aboutsummaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* Make admins adhere to branch protection rules (#32248)Tim2024-10-231-0/+47
| | | | | | | | | | | | This introduces a new flag `BlockAdminMergeOverride` on the branch protection rules that prevents admins/repo owners from bypassing branch protection rules and merging without approvals or failing status checks. Fixes #17131 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Make git push options accept short name (#32245)wxiaoguang2024-10-121-0/+57
| | | | | Just like what most CLI parsers do: `--opt` means `opt=true` Then users could use `-o force-push` as `-o force-push=true`
* Allow code search by filename (#32210)Bruno Sofiato2024-10-1124-5/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a large and complex PR, so let me explain in detail its changes. First, I had to create new index mappings for Bleve and ElasticSerach as the current ones do not support search by filename. This requires Gitea to recreate the code search indexes (I do not know if this is a breaking change, but I feel it deserves a heads-up). I've used [this approach](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/analysis-pathhierarchy-tokenizer.html) to model the filename index. It allows us to efficiently search for both the full path and the name of a file. Bleve, however, does not support this out-of-box, so I had to code a brand new [token filter](https://blevesearch.com/docs/Token-Filters/) to generate the search terms. I also did an overhaul in the `indexer_test.go` file. It now asserts the order of the expected results (this is important since matches based on the name of a file are more relevant than those based on its content). I've added new test scenarios that deal with searching by filename. They use a new repo included in the Gitea fixture. The screenshot below depicts how Gitea shows the search results. It shows results based on content in the same way as the current version does. In matches based on the filename, the first seven lines of the file contents are shown (BTW, this is how GitHub does it). ![image](https://github.com/user-attachments/assets/9d938d86-1a8d-4f89-8644-1921a473e858) Resolves #32096 --------- Signed-off-by: Bruno Sofiato <bruno.sofiato@gmail.com>
* Allow maintainers to view and edit files of private repos when "Allow ↵Zettat1232024-10-111-0/+78
| | | | | maintainers to edit" is enabled (#32215) Fix #31539
* Improve the maintainblity of the reserved username list (#32229)wxiaoguang2024-10-101-36/+9
|
* Move admin routers from /admin to /-/admin (#32189)Lunny Xiao2024-10-104-13/+12
| | | | | | | Resolve #32181 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor CSRF token (#32216)wxiaoguang2024-10-1025-116/+80
|
* Fix bug when a token is given public only (#32204)Lunny Xiao2024-10-083-1/+57
|
* Add support for searching users by email (#30908)yp053272024-10-041-0/+36
| | | | | | | Fix #30898 we have an option `SearchByEmail`, so enable it, then we can search user by email. Also added a test for it.
* Fix PR creation on forked repositories (#31863)Job2024-10-041-0/+27
| | | Resolves #20475
* add {{TEST_MINIO_ENDPOINT}} for local testing "with/without" docker + fix ↵sommerf-lf2024-10-033-7/+15
| | | | | | | | | | | | | | | | | | pgsql testing doc (#32105) while testing i found out that testing locally as documented in the changed README.md for pgsql isn't working because of the minio dependency. reworked this to by default be still docker, but allow for for local with only minio in docker and testing on bare metal. also depending on this: fixed docs for running pgsql test Closes: #32168 (by changing documentation for pgsql tests) Closes: #32169 (by changing documentation, Makefile & pgsql.ini.tmpl: adding {{TEST_MINIO_ENDPOINT}}) sry for the combined pr, but when testing I ran into this issue and first thought they were related and now finally address the same problem: not beeing able to run pgsql integration tests as described in the according README.md
* Make oauth2 code clear. Move oauth2 provider code to their own ↵Lunny Xiao2024-10-021-14/+14
| | | | | | packages/files (#32148) Fix #30266 Replace #31533
* Support repo license (#24872)yp053272024-10-016-3/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Close #278 Close #24076 ## Solutions: - Use [google/licenseclassifier](https://github.com/google/licenseclassifier/) Test result between [google/licensecheck](https://github.com/google/licensecheck) and [go-license-detector](https://github.com/go-enry/go-license-detector): https://github.com/go-gitea/gitea/pull/24872#issuecomment-1560361167 Test result between [google/licensecheck](https://github.com/google/licensecheck) and [google/licenseclassifier](https://github.com/google/licenseclassifier/): https://github.com/go-gitea/gitea/pull/24872#issuecomment-1576092178 - Generate License Convert Name List to avoid import license