the `/` symbol. * In menus exclusive labels are grouped with a divider line. --------- Co-authored-by: Yarden Shoham <hrsi88@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Rename `repo.GetOwner` to `repo.LoadOwner` (#22967)yp053272023-02-182-3/+3
| | | | | | | Fixes https://github.com/go-gitea/gitea/issues/22963 --------- Co-authored-by: Yarden Shoham <hrsi88@gmail.com>
* Allow custom "created" timestamps in user creation API (#22549)Sybren2023-02-161-0/+9
| | | | | | | | | | | | | | | Allow back-dating user creation via the `adminCreateUser` API operation. `CreateUserOption` now has an optional field `created_at`, which can contain a datetime-formatted string. If this field is present, the user's `created_unix` database field will be updated to its value. This is important for Blender's migration of users from Phabricator to Gitea. There are many users, and the creation timestamp of their account can give us some indication as to how long someone's been part of the community. The back-dating is done in a separate query that just updates the user's `created_unix` field. This was the easiest and cleanest way I could find, as in the initial `INSERT` query the field always is set to "now".
* Add context cache as a request level cache (#22294)Lunny Xiao2023-02-1527-70/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid duplicated load of the same data in an HTTP request, we can set a context cache to do that. i.e. Some pages may load a user from a database with the same id in different areas on the same page. But the code is hidden in two different deep logic. How should we share the user? As a result of this PR, now if both entry functions accept `context.Context` as the first parameter and we just need to refactor `GetUserByID` to reuse the user from the context cache. Then it will not be loaded twice on an HTTP request. But of course, sometimes we would like to reload an object from the database, that's why `RemoveContextData` is also exposed. The core context cache is here. It defines a new context ```go type cacheContext struct { ctx context.Context data map[any]map[any]any lock sync.RWMutex } var cacheContextKey = struct{}{} func WithCacheContext(ctx context.Context) context.Context { return context.WithValue(ctx, cacheContextKey, &cacheContext{ ctx: ctx, data: make(map[any]map[any]any), }) } ``` Then you can use the below 4 methods to read/write/del the data within the same context. ```go func GetContextData(ctx context.Context, tp, key any) any func SetContextData(ctx context.Context, tp, key, value any) func RemoveContextData(ctx context.Context, tp, key any) func GetWithContextCache[T any](ctx context.Context, cacheGroupKey string, cacheTargetID any, f func() (T, error)) (T, error) ``` Then let's take a look at how `system.GetString` implement it. ```go func GetSetting(ctx context.Context, key string) (string, error) { return cache.GetWithContextCache(ctx, contextCacheKey, key, func() (string, error) { return cache.GetString(genSettingCacheKey(key), func() (string, error) { res, err := GetSettingNoCache(ctx, key) if err != nil { return "", err } return res.SettingValue, nil }) }) } ``` First, it will check if context data include the setting object with the key. If not, it will query from the global cache which may be memory or a Redis cache. If not, it will get the object from the database. In the end, if the object gets from the global cache or database, it will be set into the context cache. An object stored in the context cache will only be destroyed after the context disappeared.
* Pull Requests: setting to allow edits by maintainers by default, tweak UI ↵Brecht Van Lommel2023-02-131-0/+4
| | | | | | | | | | | | | | | | | | (#22862) Add setting to allow edits by maintainers by default, to avoid having to often ask contributors to enable this. This also reorganizes the pull request settings UI to improve clarity. It was unclear which checkbox options were there to control available merge styles and which merge styles they correspond to. Now there is a "Merge Styles" label followed by the merge style options with the same name as in other menus. The remaining checkboxes were moved to the bottom, ordered rougly by typical order of operations. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Map OIDC groups to Orgs/Teams (#21441)KN4CK3R2023-02-083-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #19555 Test-Instructions: https://github.com/go-gitea/gitea/pull/21441#issuecomment-1419438000 This PR implements the mapping of user groups provided by OIDC providers to orgs teams in Gitea. The main part is a refactoring of the existing LDAP code to make it usable from different providers. Refactorings: - Moved the router auth code from module to service because of import cycles - Changed some model methods to take a `Context` parameter - Moved the mapping code from LDAP to a common location I've tested it with Keycloak but other providers should work too. The JSON mapping format is the same as for LDAP. ![grafik](https://user-images.githubusercontent.com/1666336/195634392-3fc540fc-b229-4649-99ac-91ae8e19df2d.png) --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add Chef package registry (#22554)KN4CK3R2023-02-061-1/+1
| | | | | | | | | | | | | This PR implements a [Chef registry](https://chef.io/) to manage cookbooks. This package type was a bit complicated because Chef uses RSA signed requests as authentication with the registry. ![grafik](https://user-images.githubusercontent.com/1666336/213747995-46819fd8-c3d6-45a2-afd4-a4c3c8505a4a.png) ![grafik](https://user-images.githubusercontent.com/1666336/213748145-d01c9e81-d4dd-41e3-a3cc-8241862c3166.png) Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add Cargo package registry (#21888)KN4CK3R2023-02-051-1/+1
| | | | | | | | | | | | | | | | | | This PR implements a [Cargo registry](https://doc.rust-lang.org/cargo/) to manage Rust packages. This package type was a little bit more complicated because Cargo needs an additional Git repository to store its package index. Screenshots: ![grafik](https://user-images.githubusercontent.com/1666336/203102004-08d812ac-c066-4969-9bda-2fed818554eb.png) ![grafik](https://user-images.githubusercontent.com/1666336/203102141-d9970f14-dca6-4174-b17a-50ba1bd79087.png) ![grafik](https://user-images.githubusercontent.com/1666336/203102244-dc05743b-78b6-4d97-998e-ef76341a978f.png) --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add Conda package registry (#22262)KN4CK3R2023-02-011-1/+1
| | | This PR adds a [Conda](https://conda.io/) package registry.
