Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove "misc" scope check from public API endpoints (#26134) #26149

Merged
merged 2 commits into from
Jul 26, 2023
Merged

Remove "misc" scope check from public API endpoints (#26134) #26149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
72fa26f
Remove "misc" scope check from public API endpoints (#26134)
wxiaoguang Jul 26, 2023
10d3f76
Merge branch 'release/v1.20' into backport-26134-v1.20
GiteaBot Jul 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 30 additions & 30 deletions docs/content/development/oauth2-provider.en-us.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,36 +47,36 @@ Gitea supports scoped access tokens, which allow users the ability to restrict t

Gitea token scopes are as follows:

| Name | Description |
| ---- |--------------------------------------------------------------------------------------------------------------------------------------------------|
| **(no scope)** | Not supported. A scope is required even for public repositories. |
| **activitypub** | `activitypub` API routes: ActivityPub related operations. |
|     **read:activitypub** | Grants read access for ActivityPub operations. |
|     **write:activitypub** | Grants read/write/delete access for ActivityPub operations. |
| **admin** | `/admin/*` API routes: Site-wide administrative operations (hidden for non-admin accounts). |
|     **read:admin** | Grants read access for admin operations, such as getting cron jobs or registered user emails. |
|     **write:admin** | Grants read/write/delete access for admin operations, such as running cron jobs or updating user accounts. | |
| **issue** | `issues/*`, `labels/*`, `milestones/*` API routes: Issue-related operations. |
|     **read:issue** | Grants read access for issues operations, such as getting issue comments, issue attachments, and milestones. |
|     **write:issue** | Grants read/write/delete access for issues operations, such as posting or editing an issue comment or attachment, and updating milestones. |
| **misc** | miscellaneous and settings top-level API routes. |
|     **read:misc** | Grants read access to miscellaneous operations, such as getting label and gitignore templates. |
|     **write:misc** | Grants read/write/delete access to miscellaneous operations, such as markup utility operations. |
| **notification** | `notification/*` API routes: user notification operations. |
|     **read:notification** | Grants read access to user notifications, such as which notifications users are subscribed to and read new notifications. |
|     **write:notification** | Grants read/write/delete access to user notifications, such as marking notifications as read. |
| **organization** | `orgs/*` and `teams/*` API routes: Organization and team management operations. |
|     **read:organization** | Grants read access to org and team status, such as listing all orgs a user has visibility to, teams, and team members. |
|     **write:organization** | Grants read/write/delete access to org and team status, such as creating and updating teams and updating org settings. |
| **package** | `/packages/*` API routes: Packages operations |
|     **read:package** | Grants read access to package operations, such as reading and downloading available packages. |
|     **write:package** | Grants read/write/delete access to package operations. Currently the same as `read:package`. |
| **repository** | `/repos/*` API routes except `/repos/issues/*`: Repository file, pull-request, and release operations. |
|     **read:repository** | Grants read access to repository operations, such as getting repository files, releases, collaborators. |
|     **write:repository** | Grants read/write/delete access to repository operations, such as getting updating repository files, creating pull requests, updating collaborators. |
| **user** | `/user/*` and `/users/*` API routes: User-related operations. |
|     **read:user** | Grants read access to user operations, such as getting user repo subscriptions and user settings. |
|     **write:user** | Grants read/write/delete access to user operations, such as updating user repo subscriptions, followed users, and user settings. |
| Name | Description |
| ---- |------------------------------------------------------------------------------------------------------------------------------------------------------|
| **(no scope)** | Not supported. A scope is required even for public repositories. |
| **activitypub** | `activitypub` API routes: ActivityPub related operations. |
|     **read:activitypub** | Grants read access for ActivityPub operations. |
|     **write:activitypub** | Grants read/write/delete access for ActivityPub operations. |
| **admin** | `/admin/*` API routes: Site-wide administrative operations (hidden for non-admin accounts). |
|     **read:admin** | Grants read access for admin operations, such as getting cron jobs or registered user emails. |
|     **write:admin** | Grants read/write/delete access for admin operations, such as running cron jobs or updating user accounts. |
| **issue** | `issues/*`, `labels/*`, `milestones/*` API routes: Issue-related operations. |
|     **read:issue** | Grants read access for issues operations, such as getting issue comments, issue attachments, and milestones. |
|     **write:issue** | Grants read/write/delete access for issues operations, such as posting or editing an issue comment or attachment, and updating milestones. |
| **misc** | Reserved for future usage. |
|     **read:misc** | Reserved for future usage. |
|     **write:misc** | Reserved for future usage. |
| **notification** | `notification/*` API routes: user notification operations. |
|     **read:notification** | Grants read access to user notifications, such as which notifications users are subscribed to and read new notifications. |
|     **write:notification** | Grants read/write/delete access to user notifications, such as marking notifications as read. |
| **organization** | `orgs/*` and `teams/*` API routes: Organization and team management operations. |
|     **read:organization** | Grants read access to org and team status, such as listing all orgs a user has visibility to, teams, and team members. |
|     **write:organization** | Grants read/write/delete access to org and team status, such as creating and updating teams and updating org settings. |
| **package** | `/packages/*` API routes: Packages operations |
|     **read:package** | Grants read access to package operations, such as reading and downloading available packages. |
|     **write:package** | Grants read/write/delete access to package operations. Currently the same as `read:package`. |
| **repository** | `/repos/*` API routes except `/repos/issues/*`: Repository file, pull-request, and release operations. |
|     **read:repository** | Grants read access to repository operations, such as getting repository files, releases, collaborators. |
|     **write:repository** | Grants read/write/delete access to repository operations, such as getting updating repository files, creating pull requests, updating collaborators. |
| **user** | `/user/*` and `/users/*` API routes: User-related operations. |
|     **read:user** | Grants read access to user operations, such as getting user repo subscriptions and user settings. |
|     **write:user** | Grants read/write/delete access to user operations, such as updating user repo subscriptions, followed users, and user settings. |

