aboutsummaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* add `username` to OIDC introspection response (#31688)Shivaram Lingamneni2024-07-251-2/+4
| | | | | | | | | This field is specified as optional here: https://datatracker.ietf.org/doc/html/rfc7662#section-2.2 It's used by some OIDC integrations, e.g. https://emersion.fr/blog/2022/irc-and-oauth2/ Co-authored-by: Giteabot <teabot@gitea.io>
* fix OIDC introspection authentication (#31632)Shivaram Lingamneni2024-07-231-0/+56
| | | | | | | | | | | | | | | | | | | | | See discussion on #31561 for some background. The introspect endpoint was using the OIDC token itself for authentication. This fixes it to use basic authentication with the client ID and secret instead: * Applications with a valid client ID and secret should be able to successfully introspect an invalid token, receiving a 200 response with JSON data that indicates the token is invalid * Requests with an invalid client ID and secret should not be able to introspect, even if the token itself is valid Unlike #31561 (which just future-proofed the current behavior against future changes to `DISABLE_QUERY_AUTH_TOKEN`), this is a potential compatibility break (some introspection requests without valid client IDs that would previously succeed will now fail). Affected deployments must begin sending a valid HTTP basic authentication header with their introspection requests, with the username set to a valid client ID and the password set to the corresponding client secret.
* allow synchronizing user status from OAuth2 login providers (#31572)Rowan Bohde2024-07-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This leverages the existing `sync_external_users` cron job to synchronize the `IsActive` flag on users who use an OAuth2 provider set to synchronize. This synchronization is done by checking for expired access tokens, and using the stored refresh token to request a new access token. If the response back from the OAuth2 provider is the `invalid_grant` error code, the user is marked as inactive. However, the user is able to reactivate their account by logging in the web browser through their OAuth2 flow. Also changed to support this is that a linked `ExternalLoginUser` is always created upon a login or signup via OAuth2. ### Notes on updating permissions Ideally, we would also refresh permissions from the configured OAuth provider (e.g., admin, restricted and group mappings) to match the implementation of LDAP. However, the OAuth library used for this `goth`, doesn't seem to support issuing a session via refresh tokens. The interface provides a [`RefreshToken` method](https://github.com/markbates/goth/blob/master/provider.go#L20), but the returned `oauth.Token` doesn't implement the `goth.Session` we would need to call `FetchUser`. Due to specific implementations, we would need to build a compatibility function for every provider, since they cast to concrete types (e.g. [Azure](https://github.com/markbates/goth/blob/master/providers/azureadv2/azureadv2.go#L132)) --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Allow disabling authentication related user features (#31535)Rowan Bohde2024-07-091-0/+405
| | | | | | | | | | | | | | | | | | | | We have some instances that only allow using an external authentication source for authentication. In this case, users changing their email, password, or linked OpenID connections will not have any effect, and we'd like to prevent showing that to them to prevent confusion. Included in this are several changes to support this: * A new setting to disable user managed authentication credentials (email, password & OpenID connections) * A new setting to disable user managed MFA (2FA codes & WebAuthn) * Fix an issue where some templates had separate logic for determining if a feature was disabled since it didn't check the globally disabled features * Hide more user setting pages in the navbar when their settings aren't enabled --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Allow force push to protected branches (#28086)Henry Goodman2024-07-051-26/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #22722 ### Problem Currently, it is not possible to force push to a branch with branch protection rules in place. There are often times where this is necessary (CI workflows/administrative tasks etc). The current workaround is to rename/remove the branch protection, perform the force push, and then reinstate the protections. ### Solution Provide an additional section in the branch protection rules to allow users to specify which users with push access can also force push to the branch. The default value of the rule will be set to `Disabled`, and the UI is intuitive and very similar to the `Push` section. It is worth noting in this implementation that allowing force push does not override regular push