aboutsummaryrefslogtreecommitdiffstats
path: root/routers/api
Commit message (Collapse)AuthorAgeFilesLines
* Fix comment permissions (#28213)Lunny Xiao2023-11-2513-30/+159
| | | | This PR will fix some missed checks for private repositories' data on web routes and API routes.
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-2413-73/+70
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Fix swagger title (#28164)yp053272023-11-221-1/+1
| | | | ![image](https://github.com/go-gitea/gitea/assets/18380374/380859b2-a643-42fd-b53e-78c93c05c826) Don't know why there's a `.` behind. 🤔
* Enable system users search via the API (#28013)Earl Warren2023-11-131-12/+26
| | | | | Refs: https://codeberg.org/forgejo/forgejo/issues/1403 (cherry picked from commit dd4d17c159eaf8b642aa9e6105b0532e25972bb7)
* Unify two factor check (#27915)KN4CK3R2023-11-061-36/+0
| | | | | | | | Fixes #27819 We have support for two factor logins with the normal web login and with basic auth. For basic auth the two factor check was implemented at three different places and you need to know that this check is necessary. This PR moves the check into the basic auth itself.
* Fix/upload artifact error windows (#27802)FuXiaoHei2023-10-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From issue https://github.com/go-gitea/gitea/issues/27314 When act_runner in `host` mode on Windows. `upload_artifact@v3` actions use `path.join` to generate `itemPath` params when uploading artifact chunk. `itemPath` is encoded as `${artifact_name}\${artifact_path}`. <del>It's twice query escaped from ${artifact_name}/${artifact_path} that joined by Windows slash \.</del> **So we need convert Windows slash to linux**. In https://github.com/go-gitea/gitea/issues/27314, runner shows logs from `upload_artifact@v3` like with `%255C`: ``` [artifact-cases/test-artifact-cases] | ::error::Unexpected response. Unable to upload chunk to http://192.168.31.230:3000/api/actions_pipeline/_apis/pipelines/workflows/6/artifacts/34d628a422db9367c869d3fb36be81f5/upload?itemPath=more-files%255Css.json ``` But in gitea server at the same time, But shows `%5C` ``` 2023/10/27 19:29:51 ...eb/routing/logger.go:102:func1() [I] router: completed PUT /api/actions_pipeline/_apis/pipelines/workflows/6/artifacts/34d628a422db9367c869d3fb36be81f5/upload?itemPath=more-files%5Css.json for 192.168.31.230:55340, 400 Bad Request in 17.6ms @ <autogenerated>:1(actions.artifactRoutes.uploadArtifact-fm) ``` I found `%255C` is escaped by `https://github.com/actions/upload-artifact/blob/main/dist/index.js#L2329`. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix bad method call when deleting user secrets via API (#27829)Jean-Baptiste Gomond2023-10-291-1/+1
| | | | | Fixed a little mistake when you deleting user secrets via the API. Found it when working on #27725. It should be backported to 1.21 I think.
* Do not force creation of _cargo-index repo on publish (#27266)merlleu2023-10-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | Hello there, Cargo Index over HTTP is now prefered over git for package updates: we should not force users who do not need the GIT repo to have the repo created/updated on each publish (it can still be created in the packages settings). The current behavior when publishing is to check if the repo exist and create it on the fly if not, then update it's content. Cargo HTTP Index does not rely on the repo itself so this will be useless for everyone not using the git protocol for cargo registry. This PR only disable the creation on the fly of the repo when publishing a crate. This is linked to #26844 (error 500 when trying to publish a crate if user is missing write access to the repo) because it's now optional. --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Upgrade to golangci-lint@v1.55.0 (#27756)silverwind2023-10-241-2/+1
| | | https://github.com/golangci/golangci-lint/releases/tag/v1.55.0
* Fix org team endpoint (#27721)Nanguan Lin2023-10-221-4/+4
| | | Fix #27711
* Delete repos of org when purge delete user (#27273)JakobDev2023-10-191-1/+1
| | | | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/1514 I had to remove `RenameOrganization` to avoid circular import. We should really add some foreign keys to the database.
