mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-19 16:18:11 +00:00
silverwindandwxiaoguang
5264304a34
The token a request authenticated with now lives on the doer, so permission and visibility checks apply its scope from the doer alone. Replaces https://github.com/go-gitea/gitea/pull/39167, following https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619. 1. Public-only tokens get 404 instead of 403 for hidden users, orgs and repos, like GitHub. 2. Org ownership, site admin, repo and org creation, generation and transfer endpoints reject public-only tokens. 3. API pull request responses set `head.repo` to `null` and `head.repo_id` to `-1` when the caller cannot see the head repository. 4. Public-only tokens see org memberships like anonymous callers, so concealed members stay hidden. 5. Site admin access in activity feeds, follower lists, org members, Actions run lists and packages needs a session or an `all`-scoped token. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
67 lines
2.4 KiB
Go
67 lines
2.4 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package audit
|
|
|
|
import (
|
|
"context"
|
|
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/web/middleware"
|
|
)
|
|
|
|
type doerContextKeyType struct{}
|
|
|
|
var doerContextKey doerContextKeyType
|
|
|
|
type impersonatorContextKeyType struct{}
|
|
|
|
var impersonatorContextKey impersonatorContextKeyType
|
|
|
|
// WithImpersonator returns a context that records audit events as performed by
|
|
// the doer on behalf of the given admin.
|
|
func WithImpersonator(ctx context.Context, impersonator *user_model.User) context.Context {
|
|
return context.WithValue(ctx, impersonatorContextKey, impersonator)
|
|
}
|
|
|
|
// WithDoer returns a context that records audit events as the given user.
|
|
//
|
|
// Web and API requests need this only in unusual cases: the signed-in user is
|
|
// already published to the request data store by routers/common.AuthShared and
|
|
// is picked up automatically. Use it at entry points that have no signed-in
|
|
// user - the CLI, cron tasks, authentication source syncs and git hooks - before
|
|
// calling into services that record audit events themselves.
|
|
func WithDoer(ctx context.Context, doer *user_model.User) context.Context {
|
|
return context.WithValue(ctx, doerContextKey, doer)
|
|
}
|
|
|
|
// doerFromContext resolves the actor of an audit event: an explicit WithDoer
|
|
// value wins over the signed-in user of the surrounding request. Returns nil
|
|
// when neither is available, which Record turns into an unknown actor.
|
|
func doerFromContext(ctx context.Context) *user_model.User {
|
|
if doer, ok := ctx.Value(doerContextKey).(*user_model.User); ok && doer != nil {
|
|
return doer
|
|
}
|
|
if data := middleware.GetContextData(ctx); data != nil {
|
|
if doer, ok := data[middleware.ContextDataKeySignedUser].(*user_model.User); ok {
|
|
return doer
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ImpersonatorFromContext resolves the admin acting as the doer, so an event
|
|
// recorded during an impersonated session cannot be pinned on the impersonated
|
|
// user alone. Returns nil for ordinary sessions.
|
|
func ImpersonatorFromContext(ctx context.Context) *user_model.User {
|
|
if impersonator, ok := ctx.Value(impersonatorContextKey).(*user_model.User); ok && impersonator != nil {
|
|
return impersonator
|
|
}
|
|
if data := middleware.GetContextData(ctx); data != nil {
|
|
if impersonator, ok := data[middleware.ContextDataKeyImpersonator].(*user_model.User); ok {
|
|
return impersonator
|
|
}
|
|
}
|
|
return nil
|
|
}
|