access, and both will need to be enabled for a user to force push. This applies to manual force push to a remote, and also in Gitea UI updating a PR by rebase (which requires force push) This modifies the `BranchProtection` API structs to add: - `enable_force_push bool` - `enable_force_push_whitelist bool` - `force_push_whitelist_usernames string[]` - `force_push_whitelist_teams string[]` - `force_push_whitelist_deploy_keys bool` ### Updated Branch Protection UI: <img width="943" alt="image" src="https://github.com/go-gitea/gitea/assets/79623665/7491899c-d816-45d5-be84-8512abd156bf"> ### Pull Request `Update branch by Rebase` option enabled with source branch `test` being a protected branch: ![image](https://github.com/go-gitea/gitea/assets/79623665/e018e6e9-b7b2-4bd3-808e-4947d7da35cc) <img width="1038" alt="image" src="https://github.com/go-gitea/gitea/assets/79623665/57ead13e-9006-459f-b83c-7079e6f4c654"> --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add typescript guideline and typescript-specific eslint plugins and fix ↵silverwind2024-07-032-14/+14
| | | | | | | | issues (#31521) 1. Add some general guidelines how to write our typescript code 2. Add `@typescript-eslint/eslint-plugin`, general typescript rules 3. Add `eslint-plugin-deprecation` to detect deprecated code 4. Fix all new lint issues that came up
* Add initial typescript config and use it for eslint,vitest,playwright (#31186)silverwind2024-06-284-13/+13
| | | | | | | | | | | | | | | | | | | | This enables eslint to use the typescript parser and resolver which brings some benefits that eslint rules now have type information available and a tsconfig.json is required for the upcoming typescript migration as well. Notable changes done: - Add typescript parser and resolver - Move the vue-specific config into the root file - Enable `vue-scoped-css/enforce-style-type` rule, there was only one violation and I added a inline disable there. - Fix new lint errors that were detected because of the parser change - Update `i/no-unresolved` to remove now-unnecessary workaround for the resolver - Disable `i/no-named-as-default` as it seems to raise bogus issues in the webpack config - Change vitest config to typescript - Change playwright config to typescript - Add `eslint-plugin-playwright` and fix issues - Add `tsc` linting to `make lint-js`
* Simplify 404/500 page (#31409)wxiaoguang2024-06-232-4/+3
|
* Refactor names (#31405)wxiaoguang2024-06-193-9/+9
| | | | | | | This PR only does "renaming": * `Route` should be `Router` (and chi router is also called "router") * `Params` should be `PathParam` (to distingush it from URL query param, and to match `FormString`) * Use lower case for private functions to avoid exposing or abusing
* Refactor route path normalization (#31381)wxiaoguang2024-06-171-20/+21
| | | | Refactor route path normalization and decouple it from the chi router. Fix the TODO, fix the legacy strange path behavior.
* Improve rubygems package registry (#31357)wxiaoguang2024-06-171-102/+212
| | | | | | | To make it work with Bundler: https://guides.rubygems.org/rubygems-org-compact-index-api/ It only adds 2 new API endpoints and improves some tests, existing logic is not changed.
* Fix #31185 try fix lfs download from bitbucket failed (#31201)Zoupers Zou2024-06-112-7/+7
| | | Fix #31185
* Remove sub-path from container registry realm (#31293)wxiaoguang2024-06-091-3/+9
| | | | Container registry requires that the "/v2" must be in the root, so the sub-path in AppURL should be removed
* Add `lint-go-gopls` (#30729)silverwind2024-06-053-6/+6
| | | | | | | | | | | | | | | | | | | | | | Uses `gopls check <files>` as a linter. Tested locally and brings up 149 errors currently for me. I don't think I want to fix them in this PR, but I would like at least to get this analysis running on CI. List of errors: ``` modules/indexer/code/indexer.go:181:11: impossible condition: nil != nil routers/private/hook_post_receive.go:120:15: tautological condition: nil == nil services/auth/source/oauth2/providers.go:185:9: tautological condition: nil == nil services/convert/issue.go:216:11: tautological condition: non-nil != nil tests/integration/git_test.go:332:9: impossible condition: nil != nil services/migrations/migrate.go:179:24-43: unused parameter: ctx services/repository/transfer.go:288:48-69: unused parameter: doer tests/integration/api_repo_tags_test.go:75:41-61: unused parameter: session tests/integration/git_test.go:696:64-74: unused parameter: baseBranch tests/integration/gpg_git_test.go:265:27-39: unused parameter: t tests/integration/gpg_git_test.go:284:23-29: unused parameter: tmpDir tests/integration/gpg_git_test.go:284:31-35: unused parameter: name tests/integration/gpg_git_test.go:284:37-42: unused parameter: email ```
* Fix NuGet Package API for $filter with Id equality (#31188)Thomas Desveaux2024-06-041-16/+86
