de484e86bc
This PR adds the support for scopes of access tokens, mimicking the design of GitHub OAuth scopes. The changes of the core logic are in `models/auth` that `AccessToken` struct will have a `Scope` field. The normalized (no duplication of scope), comma-separated scope string will be stored in `access_token` table in the database. In `services/auth`, the scope will be stored in context, which will be used by `reqToken` middleware in API calls. Only OAuth2 tokens will have granular token scopes, while others like BasicAuth will default to scope `all`. A large amount of work happens in `routers/api/v1/api.go` and the corresponding `tests/integration` tests, that is adding necessary scopes to each of the API calls as they fit. - [x] Add `Scope` field to `AccessToken` - [x] Add access control to all API endpoints - [x] Update frontend & backend for when creating tokens - [x] Add a database migration for `scope` column (enable 'all' access to past tokens) I'm aiming to complete it before Gitea 1.19 release. Fixes #4300
112 lines
2.3 KiB
Go
112 lines
2.3 KiB
Go
// Copyright 2018 The Gogs Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package forms
|
|
|
|
import (
|
|
"strconv"
|
|
"testing"
|
|
|
|
auth_model "code.gitea.io/gitea/models/auth"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestRegisterForm_IsDomainAllowed_Empty(t *testing.T) {
|
|
_ = setting.Service
|
|
|
|
setting.Service.EmailDomainWhitelist = []string{}
|
|
|
|
form := RegisterForm{}
|
|
|
|
assert.True(t, form.IsEmailDomainAllowed())
|
|
}
|
|
|
|
func TestRegisterForm_IsDomainAllowed_InvalidEmail(t *testing.T) {
|
|
_ = setting.Service
|
|
|
|
setting.Service.EmailDomainWhitelist = []string{"gitea.io"}
|
|
|
|
tt := []struct {
|
|
email string
|
|
}{
|
|
{"securitygieqqq"},
|
|
{"hdudhdd"},
|
|
}
|
|
|
|
for _, v := range tt {
|
|
form := RegisterForm{Email: v.email}
|
|
|
|
assert.False(t, form.IsEmailDomainAllowed())
|
|
}
|
|
}
|
|
|
|
func TestRegisterForm_IsDomainAllowed_WhitelistedEmail(t *testing.T) {
|
|
_ = setting.Service
|
|
|
|
setting.Service.EmailDomainWhitelist = []string{"gitea.io"}
|
|
|
|
tt := []struct {
|
|
email string
|
|
valid bool
|
|
}{
|
|
{"security@gitea.io", true},
|
|
{"security@gITea.io", true},
|
|
{"hdudhdd", false},
|
|
{"seee@example.com", false},
|
|
}
|
|
|
|
for _, v := range tt {
|
|
form := RegisterForm{Email: v.email}
|
|
|
|
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
|
|
}
|
|
}
|
|
|
|
func TestRegisterForm_IsDomainAllowed_BlocklistedEmail(t *testing.T) {
|
|
_ = setting.Service
|
|
|
|
setting.Service.EmailDomainWhitelist = []string{}
|
|
setting.Service.EmailDomainBlocklist = []string{"gitea.io"}
|
|
|
|
tt := []struct {
|
|
email string
|
|
valid bool
|
|
}{
|
|
{"security@gitea.io", false},
|
|
{"security@gitea.example", true},
|
|
{"hdudhdd", true},
|
|
}
|
|
|
|
for _, v := range tt {
|
|
form := RegisterForm{Email: v.email}
|
|
|
|
assert.Equal(t, v.valid, form.IsEmailDomainAllowed())
|
|
}
|
|
}
|
|
|
|
func TestNewAccessTokenForm_GetScope(t *testing.T) {
|
|
tests := []struct {
|
|
form NewAccessTokenForm
|
|
scope auth_model.AccessTokenScope
|
|
expectedErr error
|
|
}{
|
|
{
|
|
form: NewAccessTokenForm{Name: "test", Scope: []string{"repo"}},
|
|
scope: "repo",
|
|
},
|
|
{
|
|
form: NewAccessTokenForm{Name: "test", Scope: []string{"repo", "user"}},
|
|
scope: "repo,user",
|
|
},
|
|
}
|
|
|
|
for i, test := range tests {
|
|
t.Run(strconv.Itoa(i), func(t *testing.T) {
|
|
scope, err := test.form.GetScope()
|
|
assert.Equal(t, test.expectedErr, err)
|
|
assert.Equal(t, test.scope, scope)
|
|
})
|
|
}
|
|
}
|