mirror of https://github.com/go-gitea/gitea
Redesign Scoped Access Tokens (#24767)
## Changes
- Adds the following high level access scopes, each with `read` and
`write` levels:
- `activitypub`
- `admin` (hidden if user is not a site admin)
- `misc`
- `notification`
- `organization`
- `package`
- `issue`
- `repository`
- `user`
- Adds new middleware function `tokenRequiresScopes()` in addition to
`reqToken()`
- `tokenRequiresScopes()` is used for each high-level api section
- _if_ a scoped token is present, checks that the required scope is
included based on the section and HTTP method
- `reqToken()` is used for individual routes
- checks that required authentication is present (but does not check
scope levels as this will already have been handled by
`tokenRequiresScopes()`
- Adds migration to convert old scoped access tokens to the new set of
scopes
- Updates the user interface for scope selection
### User interface example
<img width="903" alt="Screen Shot 2023-05-31 at 1 56 55 PM"
src="https://github.com/go-gitea/gitea/assets/23248839/654766ec-2143-4f59-9037-3b51600e32f3">
<img width="917" alt="Screen Shot 2023-05-31 at 1 56 43 PM"
src="https://github.com/go-gitea/gitea/assets/23248839/1ad64081-012c-4a73-b393-66b30352654c">
## tokenRequiresScopes Design Decision
- `tokenRequiresScopes()` was added to more reliably cover api routes.
For an incoming request, this function uses the given scope category
(say `AccessTokenScopeCategoryOrganization`) and the HTTP method (say
`DELETE`) and verifies that any scoped tokens in use include
`delete:organization`.
- `reqToken()` is used to enforce auth for individual routes that
require it. If a scoped token is not present for a request,
`tokenRequiresScopes()` will not return an error
## TODO
- [x] Alphabetize scope categories
- [x] Change 'public repos only' to a radio button (private vs public).
Also expand this to organizations
- [X] Disable token creation if no scopes selected. Alternatively, show
warning
- [x] `reqToken()` is missing from many `POST/DELETE` routes in the api.
`tokenRequiresScopes()` only checks that a given token has the correct
scope, `reqToken()` must be used to check that a token (or some other
auth) is present.
- _This should be addressed in this PR_
- [x] The migration should be reviewed very carefully in order to
minimize access changes to existing user tokens.
- _This should be addressed in this PR_
- [x] Link to api to swagger documentation, clarify what
read/write/delete levels correspond to
- [x] Review cases where more than one scope is needed as this directly
deviates from the api definition.
- _This should be addressed in this PR_
- For example:
```go
m.Group("/users/{username}/orgs", func() {
m.Get("", reqToken(), org.ListUserOrgs)
m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions)
}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser,
auth_model.AccessTokenScopeCategoryOrganization),
context_service.UserAssignmentAPI())
```
## Future improvements
- [ ] Add required scopes to swagger documentation
- [ ] Redesign `reqToken()` to be opt-out rather than opt-in
- [ ] Subdivide scopes like `repository`
- [ ] Once a token is created, if it has no scopes, we should display
text instead of an empty bullet point
- [ ] If the 'public repos only' option is selected, should read
categories be selected by default
Closes #24501
Closes #24799
Co-authored-by: Jonathan Tran <jon@allspice.io>
Co-authored-by: Kyle D <kdumontnu@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
pull/25050/head
Jack Hay
1 year ago
committed by
GitHub
parent
520eb57d76
commit
18de83b2a3
@ -0,0 +1,14 @@ |
|||||||
|
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||||
|
// SPDX-License-Identifier: MIT
|
||||||
|
|
||||||
|
package v1_20 //nolint
|
||||||
|
|
||||||
|
import ( |
||||||
|
"testing" |
||||||
|
|
||||||
|
"code.gitea.io/gitea/models/migrations/base" |
||||||
|
) |
||||||
|
|
||||||
|
func TestMain(m *testing.M) { |
||||||
|
base.MainTest(m) |
||||||
|
} |
||||||
@ -0,0 +1,360 @@ |
|||||||
|
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||||
|
// SPDX-License-Identifier: MIT
|
||||||
|
|
||||||
|
package v1_20 //nolint
|
||||||
|
|
||||||
|
import ( |
||||||
|
"fmt" |
||||||
|
"strings" |
||||||
|
|
||||||
|
"code.gitea.io/gitea/modules/log" |
||||||
|
|
||||||
|
"xorm.io/xorm" |
||||||
|
) |
||||||
|
|
||||||
|
// unknownAccessTokenScope represents the scope for an access token that isn't
|
||||||
|
// known be an old token or a new token.