| | | | | | | | | | | | | | | | Fixes issue when running `choco info pkgname` where `pkgname` is also a substring of another package Id. Relates to #31168 --- This might fix the issue linked, but I'd like to test it with more choco commands before closing the issue in case I find other problems if that's ok. --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Azure blob storage support (#30995)Lunny Xiao2024-05-303-18/+28
| | | | | | | | | | | | | | | | | | | | | | | | | This PR implemented object storages(LFS/Packages/Attachments and etc.) for Azure Blob Storage. It depends on azure official golang SDK and can support both the azure blob storage cloud service and azurite mock server. Replace #25458 Fix #22527 - [x] CI Tests - [x] integration test, MSSQL integration tests will now based on azureblob - [x] unit test - [x] CLI Migrate Storage - [x] Documentation for configuration added ------ TODO (other PRs): - [ ] Improve performance of `blob download`. --------- Co-authored-by: yp05327 <576951401@qq.com>
* Fix push multiple branches error with tests (#31151)Lunny Xiao2024-05-292-0/+53
|
* Add an immutable tarball link to archive download headers for Nix (#31139)Jörg Thalheim2024-05-281-0/+11
| | | | | | | | This allows `nix flake metadata` and nix in general to lock a *branch* tarball link in a manner that causes it to fetch the correct commit even if the branch is updated with a newer version. Co-authored-by: Jade Lovelace <software@lfcode.ca> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Prevent simultaneous editing of comments and issues (#31053)metiftikci2024-05-271-0/+66
| | | | | | | | | | | fixes #22907 Tested: - [x] issue content edit - [x] issue content change tasklist - [x] pull request content edit - [x] pull request change tasklist ![issue-content-edit](https://github.com/go-gitea/gitea/assets/29250154/a0828889-fb96-4bc4-8600-da92e3205812)
* Rename project board -> column to make the UI less confusing (#30170)Lunny Xiao2024-05-271-7/+7
| | | | | | | | | | | | | This PR split the `Board` into two parts. One is the struct has been renamed to `Column` and the second we have a `Template Type`. But to make it easier to review, this PR will not change the database schemas, they are just renames. The database schema changes could be in future PRs. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: yp05327 <576951401@qq.com>
* Fix wrong display of recently pushed notification (#25812)yp053272024-05-2112-33/+226
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's a bug in #25715: If user pushed a commit into another repo with same branch name, the no-related repo will display the recently pushed notification incorrectly. It is simple to fix this, we should match the repo id in the sql query. ![image](https://github.com/go-gitea/gitea/assets/18380374/9411a926-16f1-419e-a1b5-e953af38bab1) The latest commit is 2 weeks ago. ![image](https://github.com/go-gitea/gitea/assets/18380374/52f9ab22-4999-43ac-a86f-6d36fb1e0411) The notification comes from another repo with same branch name: ![image](https://github.com/go-gitea/gitea/assets/18380374/a26bc335-8e5b-4b9c-a965-c3dc3fa6f252) After: In forked repo: ![image](https://github.com/go-gitea/gitea/assets/18380374/ce6ffc35-deb7-4be7-8b09-184207392f32) New PR Link will redirect to the original repo: ![image](https://github.com/go-gitea/gitea/assets/18380374/7b98e76f-0c75-494c-9462-80cf9f98e786) In the original repo: ![image](https://github.com/go-gitea/gitea/assets/18380374/5f6a821b-e51a-4bbd-9980-d9eb94a3c847) New PR Link: ![image](https://github.com/go-gitea/gitea/assets/18380374/1ce8c879-9f11-4312-8c32-695d7d9af0df) In the same repo: ![image](https://github.com/go-gitea/gitea/assets/18380374/64b56073-4d0e-40c4-b8a0-80be7a775f69) New PR Link: ![image](https://github.com/go-gitea/gitea/assets/18380374/96e1b6a3-fb98-40ee-b2ee-648039fb0dcf) 08/15 Update: Follow #26257, added permission check and logic fix mentioned in https://github.com/go-gitea/gitea/pull/26257#discussion_r1294085203 2024/04/25 Update: Fix #30611 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix automerge will not work because of some events haven't been triggered ↵Lunny Xiao2024-05-213-21/+224
| | | | | | | | | | | | | | | | | (#30780) Replace #25741 Close #24445 Close #30658 Close #20646 ~Depends on #30805~ Since #25741 has been rewritten totally, to make the contribution easier, I will continue the work in this PR. Thanks @6543 --------- Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Avoid 500 panic error when uploading invalid maven package file (#31014)wxiaoguang2024-05-201-0/+10
| | | | | | | PackageDescriptor.Metadata might be nil (and maybe not only for maven). This is only a quick fix. The new `if` block is written intentionally to avoid unnecessary indenting to the existing code.