templates with same contents Gitea automatically get latest license data from[ spdx/license-list-data](https://github.com/spdx/license-list-data). But unfortunately, some license templates have same contents. #20915 [click here to see the list](https://github.com/go-gitea/gitea/pull/24872#issuecomment-1584141684) So we will generate a list of these license templates with same contents and create a new file to save the result when using `make generate-license`. (Need to decide the save path) - Save License info into a new table `repo_license` Can easily support searching repo by license in the future. ## Screen shot Single License: ![image](https://github.com/go-gitea/gitea/assets/18380374/41260bd7-0b4c-4038-8592-508706cffa9f) Multiple Licenses: ![image](https://github.com/go-gitea/gitea/assets/18380374/34ce2f73-7e18-446b-9b96-ecc4fb61bd70) Triggers: - [x] Push commit to default branch - [x] Create repo - [x] Mirror repo - [x] When Default Branch is changed, licenses should be updated Todo: - [x] Save Licenses info in to DB when there's a change to license file in the commit - [x] DB Migration - [x] A nominal test? - [x] Select which library to use(https://github.com/go-gitea/gitea/pull/24872#issuecomment-1560361167) - [x] API Support - [x] Add repo license table - ~Select license in settings if there are several licenses(Not recommended)~ - License board(later, not in this PR) ![image](https://github.com/go-gitea/gitea/assets/18380374/2c3c3bf8-bcc2-4c6d-8ce0-81d1a9733878) --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: 6543 <m.huber@kithara.com> Co-authored-by: a1012112796 <1012112796@qq.com> Co-authored-by: techknowlogick <techknowlogick@gitea.com>
* Fix the logic of finding the latest pull review commit ID (#32139)Zettat1232024-10-012-1/+35
| | | Fix #31423
* Ensure `GetCSRF` doesn't return an empty token (#32130)Jason Song2024-09-303-11/+9
| | | | | | | | | | | | Since page templates keep changing, some pages that contained forms with CSRF token no longer have them. It leads to some calls of `GetCSRF` returning an empty string, which fails the tests. Like https://github.com/go-gitea/gitea/blob/3269b04d61ffe6a7ce462cd05ee150e4491124e8/tests/integration/attachment_test.go#L62-L63 The test did try to get the CSRF token and provided it, but it was empty.
* Fix bug in getting merged pull request by commit (#32079)Zettat1232024-09-241-0/+16
|
* Fix rename branch permission bug (#32066)Lunny Xiao2024-09-221-4/+4
| | | | | | The previous implementation requires admin permission to rename branches which should be write permission. Fix #31993
* Fix artifact v4 upload above 8MB (#31664)ChristopherHX2024-09-221-0/+130
| | | | | | | | | | | | Multiple chunks are uploaded with type "block" without using "appendBlock" and eventually out of order for bigger uploads. 8MB seems to be the chunk size This change parses the blockList uploaded after all blocks to get the final artifact size and order them correctly before calculating the sha256 checksum over all blocks Fixes #31354
* Add bin to Composer Metadata (#32099)Jamie Schouten2024-09-211-1/+7
| | | | | | | | | | | | | This PR addresses the missing `bin` field in Composer metadata, which currently causes vendor-provided binaries to not be symlinked to `vendor/bin` during installation. In the current implementation, running `composer install` does not publish the binaries, leading to issues where expected binaries are not available. By properly declaring the `bin` field, this PR ensures that binaries are correctly symlinked upon installation, as described in the [Composer documentation](https://getcomposer.org/doc/articles/vendor-binaries.md).
* Fix upload maven pacakge parallelly (#31851)Lunny Xiao2024-09-211-0/+33
| | | | | | | Use globallock for maven package uploads. Thanks @tlusser for the test code. Depends on ~#31813~
* Fix incorrect `/tokens` api (#32085)KN4CK3R2024-09-201-20/+11
| | | | | | | | | | Fixes #32078 - Add missing scopes output. - Disallow empty scope. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix: database not update release when using `git push --tags --force` (#32040)Exploding Dragon2024-09-181-0/+36
| | | | | | | link: https://codeberg.org/forgejo/forgejo/issues/4274 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Refactor CSRF protector (#32057)wxiaoguang2024-09-183-33/+8
| | | | | | Remove unused CSRF options, decouple "new csrf protector" and "prepare" logic, do not redirect to home page if CSRF validation falis (it shouldn't happen in daily usage, if it happens, redirecting to home doesn't help either but just makes the problem more complex for "fetch")
* Add missing comment reply handling (#32050)KN4CK3R2024-09-171-139/+143
| | | | | | | | | Fixes #31937 - Add missing comment reply handling - Use `onGiteaRun` in the test because the fixtures are not present otherwise (did this behaviour change?) Compare without whitespaces.
