mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-02 13:44:16 +09:00
da7b81d407
Add `read:commitstatus` and `write:commitstatus` token scopes, so CI and
other integrations can report commit statuses without a token that
grants full repository access.
- The commit status endpoints (`/statuses/{sha}`,
`/commits/{ref}/status` and `/commits/{ref}/statuses`) accept the new
scopes, and the repository scopes keep working as they include them
- Creating a status still requires code write permission on the
repository, the scope only narrows what the token may do
- `public-only` tokens still cannot reach private repositories
- `PathGroup` middlewares now run only for a matched path, so unrelated
methods and paths that fall back to the group are not rejected by its
scope check
Fixes: https://github.com/go-gitea/gitea/issues/32625
Ref: https://github.com/go-gitea/gitea/pull/35383
Docs: https://gitea.com/gitea/docs/pulls/622
Signed-off-by: Norbert Szulc <norbert@not7cd.net>
Co-authored-by: Aiden Scandella <git@sca.ndella.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
77 lines
2.7 KiB
Go
77 lines
2.7 KiB
Go
// Copyright 2014 The Gogs Authors. All rights reserved.
|
|
// Copyright 2019 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package structs
|
|
|
|
import (
|
|
"time"
|
|
)
|
|
|
|
// AccessToken represents an API access token.
|
|
type AccessToken struct {
|
|
// The unique identifier of the access token
|
|
ID int64 `json:"id"`
|
|
// The name of the access token
|
|
Name string `json:"name"`
|
|
// The SHA1 hash of the access token
|
|
Token string `json:"sha1"`
|
|
// The last eight characters of the token
|
|
TokenLastEight string `json:"token_last_eight"`
|
|
// The scopes granted to this access token
|
|
Scopes []string `json:"scopes"`
|
|
// The timestamp when the token was created
|
|
Created time.Time `json:"created_at"`
|
|
// The timestamp when the token was last used
|
|
Updated time.Time `json:"last_used_at"`
|
|
}
|
|
|
|
// AccessTokenList represents a list of API access token.
|
|
// swagger:response AccessTokenList
|
|
type AccessTokenList []*AccessToken
|
|
|
|
// CreateAccessTokenOption options when create access token
|
|
// swagger:model CreateAccessTokenOption
|
|
type CreateAccessTokenOption struct {
|
|
// required: true
|
|
Name string `json:"name" binding:"Required"`
|
|
// example: ["all", "read:activitypub", "write:commitstatus", "read:issue", "write:misc", "read:notification", "read:organization", "read:package", "read:repository", "read:user"]
|
|
Scopes []string `json:"scopes"`
|
|
}
|
|
|
|
// CreateOAuth2ApplicationOptions holds options to create an oauth2 application
|
|
type CreateOAuth2ApplicationOptions struct {
|
|
// The name of the OAuth2 application
|
|
Name string `json:"name" binding:"Required"`
|
|
// Whether the client is confidential
|
|
ConfidentialClient bool `json:"confidential_client"`
|
|
// Whether to skip secondary authorization
|
|
SkipSecondaryAuthorization bool `json:"skip_secondary_authorization"`
|
|
// The list of allowed redirect URIs
|
|
RedirectURIs []string `json:"redirect_uris" binding:"Required"`
|
|
}
|
|
|
|
// OAuth2Application represents an OAuth2 application.
|
|
type OAuth2Application struct {
|
|
// The unique identifier of the OAuth2 application
|
|
ID int64 `json:"id"`
|
|
// The name of the OAuth2 application
|
|
Name string `json:"name"`
|
|
// The client ID of the OAuth2 application
|
|
ClientID string `json:"client_id"`
|
|
// The client secret of the OAuth2 application
|
|
ClientSecret string `json:"client_secret"`
|
|
// Whether the client is confidential
|
|
ConfidentialClient bool `json:"confidential_client"`
|
|
// Whether to skip secondary authorization
|
|
SkipSecondaryAuthorization bool `json:"skip_secondary_authorization"`
|
|
// The list of allowed redirect URIs
|
|
RedirectURIs []string `json:"redirect_uris"`
|
|
// The timestamp when the application was created
|
|
Created time.Time `json:"created"`
|
|
}
|
|
|
|
// OAuth2ApplicationList represents a list of OAuth2 applications.
|
|
// swagger:response OAuth2ApplicationList
|
|
type OAuth2ApplicationList []*OAuth2Application
|