summaryrefslogtreecommitdiffstats
path: root/routers/api
Commit message (Collapse)AuthorAgeFilesLines
...
* Retarget depending pulls when the parent branch is deleted (#28686)Viktor Kuzmin2024-01-171-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes you need to work on a feature which depends on another (unmerged) feature. In this case, you may create a PR based on that feature instead of the main branch. Currently, such PRs will be closed without the possibility to reopen in case the parent feature is merged and its branch is deleted. Automatic target branch change make life a lot easier in such cases. Github and Bitbucket behave in such way. Example: $PR_1$: main <- feature1 $PR_2$: feature1 <- feature2 Currently, merging $PR_1$ and deleting its branch leads to $PR_2$ being closed without the possibility to reopen. This is both annoying and loses the review history when you open a new PR. With this change, $PR_2$ will change its target branch to main ($PR_2$: main <- feature2) after $PR_1$ has been merged and its branch has been deleted. This behavior is enabled by default but can be disabled. For security reasons, this target branch change will not be executed when merging PRs targeting another repo. Fixes #27062 Fixes #18408 --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: delvh <dev.lh@web.de>
* Fix `GetCommitStatuses` (#28787)KN4CK3R2024-01-151-1/+4
| | | Fixes #28764.
* Add branch protection setting for ignoring stale approvals (#28498)Jimmy Praet2024-01-151-0/+5
| | | | | | | | | | | | | | | | | | | | | | Fixes #27114. * In Gitea 1.12 (#9532), a "dismiss stale approvals" branch protection setting was introduced, for ignoring stale reviews when verifying the approval count of a pull request. * In Gitea 1.14 (#12674), the "dismiss review" feature was added. * This caused confusion with users (#25858), as "dismiss" now means 2 different things. * In Gitea 1.20 (#25882), the behavior of the "dismiss stale approvals" branch protection was modified to actually dismiss the stale review. For some users this new behavior of dismissing the stale reviews is not desirable. So this PR reintroduces the old behavior as a new "ignore stale approvals" branch protection setting. --------- Co-authored-by: delvh <dev.lh@web.de>
* Forbid removing the last admin user (#28337)yp053272024-01-151-1/+8
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Move more functions to db.Find (#28419)Lunny Xiao2024-01-154-28/+36
| | | | | | | | | Following #28220 This PR move more functions to use `db.Find`. --------- Co-authored-by: delvh <dev.lh@web.de>
* Fix schedule tasks bugs (#28691)Lunny Xiao2024-01-121-1/+1
| | | | | | | | | | | | | | | | Fix #28157 This PR fix the possible bugs about actions schedule. ## The Changes - Move `UpdateRepositoryUnit` and `SetRepoDefaultBranch` from models to service layer - Remove schedules plan from database and cancel waiting & running schedules tasks in this repository when actions unit has been disabled or global disabled. - Remove schedules plan from database and cancel waiting & running schedules tasks in this repository when default branch changed.
* Fix issue dependencies (#27736)Nanguan Lin2024-01-121-29/+32
| | | | | | | | | | | | | | | | | | | | Fix #27722 Fix #27357 Fix #25837 1. Fix the typo `BlockingByDependenciesNotPermitted`, which causes the `not permitted message` not to show. The correct one is `Blocking` or `BlockedBy` 2. Rewrite the perm check. The perm check uses a very tricky way to avoid duplicate checks for a slice of issues, which is confusing. In fact, it's also the reason causing the bug. It uses `lastRepoID` and `lastPerm` to avoid duplicate checks, but forgets to assign the `lastPerm` at the end of the code block. So I rewrote this to avoid this trick. ![I U1AT{GNFY3 1HZ`6L{(2L](https://github.com/go-gitea/gitea/assets/70063547/79acd02a-a567-4316-ae0d-11c6461becf1) 3. It also reuses the `blocks` slice, which is even more confusing. So I rewrote this too. ![UARFPXRGGZQFB7J$2`R}5_R](https://github.com/go-gitea/gitea/assets/70063547/f21cff0f-d9ac-4ce4-ae4d-adffc98ecd99)
* Support for grouping RPMs using paths (#26984)Exploding Dragon2024-01-122-30/+105
| | | | | | | | | | | | The current rpm repository places all packages in the same repository, and different systems (el7,f34) may hit packages that do not belong to this distribution ( #25304 ) , which now supports grouping of rpm. ![图片](https://github.com/go-gitea/gitea/assets/33776693/d1e1d99f-7799-4b2b-a19b-cb2a5c692914) Fixes #25304 . Fixes #27056 . Refactor: [#25866](https://github.com/go-gitea/gitea/pull/25866)
* Require token for GET subscription endpoint (#28765)Jack Hay2024-01-121-3/+3
| | | | | | | Fixes #28756 ## Changes - Require and check API token for `GET /repos/{owner}/{repo}/subscription` in order to populate `ctx.Doer`.