* Implement actions (#21937)Jason Song2023-01-311-4/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Close #13539. Co-authored by: @lunny @appleboy @fuxiaohei and others. Related projects: - https://gitea.com/gitea/actions-proto-def - https://gitea.com/gitea/actions-proto-go - https://gitea.com/gitea/act - https://gitea.com/gitea/act_runner ### Summary The target of this PR is to bring a basic implementation of "Actions", an internal CI/CD system of Gitea. That means even though it has been merged, the state of the feature is **EXPERIMENTAL**, and please note that: - It is disabled by default; - It shouldn't be used in a production environment currently; - It shouldn't be used in a public Gitea instance currently; - Breaking changes may be made before it's stable. **Please comment on #13539 if you have any different product design ideas**, all decisions reached there will be adopted here. But in this PR, we don't talk about **naming, feature-creep or alternatives**. ### ⚠️ Breaking `gitea-actions` will become a reserved user name. If a user with the name already exists in the database, it is recommended to rename it. ### Some important reviews - What is `DEFAULT_ACTIONS_URL` in `app.ini` for? - https://github.com/go-gitea/gitea/pull/21937#discussion_r1055954954 - Why the api for runners is not under the normal `/api/v1` prefix? - https://github.com/go-gitea/gitea/pull/21937#discussion_r1061173592 - Why DBFS? - https://github.com/go-gitea/gitea/pull/21937#discussion_r1061301178 - Why ignore events triggered by `gitea-actions` bot? - https://github.com/go-gitea/gitea/pull/21937#discussion_r1063254103 - Why there's no permission control for actions? - https://github.com/go-gitea/gitea/pull/21937#discussion_r1090229868 ### What it looks like <details> #### Manage runners <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205870657-c72f590e-2e08-4cd4-be7f-2e0abb299bbf.png"> #### List runs <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205872794-50fde990-2b45-48c1-a178-908e4ec5b627.png"> #### View logs <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205872501-9b7b9000-9542-4991-8f55-18ccdada77c3.png"> </details> ### How to try it <details> #### 1. Start Gitea Clone this branch and [install from source](https://docs.gitea.io/en-us/install-from-source). Add additional configurations in `app.ini` to enable Actions: ```ini [actions] ENABLED = true ``` Start it. If all is well, you'll see the management page of runners: <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205877365-8e30a780-9b10-4154-b3e8-ee6c3cb35a59.png"> #### 2. Start runner Clone the [act_runner](https://gitea.com/gitea/act_runner), and follow the [README](https://gitea.com/gitea/act_runner/src/branch/main/README.md) to start it. If all is well, you'll see a new runner has been added: <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205878000-216f5937-e696-470d-b66c-8473987d91c3.png"> #### 3. Enable actions for a repo Create a new repo or open an existing one, check the `Actions` checkbox in settings and submit. <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205879705-53e09208-73c0-4b3e-a123-2dcf9aba4b9c.png"> <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205879383-23f3d08f-1a85-41dd-a8b3-54e2ee6453e8.png"> If all is well, you'll see a new tab "Actions": <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205881648-a8072d8c-5803-4d76-b8a8-9b2fb49516c1.png"> #### 4. Upload workflow files Upload some workflow files to `.gitea/workflows/xxx.yaml`, you can follow the [quickstart](https://docs.github.com/en/actions/quickstart) of GitHub Actions. Yes, Gitea Actions is compatible with GitHub Actions in most cases, you can use the same demo: ```yaml name: GitHub Actions Demo run-name: ${{ github.actor }} is testing out GitHub Actions 🚀 on: [push] jobs: Explore-GitHub-Actions: runs-on: ubuntu-latest steps: - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event." - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by GitHub!" - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}." - name: Check out repository code uses: actions/checkout@v3 - run: echo "💡 The ${{ github.repository }} repository has been cloned to the runner." - run: echo "🖥️ The workflow is now ready to test your code on the runner." - name: List files in the repository run: | ls ${{ github.workspace }} - run: echo "🍏 This job's status is ${{ job.status }}." ``` If all is well, you'll see a new run in `Actions` tab: <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205884473-79a874bc-171b-4aaf-acd5-0241a45c3b53.png"> #### 5. Check the logs of jobs Click a run and you'll see the logs: <img width="1792" alt="image" src="https://user-images.githubusercontent.com/9418365/205884800-994b0374-67f7-48ff-be9a-4c53f3141547.png"> #### 6. Go on You can try more examples in [the documents](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions) of GitHub Actions, then you might find a lot of bugs. Come on, PRs are welcome. </details> See also: [Feature Preview: Gitea Actions](https://blog.gitea.io/2022/12/feature-preview-gitea-actions/) --------- Co-authored-by: a1012112796 <1012112796@qq.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: ChristopherHX <christopher.homberger@web.de> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Support system hook API (#14537)Lunny Xiao2023-01-283-0/+219
| | | This add system hook API
* Add API endpoint to get latest release (#21267)JakobDev2023-01-262-0/+42
| | | | | | This PR adds a new API endpoint to get the latest stable release of a repo, similar to [GitHub API](https://docs.github.com/en/rest/releases/releases#get-the-latest-release).
* Webhooks: for issue close/reopen action, add commit ID that caused it (#22583)Brecht Van Lommel2023-01-242-3/+3
| | | | | | | | The `commit_id` property name is the same as equivalent functionality in GitHub. If the action was not caused by a commit, an empty string is used. This can for example be used to automatically add a Resolved label to an issue fixed by a commit, or clear it when the issue is reopened.
* Support scoped access tokens (#20908)Chongyi Zheng2023-01-171-194/+228
| | | | | | | | | | | | | | | | | | | | | | | | | | | This PR adds the support for scopes of access tokens, mimicking the design of GitHub OAuth scopes. The changes of the core logic are in `models/auth` that `AccessToken` struct will have a `Scope` field. The normalized (no duplication of scope), comma-separated scope string will be stored in `access_token` table in the database. In `services/auth`, the scope will be stored in context, which will be used by `reqToken` middleware in API calls. Only OAuth2 tokens will have granular token scopes, while others like BasicAuth will default to scope `all`. A large amount of work happens in `routers/api/v1/api.go` and the corresponding `tests/integration` tests, that is adding necessary scopes to each of the API calls as they fit. - [x] Add `Scope` field to `AccessToken` - [x] Add access control to all API endpoints - [x] Update frontend & backend for when creating tokens - [x] Add a database migration for `scope` column (enable 'all' access to past tokens) I'm aiming to complete it before Gitea 1.19 release. Fixes #4300
* Supports wildcard protected branch (#20825)Lunny Xiao2023-01-162-27/+101
| | | | | | | | | | | | | | | | | This PR introduce glob match for protected branch name. The separator is `/` and you can use `*` matching non-separator chars and use `**` across separator. It also supports input an exist or non-exist branch name as matching condition and branch name condition has high priority than glob rule. Should fix #2529 and #15705 screenshots <img width="1160" alt="image" src="https://user-images.githubusercontent.com/81045/205651179-ebb5492a-4ade-4bb4-a13c-965e8c927063.png"> Co-authored-by: zeripath <art27@cantab.net>
* Prevent panic on looking at api "git" endpoints for empty repos (#22457)zeripath2023-01-151-1/+1
| | | | | | | | | The API endpoints for "git" can panic if they are called on an empty repo. We can simply allow empty repos for these endpoints without worry as they should just work. Fix #22452 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Improve utils of slices (#22379)Jason Song2023-01-111-17/+17
| | | | | | | | | | | | | | | | | | | - Move the file `compare.go` and `slice.go` to `slice.go`. - Fix `ExistsInSlice`, it's buggy - It uses `sort.Search`, so it assumes that the input slice is sorted. - It passes `func(i int) bool { return slice[i] == target })` to `sort.Search`, that's incorrect, check the doc of `sort.Search`. - Conbine `IsInt64InSlice(int64, []int64)` and `ExistsInSlice(string, []string)` to `SliceContains[T]([]T, T)`. - Conbine `IsSliceInt64Eq([]int64, []int64)` and `IsEqualSlice([]string, []string)` to `SliceSortedEqual[T]([]T, T)`. - Add `SliceEqual[T]([]T, T)` as a distinction from `SliceSortedEqual[T]([]T, T)`. - Redesign `RemoveIDFromList([]int64, int64) ([]int64, bool)` to `SliceRemoveAll[T]([]T, T) []T`. - Add `SliceContainsFunc[T]([]T, func(T) bool)` and `SliceRemoveAllFunc[T]([]T, func(T) bool)` for general use. - Add comments to explain why not `golang.org/x/exp/slices`. - Add unit tests.
