Commit graph

57 commits

Author SHA1 Message Date
Ivan Maximov
66877aed54
Fix typo in guidelines-backend.en-us.md (#22690) 2023-01-31 21:43:12 +00:00
Chongyi Zheng
de484e86bc
Support scoped access tokens (#20908)
This PR adds the support for scopes of access tokens, mimicking the
design of GitHub OAuth scopes.

The changes of the core logic are in `models/auth` that `AccessToken`
struct will have a `Scope` field. The normalized (no duplication of
scope), comma-separated scope string will be stored in `access_token`
table in the database.
In `services/auth`, the scope will be stored in context, which will be
used by `reqToken` middleware in API calls. Only OAuth2 tokens will have
granular token scopes, while others like BasicAuth will default to scope
`all`.
A large amount of work happens in `routers/api/v1/api.go` and the
corresponding `tests/integration` tests, that is adding necessary scopes
to each of the API calls as they fit.


- [x] Add `Scope` field to `AccessToken`
- [x] Add access control to all API endpoints
- [x] Update frontend & backend for when creating tokens
- [x] Add a database migration for `scope` column (enable 'all' access
to past tokens)

I'm aiming to complete it before Gitea 1.19 release.

Fixes #4300
2023-01-17 15:46:03 -06:00
Xinyu Zhou
563945c50c
Refactor docs (#21627)
This patch:
- Rename some files( `.md` to `.en-us.md`), fix missed translation copy
- Update link which shoud be refer to `../hacking-on-gitea/` instead of
`../make/` (outdated)
- Update `_redirects`:
  -  redirect `/{zh-cn|fr-fr}/make/` to `../hacking-on-gitea/`
  - redirect `/zh-cn/third-party-tools/` to `/zh-cn/integrations/`
- Delete duplicated/outdated files.
- Update menu `weight` of developers.zh-cn.md

Signed-off-by: Xinyu Zhou <i@sourcehut.net>
2022-10-31 23:16:19 +00:00
M Hickford
191a74d622
Record OAuth client type at registration (#21316)
The OAuth spec [defines two types of
client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1),
confidential and public. Previously Gitea assumed all clients to be
confidential.

> OAuth defines two client types, based on their ability to authenticate
securely with the authorization server (i.e., ability to
>   maintain the confidentiality of their client credentials):
>
>   confidential
> Clients capable of maintaining the confidentiality of their
credentials (e.g., client implemented on a secure server with
> restricted access to the client credentials), or capable of secure
client authentication using other means.
>
>   **public
> Clients incapable of maintaining the confidentiality of their
credentials (e.g., clients executing on the device used by the resource
owner, such as an installed native application or a web browser-based
application), and incapable of secure client authentication via any
other means.**
>
> The client type designation is based on the authorization server's
definition of secure authentication and its acceptable exposure levels
of client credentials. The authorization server SHOULD NOT make
assumptions about the client type.

 https://datatracker.ietf.org/doc/html/rfc8252#section-8.4

> Authorization servers MUST record the client type in the client
registration details in order to identify and process requests
accordingly.

Require PKCE for public clients:
https://datatracker.ietf.org/doc/html/rfc8252#section-8.1

> Authorization servers SHOULD reject authorization requests from native
apps that don't use PKCE by returning an error message

Fixes #21299

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-10-24 15:59:24 +08:00
techknowlogick
6af1a0c8c0
inline gitpod image (#21494)
fix #21492

Co-authored-by: 6543 <6543@obermui.de>
2022-10-18 09:55:57 +08:00
Yarden Shoham
b474730cf6
Refactor Gitpod configuration to improve quick spin up of automated dev environments (#21411)
This commit instructs Gitpod to run `docs` in watch mode in fresh
development environments so any dev could start hacking in seconds.

Also included some vscode extensions for Vue, Go, and Docker.