* Remove unnecessary parameter (#27671)Lunny Xiao2023-10-181-1/+1
|
* Replace more db.DefaultContext (#27628)Lunny Xiao2023-10-153-3/+3
| | | Target #27065
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-149-23/+23
| | | Last part of #27065
* Fix permissions for Token DELETE endpoint to match GET and POST (#27610)Evan Tobin2023-10-141-1/+1
| | | | | | | | Fixes #27598 In #27080, the logic for the tokens endpoints were updated to allow admins to create and view tokens in other accounts. However, the same functionality was not added to the DELETE endpoint. This PR makes the DELETE endpoint function the same as the other token endpoints and adds unit tests
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-1111-24/+25
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix the wrong HTTP response status code for duplicate packages (#27480)Nanguan Lin2023-10-1010-10/+10
| | | | | | | | fix #27470 (hope there is nothing missing 😢 ) --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* api: GetPullRequestCommits: return file list (#27483)Michael Santos2023-10-092-2/+34
| | | | | | | | Fixes https://github.com/go-gitea/gitea/issues/27481 ---- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Don't let API add 2 exclusive labels from same scope (#27433)JakobDev2023-10-051-1/+1
| | | Fixes #27380
* Even more `db.DefaultContext` refactor (#27352)JakobDev2023-10-0317-39/+39
| | | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de>
* More `db.DefaultContext` refactor (#27265)JakobDev2023-09-299-18/+18
| | | | | | | Part of #27065 This PR touches functions used in templates. As templates are not static typed, errors are harder to find, but I hope I catch it all. I think some tests from other persons do not hurt.
* make writing main test easier (#27270)Lunny Xiao2023-09-281-2/+0
| | | | | | | | | This PR removed `unittest.MainTest` the second parameter `TestOptions.GiteaRoot`. Now it detects the root directory by current working directory. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Redefine the meaning of column is_active to make Actions Registration Token ↵Lunny Xiao2023-09-271-3/+3
| | | | | | | | | | | | | | | generation easier (#27143) Partially Fix #25041 This PR redefined the meaning of column `is_active` in table `action_runner_token`. Before this PR, `is_active` means whether it has been used by any runner. If it's true, other runner cannot use it to register again. In this PR, `is_active` means whether it's validated to be used to register runner. And if it's true, then it can be used to register runners until it become false. When creating a new `is_active` register token, any previous tokens will be set `is_active` to false.
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-2536-42/+69
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Updates to the API for archived repos (#27149)JakobDev2023-09-2112-31/+69
|
* Fix organization field being null in POST /orgs/{orgid}/teams (#27150)Dionysios Kakouris2023-09-211-1/+1
| | | | | | | | | | | | | Similarly to the fix in https://github.com/go-gitea/gitea/pull/24694, this addresses the team creation not returning the organization information in the response. This fix is connected to the [issue](https://gitea.com/gitea/terraform-provider-gitea/issues/27) discovered in the terraform provider. Moreover, the [documentation](https://docs.gitea.com/api/1.20/#tag/organization/operation/orgCreateTeam) suggests that the response body should include the `organization` field (currently being `null`).
* Fix token endpoints ignore specified account (#27080)CaiCandong2023-09-182-4/+20
| | | | | | | | | Fix #26234 close #26323 close #27040 --------- Co-authored-by: silverwind <me@silverwind.io>
* Make SSPI auth mockable (#27036)wxiaoguang2023-09-173-30/+4
| | | | | | Before, the SSPI auth is only complied for Windows, it's difficult to test and it breaks a lot. Now, make the SSPI auth mockable and testable.
* Add `RemoteAddress` to mirrors (#26952)KN4CK3R2023-09-161-5/+12
| | | | | This PR adds a new field `RemoteAddress` to both mirror types which contains the sanitized remote address for easier (database) access to that information. Will be used in the audit PR if merged.
* Next round of `db.DefaultContext` refactor (#27089)JakobDev2023-09-1612-38/+38
| | | Part of #27065
* Allow empty Conan files (#27092)KN4CK3R2023-09-151-7/+2
| | | | | | | Fixes #27090 Looks like the Conan upload process has changed since last year. The empty uploads don't occur anymore.
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-1518-30/+31
| | | Next step of #27065
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-1413-25/+25
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add missing 404 response to Swagger (#27038)JakobDev2023-09-1345-0/+300
| | | | | Most middleware throw a 404 in case something is not found e.g. a Repo that is not existing. But most API endpoints don't include the 404 response in their documentation. This PR changes this.
