Skip to content

Commit 3ca5dc7

Browse files
authored
Move keys to models/asymkey (#17917)
* Move keys to models/keys * Rename models/keys -> models/asymkey * change the missed package name * Fix package alias * Fix test * Fix docs * Fix test * Fix test * merge
1 parent 0a9fcf6 commit 3ca5dc7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+1001
-887
lines changed

cmd/admin.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"text/tabwriter"
1515

1616
"code.gitea.io/gitea/models"
17+
asymkey_model "code.gitea.io/gitea/models/asymkey"
1718
"code.gitea.io/gitea/models/db"
1819
"code.gitea.io/gitea/models/login"
1920
user_model "code.gitea.io/gitea/models/user"
@@ -625,7 +626,7 @@ func runRegenerateKeys(_ *cli.Context) error {
625626
if err := initDB(ctx); err != nil {
626627
return err
627628
}
628-
return models.RewriteAllPublicKeys()
629+
return asymkey_model.RewriteAllPublicKeys()
629630
}
630631

631632
func parseOAuth2Config(c *cli.Context) *oauth2.Source {

cmd/serv.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"time"
1818

1919
"code.gitea.io/gitea/models"
20+
asymkey_model "code.gitea.io/gitea/models/asymkey"
2021
"code.gitea.io/gitea/models/perm"
2122
"code.gitea.io/gitea/modules/git"
2223
"code.gitea.io/gitea/modules/json"
@@ -129,9 +130,9 @@ func runServ(c *cli.Context) error {
129130
return fail("Internal error", "Failed to check provided key: %v", err)
130131
}
131132
switch key.Type {
132-
case models.KeyTypeDeploy:
133+
case asymkey_model.KeyTypeDeploy:
133134
println("Hi there! You've successfully authenticated with the deploy key named " + key.Name + ", but Gitea does not provide shell access.")
134-
case models.KeyTypePrincipal:
135+
case asymkey_model.KeyTypePrincipal:
135136
println("Hi there! You've successfully authenticated with the principal " + key.Content + ", but Gitea does not provide shell access.")
136137
default:
137138
println("Hi there, " + user.Name + "! You've successfully authenticated with the key named " + key.Name + ", but Gitea does not provide shell access.")

docs/content/doc/advanced/config-cheat-sheet.en-us.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a
277277
- `SSH_AUTHORIZED_PRINCIPALS_ALLOW`: **off** or **username, email**: \[off, username, email, anything\]: Specify the principals values that users are allowed to use as principal. When set to `anything` no checks are done on the principal string. When set to `off` authorized principal are not allowed to be set.
278278
- `SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE`: **false/true**: Gitea will create a authorized_principals file by default when it is not using the internal ssh server and `SSH_AUTHORIZED_PRINCIPALS_ALLOW` is not `off`.
279279
- `SSH_AUTHORIZED_PRINCIPALS_BACKUP`: **false/true**: Enable SSH Authorized Principals Backup when rewriting all keys, default is true if `SSH_AUTHORIZED_PRINCIPALS_ALLOW` is not `off`.
280-
- `SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE`: **{{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}**: Set the template for the command to passed on authorized keys. Possible keys are: AppPath, AppWorkPath, CustomConf, CustomPath, Key - where Key is a `models.PublicKey` and the others are strings which are shellquoted.
280+
- `SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE`: **{{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}**: Set the template for the command to passed on authorized keys. Possible keys are: AppPath, AppWorkPath, CustomConf, CustomPath, Key - where Key is a `models/asymkey.PublicKey` and the others are strings which are shellquoted.
281281
- `SSH_SERVER_CIPHERS`: **aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, arcfour256, arcfour128**: For the built-in SSH server, choose the ciphers to support for SSH connections, for system SSH this setting has no effect.
282282
- `SSH_SERVER_KEY_EXCHANGES`: **diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, curve25519-sha256@libssh.org**: For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, for system SSH this setting has no effect.
283283
- `SSH_SERVER_MACS`: **hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1, hmac-sha1-96**: For the built-in SSH server, choose the MACs to support for SSH connections, for system SSH this setting has no effect

integrations/api_admin_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
"net/http"
1010
"testing"
1111

