mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-16 13:11:16 +09:00
Giteabot
33498f828d
Backport #38880 by @lunny This is a prepare and required step for upcoming Gitea Official Mobile APP which supports login with OAuth2. Gitea already pre-registers OAuth2 applications for a few universally useful clients (`git-credential-oauth`, Git Credential Manager and `tea`), so those tools can run an Authorization Code + PKCE login against any instance without the user having to create an OAuth application by hand. The official Gitea mobile app needs the same mechanism. This adds a builtin application for it: | | | |---|---| | client ID | `b757811a-05c8-4c76-8d74-a5ee3d2073f2` | | config name | `gitea-app` | | display name | `Gitea App` | | redirect URI | `com.gitea.app://oauth/callback` | Unlike the existing entries, which are CLIs and can therefore use a loopback `http://127.0.0.1` redirect, a mobile app authorises through a system browser session (`ASWebAuthenticationSession` on iOS, Custom Tabs on Android) that can only receive a custom-scheme callback, hence the custom scheme here. Notes: * Builtin applications are inserted directly by `auth.Init`, so they do not pass through `DetectInvalidOAuth2ApplicationRedirectURI`, which is only applied to user- and API-created applications. No `[oauth2] CUSTOM_SCHEMES` configuration is required for this to work, and `ContainsRedirectURI` matches the URI by normalised string comparison. * Instances that do not want the application pre-registered can drop `gitea-app` from `[oauth2] DEFAULT_APPLICATIONS`, exactly as with the existing entries; `auth.Init` then deletes it again. * The client is public: no client secret, PKCE `S256` required. --- Generated by Codet Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
79 lines
2.2 KiB
Go
79 lines
2.2 KiB
Go
// Copyright 2024 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package setting
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"gitea.dev/modules/generate"
|
|
"gitea.dev/modules/test"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestGetGeneralSigningSecret(t *testing.T) {
|
|
// when there is no general signing secret, it should be generated, and keep the same value
|
|
generalSigningSecret.Store(nil)
|
|
s1 := GetGeneralTokenSigningSecret()
|
|
assert.NotNil(t, s1)
|
|
s2 := GetGeneralTokenSigningSecret()
|
|
assert.Equal(t, s1, s2)
|
|
|
|
// the config value should always override any pre-generated value
|
|
cfg, _ := NewConfigProviderFromData(`
|
|
[oauth2]
|
|
JWT_SECRET = BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
|
|
`)
|
|
defer test.MockVariableValue(&InstallLock, true)()
|
|
loadOAuth2From(cfg)
|
|
actual := GetGeneralTokenSigningSecret()
|
|
expected, _ := generate.DecodeJwtSecretBase64("BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB")
|
|
assert.Len(t, actual, 32)
|
|
assert.Equal(t, expected, actual)
|
|
}
|
|
|
|
func TestGetGeneralSigningSecretSave(t *testing.T) {
|
|
defer test.MockVariableValue(&InstallLock, true)()
|
|
|
|
old := GetGeneralTokenSigningSecret()
|
|
assert.Len(t, old, 32)
|
|
|
|
tmpFile := t.TempDir() + "/app.ini"
|
|
_ = os.WriteFile(tmpFile, nil, 0o644)
|
|
cfg, _ := NewConfigProviderFromFile(tmpFile)
|
|
loadOAuth2From(cfg)
|
|
generated := GetGeneralTokenSigningSecret()
|
|
assert.Len(t, generated, 32)
|
|
assert.NotEqual(t, old, generated)
|
|
|
|
generalSigningSecret.Store(nil)
|
|
cfg, _ = NewConfigProviderFromFile(tmpFile)
|
|
loadOAuth2From(cfg)
|
|
again := GetGeneralTokenSigningSecret()
|
|
assert.Equal(t, generated, again)
|
|
|
|
iniContent, err := os.ReadFile(tmpFile)
|
|
assert.NoError(t, err)
|
|
assert.Contains(t, string(iniContent), "JWT_SECRET = ")
|
|
}
|
|
|
|
func TestOauth2DefaultApplications(t *testing.T) {
|
|
cfg, _ := NewConfigProviderFromData(``)
|
|
loadOAuth2From(cfg)
|
|
assert.Equal(t, []string{"git-credential-oauth", "git-credential-manager", "tea", "gitea-app"}, OAuth2.DefaultApplications)
|
|
|
|
cfg, _ = NewConfigProviderFromData(`[oauth2]
|
|
DEFAULT_APPLICATIONS = tea
|
|
`)
|
|
loadOAuth2From(cfg)
|
|
assert.Equal(t, []string{"tea"}, OAuth2.DefaultApplications)
|
|
|
|
cfg, _ = NewConfigProviderFromData(`[oauth2]
|
|
DEFAULT_APPLICATIONS =
|
|
`)
|
|
loadOAuth2From(cfg)
|
|
assert.Nil(t, OAuth2.DefaultApplications)
|
|
}
|