* Fix incorrect "blob excerpt" link when comparing files (#31013)wxiaoguang2024-05-201-0/+39
| | | | | | | When comparing files between the base repo and forked repo, the "blob excerpt" link should point to the forked repo, because the commit doesn't exist in base repo. Co-authored-by: Giteabot <teabot@gitea.io>
* Fix data-race during testing (#30999)wxiaoguang2024-05-201-2/+4
| | | Fix #30992
* Protected tag is no internal server error (#30962)KN4CK3R2024-05-142-17/+29
| | | | | | Fixes #30959 Adds an API test for protected tags. Fix existing tag in combination with fixtures.
* Restyle release list, fix branch dropdown (#30837)silverwind2024-05-131-4/+4
| | | | | | | | | | | | | | | | | | | Fixes https://github.com/go-gitea/gitea/issues/30821 and restyles the release list. Desktop: <img width="1199" alt="Screenshot 2024-05-02 at 20 46 10" src="https://github.com/go-gitea/gitea/assets/115237/bee92423-d4a9-4b26-8301-3a1e09eef4cd"> Mobile: <img width="443" alt="Screenshot 2024-05-02 at 20 46 21" src="https://github.com/go-gitea/gitea/assets/115237/42ecbae5-bdb6-4b16-a0ee-9c64daede68d"> --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Support using label names when changing issue labels (#30943)Zettat1232024-05-131-2/+51
| | | | | | | | | | | | Resolve #30917 Make the APIs for adding labels and replacing labels support both label IDs and label names so the [`actions/labeler`](https://github.com/actions/labeler) action can work in Gitea. <img width="600px" src="https://github.com/go-gitea/gitea/assets/15528715/7835c771-f637-4c57-9ce5-e4fbf56fa0d3" />
* Update issue indexer after merging a PR (#30715)Zettat1232024-05-081-0/+61
| | | Fix #30684
* Fix various problems around projects board view (#30696)Lunny Xiao2024-05-082-3/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | # The problem The previous implementation will start multiple POST requests from the frontend when moving a column and another bug is moving the default column will never be remembered in fact. # What's changed - [x] This PR will allow the default column to move to a non-first position - [x] And it also uses one request instead of multiple requests when moving the columns - [x] Use a star instead of a pin as the icon for setting the default column action - [x] Inserted new column will be append to the end - [x] Fix #30701 the newly added issue will be append to the end of the default column - [x] Fix when deleting a column, all issues in it will be displayed from UI but database records exist. - [x] Add a limitation for columns in a project to 20. So the sorting will not be overflow because it's int8. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Make sure git version&feature are always prepared (#30877)wxiaoguang2024-05-061-1/+1
| | | Otherwise there would be more similar issues like #29287
* Fix issue/PR title edit (#30858)wxiaoguang2024-05-052-2/+2
| | | | | 1. "enter" doesn't work (I think it is the last enter support for #14843) 2. if a branch name contains something like `&`, then the branch selector doesn't update
* Add result check in TestAPIEditUser (#29674)yp053272024-05-051-2/+5
| | | | | | Fix #29514 There are too many usage of `NewRequestWithValues`, so there's no need to check all of them. Just one is enough I think.
* Don't only list code-enabled repositories when using repository API (#30817)Kemal Zebari2024-05-031-0/+34
| | | | | We should be listing all repositories by default. Fixes #28483.
* Fix no edit history after editing issue's title and content (#30814)yp053272024-05-032-8/+22
| | | | | Fix #30807 reuse functions in services
* Catch and handle unallowed file type errors in issue attachment API (#30791)Kemal Zebari2024-05-022-0/+55
| | | | | Before, we would just throw 500 if a user passes an attachment that is not an allowed type. This commit catches this error and throws a 422 instead since this should be considered a validation error.