* Handle invalid target when creating releases using API (#31841)Kemal Zebari2024-09-121-0/+18
| | | | | | | A 500 status code was thrown when passing a non-existent target to the create release API. This snapshot handles this error and instead throws a 404 status code. Discovered while working on #31840.
* bump to go 1.23 (#31855)techknowlogick2024-09-102-4/+4
|
* Remove SHA1 for support for ssh rsa signing (#31857)Wim2024-09-071-1/+1
| | | | | | | | | | | | https://github.com/go-fed/httpsig seems to be unmaintained. Switch to github.com/42wim/httpsig which has removed deprecated crypto and default sha256 signing for ssh rsa. No impact for those that use ed25519 ssh certificates. This is a breaking change for: - gitea.com/gitea/tea (go-sdk) - I'll be sending a PR there too - activitypub using deprecated crypto (is this actually used?)
* Fix nuget/conan/container packages upload bugs (#31967)Lunny Xiao2024-09-053-70/+383
|
* Prevent update pull refs manually and will not affect other refs update (#31931)Lunny Xiao2024-09-022-0/+23
| | | | | | | | | | All refs under `refs/pull` should only be changed from Gitea inside but not by pushing from outside of Gitea. This PR will prevent the pull refs update but allow other refs to be updated on the same pushing with `--mirror` operations. The main changes are to add checks on `update` hook but not `pre-receive` because `update` will be invoked by every ref but `pre-receive` will revert all changes once one ref update fails.
* Fix agit automerge (#31207)Lunny Xiao2024-08-203-0/+139
|
* Fix actions notify bug (#31866)Lunny Xiao2024-08-191-2/+2
| | | | Try to fix https://github.com/go-gitea/gitea/issues/31757#issuecomment-2295131062
* render plain text file if the LFS object doesn't exist (#31812)Rowan Bohde2024-08-156-1/+16
| | | | | | | | We had an issue where a repo was using LFS to store a file, but the user did not push the file. When trying to view the file, Gitea returned a 500 HTTP status code referencing `ErrLFSObjectNotExist`. It appears the intent was the render this file as plain text, but the conditional was flipped. I've also added a test to verify that the file is rendered as plain text.
* Show lock owner instead of repo owner on LFS setting page (#31788)Jason Song2024-08-111-0/+62
| | | | | | | | | | | | | Fix #31784. Before: <img width="1648" alt="image" src="https://github.com/user-attachments/assets/03f32545-4a85-42ed-bafc-2b193a5d8023"> After: <img width="1653" alt="image" src="https://github.com/user-attachments/assets/e5bcaf93-49cb-421f-aac1-5122bc488b02">
* Support compression for Actions logs (#31761)Jason Song2024-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support compression for Actions logs to save storage space and bandwidth. Inspired by https://github.com/go-gitea/gitea/issues/24256#issuecomment-1521153015 The biggest challenge is that the compression format should support [seekable](https://github.com/facebook/zstd/blob/dev/contrib/seekable_format/zstd_seekable_compression_format.md). So when users are viewing a part of the log lines, Gitea doesn't need to download the whole compressed file and decompress it. That means gzip cannot help here. And I did research, there aren't too many choices, like bgzip and xz, but I think zstd is the most popular one. It has an implementation in Golang with [zstd](https://github.com/klauspost/compress/tree/master/zstd) and [zstd-seekable-format-go](https://github.com/SaveTheRbtz/zstd-seekable-format-go), and what is better is that it has good compatibility: a seekable format zstd file can be read by a regular zstd reader. This PR introduces a new package `zstd` to combine and wrap the two packages, to provide a unified and easy-to-use API. And a new setting `LOG_COMPRESSION` is added to the config, although I don't see any reason why not to use compression, I think's it's a good idea to keep the default with `none` to be consistent with old versions. `LOG_COMPRESSION` takes effect for only new log files, it adds `.zst` as an extension to the file name, so Gitea can determine if it needs decompression according to the file name when reading. Old files will keep the format since it's not worth converting them, as they will be cleared after #31735. <img width="541" alt="image" src="https://github.com/user-attachments/assets/e9598764-a4e0-4b68-8c2b-f769265183c9">
* Add signature support for the RPM module (#27069)Exploding Dragon2024-08-061-0/+27
| | | | | | | | close #27031 If the rpm package does not contain a matching gpg signature, the installation will fail. See (#27031) , now auto-signing rpm uploads. This option is turned off by default for compatibility.
