public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-17 05:52:13 +09:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add audit logging (#38189)

Browse Source 
Co-authored-by: bircni <bircni@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
bircni
2026-09-12 10:15:23 +02:00
committed by GitHub
parent 4d43445532
commit da37b7916b
136 changed files with 3864 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/auth/oauth2.go
+13 -10
View File
@@ -25,35 +25,36 @@ import (
var _ Method = &OAuth2{}
// GetOAuthAccessTokenScopeAndUserID returns access token scope and user id
func GetOAuthAccessTokenScopeAndUserID(ctx context.Context, accessToken string) (auth_model.AccessTokenScope, int64) {
// GetOAuthAccessTokenScopeAndUserID returns access token scope, user id and the
// grant the token was issued for.
func GetOAuthAccessTokenScopeAndUserID(ctx context.Context, accessToken string) (_ auth_model.AccessTokenScope, userID, grantID int64) {
var accessTokenScope auth_model.AccessTokenScope
if !setting.OAuth2.Enabled {
return accessTokenScope, 0
return accessTokenScope, 0, 0
}
// JWT tokens require a ".", if the token isn't like that, return early
if !strings.Contains(accessToken, ".") {
return accessTokenScope, 0
return accessTokenScope, 0, 0
}
token, err := oauth2_provider.ParseToken(accessToken, oauth2_provider.DefaultSigningKey)
if err != nil {
log.Trace("oauth2.ParseToken: %v", err)
return accessTokenScope, 0
return accessTokenScope, 0, 0
}
var grant *auth_model.OAuth2Grant
if grant, err = auth_model.GetOAuth2GrantByID(ctx, token.GrantID); err != nil || grant == nil {
return accessTokenScope, 0
return accessTokenScope, 0, 0
}
if token.Kind != oauth2_provider.KindAccessToken {
return accessTokenScope, 0
return accessTokenScope, 0, 0
}
if token.ExpiresAt.Before(time.Now()) || token.IssuedAt.After(time.Now()) {
return accessTokenScope, 0
return accessTokenScope, 0, 0
}
accessTokenScope = oauth2_provider.GrantAdditionalScopes(grant.Scope)
return accessTokenScope, grant.UserID
return accessTokenScope, grant.UserID, grant.ID
}
// CheckTaskIsRunning verifies that the TaskID corresponds to a running task
@@ -118,9 +119,10 @@ func (o *OAuth2) userFromToken(ctx context.Context, tokenSHA string, store DataS
}
// Otherwise, check if this is an OAuth access token
accessTokenScope, uid := GetOAuthAccessTokenScopeAndUserID(ctx, tokenSHA)
accessTokenScope, uid, grantID := GetOAuthAccessTokenScopeAndUserID(ctx, tokenSHA)
if uid != 0 {
store.GetData()["ApiTokenScope"] = accessTokenScope
setAuthCredential(store, credentialOAuth2Grant, grantID)
}
return user_model.GetUserByID(ctx, uid)
}
@@ -141,6 +143,7 @@ func (o *OAuth2) userFromToken(ctx context.Context, tokenSHA string, store DataS
log.Error("UpdateAccessToken: %v", err)
}
store.GetData()["ApiTokenScope"] = t.Scope
setAuthCredential(store, credentialAccessToken, t.ID)
return user_model.GetUserByID(ctx, t.UID)
}