* Skip gzip for some well-known compressed file types (#30796)wxiaoguang2024-05-021-0/+33
| | | Co-authored-by: silverwind <me@silverwind.io>
* Fix tautological conditions (#30735)silverwind2024-04-301-6/+3
| | | | | | | As discovered by https://github.com/go-gitea/gitea/pull/30729. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Get repo assignees and reviewers should ignore deactivated users (#30770)65432024-04-301-1/+3
| | | | | | | | | If an user is deactivated, it should not be in the list of users who are suggested to be assigned or review-requested. old assignees or reviewers are not affected. --- *Sponsored by Kithara Software GmbH*
* Fix issue label rendering in the issue popup (#30763)wxiaoguang2024-04-301-3/+8
|
* Resolve lint for unused parameter and unnecessary type arguments (#30750)Chongyi Zheng2024-04-295-14/+14
| | | | | | | | | | Resolve all cases for `unused parameter` and `unnecessary type arguments` Related: #30729 --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Use `ProtonMail/go-crypto` for `opengpg` in tests (#30736)Chongyi Zheng2024-04-271-2/+2
|
* Replace deprecated `math/rand` functions (#30733)v1.23.0-devChongyi Zheng2024-04-272-4/+4
| | | | | | | | | | | | Suggested by logs in #30729 - Remove `math/rand.Seed` `rand.Seed is deprecated: As of Go 1.20 there is no reason to call Seed with a random value.` - Replace `math/rand.Read` `rand.Read is deprecated: For almost all use cases, [crypto/rand.Read] is more appropriate.` - Replace `math/rand` with `math/rand/v2`, which is available since Go 1.22
* Add some tests to clarify the "must-change-password" behavior (#30693)wxiaoguang2024-04-271-1/+0
| | | | | | | | | | Follow #30472: When a user is created by command line `./gitea admin user create`: Old behavior before #30472: the first user (admin or non-admin) doesn't need to change password. Revert to the old behavior before #30472
* Prevent allow/reject reviews on merged/closed PRs (#30686)Kemal Zebari2024-04-271-0/+82
| | | Resolves #30675.
* Update misspell to 0.5.1 and add `misspellings.csv` (#30573)silverwind2024-04-272-5/+5
| | | | | | Misspell 0.5.0 supports passing a csv file to extend the list of misspellings, so I added some common ones from the codebase. There is at least one typo in a API response so we need to decided whether to revert that and then likely remove the dict entry.
* feat(api): enhance Actions Secrets Management API for repository (#30656)Bo-Yi Wu2024-04-261-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | - Add endpoint to list repository action secrets in API routes - Implement `ListActionsSecrets` function to retrieve action secrets from the database - Update Swagger documentation to include the new `/repos/{owner}/{repo}/actions/secrets` endpoint - Add `actions` package import and define new routes for actions, secrets, variables, and runners in `api.go`. - Refactor action-related API functions into `Action` struct methods in `org/action.go` and `repo/action.go`. - Remove `actionAPI` struct and related functions, replacing them with `NewAction()` calls. - Rename `variables.go` to `action.go` in `org` directory. - Delete `runners.go` and `secrets.go` in both `org` and `repo` directories, consolidating their content into `action.go`. - Update copyright year and add new imports in `org/action.go`. - Implement `API` interface in `services/actions/interface.go` for action-related methods. - Remove individual action-related functions and replace them with methods on the `Action` struct in `repo/action.go`. --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> Signed-off-by: appleboy <appleboy.tw@gmail.com>
* Improve test for TestPullCompare (#30699)Lunny Xiao2024-04-261-5/+10
|
* Add test for #30674 (#30679)Lunny Xiao2024-04-241-0/+35
|
* Enable more `revive` linter rules (#30608)silverwind2024-04-223-8/+9
| | | | | | | | | | | Noteable additions: - `redefines-builtin-id` forbid variable names that shadow go builtins - `empty-lines` remove unnecessary empty lines that `gofumpt` does not remove for some reason - `superfluous-else` eliminate more superfluous `else` branches Rules are also sorted alphabetically and I cleaned up various parts of `.golangci.yml`.
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-04 13:18:59 +0000