mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-04-23 18:16:59 -04:00
a27f9a719e
Last known backend change for #11311, fixing up some loose ends on the repository APIs related to repo-specific access tokens. Adds automated testing, and aligns permissions where necessary, to ensure that repo-specific access tokens can't change the administrative state of the repositories that they are limited to. Repo-specific access tokens cannot be used to: - convert a mirror into a normal repo, - create a new repository from a template, - transfer ownership of a repository - create a new repository (already protected, but test automation added), - delete a repository (already protected, but test automation added), - editing a repository's settings (already protected, but test automation added). **Breaking**: The template generation (`POST /repos/{template_owner}/{template_repo}/generate`) and repository deletion (`DELETE /repos/{username}/{reponame}`) APIs have been updated to require the same permission scope as creating a new repository. Either `write:user` or `write:organization` is required, depending on the owner of the repository being created or deleted. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11736 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
82 lines
3.2 KiB
Go
82 lines
3.2 KiB
Go
// Copyright 2025 The Gitea Authors. All rights reserved.
|
|
// Copyright 2025 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "forgejo.org/models/auth"
|
|
repo_model "forgejo.org/models/repo"
|
|
"forgejo.org/models/unittest"
|
|
user_model "forgejo.org/models/user"
|
|
api "forgejo.org/modules/structs"
|
|
"forgejo.org/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestAPIConvert(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
user5 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
|
|
repo5 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 5})
|
|
repo4 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
|
|
org3 := "org3"
|
|
|
|
// Get user2's token
|
|
session := loginUser(t, user2.Name)
|
|
token2 := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
|
|
// Get user5's token
|
|
session = loginUser(t, user5.Name)
|
|
token5 := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
|
|
|
|
req := NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/convert", org3, repo5.Name)).AddTokenAuth(token2)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
var repo api.Repository
|
|
DecodeJSON(t, resp, &repo)
|
|
assert.NotNil(t, repo)
|
|
assert.False(t, repo.Mirror)
|
|
|
|
repo5edited := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 5})
|
|
assert.False(t, repo5edited.IsMirror)
|
|
|
|
// Test editing a non-existing repo return 404
|
|
name := "repodoesnotexist"
|
|
req = NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/convert", org3, name)).AddTokenAuth(token2)
|
|
_ = MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
// Test converting a repo when not owner returns 422
|
|
req = NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/convert", org3, repo5.Name)).AddTokenAuth(token2)
|
|
MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
|
|
// Tests converting a repo with no token returns 404
|
|
req = NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/convert", org3, repo5.Name))
|
|
_ = MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
// Test converting a repo that is not a mirror does nothing and returns 422
|
|
req = NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/convert", user5.Name, repo4.Name)).AddTokenAuth(token5)
|
|
_ = MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
repo4edited := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
|
|
assert.False(t, repo4edited.IsMirror)
|
|
}
|
|
|
|
// This test verifies that a repo-specific access token with `write:repository` scope is not a sufficient scope to edit
|
|
// the settings of a repository that is within its repo-specific list.
|
|
func TestAPIConvertAccessTokenResources(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
repo5 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 5})
|
|
org3 := "org3"
|
|
|
|
repoSpecificToken := createFineGrainedRepoAccessToken(t, "user2",
|
|
[]auth_model.AccessTokenScope{auth_model.AccessTokenScopeWriteRepository},
|
|
[]int64{repo5.ID},
|
|
)
|
|
req := NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/convert", org3, repo5.Name)).AddTokenAuth(repoSpecificToken)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
}
|