mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-04-23 03:36:58 -04:00
This PR is part of a series (#11311). If the user authenticating to an API call is a Forgejo site administrator, or a Forgejo repo administrator, a wide variety of permission and ownership checks in the API are either bypassed, or are bypassable. If a user has created an access token with restricted resources, I understand the intent of the user is to create a token which has a layer of risk reduction in the event that the token is lost/leaked to an attacker. For this reason, it makes sense to me that restricted scope access tokens shouldn't inherit the owner's administrator access. My intent is that repo-specific access tokens [will only be able to access specific authorization scopes](https://codeberg.org/forgejo/design/issues/50#issuecomment-11093951), probably: `repository:read`, `repository:write`, `issue:read`, `issue:write`, (`organization:read` / `user:read` maybe). This means that *most* admin access is not intended to be affected by this because repo-specific access tokens won't have, for example, `admin:write` scope. However, administrative access still grants elevated permissions in some areas that are relevant to these scopes, and need to be restricted: - The `?sudo=otheruser` query parameter allows site administrators to impersonate other users in the API. - Repository management rules are different for a site administrator, allowing them to create repos for another user, create repos in another organization, migrate a repository to an arbitrary owner, and transfer a repository to a prviate organization. - Administrators have access to extra data through some APIs which would be in scope: the detailed configuration of branch protection rules, the some details of repository deploy keys (which repo, and which scope -- seems odd), (user:read -- user SSH keys, activity feeds of private users, user profiles of private users, user webhook configurations). - Pull request reviews have additional perms for repo administrators, including the ability to dismiss PR reviews, delete PR reviews, and view draft PR reviews. - Repo admins and site admins can comment on locked issues, and related to comments can edit or delete other user's comments and attachments. - Repo admins can manage and view logged time on behalf of other users. A handful of these permissions may make sense for repo-specific access tokens, but most of them clearly exceed the risk that would be expected from creating a limited scope access token. I'd generally prefer to take a restrictive approach, and we can relax it if real-world use-cases come in -- users will have a workaround of creating an access token without repo-specific restrictions if they are blocked from needed access. **Breaking:** The administration restrictions introduced in this PR affect both repo-specific access tokens, and existing public-only access tokens. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - Although repo-specific access tokens are not yet exposed to end users, the breaking changes to public-only tokens will be visible to users and require release notes. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11468 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
179 lines
3.9 KiB
Go
179 lines
3.9 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package user
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
api "forgejo.org/modules/structs"
|
|
"forgejo.org/modules/web"
|
|
"forgejo.org/routers/api/v1/utils"
|
|
"forgejo.org/services/context"
|
|
webhook_service "forgejo.org/services/webhook"
|
|
)
|
|
|
|
// ListHooks list the authenticated user's webhooks
|
|
func ListHooks(ctx *context.APIContext) {
|
|
// swagger:operation GET /user/hooks user userListHooks
|
|
// ---
|
|
// summary: List the authenticated user's webhooks
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: page
|
|
// in: query
|
|
// description: page number of results to return (1-based)
|
|
// type: integer
|
|
// - name: limit
|
|
// in: query
|
|
// description: page size of results
|
|
// type: integer
|
|
// responses:
|
|
// "200":
|
|
// "$ref": "#/responses/HookListWithoutPagination"
|
|
// "401":
|
|
// "$ref": "#/responses/unauthorized"
|
|
// "403":
|
|
// "$ref": "#/responses/forbidden"
|
|
|
|
utils.ListOwnerHooks(
|
|
ctx,
|
|
ctx.Doer,
|
|
)
|
|
}
|
|
|
|
// GetHook get the authenticated user's hook by id
|
|
func GetHook(ctx *context.APIContext) {
|
|
// swagger:operation GET /user/hooks/{id} user userGetHook
|
|
// ---
|
|
// summary: Get a hook
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: id
|
|
// in: path
|
|
// description: id of the hook to get
|
|
// type: integer
|
|
// format: int64
|
|
// required: true
|
|
// responses:
|
|
// "200":
|
|
// "$ref": "#/responses/Hook"
|
|
// "401":
|
|
// "$ref": "#/responses/unauthorized"
|
|
// "403":
|
|
// "$ref": "#/responses/forbidden"
|
|
|
|
hook, err := utils.GetOwnerHook(ctx, ctx.Doer.ID, ctx.ParamsInt64("id"))
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
if !ctx.IsUserSiteAdmin() && hook.OwnerID != ctx.Doer.ID {
|
|
ctx.NotFound()
|
|
return
|
|
}
|
|
|
|
apiHook, err := webhook_service.ToHook(ctx.Doer.HomeLink(), hook)
|
|
if err != nil {
|
|
ctx.InternalServerError(err)
|
|
return
|
|
}
|
|
ctx.JSON(http.StatusOK, apiHook)
|
|
}
|
|
|
|
// CreateHook create a hook for the authenticated user
|
|
func CreateHook(ctx *context.APIContext) {
|
|
// swagger:operation POST /user/hooks user userCreateHook
|
|
// ---
|
|
// summary: Create a hook
|
|
// consumes:
|
|
// - application/json
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: body
|
|
// in: body
|
|
// required: true
|
|
// schema:
|
|
// "$ref": "#/definitions/CreateHookOption"
|
|
// responses:
|
|
// "201":
|
|
// "$ref": "#/responses/Hook"
|
|
// "401":
|
|
// "$ref": "#/responses/unauthorized"
|
|
// "403":
|
|
// "$ref": "#/responses/forbidden"
|
|
|
|
utils.AddOwnerHook(
|
|
ctx,
|
|
ctx.Doer,
|
|
web.GetForm(ctx).(*api.CreateHookOption),
|
|
)
|
|
}
|
|
|
|
// EditHook modify a hook of the authenticated user
|
|
func EditHook(ctx *context.APIContext) {
|
|
// swagger:operation PATCH /user/hooks/{id} user userEditHook
|
|
// ---
|
|
// summary: Update a hook
|
|
// consumes:
|
|
// - application/json
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: id
|
|
// in: path
|
|
// description: id of the hook to update
|
|
// type: integer
|
|
// format: int64
|
|
// required: true
|
|
// - name: body
|
|
// in: body
|
|
// schema:
|
|
// "$ref": "#/definitions/EditHookOption"
|
|
// responses:
|
|
// "200":
|
|
// "$ref": "#/responses/Hook"
|
|
// "401":
|
|
// "$ref": "#/responses/unauthorized"
|
|
// "403":
|
|
// "$ref": "#/responses/forbidden"
|
|
|
|
utils.EditOwnerHook(
|
|
ctx,
|
|
ctx.Doer,
|
|
web.GetForm(ctx).(*api.EditHookOption),
|
|
ctx.ParamsInt64("id"),
|
|
)
|
|
}
|
|
|
|
// DeleteHook delete a hook of the authenticated user
|
|
func DeleteHook(ctx *context.APIContext) {
|
|
// swagger:operation DELETE /user/hooks/{id} user userDeleteHook
|
|
// ---
|
|
// summary: Delete a hook
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: id
|
|
// in: path
|
|
// description: id of the hook to delete
|
|
// type: integer
|
|
// format: int64
|
|
// required: true
|
|
// responses:
|
|
// "204":
|
|
// "$ref": "#/responses/empty"
|
|
// "401":
|
|
// "$ref": "#/responses/unauthorized"
|
|
// "403":
|
|
// "$ref": "#/responses/forbidden"
|
|
|
|
utils.DeleteOwnerHook(
|
|
ctx,
|
|
ctx.Doer,
|
|
ctx.ParamsInt64("id"),
|
|
)
|
|
}
|