|
||||||
|
type unknownAccessTokenScope string |
||||||
|
|
||||||
|
// AccessTokenScope represents the scope for an access token.
|
||||||
|
type AccessTokenScope string |
||||||
|
|
||||||
|
// for all categories, write implies read
|
||||||
|
const ( |
||||||
|
AccessTokenScopeAll AccessTokenScope = "all" |
||||||
|
AccessTokenScopePublicOnly AccessTokenScope = "public-only" // limited to public orgs/repos
|
||||||
|
|
||||||
|
AccessTokenScopeReadActivityPub AccessTokenScope = "read:activitypub" |
||||||
|
AccessTokenScopeWriteActivityPub AccessTokenScope = "write:activitypub" |
||||||
|
|
||||||
|
AccessTokenScopeReadAdmin AccessTokenScope = "read:admin" |
||||||
|
AccessTokenScopeWriteAdmin AccessTokenScope = "write:admin" |
||||||
|
|
||||||
|
AccessTokenScopeReadMisc AccessTokenScope = "read:misc" |
||||||
|
AccessTokenScopeWriteMisc AccessTokenScope = "write:misc" |
||||||
|
|
||||||
|
AccessTokenScopeReadNotification AccessTokenScope = "read:notification" |
||||||
|
AccessTokenScopeWriteNotification AccessTokenScope = "write:notification" |
||||||
|
|
||||||
|
AccessTokenScopeReadOrganization AccessTokenScope = "read:organization" |
||||||
|
AccessTokenScopeWriteOrganization AccessTokenScope = "write:organization" |
||||||
|
|
||||||
|
AccessTokenScopeReadPackage AccessTokenScope = "read:package" |
||||||
|
AccessTokenScopeWritePackage AccessTokenScope = "write:package" |
||||||
|
|
||||||
|
AccessTokenScopeReadIssue AccessTokenScope = "read:issue" |
||||||
|
AccessTokenScopeWriteIssue AccessTokenScope = "write:issue" |
||||||
|
|
||||||
|
AccessTokenScopeReadRepository AccessTokenScope = "read:repository" |
||||||
|
AccessTokenScopeWriteRepository AccessTokenScope = "write:repository" |
||||||
|
|
||||||
|
AccessTokenScopeReadUser AccessTokenScope = "read:user" |
||||||
|
AccessTokenScopeWriteUser AccessTokenScope = "write:user" |
||||||
|
) |
||||||
|
|
||||||
|
// accessTokenScopeBitmap represents a bitmap of access token scopes.
|
||||||
|
type accessTokenScopeBitmap uint64 |
||||||
|
|
||||||
|
// Bitmap of each scope, including the child scopes.
