mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-20 00:19:00 +00:00
silverwindandwxiaoguang
5264304a34
The token a request authenticated with now lives on the doer, so permission and visibility checks apply its scope from the doer alone. Replaces https://github.com/go-gitea/gitea/pull/39167, following https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619. 1. Public-only tokens get 404 instead of 403 for hidden users, orgs and repos, like GitHub. 2. Org ownership, site admin, repo and org creation, generation and transfer endpoints reject public-only tokens. 3. API pull request responses set `head.repo` to `null` and `head.repo_id` to `-1` when the caller cannot see the head repository. 4. Public-only tokens see org memberships like anonymous callers, so concealed members stay hidden. 5. Site admin access in activity feeds, follower lists, org members, Actions run lists and packages needs a session or an `all`-scoped token. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
54 lines
1.5 KiB
Go
54 lines
1.5 KiB
Go
// Copyright 2025 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package user
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/models/unittest"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestSystemUser(t *testing.T) {
|
|
uid, u, err := GetPossibleUserByID(t.Context(), -1)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, int64(-1), uid)
|
|
assert.Equal(t, "Ghost", u.Name)
|
|
assert.Equal(t, "ghost", u.LowerName)
|
|
assert.True(t, u.IsGhost())
|
|
|
|
u = GetSystemUserByName("gHost")
|
|
require.NotNil(t, u)
|
|
assert.Equal(t, "Ghost", u.Name)
|
|
|
|
uid, u, err = GetPossibleUserByID(t.Context(), -2)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, int64(-2), uid)
|
|
assert.Equal(t, "gitea-actions", u.Name)
|
|
assert.Equal(t, "gitea-actions", u.LowerName)
|
|
|
|
u = GetSystemUserByName("Gitea-actionS")
|
|
require.NotNil(t, u)
|
|
assert.Equal(t, "Gitea Actions", u.FullName)
|
|
|
|
uid, u, err = GetPossibleUserByID(t.Context(), 999999)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, int64(-1), uid)
|
|
assert.Equal(t, "Ghost", u.Name)
|
|
}
|
|
|
|
func TestGetDoerPermissionUserCarriesToken(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
u, err := GetDoerPermissionUser(t.Context(), 2, NewTokenExtDoerData(CredentialAccessToken, 9, "public-only,read:repository").EncodeToString())
|
|
require.NoError(t, err)
|
|
assert.True(t, IsPublicOnlyDoer(u))
|
|
assert.Equal(t, "access-token:9", GetDoerCredential(u))
|
|
|
|
_, err = GetDoerPermissionUser(t.Context(), 2, "access-token:9|bogus")
|
|
assert.Error(t, err)
|
|
}
|