* Fix: system webhooks API bug (#28531)vincent2023-12-311-6/+17
| | | | - Fix the bug about admin/hooks API that `GET /admin/hooks` can only fetch system_hooks, `POST /admin/hooks` can only create default_hooks.
* Add get actions runner registration token for API routes, repo, org, user ↵Lunny Xiao2023-12-277-14/+184
| | | | | | | | | | and global level (#27144) Replace #23761 --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Refactor deletion (#28610)delvh2023-12-252-10/+16
| | | | | | | | | | | | | | | | | | Introduce the new generic deletion methods - `func DeleteByID[T any](ctx context.Context, id int64) (int64, error)` - `func DeleteByIDs[T any](ctx context.Context, ids ...int64) error` - `func Delete[T any](ctx context.Context, opts FindOptions) (int64, error)` So, we no longer need any specific deletion method and can just use the generic ones instead. Replacement of #28450 Closes #28450 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Refactor CORS handler (#28587)wxiaoguang2023-12-251-3/+1
| | | | | | | | | | | The CORS code has been unmaintained for long time, and the behavior is not correct. This PR tries to improve it. The key point is written as comment in code. And add more tests. Fix #28515 Fix #27642 Fix #17098
* Added instance-level variables (#28115)Jean-Baptiste Gomond2023-12-251-2/+8
| | | | | | | | | | | This PR adds instance-level variables, and so closes #27726 ![gitea_instance_variables_1](https://github.com/go-gitea/gitea/assets/8344487/ad409cd4-ce36-4c84-a764-34451b0fb63a) ![gitea_instance_variables_2](https://github.com/go-gitea/gitea/assets/8344487/426f0965-dec6-4560-948c-067cdeddd720) ![gitea_instance_variables_3](https://github.com/go-gitea/gitea/assets/8344487/cf1d7776-4938-4825-922e-cbbbf28a5f33)
* Fix merging artifact chunks error when minio storage basepath is set (#28555)FuXiaoHei2023-12-211-4/+9
| | | | | | | | | | | | Related to https://github.com/go-gitea/gitea/issues/28279 When merging artifact chunks, it lists chunks from storage. When storage is minio, chunk's path contains `MINIO_BASE_PATH` that makes merging break. <del>So trim the `MINIO_BASE_PATH` when handle chunks.</del> Update the chunk file's basename to retain necessary information. It ensures that the directory in the chunk's path remains unaffected.
* Always enable caches (#28527)Lunny Xiao2023-12-191-9/+7
| | | | | | | | | Nowadays, cache will be used on almost everywhere of Gitea and it cannot be disabled, otherwise some features will become unaviable. Then I think we can just remove the option for cache enable. That means cache cannot be disabled. But of course, we can still use cache configuration to set how should Gitea use the cache.
* Improve ObjectFormat interface (#28496)Lunny Xiao2023-12-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The 4 functions are duplicated, especially as interface methods. I think we just need to keep `MustID` the only one and remove other 3. ``` MustID(b []byte) ObjectID MustIDFromString(s string) ObjectID NewID(b []byte) (ObjectID, error) NewIDFromString(s string) (ObjectID, error) ``` Introduced the new interfrace method `ComputeHash` which will replace the interface `HasherInterface`. Now we don't need to keep two interfaces. Reintroduced `git.NewIDFromString` and `git.MustIDFromString`. The new function will detect the hash length to decide which objectformat of it. If it's 40, then it's SHA1. If it's 64, then it's SHA256. This will be right if the commitID is a full one. So the parameter should be always a full commit id. @AdamMajer Please review.
* chore(api): support ignore password if login source type is LDAP for ↵Bo-Yi Wu2023-12-191-11/+21
| | | | | | | | | | | | creating user API (#28491) - Modify the `Password` field in `CreateUserOption` struct to remove the `Required` tag - Update the `v1_json.tmpl` template to include the `email` field and remove the `password` field --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
* Adjust object format interface (#28469)Lunny Xiao2023-12-172-13/+13
| | | | | | | - Remove `ObjectFormatID` - Remove function `ObjectFormatFromID`. - Use `Sha1ObjectFormat` directly but not a pointer because it's an empty struct. - Store `ObjectFormatName` in `repository` struct
* Abstract hash function usage (#28138)Adam Majer2023-12-133-10/+12
| | | | | | Refactor Hash interfaces and centralize hash function. This will allow easier introduction of different hash function later on. This forms the "no-op" part of the SHA256 enablement patch.