|
||||||
|
const ( |
||||||
|
// AccessTokenScopeAllBits is the bitmap of all access token scopes
|
||||||
|
accessTokenScopeAllBits accessTokenScopeBitmap = accessTokenScopeWriteActivityPubBits | |
||||||
|
accessTokenScopeWriteAdminBits | accessTokenScopeWriteMiscBits | accessTokenScopeWriteNotificationBits | |
||||||
|
accessTokenScopeWriteOrganizationBits | accessTokenScopeWritePackageBits | accessTokenScopeWriteIssueBits | |
||||||
|
accessTokenScopeWriteRepositoryBits | accessTokenScopeWriteUserBits |
||||||
|
|
||||||
|
accessTokenScopePublicOnlyBits accessTokenScopeBitmap = 1 << iota |
||||||
|
|
||||||
|
accessTokenScopeReadActivityPubBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteActivityPubBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadActivityPubBits |
||||||
|
|
||||||
|
accessTokenScopeReadAdminBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteAdminBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadAdminBits |
||||||
|
|
||||||
|
accessTokenScopeReadMiscBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteMiscBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadMiscBits |
||||||
|
|
||||||
|
accessTokenScopeReadNotificationBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteNotificationBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadNotificationBits |
||||||
|
|
||||||
|
accessTokenScopeReadOrganizationBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteOrganizationBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadOrganizationBits |
||||||
|
|
||||||
|
accessTokenScopeReadPackageBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWritePackageBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadPackageBits |
||||||
|
|
||||||
|
accessTokenScopeReadIssueBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteIssueBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadIssueBits |
||||||
|
|
||||||
|
accessTokenScopeReadRepositoryBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteRepositoryBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadRepositoryBits |
||||||
|
|
||||||
|
accessTokenScopeReadUserBits accessTokenScopeBitmap = 1 << iota |
||||||
|
accessTokenScopeWriteUserBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadUserBits |
||||||
|
|
||||||
|
// The current implementation only supports up to 64 token scopes.
|
||||||
|
// If we need to support > 64 scopes,
|
||||||
|
// refactoring the whole implementation in this file (and only this file) is needed.
|
||||||
|
) |
||||||
|
|
||||||
|
// allAccessTokenScopes contains all access token scopes.
|
||||||
|
// The order is important: parent scope must precede child scopes.
|
||||||
|
var allAccessTokenScopes = []AccessTokenScope{ |
||||||
|
AccessTokenScopePublicOnly, |
||||||
|
AccessTokenScopeWriteActivityPub, AccessTokenScopeReadActivityPub, |
||||||
|
AccessTokenScopeWriteAdmin, AccessTokenScopeReadAdmin, |
||||||
|
AccessTokenScopeWriteMisc, AccessTokenScopeReadMisc, |
||||||
|
AccessTokenScopeWriteNotification, AccessTokenScopeReadNotification, |
||||||
|
AccessTokenScopeWriteOrganization, AccessTokenScopeReadOrganization, |
||||||
|
AccessTokenScopeWritePackage, AccessTokenScopeReadPackage, |
||||||
|
AccessTokenScopeWriteIssue, AccessTokenScopeReadIssue, |
||||||
|
AccessTokenScopeWriteRepository, AccessTokenScopeReadRepository, |
||||||
|
AccessTokenScopeWriteUser, AccessTokenScopeReadUser, |
||||||
|
} |
||||||
|
|
||||||
|
// allAccessTokenScopeBits contains all access token scopes.
