mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
silverwindandwxiaoguang
5264304a34
The token a request authenticated with now lives on the doer, so permission and visibility checks apply its scope from the doer alone. Replaces https://github.com/go-gitea/gitea/pull/39167, following https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619. 1. Public-only tokens get 404 instead of 403 for hidden users, orgs and repos, like GitHub. 2. Org ownership, site admin, repo and org creation, generation and transfer endpoints reject public-only tokens. 3. API pull request responses set `head.repo` to `null` and `head.repo_id` to `-1` when the caller cannot see the head repository. 4. Public-only tokens see org memberships like anonymous callers, so concealed members stay hidden. 5. Site admin access in activity feeds, follower lists, org members, Actions run lists and packages needs a session or an `all`-scoped token. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
68 lines
1.8 KiB
Go
68 lines
1.8 KiB
Go
// Copyright 2024 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/services/actions"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestUserIDFromToken(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
t.Run("Actions JWT", func(t *testing.T) {
|
|
const RunningTaskID int64 = 47
|
|
token, err := actions.CreateAuthorizationToken(RunningTaskID, 1, 2)
|
|
assert.NoError(t, err)
|
|
|
|
o := OAuth2{}
|
|
u, err := o.userFromToken(t.Context(), token)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, user_model.ActionsUserID, u.ID)
|
|
taskID, ok := user_model.GetActionsUserTaskID(u)
|
|
assert.True(t, ok)
|
|
assert.Equal(t, RunningTaskID, taskID)
|
|
})
|
|
|
|
t.Run("Access token", func(t *testing.T) {
|
|
token := &auth_model.AccessToken{UID: 2, Name: "public-only", Scope: "public-only,read:repository"}
|
|
require.NoError(t, auth_model.NewAccessToken(t.Context(), token))
|
|
|
|
u, err := (&OAuth2{}).userFromToken(t.Context(), token.Token)
|
|
require.NoError(t, err)
|
|
scope, _ := user_model.GetDoerTokenScope(u)
|
|
assert.Equal(t, token.Scope, scope)
|
|
assert.Equal(t, fmt.Sprintf("access-token:%d", token.ID), user_model.GetDoerCredential(u))
|
|
})
|
|
}
|
|
|
|
func TestCheckTaskIsRunning(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
cases := map[string]struct {
|
|
TaskID int64
|
|
Expected bool
|
|
}{
|
|
"Running": {TaskID: 47, Expected: true},
|
|
"Missing": {TaskID: 1, Expected: false},
|
|
"Cancelled": {TaskID: 46, Expected: false},
|
|
}
|
|
|
|
for name := range cases {
|
|
c := cases[name]
|
|
t.Run(name, func(t *testing.T) {
|
|
actual := CheckTaskIsRunning(t.Context(), c.TaskID)
|
|
assert.Equal(t, c.Expected, actual)
|
|
})
|
|
}
|
|
}
|