* Extract auth middleware from service (#27028)KN4CK3R2023-09-121-2/+103
| | | | | | Related #27027 Extract the router logic from `services/auth/middleware.go` into `routers/web` <-> `routers/common` <-> `routers/api`.
* Move some functions to service layer (#26969)Lunny Xiao2023-09-081-2/+2
|
* Add a new column schedule_id for action_run to track (#26975)Lunny Xiao2023-09-081-1/+7
| | | | | | | | Fix #26971 And the UI now will display it's scheduled but not triggered by a push. <img width="954" alt="图片" src="https://github.com/go-gitea/gitea/assets/81045/d211845c-457e-4c3e-af1f-a0d654d3f365">
* move repository deletion to service layer (#26948)Lunny Xiao2023-09-083-7/+8
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Replace `util.SliceXxx` with `slices.Xxx` (#26958)CaiCandong2023-09-072-2/+4
|
* Add reverseproxy auth for API back with default disabled (#26703)Lunny Xiao2023-09-071-2/+8
| | | | | | | | | | | | | | | This feature was removed by #22219 to avoid possible CSRF attack. This PR takes reverseproxy auth for API back but with default disabled. To prevent possbile CSRF attack, the responsibility will be the reverseproxy but not Gitea itself. For those want to enable this `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`, they should know what they are doing. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Move createrepository from module to service layer (#26927)Lunny Xiao2023-09-063-5/+4
| | | | Repository creation depends on many models, so moving it to service layer is better.
* Artifacts retention and auto clean up (#26131)FuXiaoHei2023-09-062-5/+25
| | | | | | | | | | | | | | Currently, Artifact does not have an expiration and automatic cleanup mechanism, and this feature needs to be added. It contains the following key points: - [x] add global artifact retention days option in config file. Default value is 90 days. - [x] add cron task to clean up expired artifacts. It should run once a day. - [x] support custom retention period from `retention-days: 5` in `upload-artifact@v3`. - [x] artifacts link in actions view should be non-clickable text when expired.
* Move notification interface to services layer (#26915)Lunny Xiao2023-09-058-21/+21
| | | Extract from #22266
* Remove `Named` interface (#26913)KN4CK3R2023-09-054-0/+8
| | | | `Named` is implemented by every `Method` and future implementations should implement the method too.
* Refactor secrets modification logic (#26873)KN4CK3R2023-09-053-90/+86
| | | | - Share code between web and api - Add some tests
* Add missing `reqToken()` to notifications endpoints (#26914)JakobDev2023-09-051-3/+3
| | | | | | | | They currently throw a Internal Server Error when you use them without a token. Now they correctly return a `token is required` error. This is no security issue. If you use this endpoints with a token that don't have the correct permission, you get the correct error. This is not affected by this PR.
* feat(API): add routes and functions for managing user's secrets (#26909)Bo-Yi Wu2023-09-052-0/+112
| | | | | | | | | | | | | - Add routes for creating or updating a user's actions secrets in `routers/api/v1/api.go` - Add a new file `routers/api/v1/user/action.go` with functions for creating or updating a user's secrets and deleting a user's secret - Modify the `templates/swagger/v1_json.tmpl` file to include the routes for creating or updating a user's secrets and deleting a user's secret --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Allow users with write permissions for issues to add attachments with API ↵Zettat1232023-09-011-1/+1
| | | | | | | | | (#26837) Fixes #24944 Since a user with write permissions for issues can add attachments to an issue via the the web interface, the user should also be able to add attachments via the API
* feat(API): add secret deletion functionality for repository (#26808)Bo-Yi Wu2023-09-013-4/+63
| | | | | | | | | | | | | | | - Modify the `CreateOrUpdateSecret` function in `api.go` to include a `Delete` operation for the secret - Modify the `DeleteOrgSecret` function in `action.go` to include a `DeleteSecret` operation for the organization - Modify the `DeleteSecret` function in `action.go` to include a `DeleteSecret` operation for the repository - Modify the `v1_json.tmpl` template file to update the `operationId` and `summary` for the `deleteSecret` operation in both the organization and repository sections --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
* Move web/api context related testing function into a separate package (#26859)wxiaoguang2023-09-013-17/+17
| | | | | | | | | Just like `models/unittest`, the testing helper functions should be in a separate package: `contexttest` And complete the TODO: > // TODO: move this function to other packages, because it depends on "models" package
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-03 11:50:14 +0000