|
||||||
|
var allAccessTokenScopeBits = map[AccessTokenScope]accessTokenScopeBitmap{ |
||||||
|
AccessTokenScopeAll: accessTokenScopeAllBits, |
||||||
|
AccessTokenScopePublicOnly: accessTokenScopePublicOnlyBits, |
||||||
|
AccessTokenScopeReadActivityPub: accessTokenScopeReadActivityPubBits, |
||||||
|
AccessTokenScopeWriteActivityPub: accessTokenScopeWriteActivityPubBits, |
||||||
|
AccessTokenScopeReadAdmin: accessTokenScopeReadAdminBits, |
||||||
|
AccessTokenScopeWriteAdmin: accessTokenScopeWriteAdminBits, |
||||||
|
AccessTokenScopeReadMisc: accessTokenScopeReadMiscBits, |
||||||
|
AccessTokenScopeWriteMisc: accessTokenScopeWriteMiscBits, |
||||||
|
AccessTokenScopeReadNotification: accessTokenScopeReadNotificationBits, |
||||||
|
AccessTokenScopeWriteNotification: accessTokenScopeWriteNotificationBits, |
||||||
|
AccessTokenScopeReadOrganization: accessTokenScopeReadOrganizationBits, |
||||||
|
AccessTokenScopeWriteOrganization: accessTokenScopeWriteOrganizationBits, |
||||||
|
AccessTokenScopeReadPackage: accessTokenScopeReadPackageBits, |
||||||
|
AccessTokenScopeWritePackage: accessTokenScopeWritePackageBits, |
||||||
|
AccessTokenScopeReadIssue: accessTokenScopeReadIssueBits, |
||||||
|
AccessTokenScopeWriteIssue: accessTokenScopeWriteIssueBits, |
||||||
|
AccessTokenScopeReadRepository: accessTokenScopeReadRepositoryBits, |
||||||
|
AccessTokenScopeWriteRepository: accessTokenScopeWriteRepositoryBits, |
||||||
|
AccessTokenScopeReadUser: accessTokenScopeReadUserBits, |
||||||
|
AccessTokenScopeWriteUser: accessTokenScopeWriteUserBits, |
||||||
|
} |
||||||
|
|
||||||
|
// hasScope returns true if the string has the given scope
|
||||||
|
func (bitmap accessTokenScopeBitmap) hasScope(scope AccessTokenScope) (bool, error) { |
||||||
|
expectedBits, ok := allAccessTokenScopeBits[scope] |
||||||
|
if !ok { |
||||||
|
return false, fmt.Errorf("invalid access token scope: %s", scope) |
||||||
|
} |
||||||
|
|
||||||
|
return bitmap&expectedBits == expectedBits, nil |
||||||
|
} |
||||||
|
|
||||||
|
// toScope returns a normalized scope string without any duplicates.
|
||||||
|
func (bitmap accessTokenScopeBitmap) toScope(unknownScopes *[]unknownAccessTokenScope) AccessTokenScope { |
||||||
|
var scopes []string |
||||||
|
|
||||||
|
// Preserve unknown scopes, and put them at the beginning so that it's clear
|
||||||
|
// when debugging.
|
||||||
|
if unknownScopes != nil { |
||||||
|
for _, unknownScope := range *unknownScopes { |
||||||
|
scopes = append(scopes, string(unknownScope)) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// iterate over all scopes, and reconstruct the bitmap
|
||||||
|
// if the reconstructed bitmap doesn't change, then the scope is already included
|
||||||
|
var reconstruct accessTokenScopeBitmap |
||||||
|
|
||||||
|
for _, singleScope := range allAccessTokenScopes { |
||||||
|
// no need for error checking here, since we know the scope is valid
|
||||||
|
if ok, _ := bitmap.hasScope(singleScope); ok { |
||||||
|
current := reconstruct | allAccessTokenScopeBits[singleScope] |
||||||
|
if current == reconstruct { |
||||||
|
continue |
||||||
|
} |
||||||
|
|
||||||
|
reconstruct = current |
||||||
|
scopes = append(scopes, string(singleScope)) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
scope := AccessTokenScope(strings.Join(scopes, ",")) |
||||||
|
scope = AccessTokenScope(strings.ReplaceAll( |
||||||
|
string(scope), |
||||||
|
"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user", |
||||||
|
"all", |
||||||
|
)) |
||||||
|
return scope |
||||||
|
} |
||||||
|
|
||||||
|
// parse the scope string into a bitmap, thus removing possible duplicates.