Try it here:

[![Open in
Gitpod](https://gitpod.io/button/open-in-gitpod.svg)](https://gitpod.io/#https://github.com/yardenshoham/gitea/tree/gitpod)

Signed-off-by: Yarden Shoham <hrsi88@gmail.com>
Co-authored-by: Gusted <williamzijl7@hotmail.com>
2022-10-12 12:17:04 -04:00
Yarden Shoham
b5a54f03a2
Fix broken link to frontend guidelines in hacking guidelines (#21382) 2022-10-11 21:23:21 -04:00
rj1
56aabf3e8d
Fix some typos and update db transaction demo in backend guideline (#21322)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2022-10-08 02:12:19 +08:00
wxiaoguang
eaa67671cc
Fix doc and heatmap for the Vue3 refactoring (#21312) 2022-10-02 10:13:44 +08:00
John Olheiser
b42aaf29ea
Remove insecure flag from curl (#21074)
Followup to #21071 
Thanks for the catch @wxiaoguang 

[WRT](https://github.com/go-gitea/gitea/pull/21071#discussion_r962706673)

Ref #21071
2022-09-05 14:22:44 +01:00
John Olheiser
0ad0190f69
Update curl usage in API docs (#21071) 2022-09-05 03:22:03 -04:00
Kyle D
c8ded77680
Kd/ci playwright go test (#20123)
* Add initial playwright config

* Simplify Makefile

* Simplify Makefile

* Use correct config files

* Update playwright settings

* Fix package-lock file

* Don't use test logger for e2e tests

* fix frontend lint

* Allow passing TEST_LOGGER variable

* Init postgres database

* use standard gitea env variables

* Update playwright

* update drone

* Move empty env var to commands

* Cleanup

* Move integrations to subfolder

* tests integrations to tests integraton

* Run e2e tests with go test

* Fix linting

* install CI deps

* Add files to ESlint

* Fix drone typo

* Don't log to console in CI

* Use go test http server

* Add build step before tests

* Move shared init function to common package

* fix drone

* Clean up tests

* Fix linting

* Better mocking for page + version string

* Cleanup test generation

* Remove dependency on gitea binary

* Fix linting

* add initial support for running specific tests

* Add ACCEPT_VISUAL variable

* don't require git-lfs

* Add initial documentation

* Review feedback

* Add logged in session test

* Attempt fixing drone race

* Cleanup and bump version

* Bump deps

* Review feedback

* simplify installation

* Fix ci

* Update install docs
2022-09-02 15:18:23 -04:00
techknowlogick
1a538df5f4
Add documentation about pagination of the API (#20740)
* Add documentation about pagination of the API

* Update docs/content/doc/developers/api-usage.en-us.md

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2022-08-09 21:58:55 -04:00
silverwind
ae52df6a64
Add markdownlint (#20512)
Add `markdownlint` linter and fix issues. Config is based on the one
from electron's repo with a few rules relaxed.
2022-07-28 09:22:47 +08:00
Gusted
711cbcce8d
Use neutral language in comments and docs (#20135)
- Replace `his/her` to `their`, as it's more neutral language.
2022-06-25 17:50:12 -05:00
wxiaoguang
3d9c02a1bb
Update frontend guideline (#19901)
* update frontend guideline

* "Native" => "Vanilla JS", fix typo comma.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-06-06 10:44:20 -04:00
wxiaoguang
6171ea7d31
update documents (#19868) 2022-06-02 00:22:42 -04:00
Yehonatan Ezron
4cac908255
docs(hacking-on-gitea): fix installation instruction for elasticsearch docker (#19829) 2022-05-29 20:59:25 +03:00
ktprograms
4396d0e7c9
Note where frontend files are located in docs (#19379)
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-04-12 16:36:24 -04:00
zeripath
886b1de949
Update the webauthn_credential_id_sequence in Postgres (#19048)
* Update the webauthn_credential_id_sequence in Postgres

There is (yet) another problem with v210 in that Postgres will silently allow preset
ID insertions ... but it will not update the sequence value.

This PR simply adds a little step to the end of the v210 migration to update the
sequence number.

Users who have already migrated who find that they cannot insert new
webauthn_credentials into the DB can either run:

```bash
gitea doctor recreate-table webauthn_credential
```

or

```bash
./gitea doctor --run=check-db-consistency --fix
```

which will fix the bad sequence.

Fix #19012

Signed-off-by: Andrew Thornton <art27@cantab.net>
2022-03-10 23:04:55 +01:00
silverwind
fa0e2d60c2
Disable service worker by default (#18914)
The service worker causes a lot of issues with JS errors after instance
upgrades while not bringing any real performance gain over regular HTTP
caching.

