From 33498f828da9a0c753edb202a38fb9a50df1c19b Mon Sep 17 00:00:00 2001 From: Giteabot Date: Fri, 14 Aug 2026 06:17:59 -0700 Subject: [PATCH] chore: Pre-register a builtin OAuth2 application for the official Gitea mobile app (#38880) (#38922) Backport #38880 by @lunny This is a prepare and required step for upcoming Gitea Official Mobile APP which supports login with OAuth2. Gitea already pre-registers OAuth2 applications for a few universally useful clients (`git-credential-oauth`, Git Credential Manager and `tea`), so those tools can run an Authorization Code + PKCE login against any instance without the user having to create an OAuth application by hand. The official Gitea mobile app needs the same mechanism. This adds a builtin application for it: | | | |---|---| | client ID | `b757811a-05c8-4c76-8d74-a5ee3d2073f2` | | config name | `gitea-app` | | display name | `Gitea App` | | redirect URI | `com.gitea.app://oauth/callback` | Unlike the existing entries, which are CLIs and can therefore use a loopback `http://127.0.0.1` redirect, a mobile app authorises through a system browser session (`ASWebAuthenticationSession` on iOS, Custom Tabs on Android) that can only receive a custom-scheme callback, hence the custom scheme here. Notes: * Builtin applications are inserted directly by `auth.Init`, so they do not pass through `DetectInvalidOAuth2ApplicationRedirectURI`, which is only applied to user- and API-created applications. No `[oauth2] CUSTOM_SCHEMES` configuration is required for this to work, and `ContainsRedirectURI` matches the URI by normalised string comparison. * Instances that do not want the application pre-registered can drop `gitea-app` from `[oauth2] DEFAULT_APPLICATIONS`, exactly as with the existing entries; `auth.Init` then deletes it again. * The client is public: no client secret, PKCE `S256` required. --- Generated by Codet Co-authored-by: Lunny Xiao --- custom/conf/app.example.ini | 3 ++- models/auth/oauth2.go | 5 +++++ modules/setting/oauth2.go | 2 +- modules/setting/oauth2_test.go | 2 +- 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini index 7311742cff6..18b596e2ec2 100644 --- a/custom/conf/app.example.ini +++ b/custom/conf/app.example.ini @@ -606,7 +606,8 @@ ENABLED = true ;; * https://github.com/hickford/git-credential-oauth ;; * https://github.com/git-ecosystem/git-credential-manager ;; * https://gitea.com/gitea/tea -;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea +;; * Gitea App (the official Gitea mobile app) +;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app ;; ;; By default, OAuth2 applications can only use "http" and "https" as their redirect URI schemes. ;; If you need to use other schemes (e.g. for desktop applications), you can specify them here as a comma-separated list. diff --git a/models/auth/oauth2.go b/models/auth/oauth2.go index f67a5560654..b9e4a6b0ba5 100644 --- a/models/auth/oauth2.go +++ b/models/auth/oauth2.go @@ -83,6 +83,11 @@ func BuiltinApplications() map[string]*BuiltinOAuth2Application { DisplayName: "tea", RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"}, } + m["b757811a-05c8-4c76-8d74-a5ee3d2073f2"] = &BuiltinOAuth2Application{ + ConfigName: "gitea-app", + DisplayName: "Gitea App", + RedirectURIs: []string{"com.gitea.app://oauth/callback"}, + } return m } diff --git a/modules/setting/oauth2.go b/modules/setting/oauth2.go index 0c2db10edf7..94bdf780dd4 100644 --- a/modules/setting/oauth2.go +++ b/modules/setting/oauth2.go @@ -108,7 +108,7 @@ var OAuth2 = struct { JWTSigningAlgorithm: "RS256", JWTSigningPrivateKeyFile: "jwt/private.pem", MaxTokenLength: math.MaxInt16, - DefaultApplications: []string{"git-credential-oauth", "git-credential-manager", "tea"}, + DefaultApplications: []string{"git-credential-oauth", "git-credential-manager", "tea", "gitea-app"}, } func loadOAuth2From(rootCfg ConfigProvider) { diff --git a/modules/setting/oauth2_test.go b/modules/setting/oauth2_test.go index a2235c6fc8a..7da186a9f49 100644 --- a/modules/setting/oauth2_test.go +++ b/modules/setting/oauth2_test.go @@ -62,7 +62,7 @@ func TestGetGeneralSigningSecretSave(t *testing.T) { func TestOauth2DefaultApplications(t *testing.T) { cfg, _ := NewConfigProviderFromData(``) loadOAuth2From(cfg) - assert.Equal(t, []string{"git-credential-oauth", "git-credential-manager", "tea"}, OAuth2.DefaultApplications) + assert.Equal(t, []string{"git-credential-oauth", "git-credential-manager", "tea", "gitea-app"}, OAuth2.DefaultApplications) cfg, _ = NewConfigProviderFromData(`[oauth2] DEFAULT_APPLICATIONS = tea