|
||||||
|
func (s AccessTokenScope) parse() (accessTokenScopeBitmap, *[]unknownAccessTokenScope) { |
||||||
|
var bitmap accessTokenScopeBitmap |
||||||
|
var unknownScopes []unknownAccessTokenScope |
||||||
|
|
||||||
|
// The following is the more performant equivalent of 'for _, v := range strings.Split(remainingScope, ",")' as this is hot code
|
||||||
|
remainingScopes := string(s) |
||||||
|
for len(remainingScopes) > 0 { |
||||||
|
i := strings.IndexByte(remainingScopes, ',') |
||||||
|
var v string |
||||||
|
if i < 0 { |
||||||
|
v = remainingScopes |
||||||
|
remainingScopes = "" |
||||||
|
} else if i+1 >= len(remainingScopes) { |
||||||
|
v = remainingScopes[:i] |
||||||
|
remainingScopes = "" |
||||||
|
} else { |
||||||
|
v = remainingScopes[:i] |
||||||
|
remainingScopes = remainingScopes[i+1:] |
||||||
|
} |
||||||
|
singleScope := AccessTokenScope(v) |
||||||
|
if singleScope == "" { |
||||||
|
continue |
||||||
|
} |
||||||
|
if singleScope == AccessTokenScopeAll { |
||||||
|
bitmap |= accessTokenScopeAllBits |
||||||
|
continue |
||||||
|
} |
||||||
|
|
||||||
|
bits, ok := allAccessTokenScopeBits[singleScope] |
||||||
|
if !ok { |
||||||
|
unknownScopes = append(unknownScopes, unknownAccessTokenScope(string(singleScope))) |
||||||
|
} |
||||||
|
bitmap |= bits |
||||||
|
} |
||||||
|
|
||||||
|
return bitmap, &unknownScopes |
||||||
|
} |
||||||
|
|
||||||
|
// NormalizePreservingUnknown returns a normalized scope string without any
|
||||||
|
// duplicates. Unknown scopes are included.
|
||||||
|
func (s AccessTokenScope) NormalizePreservingUnknown() AccessTokenScope { |
||||||
|
bitmap, unknownScopes := s.parse() |
||||||
|
|
||||||
|
return bitmap.toScope(unknownScopes) |
||||||
|
} |
||||||
|
|
||||||
|
// OldAccessTokenScope represents the scope for an access token.
|
||||||
|
type OldAccessTokenScope string |
||||||
|
|
||||||
|
const ( |
||||||
|
OldAccessTokenScopeAll OldAccessTokenScope = "all" |
||||||
|
|
||||||
|
OldAccessTokenScopeRepo OldAccessTokenScope = "repo" |
||||||
|
OldAccessTokenScopeRepoStatus OldAccessTokenScope = "repo:status" |
||||||
|
OldAccessTokenScopePublicRepo OldAccessTokenScope = "public_repo" |
||||||
|
|
||||||
|
OldAccessTokenScopeAdminOrg OldAccessTokenScope = "admin:org" |
||||||
|
OldAccessTokenScopeWriteOrg OldAccessTokenScope = "write:org" |
||||||
|
OldAccessTokenScopeReadOrg OldAccessTokenScope = "read:org" |
||||||
|
|
||||||
|
OldAccessTokenScopeAdminPublicKey OldAccessTokenScope = "admin:public_key" |
||||||
|
OldAccessTokenScopeWritePublicKey OldAccessTokenScope = "write:public_key" |
||||||
|
OldAccessTokenScopeReadPublicKey OldAccessTokenScope = "read:public_key" |
||||||
|
|
||||||
|
OldAccessTokenScopeAdminRepoHook OldAccessTokenScope = "admin:repo_hook" |
||||||
|
OldAccessTokenScopeWriteRepoHook OldAccessTokenScope = "write:repo_hook" |
||||||
|
OldAccessTokenScopeReadRepoHook OldAccessTokenScope = "read:repo_hook" |
||||||
|
|
||||||
|
OldAccessTokenScopeAdminOrgHook OldAccessTokenScope = "admin:org_hook" |
||||||
|
|
||||||
|