* Add endpoint for not implemented Docker auth (#28457)KN4CK3R2023-12-132-1/+15
| | | | | | | | | | Recently Docker started to use the optional `POST /v2/token` endpoint which should respond with a `404 Not Found` status code instead of the current `405 Method Not Allowed`. > Note: Not all token servers implement oauth2. If the request to the endpoint returns 404 using the HTTP POST method, refer to Token Documentation for using the HTTP GET method supported by all token servers.
* Do some missing checks (#28423)Lunny Xiao2023-12-121-1/+19
|
* Deprecate query string auth tokens (#28390)Jack Hay2023-12-121-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>
* Second part of refactor `db.Find` (#28194)Lunny Xiao2023-12-112-6/+16
| | | Continue of #27798 and move more functions to `db.Find` and `db.Count`.
* Also sync DB branches on push if necessary (#28361)Lunny Xiao2023-12-091-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix #28056 This PR will check whether the repo has zero branch when pushing a branch. If that, it means this repository hasn't been synced. The reason caused that is after user upgrade from v1.20 -> v1.21, he just push branches without visit the repository user interface. Because all repositories routers will check whether a branches sync is necessary but push has not such check. For every repository, it has two states, synced or not synced. If there is zero branch for a repository, then it will be assumed as non-sync state. Otherwise, it's synced state. So if we think it's synced, we just need to update branch/insert new branch. Otherwise do a full sync. So that, for every push, there will be almost no extra load added. It's high performance than yours. For the implementation, we in fact will try to update the branch first, if updated success with affect records > 0, then all are done. Because that means the branch has been in the database. If no record is affected, that means the branch does not exist in database. So there are two possibilities. One is this is a new branch, then we just need to insert the record. Another is the branches haven't been synced, then we need to sync all the branches into database.
* Add `HEAD` support for rpm repo files (#28309)KN4CK3R2023-12-052-1/+28
| | | | | | | | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/1810 zypper uses HEAD requests to check file existence. https://github.com/openSUSE/libzypp/blob/HEAD/zypp/RepoManager.cc#L2549 https://github.com/openSUSE/libzypp/blob/HEAD/zypp-curl/ng/network/private/downloaderstates/basicdownloader_p.cc#L116 @ExplodingDragon fyi
* Remove deprecated query condition in ListReleases (#28339)Nanguan Lin2023-12-051-8/+0
| | | | | | | | | | | | | close #24057 call stack: https://github.com/go-gitea/gitea/blob/25faee3c5f5be23c99b3b7e50418fc0dbad7a41b/routers/api/v1/repo/release.go#L154 https://github.com/go-gitea/gitea/blob/ec1feedbf582b05b6a5e8c59fb2457f25d053ba2/routers/api/v1/utils/page.go#L13-L18 https://github.com/go-gitea/gitea/blob/ec1feedbf582b05b6a5e8c59fb2457f25d053ba2/services/convert/utils.go#L15-L22 ## :warning: Breaking :warning: (though it's not caused by this PR) Do not use `per_page` to specify pagination; use `limit` instead
* Fix comment permissions (#28213)Lunny Xiao2023-11-2513-30/+159
| | | | This PR will fix some missed checks for private repositories' data on web routes and API routes.
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-2413-73/+70
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Fix swagger title (#28164)yp053272023-11-221-1/+1
| | | | ![image](https://github.com/go-gitea/gitea/assets/18380374/380859b2-a643-42fd-b53e-78c93c05c826) Don't know why there's a `.` behind. 🤔
* Enable system users search via the API (#28013)Earl Warren2023-11-131-12/+26
| | | | | Refs: https://codeberg.org/forgejo/forgejo/issues/1403 (cherry picked from commit dd4d17c159eaf8b642aa9e6105b0532e25972bb7)
* Unify two factor check (#27915)KN4CK3R2023-11-061-36/+0
| | | | | | | | Fixes #27819 We have support for two factor logins with the normal web login and with basic auth. For basic auth the two factor check was implemented at three different places and you need to know that this check is necessary. This PR moves the check into the basic auth itself.