12-
"code.gitea.io/gitea/models"
12+
asymkey_model "code.gitea.io/gitea/models/asymkey"
1313
"code.gitea.io/gitea/models/unittest"
1414
user_model "code.gitea.io/gitea/models/user"
1515
"code.gitea.io/gitea/modules/json"
@@ -34,7 +34,7 @@ func TestAPIAdminCreateAndDeleteSSHKey(t *testing.T) {
3434

3535
var newPublicKey api.PublicKey
3636
DecodeJSON(t, resp, &newPublicKey)
37-
unittest.AssertExistsAndLoadBean(t, &models.PublicKey{
37+
unittest.AssertExistsAndLoadBean(t, &asymkey_model.PublicKey{
3838
ID: newPublicKey.ID,
3939
Name: newPublicKey.Title,
4040
Content: newPublicKey.Key,
@@ -45,7 +45,7 @@ func TestAPIAdminCreateAndDeleteSSHKey(t *testing.T) {
4545
req = NewRequestf(t, "DELETE", "/api/v1/admin/users/%s/keys/%d?token=%s",
4646
keyOwner.Name, newPublicKey.ID, token)
4747
session.MakeRequest(t, req, http.StatusNoContent)
48-
unittest.AssertNotExistsBean(t, &models.PublicKey{ID: newPublicKey.ID})
48+
unittest.AssertNotExistsBean(t, &asymkey_model.PublicKey{ID: newPublicKey.ID})
4949
}
5050

5151
func TestAPIAdminDeleteMissingSSHKey(t *testing.T) {

integrations/api_keys_test.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010
"net/url"
1111
"testing"
1212

13-
"code.gitea.io/gitea/models"
13+
asymkey_model "code.gitea.io/gitea/models/asymkey"
1414
"code.gitea.io/gitea/models/perm"
1515
repo_model "code.gitea.io/gitea/models/repo"
1616
"code.gitea.io/gitea/models/unittest"
@@ -65,7 +65,7 @@ func TestCreateReadOnlyDeployKey(t *testing.T) {
6565

6666
var newDeployKey api.DeployKey
6767
DecodeJSON(t, resp, &newDeployKey)
68-
unittest.AssertExistsAndLoadBean(t, &models.DeployKey{
68+
unittest.AssertExistsAndLoadBean(t, &asymkey_model.DeployKey{
6969
ID: newDeployKey.ID,
7070
Name: rawKeyBody.Title,
7171
Content: rawKeyBody.Key,
@@ -90,7 +90,7 @@ func TestCreateReadWriteDeployKey(t *testing.T) {
9090

9191
var newDeployKey api.DeployKey
9292
DecodeJSON(t, resp, &newDeployKey)
93-
unittest.AssertExistsAndLoadBean(t, &models.DeployKey{
93+
unittest.AssertExistsAndLoadBean(t, &asymkey_model.DeployKey{
9494
ID: newDeployKey.ID,
9595
Name: rawKeyBody.Title,
9696
Content: rawKeyBody.Key,
@@ -116,7 +116,7 @@ func TestCreateUserKey(t *testing.T) {
116116

117117
var newPublicKey api.PublicKey
118118
DecodeJSON(t, resp, &newPublicKey)
119-
unittest.AssertExistsAndLoadBean(t, &models.PublicKey{
119+
unittest.AssertExistsAndLoadBean(t, &asymkey_model.PublicKey{
120120
ID: newPublicKey.ID,
121121
OwnerID: user.ID,
122122
Name: rawKeyBody.Title,

integrations/api_private_serv_test.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
"net/url"
1010
"testing"
1111

12-
"code.gitea.io/gitea/models"
12+
asymkey_model "code.gitea.io/gitea/models/asymkey"
1313
"code.gitea.io/gitea/models/perm"
1414
"code.gitea.io/gitea/modules/private"
1515

@@ -27,7 +27,7 @@ func TestAPIPrivateNoServ(t *testing.T) {
2727
assert.Equal(t, int64(1), key.ID)
2828
assert.Equal(t, "user2@localhost", key.Name)
2929

30-
deployKey, err := models.AddDeployKey(1, "test-deploy", "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGXEEzWmm1dxb+57RoK5KVCL0w2eNv9cqJX2AGGVlkFsVDhOXHzsadS3LTK4VlEbbrDMJdoti9yM8vclA8IeRacAAAAEc3NoOg== nocomment", false)
30+
deployKey, err := asymkey_model.AddDeployKey(1, "test-deploy", "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGXEEzWmm1dxb+57RoK5KVCL0w2eNv9cqJX2AGGVlkFsVDhOXHzsadS3LTK4VlEbbrDMJdoti9yM8vclA8IeRacAAAAEc3NoOg== nocomment", false)
3131
assert.NoError(t, err)
3232