OldAccessTokenScopeNotification OldAccessTokenScope = "notification" |
||||||
|
|
||||||
|
OldAccessTokenScopeUser OldAccessTokenScope = "user" |
||||||
|
OldAccessTokenScopeReadUser OldAccessTokenScope = "read:user" |
||||||
|
OldAccessTokenScopeUserEmail OldAccessTokenScope = "user:email" |
||||||
|
OldAccessTokenScopeUserFollow OldAccessTokenScope = "user:follow" |
||||||
|
|
||||||
|
OldAccessTokenScopeDeleteRepo OldAccessTokenScope = "delete_repo" |
||||||
|
|
||||||
|
OldAccessTokenScopePackage OldAccessTokenScope = "package" |
||||||
|
OldAccessTokenScopeWritePackage OldAccessTokenScope = "write:package" |
||||||
|
OldAccessTokenScopeReadPackage OldAccessTokenScope = "read:package" |
||||||
|
OldAccessTokenScopeDeletePackage OldAccessTokenScope = "delete:package" |
||||||
|
|
||||||
|
OldAccessTokenScopeAdminGPGKey OldAccessTokenScope = "admin:gpg_key" |
||||||
|
OldAccessTokenScopeWriteGPGKey OldAccessTokenScope = "write:gpg_key" |
||||||
|
OldAccessTokenScopeReadGPGKey OldAccessTokenScope = "read:gpg_key" |
||||||
|
|
||||||
|
OldAccessTokenScopeAdminApplication OldAccessTokenScope = "admin:application" |
||||||
|
OldAccessTokenScopeWriteApplication OldAccessTokenScope = "write:application" |
||||||
|
OldAccessTokenScopeReadApplication OldAccessTokenScope = "read:application" |
||||||
|
|
||||||
|
OldAccessTokenScopeSudo OldAccessTokenScope = "sudo" |
||||||
|
) |
||||||
|
|
||||||
|
var accessTokenScopeMap = map[OldAccessTokenScope][]AccessTokenScope{ |
||||||
|
OldAccessTokenScopeAll: {AccessTokenScopeAll}, |
||||||
|
OldAccessTokenScopeRepo: {AccessTokenScopeWriteRepository}, |
||||||
|
OldAccessTokenScopeRepoStatus: {AccessTokenScopeWriteRepository}, |
||||||
|
OldAccessTokenScopePublicRepo: {AccessTokenScopePublicOnly, AccessTokenScopeWriteRepository}, |
||||||
|
OldAccessTokenScopeAdminOrg: {AccessTokenScopeWriteOrganization}, |
||||||
|
OldAccessTokenScopeWriteOrg: {AccessTokenScopeWriteOrganization}, |
||||||
|
OldAccessTokenScopeReadOrg: {AccessTokenScopeReadOrganization}, |
||||||
|
OldAccessTokenScopeAdminPublicKey: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeWritePublicKey: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeReadPublicKey: {AccessTokenScopeReadUser}, |
||||||
|
OldAccessTokenScopeAdminRepoHook: {AccessTokenScopeWriteRepository}, |
||||||
|
OldAccessTokenScopeWriteRepoHook: {AccessTokenScopeWriteRepository}, |
||||||
|
OldAccessTokenScopeReadRepoHook: {AccessTokenScopeReadRepository}, |
||||||
|
OldAccessTokenScopeAdminOrgHook: {AccessTokenScopeWriteOrganization}, |
||||||
|
OldAccessTokenScopeNotification: {AccessTokenScopeWriteNotification}, |
||||||
|
OldAccessTokenScopeUser: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeReadUser: {AccessTokenScopeReadUser}, |
||||||
|
OldAccessTokenScopeUserEmail: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeUserFollow: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeDeleteRepo: {AccessTokenScopeWriteRepository}, |
||||||
|
OldAccessTokenScopePackage: {AccessTokenScopeWritePackage}, |
||||||
|
OldAccessTokenScopeWritePackage: {AccessTokenScopeWritePackage}, |