* Fix/upload artifact error windows (#27802)FuXiaoHei2023-10-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From issue https://github.com/go-gitea/gitea/issues/27314 When act_runner in `host` mode on Windows. `upload_artifact@v3` actions use `path.join` to generate `itemPath` params when uploading artifact chunk. `itemPath` is encoded as `${artifact_name}\${artifact_path}`. <del>It's twice query escaped from ${artifact_name}/${artifact_path} that joined by Windows slash \.</del> **So we need convert Windows slash to linux**. In https://github.com/go-gitea/gitea/issues/27314, runner shows logs from `upload_artifact@v3` like with `%255C`: ``` [artifact-cases/test-artifact-cases] | ::error::Unexpected response. Unable to upload chunk to http://192.168.31.230:3000/api/actions_pipeline/_apis/pipelines/workflows/6/artifacts/34d628a422db9367c869d3fb36be81f5/upload?itemPath=more-files%255Css.json ``` But in gitea server at the same time, But shows `%5C` ``` 2023/10/27 19:29:51 ...eb/routing/logger.go:102:func1() [I] router: completed PUT /api/actions_pipeline/_apis/pipelines/workflows/6/artifacts/34d628a422db9367c869d3fb36be81f5/upload?itemPath=more-files%5Css.json for 192.168.31.230:55340, 400 Bad Request in 17.6ms @ <autogenerated>:1(actions.artifactRoutes.uploadArtifact-fm) ``` I found `%255C` is escaped by `https://github.com/actions/upload-artifact/blob/main/dist/index.js#L2329`. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix bad method call when deleting user secrets via API (#27829)Jean-Baptiste Gomond2023-10-291-1/+1
| | | | | Fixed a little mistake when you deleting user secrets via the API. Found it when working on #27725. It should be backported to 1.21 I think.
* Do not force creation of _cargo-index repo on publish (#27266)merlleu2023-10-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | Hello there, Cargo Index over HTTP is now prefered over git for package updates: we should not force users who do not need the GIT repo to have the repo created/updated on each publish (it can still be created in the packages settings). The current behavior when publishing is to check if the repo exist and create it on the fly if not, then update it's content. Cargo HTTP Index does not rely on the repo itself so this will be useless for everyone not using the git protocol for cargo registry. This PR only disable the creation on the fly of the repo when publishing a crate. This is linked to #26844 (error 500 when trying to publish a crate if user is missing write access to the repo) because it's now optional. --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Upgrade to golangci-lint@v1.55.0 (#27756)silverwind2023-10-241-2/+1
| | | https://github.com/golangci/golangci-lint/releases/tag/v1.55.0
* Fix org team endpoint (#27721)Nanguan Lin2023-10-221-4/+4
| | | Fix #27711
* Delete repos of org when purge delete user (#27273)JakobDev2023-10-191-1/+1
| | | | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/1514 I had to remove `RenameOrganization` to avoid circular import. We should really add some foreign keys to the database.
* Remove unnecessary parameter (#27671)Lunny Xiao2023-10-181-1/+1
|
* Replace more db.DefaultContext (#27628)Lunny Xiao2023-10-153-3/+3
| | | Target #27065
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-149-23/+23
| | | Last part of #27065
* Fix permissions for Token DELETE endpoint to match GET and POST (#27610)Evan Tobin2023-10-141-1/+1
| | | | | | | | Fixes #27598 In #27080, the logic for the tokens endpoints were updated to allow admins to create and view tokens in other accounts. However, the same functionality was not added to the DELETE endpoint. This PR makes the DELETE endpoint function the same as the other token endpoints and adds unit tests
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-1111-24/+25
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix the wrong HTTP response status code for duplicate packages (#27480)Nanguan Lin2023-10-1010-10/+10
| | | | | | | | fix #27470 (hope there is nothing missing 😢 ) --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* api: GetPullRequestCommits: return file list (#27483)Michael Santos2023-10-092-2/+34
| | | | | | | | Fixes https://github.com/go-gitea/gitea/issues/27481 ---- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Don't let API add 2 exclusive labels from same scope (#27433)JakobDev2023-10-051-1/+1
| | | Fixes #27380
* Even more `db.DefaultContext` refactor (#27352)JakobDev2023-10-0317-39/+39
| | | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de>
* More `db.DefaultContext` refactor (#27265)JakobDev2023-09-299-18/+18
| | | | | | | Part of #27065 This PR touches functions used in templates. As templates are not static typed, errors are harder to find, but I hope I catch it all. I think some tests from other persons do not hurt.
* make writing main test easier (#27270)Lunny Xiao2023-09-281-2/+0
| | | | | | | | | This PR removed `unittest.MainTest` the second parameter `TestOptions.GiteaRoot`. Now it detects the root directory by current working directory. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Redefine the meaning of column is_active to make Actions Registration Token ↵Lunny Xiao2023-09-271-3/+3
| | | | | | | | | | | | | | | generation easier (#27143) Partially Fix #25041 This PR redefined the meaning of column `is_active` in table `action_runner_token`. Before this PR, `is_active` means whether it has been used by any runner. If it's true, other runner cannot use it to register again. In this PR, `is_active` means whether it's validated to be used to register runner. And if it's true, then it can be used to register runners until it become false. When creating a new `is_active` register token, any previous tokens will be set `is_active` to false.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-10 14:22:28 +0000