3333
key, user, err = private.ServNoCommand(ctx, deployKey.KeyID)
@@ -85,7 +85,7 @@ func TestAPIPrivateServ(t *testing.T) {
8585
assert.Empty(t, results)
8686

8787
// Add reading deploy key
88-
deployKey, err := models.AddDeployKey(19, "test-deploy", "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGXEEzWmm1dxb+57RoK5KVCL0w2eNv9cqJX2AGGVlkFsVDhOXHzsadS3LTK4VlEbbrDMJdoti9yM8vclA8IeRacAAAAEc3NoOg== nocomment", true)
88+
deployKey, err := asymkey_model.AddDeployKey(19, "test-deploy", "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGXEEzWmm1dxb+57RoK5KVCL0w2eNv9cqJX2AGGVlkFsVDhOXHzsadS3LTK4VlEbbrDMJdoti9yM8vclA8IeRacAAAAEc3NoOg== nocomment", true)
8989
assert.NoError(t, err)
9090

9191
// Can pull from repo we're a deploy key for
@@ -117,7 +117,7 @@ func TestAPIPrivateServ(t *testing.T) {
117117
assert.Empty(t, results)
118118

119119
// Add writing deploy key
120-
deployKey, err = models.AddDeployKey(20, "test-deploy", "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGXEEzWmm1dxb+57RoK5KVCL0w2eNv9cqJX2AGGVlkFsVDhOXHzsadS3LTK4VlEbbrDMJdoti9yM8vclA8IeRacAAAAEc3NoOg== nocomment", false)
120+
deployKey, err = asymkey_model.AddDeployKey(20, "test-deploy", "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGXEEzWmm1dxb+57RoK5KVCL0w2eNv9cqJX2AGGVlkFsVDhOXHzsadS3LTK4VlEbbrDMJdoti9yM8vclA8IeRacAAAAEc3NoOg== nocomment", false)
121121
assert.NoError(t, err)
122122