||||||
|
OldAccessTokenScopeReadPackage: {AccessTokenScopeReadPackage}, |
||||||
|
OldAccessTokenScopeDeletePackage: {AccessTokenScopeWritePackage}, |
||||||
|
OldAccessTokenScopeAdminGPGKey: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeWriteGPGKey: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeReadGPGKey: {AccessTokenScopeReadUser}, |
||||||
|
OldAccessTokenScopeAdminApplication: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeWriteApplication: {AccessTokenScopeWriteUser}, |
||||||
|
OldAccessTokenScopeReadApplication: {AccessTokenScopeReadUser}, |
||||||
|
OldAccessTokenScopeSudo: {AccessTokenScopeWriteAdmin}, |
||||||
|
} |
||||||
|
|
||||||
|
type AccessToken struct { |
||||||
|
ID int64 `xorm:"pk autoincr"` |
||||||
|
Scope string |
||||||
|
} |
||||||
|
|
||||||
|
func ConvertScopedAccessTokens(x *xorm.Engine) error { |
||||||
|
var tokens []*AccessToken |
||||||
|
|
||||||
|
if err := x.Find(&tokens); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
|
||||||
|
for _, token := range tokens { |
||||||
|
var scopes []string |
||||||
|
allNewScopesMap := make(map[AccessTokenScope]bool) |
||||||
|
for _, oldScope := range strings.Split(token.Scope, ",") { |
||||||
|
if newScopes, exists := accessTokenScopeMap[OldAccessTokenScope(oldScope)]; exists { |
||||||
|
for _, newScope := range newScopes { |
||||||
|
allNewScopesMap[newScope] = true |
||||||
|
} |
||||||
|
} else { |
||||||
|
log.Debug("access token scope not recognized as old token scope %s; preserving it", oldScope) |
||||||
|
scopes = append(scopes, oldScope) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
for s := range allNewScopesMap { |
||||||
|
scopes = append(scopes, string(s)) |
||||||
|
} |
||||||
|
scope := AccessTokenScope(strings.Join(scopes, ",")) |
||||||
|
|
||||||
|
// normalize the scope
|
||||||
|
normScope := scope.NormalizePreservingUnknown() |
||||||
|
|
||||||
|
token.Scope = string(normScope) |
||||||
|
|
||||||
|
// update the db entry with the new scope
|
||||||
|
if _, err := x.Cols("scope").ID(token.ID).Update(token); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
return nil |
||||||
|
} |
||||||
@ -0,0 +1,110 @@ |
|||||||
|
// Copyright 2023 The Gitea Authors. All rights reserved.
|
||||||
|
// SPDX-License-Identifier: MIT
|
||||||
|
|
||||||
|
package v1_20 //nolint
|
||||||
|
|
||||||
|
import ( |
||||||
|
"sort" |
||||||
|
"strings" |
||||||
|
"testing" |
||||||
|
|
||||||
|
"code.gitea.io/gitea/models/migrations/base" |
||||||
|
|
||||||
|
"github.com/stretchr/testify/assert" |
||||||
|
) |
||||||
|
|
||||||
|
type testCase struct { |
||||||
|
Old OldAccessTokenScope |
||||||
|
New AccessTokenScope |
||||||
|
} |
||||||
|
|
||||||
|
func createOldTokenScope(scopes ...OldAccessTokenScope) OldAccessTokenScope { |
||||||
|
s := make([]string, 0, len(scopes)) |
||||||
|
for _, os := range scopes { |
||||||
|
s = append(s, string(os)) |
||||||
|
} |
||||||
|
return OldAccessTokenScope(strings.Join(s, ",")) |
||||||
|
} |
||||||
|
|
||||||
|
func createNewTokenScope(scopes ...AccessTokenScope) AccessTokenScope { |