* Clarify Actions resources ownership (#31724)Jason Song2024-08-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix #31707. Also related to #31715. Some Actions resources could has different types of ownership. It could be: - global: all repos and orgs/users can use it. - org/user level: only the org/user can use it. - repo level: only the repo can use it. There are two ways to distinguish org/user level from repo level: 1. `{owner_id: 1, repo_id: 2}` for repo level, and `{owner_id: 1, repo_id: 0}` for org level. 2. `{owner_id: 0, repo_id: 2}` for repo level, and `{owner_id: 1, repo_id: 0}` for org level. The first way seems more reasonable, but it may not be true. The point is that although a resource, like a runner, belongs to a repo (it can be used by the repo), the runner doesn't belong to the repo's org (other repos in the same org cannot use the runner). So, the second method makes more sense. And the first way is not user-friendly to query, we must set the repo id to zero to avoid wrong results. So, #31715 should be right. And the most simple way to fix #31707 is just: ```diff - shared.GetRegistrationToken(ctx, ctx.Repo.Repository.OwnerID, ctx.Repo.Repository.ID) + shared.GetRegistrationToken(ctx, 0, ctx.Repo.Repository.ID) ``` However, it is quite intuitive to set both owner id and repo id since the repo belongs to the owner. So I prefer to be compatible with it. If we get both owner id and repo id not zero when creating or finding, it's very clear that the caller want one with repo level, but set owner id accidentally. So it's OK to accept it but fix the owner id to zero.
* Add permission check when creating PR (#31033)yp053272024-07-292-16/+82
| | | user should be a collaborator of the base repo to create a PR
* add `username` to OIDC introspection response (#31688)Shivaram Lingamneni2024-07-251-2/+4
| | | | | | | | | This field is specified as optional here: https://datatracker.ietf.org/doc/html/rfc7662#section-2.2 It's used by some OIDC integrations, e.g. https://emersion.fr/blog/2022/irc-and-oauth2/ Co-authored-by: Giteabot <teabot@gitea.io>
* fix OIDC introspection authentication (#31632)Shivaram Lingamneni2024-07-231-0/+56
| | | | | | | | | | | | | | | | | | | | | See discussion on #31561 for some background. The introspect endpoint was using the OIDC token itself for authentication. This fixes it to use basic authentication with the client ID and secret instead: * Applications with a valid client ID and secret should be able to successfully introspect an invalid token, receiving a 200 response with JSON data that indicates the token is invalid * Requests with an invalid client ID and secret should not be able to introspect, even if the token itself is valid Unlike #31561 (which just future-proofed the current behavior against future changes to `DISABLE_QUERY_AUTH_TOKEN`), this is a potential compatibility break (some introspection requests without valid client IDs that would previously succeed will now fail). Affected deployments must begin sending a valid HTTP basic authentication header with their introspection requests, with the username set to a valid client ID and the password set to the corresponding client secret.
* allow synchronizing user status from OAuth2 login providers (#31572)Rowan Bohde2024-07-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This leverages the existing `sync_external_users` cron job to synchronize the `IsActive` flag on users who use an OAuth2 provider set to synchronize. This synchronization is done by checking for expired access tokens, and using the stored refresh token to request a new access token. If the response back from the OAuth2 provider is the `invalid_grant` error code, the user is marked as inactive. However, the user is able to reactivate their account by logging in the web browser through their OAuth2 flow. Also changed to support this is that a linked `ExternalLoginUser` is always created upon a login or signup via OAuth2. ### Notes on updating permissions Ideally, we would also refresh permissions from the configured OAuth provider (e.g., admin, restricted and group mappings) to match the implementation of LDAP. However, the OAuth library used for this `goth`, doesn't seem to support issuing a session via refresh tokens. The interface provides a [`RefreshToken` method](https://github.com/markbates/goth/blob/master/provider.go#L20), but the returned `oauth.Token` doesn't implement the `goth.Session` we would need to call `FetchUser`. Due to specific implementations, we would need to build a compatibility function for every provider, since they cast to concrete types (e.g. [Azure](https://github.com/markbates/goth/blob/master/providers/azureadv2/azureadv2.go#L132)) --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Allow disabling authentication related user features (#31535)Rowan Bohde2024-07-091-0/+405