123123
// Cannot push to a private repo with reading key

models/asymkey/error.go

+248
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
// Copyright 2021 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package asymkey
6+
7+
import "fmt"
8+
9+
// ErrKeyUnableVerify represents a "KeyUnableVerify" kind of error.
10+
type ErrKeyUnableVerify struct {
11+
Result string
12+
}
13+
14+
// IsErrKeyUnableVerify checks if an error is a ErrKeyUnableVerify.
15+
func IsErrKeyUnableVerify(err error) bool {
16+
_, ok := err.(ErrKeyUnableVerify)
17+
return ok
18+
}
19+
20+
func (err ErrKeyUnableVerify) Error() string {
21+
return fmt.Sprintf("Unable to verify key content [result: %s]", err.Result)
22+
}
23+
24+
// ErrKeyNotExist represents a "KeyNotExist" kind of error.
25+
type ErrKeyNotExist struct {
26+
ID int64
27+
}
28+
29+
// IsErrKeyNotExist checks if an error is a ErrKeyNotExist.
30+
func IsErrKeyNotExist(err error) bool {
31+
_, ok := err.(ErrKeyNotExist)
32+
return ok
33+
}
34+
35+
func (err ErrKeyNotExist) Error() string {
36+
return fmt.Sprintf("public key does not exist [id: %d]", err.ID)
37+
}
38+
39+
// ErrKeyAlreadyExist represents a "KeyAlreadyExist" kind of error.
40+
type ErrKeyAlreadyExist struct {
41+
OwnerID int64
42+
Fingerprint string
43+
Content string
44+
}
45+
46+
// IsErrKeyAlreadyExist checks if an error is a ErrKeyAlreadyExist.
47+
func IsErrKeyAlreadyExist(err error) bool {
48+
_, ok := err.(ErrKeyAlreadyExist)
49+
return ok
50+
}
51+
52+
func (err ErrKeyAlreadyExist) Error() string {
53+
return fmt.Sprintf("public key already exists [owner_id: %d, finger_print: %s, content: %s]",
54+
err.OwnerID, err.Fingerprint, err.Content)
55+
}
56+
57+
// ErrKeyNameAlreadyUsed represents a "KeyNameAlreadyUsed" kind of error.
58+
type ErrKeyNameAlreadyUsed struct {
59+
OwnerID int64
60+
Name string
61+
}
62+
63+
// IsErrKeyNameAlreadyUsed checks if an error is a ErrKeyNameAlreadyUsed.
64+
func IsErrKeyNameAlreadyUsed(err error) bool {
65+
_, ok := err.(ErrKeyNameAlreadyUsed)
66+
return ok
67+
}
68+
69+
func (err ErrKeyNameAlreadyUsed) Error() string {
70+
return fmt.Sprintf("public key already exists [owner_id: %d, name: %s]", err.OwnerID, err.Name)
71+
}
72+
73+
// ErrGPGNoEmailFound represents a "ErrGPGNoEmailFound" kind of error.
74+
type ErrGPGNoEmailFound struct {
75+
FailedEmails []string
76+
ID string
77+
}
78+
79+
// IsErrGPGNoEmailFound checks if an error is a ErrGPGNoEmailFound.
80+
func IsErrGPGNoEmailFound(err error) bool {
81+
_, ok := err.(ErrGPGNoEmailFound)
82+
return ok
83+
}
84+
85+
func (err ErrGPGNoEmailFound) Error() string {
86+
return fmt.Sprintf("none of the emails attached to the GPG key could be found: %v", err.FailedEmails)
87+
}
88+
89+
// ErrGPGInvalidTokenSignature represents a "ErrGPGInvalidTokenSignature" kind of error.
90+
type ErrGPGInvalidTokenSignature struct {
91+
Wrapped error
92+
ID string
93+
}
94+
95+
// IsErrGPGInvalidTokenSignature checks if an error is a ErrGPGInvalidTokenSignature.
96+
func IsErrGPGInvalidTokenSignature(err error) bool {
97+
_, ok := err.(ErrGPGInvalidTokenSignature)
98+
return ok
99+
}
100+
101+
func (err ErrGPGInvalidTokenSignature) Error() string {
102+
return "the provided signature does not sign the token with the provided key"
103+
}
104+
105+
// ErrGPGKeyParsing represents a "ErrGPGKeyParsing" kind of error.
106+
type ErrGPGKeyParsing struct {
107+
ParseError error
108+
}
109+
110+
// IsErrGPGKeyParsing checks if an error is a ErrGPGKeyParsing.
111+
func IsErrGPGKeyParsing(err error) bool {
112+
_, ok := err.(ErrGPGKeyParsing)
113+
return ok
114+
}
115+
116+
func (err ErrGPGKeyParsing) Error() string {
117+
return fmt.Sprintf("failed to parse gpg key %s", err.ParseError.Error())
118+
}
119+
120+
// ErrGPGKeyNotExist represents a "GPGKeyNotExist" kind of error.
121+
type ErrGPGKeyNotExist struct {
122+
ID int64
123+
}
124+
125+
// IsErrGPGKeyNotExist checks if an error is a ErrGPGKeyNotExist.
126+
func IsErrGPGKeyNotExist(err error) bool {
127+
_, ok := err.(ErrGPGKeyNotExist)
128+
return ok
129+
}
130+
131+