||||||
|
s := make([]string, 0, len(scopes)) |
||||||
|
for _, os := range scopes { |
||||||
|
s = append(s, string(os)) |
||||||
|
} |
||||||
|
return AccessTokenScope(strings.Join(s, ",")) |
||||||
|
} |
||||||
|
|
||||||
|
func Test_ConvertScopedAccessTokens(t *testing.T) { |
||||||
|
tests := []testCase{ |
||||||
|
{ |
||||||
|
createOldTokenScope(OldAccessTokenScopeRepo, OldAccessTokenScopeUserFollow), |
||||||
|
createNewTokenScope(AccessTokenScopeWriteRepository, AccessTokenScopeWriteUser), |
||||||
|
}, |
||||||
|
{ |
||||||
|
createOldTokenScope(OldAccessTokenScopeUser, OldAccessTokenScopeWritePackage, OldAccessTokenScopeSudo), |
||||||
|
createNewTokenScope(AccessTokenScopeWriteAdmin, AccessTokenScopeWritePackage, AccessTokenScopeWriteUser), |
||||||
|
}, |
||||||
|
{ |
||||||
|
createOldTokenScope(), |
||||||
|
createNewTokenScope(), |
||||||
|
}, |
||||||
|
{ |
||||||
|
createOldTokenScope(OldAccessTokenScopeReadGPGKey, OldAccessTokenScopeReadOrg, OldAccessTokenScopeAll), |
||||||
|
createNewTokenScope(AccessTokenScopeAll), |
||||||
|
}, |
||||||
|
{ |
||||||
|
createOldTokenScope(OldAccessTokenScopeReadGPGKey, "invalid"), |
||||||
|
createNewTokenScope("invalid", AccessTokenScopeReadUser), |
||||||
|
}, |
||||||
|
} |
||||||
|
|
||||||
|
// add a test for each individual mapping
|
||||||
|
for oldScope, newScope := range accessTokenScopeMap { |
||||||
|
tests = append(tests, testCase{ |
||||||
|
oldScope, |
||||||
|
createNewTokenScope(newScope...), |
||||||
|
}) |
||||||
|
} |
||||||
|
|
||||||
|
x, deferable := base.PrepareTestEnv(t, 0, new(AccessToken)) |
||||||
|
defer deferable() |
||||||
|
if x == nil || t.Failed() { |
||||||
|
t.Skip() |
||||||
|
return |
||||||
|
} |
||||||
|
|
||||||
|
// verify that no fixtures were loaded
|
||||||
|
count, err := x.Count(&AccessToken{}) |
||||||
|
assert.NoError(t, err) |
||||||
|
assert.Equal(t, int64(0), count) |
||||||
|
|
||||||
|
for _, tc := range tests { |
||||||
|
_, err = x.Insert(&AccessToken{ |
||||||
|
Scope: string(tc.Old), |
||||||
|
}) |
||||||
|
assert.NoError(t, err) |
||||||
|
} |
||||||
|
|
||||||
|
// migrate the scopes
|
||||||
|
err = ConvertScopedAccessTokens(x) |
||||||
|
assert.NoError(t, err) |
||||||
|
|
||||||
|
// migrate the scopes again (migration should be idempotent)
|
||||||
|
err = ConvertScopedAccessTokens(x) |
||||||
|
assert.NoError(t, err) |
||||||
|
|
||||||
|
tokens := make([]AccessToken, 0) |
||||||
|
err = x.Find(&tokens) |
||||||
|
assert.NoError(t, err) |
||||||
|
assert.Equal(t, len(tests), len(tokens)) |
||||||
|
|
||||||
|
// sort the tokens (insertion order by auto-incrementing primary key)
|
||||||
|
sort.Slice(tokens, func(i, j int) bool { |
||||||
|
return tokens[i].ID < tokens[j].ID |
||||||
|
}) |
||||||
|
|
||||||
|
// verify that the converted scopes are equal to the expected test result
|
||||||
|
for idx, newToken := range tokens { |
||||||
|
assert.Equal(t, string(tests[idx].New), newToken.Scope) |
||||||
|
} |
||||||
|
} |
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in new issue