| | | | | | | | | | | | | | | | | | | | We have some instances that only allow using an external authentication source for authentication. In this case, users changing their email, password, or linked OpenID connections will not have any effect, and we'd like to prevent showing that to them to prevent confusion. Included in this are several changes to support this: * A new setting to disable user managed authentication credentials (email, password & OpenID connections) * A new setting to disable user managed MFA (2FA codes & WebAuthn) * Fix an issue where some templates had separate logic for determining if a feature was disabled since it didn't check the globally disabled features * Hide more user setting pages in the navbar when their settings aren't enabled --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Allow force push to protected branches (#28086)Henry Goodman2024-07-051-26/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #22722 ### Problem Currently, it is not possible to force push to a branch with branch protection rules in place. There are often times where this is necessary (CI workflows/administrative tasks etc). The current workaround is to rename/remove the branch protection, perform the force push, and then reinstate the protections. ### Solution Provide an additional section in the branch protection rules to allow users to specify which users with push access can also force push to the branch. The default value of the rule will be set to `Disabled`, and the UI is intuitive and very similar to the `Push` section. It is worth noting in this implementation that allowing force push does not override regular push access, and both will need to be enabled for a user to force push. This applies to manual force push to a remote, and also in Gitea UI updating a PR by rebase (which requires force push) This modifies the `BranchProtection` API structs to add: - `enable_force_push bool` - `enable_force_push_whitelist bool` - `force_push_whitelist_usernames string[]` - `force_push_whitelist_teams string[]` - `force_push_whitelist_deploy_keys bool` ### Updated Branch Protection UI: <img width="943" alt="image" src="https://github.com/go-gitea/gitea/assets/79623665/7491899c-d816-45d5-be84-8512abd156bf"> ### Pull Request `Update branch by Rebase` option enabled with source branch `test` being a protected branch: ![image](https://github.com/go-gitea/gitea/assets/79623665/e018e6e9-b7b2-4bd3-808e-4947d7da35cc) <img width="1038" alt="image" src="https://github.com/go-gitea/gitea/assets/79623665/57ead13e-9006-459f-b83c-7079e6f4c654"> --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add typescript guideline and typescript-specific eslint plugins and fix ↵silverwind2024-07-032-14/+14
| | | | | | | | issues (#31521) 1. Add some general guidelines how to write our typescript code 2. Add `@typescript-eslint/eslint-plugin`, general typescript rules 3. Add `eslint-plugin-deprecation` to detect deprecated code 4. Fix all new lint issues that came up
* Add initial typescript config and use it for eslint,vitest,playwright (#31186)silverwind2024-06-284-13/+13
| | | | | | | | | | | | | | | | | | | | This enables eslint to use the typescript parser and resolver which brings some benefits that eslint rules now have type information available and a tsconfig.json is required for the upcoming typescript migration as well. Notable changes done: - Add typescript parser and resolver - Move the vue-specific config into the root file - Enable `vue-scoped-css/enforce-style-type` rule, there was only one violation and I added a inline disable there. - Fix new lint errors that were detected because of the parser change - Update `i/no-unresolved` to remove now-unnecessary workaround for the resolver - Disable `i/no-named-as-default` as it seems to raise bogus issues in the webpack config - Change vitest config to typescript - Change playwright config to typescript - Add `eslint-plugin-playwright` and fix issues - Add `tsc` linting to `make lint-js`
* Simplify 404/500 page (#31409)wxiaoguang2024-06-232-4/+3
|
* Refactor names (#31405)wxiaoguang2024-06-193-9/+9
| | | | | | | This PR only does "renaming": * `Route` should be `Router` (and chi router is also called "router") * `Params` should be `PathParam` (to distingush it from URL query param, and to match `FormString`) * Use lower case for private functions to avoid exposing or abusing
* Refactor route path normalization (#31381)wxiaoguang2024-06-171-20/+21
| | | | Refactor route path normalization and decouple it from the chi router. Fix the TODO, fix the legacy strange path behavior.
* Improve rubygems package registry (#31357)wxiaoguang2024-06-171-102/+212
| | | | | | | To make it work with Bundler: https://guides.rubygems.org/rubygems-org-compact-index-api/ It only adds 2 new API endpoints and improves some tests, existing logic is not changed.
* Fix #31185 try fix lfs download from bitbucket failed (#31201)Zoupers Zou2024-06-112-7/+7
| | | Fix #31185
* Remove sub-path from container registry realm (#31293)wxiaoguang2024-06-091-3/+9
| | | | Container registry requires that the "/v2" must be in the root, so the sub-path in AppURL should be removed
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-07 04:10:46 +0000