func (err ErrGPGKeyNotExist) Error() string {
132+
return fmt.Sprintf("public gpg key does not exist [id: %d]", err.ID)
133+
}
134+
135+
// ErrGPGKeyImportNotExist represents a "GPGKeyImportNotExist" kind of error.
136+
type ErrGPGKeyImportNotExist struct {
137+
ID string
138+
}
139+
140+
// IsErrGPGKeyImportNotExist checks if an error is a ErrGPGKeyImportNotExist.
141+
func IsErrGPGKeyImportNotExist(err error) bool {
142+
_, ok := err.(ErrGPGKeyImportNotExist)
143+
return ok
144+
}
145+
146+
func (err ErrGPGKeyImportNotExist) Error() string {
147+
return fmt.Sprintf("public gpg key import does not exist [id: %s]", err.ID)
148+
}
149+
150+
// ErrGPGKeyIDAlreadyUsed represents a "GPGKeyIDAlreadyUsed" kind of error.
151+
type ErrGPGKeyIDAlreadyUsed struct {
152+
KeyID string
153+
}
154+
155+
// IsErrGPGKeyIDAlreadyUsed checks if an error is a ErrKeyNameAlreadyUsed.
156+
func IsErrGPGKeyIDAlreadyUsed(err error) bool {
157+
_, ok := err.(ErrGPGKeyIDAlreadyUsed)
158+
return ok
159+
}
160+
161+
func (err ErrGPGKeyIDAlreadyUsed) Error() string {
162+
return fmt.Sprintf("public key already exists [key_id: %s]", err.KeyID)
163+
}
164+
165+
// ErrGPGKeyAccessDenied represents a "GPGKeyAccessDenied" kind of Error.
166+
type ErrGPGKeyAccessDenied struct {
167+
UserID int64
168+
KeyID int64
169+
}
170+
171+
// IsErrGPGKeyAccessDenied checks if an error is a ErrGPGKeyAccessDenied.
172+
func IsErrGPGKeyAccessDenied(err error) bool {
173+
_, ok := err.(ErrGPGKeyAccessDenied)
174+
return ok
175+
}
176+
177+
// Error pretty-prints an error of type ErrGPGKeyAccessDenied.
178+
func (err ErrGPGKeyAccessDenied) Error() string {
179+
return fmt.Sprintf("user does not have access to the key [user_id: %d, key_id: %d]",
180+
err.UserID, err.KeyID)
181+
}
182+
183+
// ErrKeyAccessDenied represents a "KeyAccessDenied" kind of error.
184+
type ErrKeyAccessDenied struct {
185+
UserID int64
186+
KeyID int64
187+
Note string
188+
}
189+
190+
// IsErrKeyAccessDenied checks if an error is a ErrKeyAccessDenied.
191+
func IsErrKeyAccessDenied(err error) bool {
192+
_, ok := err.(ErrKeyAccessDenied)
193+
return ok
194+
}
195+
196+
func (err ErrKeyAccessDenied) Error() string {
197+
return fmt.Sprintf("user does not have access to the key [user_id: %d, key_id: %d, note: %s]",
198+
err.UserID, err.KeyID, err.Note)
199+
}
200+
201+
// ErrDeployKeyNotExist represents a "DeployKeyNotExist" kind of error.
202+
type ErrDeployKeyNotExist struct {
203+
ID int64
204+
KeyID int64
205+
RepoID int64
206+
}
207+
208+
// IsErrDeployKeyNotExist checks if an error is a ErrDeployKeyNotExist.
209+
func IsErrDeployKeyNotExist(err error) bool {
210+
_, ok := err.(ErrDeployKeyNotExist)
211+
return ok
212+
}
213+
214+
func (err ErrDeployKeyNotExist) Error() string {
215+
return fmt.Sprintf("Deploy key does not exist [id: %d, key_id: %d, repo_id: %d]", err.ID, err.KeyID, err.RepoID)
216+
}
217+
218+
// ErrDeployKeyAlreadyExist represents a "DeployKeyAlreadyExist" kind of error.
219+
type ErrDeployKeyAlreadyExist struct {
220+
KeyID int64
221+
RepoID int64
222+
}
223+
224+
// IsErrDeployKeyAlreadyExist checks if an error is a ErrDeployKeyAlreadyExist.
225+
func IsErrDeployKeyAlreadyExist(err error) bool {
226+
_, ok := err.(ErrDeployKeyAlreadyExist)
227+
return ok
228+
}
229+
230+
func (err ErrDeployKeyAlreadyExist) Error() string {
231+
return fmt.Sprintf("public key already exists [key_id: %d, repo_id: %d]", err.KeyID, err.RepoID)
232+
}
233+
234+
// ErrDeployKeyNameAlreadyUsed represents a "DeployKeyNameAlreadyUsed" kind of error.
235+
type ErrDeployKeyNameAlreadyUsed struct {
236+
RepoID int64
237+
Name string
238+
}
239+
240+
// IsErrDeployKeyNameAlreadyUsed checks if an error is a ErrDeployKeyNameAlreadyUsed.
241+
func IsErrDeployKeyNameAlreadyUsed(err error) bool {
242+
_, ok := err.(ErrDeployKeyNameAlreadyUsed)
243+
return ok
244+
}
245+
246+
func (err ErrDeployKeyNameAlreadyUsed) Error() string {
247+
return fmt.Sprintf("public key with name already exists [repo_id: %d, name: %s]", err.RepoID, err.Name)
248+
}

0 commit comments

Comments
 (0)