Disable it by default for this reason. Maybe later we can remove it
completely, as I simply see no benefit in having it.
2022-02-26 18:14:23 +08:00
Lauris BH
8038610a42
Automatically pause queue if index service is unavailable (#15066)
* Handle keyword search error when issue indexer service is not available

* Implement automatic disabling and resume of code indexer queue
2022-01-27 10:30:51 +02:00
wxiaoguang
4d0a72a271
Revert "Prevent possible XSS when using jQuery (#18289)" (#18293)
This reverts commit 661d3d28e9.
2022-01-16 11:19:26 +00:00
Gusted
661d3d28e9
Prevent possible XSS when using jQuery (#18289)
In the case of misuse or misunderstanding from a developer whereby,
if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the
creation of a new element. Current usage is using hard-coded selectors
in the templates, but nobody prevents that from expanding to
user-controlled somehow.
2022-01-16 13:14:32 +08:00
wxiaoguang
eaf09a5368
Fix documents for development and bug report (#18249) 2022-01-13 10:58:46 +08:00
Bo-Yi Wu
ee8718e452
chore: remove unnecessary section (#18209)
Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>
2022-01-11 18:27:32 -05:00
luzpaz
8c647bf0f6
Fix various typos (#18219)
Found via `codespell -q 3 -S ./options/locale,./vendor -L ba,pullrequest,pullrequests,readby,te,unknwon`

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-01-10 17:32:37 +08:00
Greg Myers
79791ba4ac
Fix typos in docs/content (#18215) 2022-01-09 19:53:03 +08:00
singuliere
1a4e2bfcd1
tests: s/GITEA_UNIT_TESTS_VERBOSE/GITEA_UNIT_TESTS_LOG_SQL/ (#18142)
The GITEA_UNIT_TESTS_VERBOSE variable is an undocumented variable
introduced in 2017 (see 1028ef2def)
whose sole purpose has been to log SQL statements when running unit
tests.

It is renamed for clarity and a warning is displayed for backward
compatibility for people and scripts that know about it.

The documentation is updated to reflect this change.
2022-01-01 04:31:24 +01:00
wxiaoguang
c99b8efba2
Improve document for developers: Windows CGO, unit test option (#18140) 2021-12-31 22:21:11 +08:00
wxiaoguang
38d81cdd01
Fix documents for Windows development (#18109)
* Fix documents for Windows development
2021-12-26 23:27:18 +08:00
qwerty287
5754080eb9
Fix various typos of software names (#18083)
* `git` -> `Git`
* `Github` and `github` -> `GitHub`
* `crowdin` -> `Crowdin`
* `git-lfs` -> `Git LFS`
* `githooks`, `git hooks`, `git-hooks` -> `Git Hooks`
* `discord` -> `Discord`
* `2fa` -> `2FA`
* `gitlab` and `Gitlab` -> `GitLab`
* `web hook` -> `webhook`
* `linux` -> `Linux`
* `sqlite` -> `SQLite`
* `MYSQL` and `mysql` -> `MySQL`
* rename refs to `master` branch -> `main`
* Fix English grammar
2021-12-24 11:56:57 +08:00
singuliere
64b7d0de8e
docs: modules do not rely on models, services do (#17861)
services: provide some services for users, usually use
database (models) modules: provide some basic functions without
database, eg: code parser, etc The major difference is services use
database, while modules don’t.

Signed-off-by: singuliere <singuliere@autistici.org>
2021-11-30 11:56:12 +00:00
qwerty287
3fec2cb3d3
Fix various typos in docs (#17844) 2021-11-28 18:43:18 -05:00
qwerty287
b1df890951
Docs: replace gitea with Gitea (#17838)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2021-11-28 21:28:30 +08:00
Lunny Xiao
b2daa7e203
Add documentation for backend development (#17512)
* Add documentation for backend development