* Use context parameter in models/git (#22367)Jason Song2023-01-093-4/+4
| | | | | | | | | After #22362, we can feel free to use transactions without `db.DefaultContext`. And there are still lots of models using `db.DefaultContext`, I think we should refactor them carefully and one by one. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove old HookEventType (#22358)Jason Song2023-01-061-35/+35
| | | Supplement to #22256.
* Restructure `webhook` module (#22256)delvh2023-01-013-18/+19
| | | | | | | | | | | | Previously, there was an `import services/webhooks` inside `modules/notification/webhook`. This import was removed (after fighting against many import cycles). Additionally, `modules/notification/webhook` was moved to `modules/webhook`, and a few structs/constants were extracted from `models/webhooks` to `modules/webhook`. Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add `sync_on_commit` option for push mirrors api (#22271)Chongyi Zheng2022-12-301-4/+5
| | | | | | | | | Push mirrors `sync_on_commit` option was added to the web interface in v1.18.0. However, it's not added to the API. This PR updates the API endpoint. Fixes #22267 Also, I think this should be backported to 1.18
* Support template for merge message description (#22248)Jason Song2022-12-291-1/+1
| | | | | | | | | | | | | | | | | Fix #21435. Use the first line of the template as the git commit message title, and the rest as the description. ## Snapshots <img width="806" alt="image" src="https://user-images.githubusercontent.com/9418365/209644083-5d85179c-cf58-404f-bc98-c662398a2411.png"> <img width="860" alt="image" src="https://user-images.githubusercontent.com/9418365/209644392-22573090-e2c1-458b-ba44-855b79735632.png"> <img width="1154" alt="image" src="https://user-images.githubusercontent.com/9418365/209644457-a1b2711a-6787-45b4-b52c-a88d7fc132d7.png"> Co-authored-by: delvh <dev.lh@web.de>
* Move `convert` package to services (#22264)KN4CK3R2022-12-2958-58/+58
| | | | | | | | | | Addition to #22256 The `convert` package relies heavily on different models which is [disallowed by our definition of modules](https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md#design-guideline). This helps to prevent possible import cycles. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add option to prohibit fork if user reached maximum limit of repositories ↵Xinyu Zhou2022-12-271-1/+1
| | | | | | | | | | | | | | | | | | (#21848) If user has reached the maximum limit of repositories: - Before - disallow create - allow fork without limit - This patch: - disallow create - disallow fork - Add option `ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT` (Default **true**) : enable this allow user fork repositories without maximum number limit fixed https://github.com/go-gitea/gitea/issues/21847 Signed-off-by: Xinyu Zhou <i@sourcehut.net>
* Use complete SHA to create and query commit status (#22244)Jason Song2022-12-272-0/+30
| | | | | | | Fix #13485. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove ReverseProxy authentication from the API (#22219)zeripath2022-12-271-9/+3
| | | | | | | | | | | | | | | | | | | Since we changed the /api/v1/ routes to disallow session authentication we also removed their reliance on CSRF. However, we left the ReverseProxy authentication here - but this means that POSTs to the API are no longer protected by CSRF. Now, ReverseProxy authentication is a kind of session authentication, and is therefore inconsistent with the removal of session from the API. This PR proposes that we simply remove the ReverseProxy authentication from the API and therefore users of the API must explicitly use tokens or basic authentication. Replace #22077 Close #22221 Close #22077 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow empty assignees on pull request edit (#22150)KN4CK3R2022-12-211-0/+5
| | | Fixes #22140
* refactor bind functions based on generics (#22055)Lunny Xiao2022-12-121-7/+2
|
* Rename almost all Ctx functions (#22071)Lunny Xiao2022-12-106-23/+23
|
* Add API management for issue/pull and comment attachments (#21783)KN4CK3R2022-12-095-4/+798
| | | | | | | | | | | | | | Close #14601 Fix #3690 Revive of #14601. Updated to current code, cleanup and added more read/write checks. Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andre Bruch <ab@andrebruch.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Norwin <git@nroo.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix ListBranches to handle empty case (#21921)Lunny Xiao2022-12-041-26/+34
| | | | | | Fix #21910 Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* refactor some functions to support ctx as first parameter (#21878)Lunny Xiao2022-12-0315-38/+40
| | | | Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lauris BH <lauris@nix.lv>
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-19 09:33:51 +0000