forked from forgejo/forgejo
Support scoped access tokens (#20908)
This PR adds the support for scopes of access tokens, mimicking the design of GitHub OAuth scopes. The changes of the core logic are in `models/auth` that `AccessToken` struct will have a `Scope` field. The normalized (no duplication of scope), comma-separated scope string will be stored in `access_token` table in the database. In `services/auth`, the scope will be stored in context, which will be used by `reqToken` middleware in API calls. Only OAuth2 tokens will have granular token scopes, while others like BasicAuth will default to scope `all`. A large amount of work happens in `routers/api/v1/api.go` and the corresponding `tests/integration` tests, that is adding necessary scopes to each of the API calls as they fit. - [x] Add `Scope` field to `AccessToken` - [x] Add access control to all API endpoints - [x] Update frontend & backend for when creating tokens - [x] Add a database migration for `scope` column (enable 'all' access to past tokens) I'm aiming to complete it before Gitea 1.19 release. Fixes #4300
This commit is contained in:
Chongyi Zheng
GitHub
parent
db2286bbb6
commit
de484e86bc
79 changed files with 1221 additions and 449 deletions
|
|
@ -41,6 +41,207 @@
|
|||
<label for="name">{{.locale.Tr "settings.token_name"}}</label>
|
||||
<input id="name" name="name" value="{{.name}}" autofocus required>
|
||||
</div>
|
||||
<details class="ui optional field">
|
||||
<summary class="p-2">
|
||||
{{.locale.Tr "settings.select_scopes"}}
|
||||
</summary>
|
||||
<div class="field pl-2">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="repo">
|
||||
<label>repo</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="repo:status">
|
||||
<label>repo:status</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="public:repo">
|
||||
<label>public_repo</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="admin:org">
|
||||
<label>admin:org</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="write:org">
|
||||
<label>write:org</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="read:public_key">
|
||||
<label>read:public_key</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="admin:public_key">
|
||||
<label>admin:public_key</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="write:public_key">
|
||||
<label>write:public_key</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="read:public_key">
|
||||
<label>read:public_key</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="admin:repo_hook">
|
||||
<label>admin:repo_hook</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="write:repo_hook">
|
||||
<label>write:repo_hook</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="read:repo_hook">
|
||||
<label>read:repo_hook</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="admin:org_hook">
|
||||
<label>admin:org_hook</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="notification">
|
||||
<label>notification</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="user">
|
||||
<label>user</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="read:user">
|
||||
<label>read:user</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="user:email">
|
||||
<label>user:email</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="user:follow">
|
||||
<label>user:follow</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="delete:repo">
|
||||
<label>delete_repo</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="package">
|
||||
<label>package</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="write:package">
|
||||
<label>write:package</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="read:package">
|
||||
<label>read:package</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="delete:package">
|
||||
<label>delete:package</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="admin:gpg_key">
|
||||
<label>admin:gpg_key</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="write:gpg_key">
|
||||
<label>write:gpg_key</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="read:gpg_key">
|
||||
<label>read:gpg_key</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="admin:application">
|
||||
<label>admin:application</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field pl-4">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="write:application">
|
||||
<label>write:application</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="read:application">
|
||||
<label>read:application</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input class="enable-system" type="checkbox" name="scope" value="sudo">
|
||||
<label>sudo</label>
|
||||
</div>
|
||||
</div>
|
||||
</details>
|
||||
<button class="ui green button">
|
||||
{{.locale.Tr "settings.generate_token"}}
|
||||
</button>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue