mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-20 08:20:04 +00:00
silverwindandwxiaoguang
5264304a34
The token a request authenticated with now lives on the doer, so permission and visibility checks apply its scope from the doer alone. Replaces https://github.com/go-gitea/gitea/pull/39167, following https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619. 1. Public-only tokens get 404 instead of 403 for hidden users, orgs and repos, like GitHub. 2. Org ownership, site admin, repo and org creation, generation and transfer endpoints reject public-only tokens. 3. API pull request responses set `head.repo` to `null` and `head.repo_id` to `-1` when the caller cannot see the head repository. 4. Public-only tokens see org memberships like anonymous callers, so concealed members stay hidden. 5. Site admin access in activity feeds, follower lists, org members, Actions run lists and packages needs a session or an `all`-scoped token. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
47 lines
1.5 KiB
Go
47 lines
1.5 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
deploykey_model "gitea.dev/models/deploykey"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/log"
|
|
)
|
|
|
|
var _ Method = &DeployToken{}
|
|
|
|
// DeployToken authenticates a deploy key token given as HTTP basic auth credential.
|
|
// Only add it to an auth group where a repo scoped credential makes sense.
|
|
type DeployToken struct{}
|
|
|
|
func (d *DeployToken) Name() string {
|
|
return DeployTokenMethodName
|
|
}
|
|
|
|
// Verify returns a user that stands for the deploy key alone. Its permissions come from the key,
|
|
// see access_model.getDeployKeyRepoPermission, so the request can never reach another repository
|
|
// or exceed the access mode of the key.
|
|
func (d *DeployToken) Verify(req *http.Request, _ http.ResponseWriter, store DataStore, _ SessionStore) (*user_model.User, error) {
|
|
authToken := parseAuthBasic(req).authToken
|
|
if authToken == "" {
|
|
return nil, nil //nolint:nilnil // the auth method is not applicable
|
|
}
|
|
|
|
key, err := deploykey_model.VerifyDeployKeyToken(req.Context(), authToken)
|
|
if err != nil {
|
|
if deploykey_model.IsErrDeployKeyNotExist(err) {
|
|
return nil, nil //nolint:nilnil // not a deploy token, let the other methods try
|
|
}
|
|
return nil, err
|
|
}
|
|
|
|
if err := deploykey_model.UpdateDeployKeyLastUsed(req.Context(), key.ID); err != nil {
|
|
log.Error("UpdateDeployKeyUpdated: %v", err)
|
|
}
|
|
|
|
return user_model.NewDeployKeyUserWithKeyID(key.ID), nil
|
|
}
|