* Update backend guidline

* More sections

* Add modules/setting and modules/git

* Uniform gitea as Gitea

* some improvements

* some improvements
2021-11-23 10:10:18 +08:00
wxiaoguang
49b2cb998b
Fix project board bug and improve documents (#17753)
* the project board was broken, this PR fixes it, and refactor the code, and we prevent the uncategorized column from being dragged.
* improve the frontend guideline (as discussed in https://github.com/go-gitea/gitea/pull/17699)
2021-11-22 19:40:17 +08:00
Lunny Xiao
e3da8c1e88
fix migrations documents (#17679)
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2021-11-17 15:17:37 +08:00
wxiaoguang
7f802631c5
Fix some incorrect async functions, improve frontend document. (#17597) 2021-11-12 20:37:45 +08:00
wxiaoguang
1a7473ff45
Split index.js to separate files (#17315)
* split `index.js` to separate files

* tune clipboard

* fix promise

* fix document

* remove intermediate empty file

* fix async event listener

* use `export function` instead of `export {}`, add more comments

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: 6543 <6543@obermui.de>
2021-10-17 01:28:04 +08:00
wxiaoguang
56362043d3
Frontend refactor: move Vue related code from index.js to components dir, and remove unused codes. (#17301)
* frontend refactor

* Apply suggestions from code review

Co-authored-by: delvh <dev.lh@web.de>

* Update templates/base/head.tmpl

Co-authored-by: delvh <dev.lh@web.de>

* Update docs/content/doc/developers/guidelines-frontend.md

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

* fix typo

* fix typo

* refactor PageData to pageData

* Apply suggestions from code review

Co-authored-by: delvh <dev.lh@web.de>

* Simply for the visual difference.

Co-authored-by: delvh <dev.lh@web.de>

* Revert "Apply suggestions from code review"

This reverts commit 4d78ad9b0e96ca180e0823de17659a2e0814c099.

Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: 6543 <6543@obermui.de>
2021-10-15 10:35:26 +08:00
wxiaoguang
d24eb6e6ce
Add GoLand configuration in hacking on gitea (#16843)
Co-authored-by: zeripath <art27@cantab.net>
2021-08-28 23:25:08 -04:00
AJ ONeal
b9a0e33238
Pre-fill suggested New File 'name' and 'content' with Query Params (#16556)
* feature: add (GitHub-style) querystrings for pre-filling new file content

* docs: add query parameters for new files
2021-07-29 05:39:46 +02:00
Val Lorentz
2e40ff38d1
docs: Fix broken anchors in links to awesome-gitea (#16331) 2021-07-03 21:42:33 +01:00
techknowlogick
8640717f5f
Add docs for windows env vars (#16236)
* Add docs for windows env vars

Fix #16213

* Fix docs/content/doc/developers/hacking-on-gitea.en-us.md

Co-authored-by: John Olheiser <john.olheiser@gmail.com>

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
2021-06-23 15:57:56 -04:00
KN4CK3R
29695cd6d5
Add asymmetric JWT signing (#16010)
* Added asymmetric token signing.

* Load signing key from settings.

* Added optional kid parameter.

* Updated documentation.

* Add "kid" to token header.
2021-06-17 23:56:46 +02:00
Ikko Ashimine
3e068fcdcb
Fix typo in hacking-on-gitea.en-us.md (#15918)
* continously -> continuously
* continous -> continuous
2021-05-18 19:35:59 +02:00
Ian Wienand
c3aaf5eafd
Rework Token API comments (#15162)
Move the token API discussion into a common section discussing the
generation and listing of the tokens.  Add a note on the display of
the sha1 during creation and listing.

Co-authored-by: Norwin <noerw@users.noreply.github.com>
2021-05-16 15:51:53 +02:00
techknowlogick
ab77a24f18
update branch in CI and docs (#15631) 2021-05-04 12:16:23 -04:00
Nathan Zook
2242f381e6
Added OpenAPI document link to usage (#15535)
* Added OpenAPI document link to usage

The OpenAPI document at /api/swagger.v1.json needs an obvious reference.  Sadly, I am English monolingual, so someone else is going to have to do the other languages.  In the mean time, this PR should help anyone looking for the file.

* Update docs/content/doc/developers/api-usage.en-us.md

Co-authored-by: a1012112796 <1012112796@qq.com>

Co-authored-by: techknowlogick <matti@mdranta.net>
Co-authored-by: a1012112796 <1012112796@qq.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2021-04-19 23:29:08 -04:00