## Client types

Expand Down
2 changes: 1 addition & 1 deletion models/auth/token_scope.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ type AccessTokenScopeCategory int
const (
AccessTokenScopeCategoryActivityPub = iota
AccessTokenScopeCategoryAdmin
AccessTokenScopeCategoryMisc
AccessTokenScopeCategoryMisc // WARN: this is now just a placeholder, don't remove it which will change the following values
AccessTokenScopeCategoryNotification
AccessTokenScopeCategoryOrganization
AccessTokenScopeCategoryPackage
Expand Down
4 changes: 2 additions & 2 deletions routers/api/v1/api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -757,7 +757,7 @@ func Routes(ctx gocontext.Context) *web.Route {
}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryActivityPub))
}

// Misc (requires 'misc' scope)
// Misc (public accessible)
m.Group("", func() {
m.Get("/version", misc.Version)
m.Get("/signing-key.gpg", misc.SigningKey)
Expand All @@ -777,7 +777,7 @@ func Routes(ctx gocontext.Context) *web.Route {
m.Get("/attachment", settings.GetGeneralAttachmentSettings)
m.Get("/repository", settings.GetGeneralRepoSettings)
})
}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryMisc))
})

// Notifications (requires 'notifications' scope)
m.Group("/notifications", func() {
Expand Down
30 changes: 0 additions & 30 deletions tests/integration/api_token_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,26 +141,6 @@ func TestAPIDeniesPermissionBasedOnTokenScope(t *testing.T) {
},
},
},
{
"/api/v1/markdown",
"POST",
[]permission{
{
auth_model.AccessTokenScopeCategoryMisc,
auth_model.Write,
},
},
},
{
"/api/v1/markdown/raw",
"POST",
[]permission{
{
auth_model.AccessTokenScopeCategoryMisc,
auth_model.Write,
},
},
},
{
"/api/v1/notifications",
"GET",
Expand Down Expand Up @@ -347,16 +327,6 @@ func TestAPIDeniesPermissionBasedOnTokenScope(t *testing.T) {
},
},
},
{
"/api/v1/settings/api",
"GET",
[]permission{
{
auth_model.AccessTokenScopeCategoryMisc,
auth_model.Read,
},
},
},
{
"/api/v1/user",
"GET",
Expand Down