You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* upstream/main: (26 commits)
Clean up WebAuthn javascript code and remove JQuery code (go-gitea#22697)
Enable all webpack sourcemaps in dev build, disable all in prod build (go-gitea#25089)
Don't display `select all issues` checkbox when no issues are available (go-gitea#25086)
change placeholders in actions docs
change placeholders in actions docs
fix "Remove stars when repo goes private go-gitea#19904" (go-gitea#25084)
Introduce how to configure cache when starting a Runner with Docker (go-gitea#25077)
Remove stars when repo goes private (go-gitea#19904)
Use correct selector for hiding RSS icon link in the branch selector dropdown (go-gitea#25080)
Fix parallelly generating index failure with Mysql (go-gitea#24567)
Use git command instead of the ini package to remove the `origin` remote (go-gitea#25066)
improve permission documentation (go-gitea#23942)
Use RepositoryList instead of []*Repository (go-gitea#25074)
Add ability to set multiple redirect URIs in OAuth application UI (go-gitea#25072)
Add Progressbar to Milestone Page (go-gitea#25050)
[skip ci] Updated licenses and gitignores
Redesign Scoped Access Tokens (go-gitea#24767)
Use a separate admin page to show global stats, remove `actions` stat (go-gitea#25062)
Remove cancel button from branch protection form (go-gitea#25063)
Allow for PKCE flow without client secret + add docs (go-gitea#25033)
...
To use the Authorization Code Grant as a third party application it is required to register a new application via the "Settings" (`/user/settings/applications`) section of the settings.
43
+
To use the Authorization Code Grant as a third party application it is required to register a new application via the "Settings" (`/user/settings/applications`) section of the settings. To test or debug you can use the web-tool https://oauthdebugger.com/.
44
44
45
45
## Scopes
46
46
47
-
Gitea supports the following scopes for tokens:
48
-
49
-
| Name | Description |
50
-
| ---- | ----------- |
51
-
|**(no scope)**| Grants read-only access to public user profile and public repositories. |
52
-
|**repo**| Full control over all repositories. |
53
-
| **repo:status**| Grants read/write access to commit status in all repositories. |
54
-
| **public_repo**| Grants read/write access to public repositories only. |
55
-
|**admin:repo_hook**| Grants access to repository hooks of all repositories. This is included in the `repo` scope. |
56
-
| **write:repo_hook**| Grants read/write access to repository hooks |
57
-
| **read:repo_hook**| Grants read-only access to repository hooks |
58
-
|**admin:org**| Grants full access to organization settings |
59
-
| **write:org**| Grants read/write access to organization settings |
60
-
| **read:org**| Grants read-only access to organization settings |
61
-
|**admin:public_key**| Grants full access for managing public keys |
62
-
| **write:public_key**| Grant read/write access to public keys |
63
-
| **read:public_key**| Grant read-only access to public keys |
64
-
|**admin:org_hook**| Grants full access to organizational-level hooks |
65
-
|**admin:user_hook**| Grants full access to user-level hooks |
66
-
|**notification**| Grants full access to notifications |
67
-
|**user**| Grants full access to user profile info |
68
-
| **read:user**| Grants read access to user's profile |
69
-
| **user:email**| Grants read access to user's email addresses |
70
-
| **user:follow**| Grants access to follow/un-follow a user |
71
-
|**delete_repo**| Grants access to delete repositories as an admin |
72
-
|**package**| Grants full access to hosted packages |
73
-
| **write:package**| Grants read/write access to packages |
74
-
| **read:package**| Grants read access to packages |
75
-
| **delete:package**| Grants delete access to packages |
76
-
|**admin:gpg_key**| Grants full access for managing GPG keys |
77
-
| **write:gpg_key**| Grants read/write access to GPG keys |
78
-
| **read:gpg_key**| Grants read-only access to GPG keys |
79
-
|**admin:application**| Grants full access to manage applications |
80
-
| **write:application**| Grants read/write access for managing applications |
81
-
| **read:application**| Grants read access for managing applications |
82
-
|**sudo**| Allows to perform actions as the site admin. |
47
+
Gitea supports scoped access tokens, which allow users the ability to restrict tokens to operate only on selected url routes. Scopes are grouped by high-level API routes, and further refined to the following:
48
+
49
+
-`read`: `GET` routes
50
+
-`write`: `POST`, `PUT`, `PATCH`, and `DELETE` routes (in addition to `GET`)
|**(no scope)**| Not supported. A scope is required even for public repositories. |
57
+
|**activitypub**|`activitypub` API routes: ActivityPub related operations. |
58
+
| **read:activitypub**| Grants read access for ActivityPub operations. |
59
+
| **write:activitypub**| Grants read/write/delete access for ActivityPub operations. |
60
+
|**admin**|`/admin/*` API routes: Site-wide administrative operations (hidden for non-admin accounts). |
61
+
| **read:admin**| Grants read access for admin operations, such as getting cron jobs or registered user emails. |
62
+
| **write:admin**| Grants read/write/delete access for admin operations, such as running cron jobs or updating user accounts. ||
63
+
|**issue**|`issues/*`, `labels/*`, `milestones/*` API routes: Issue-related operations. |
64
+
| **read:issue**| Grants read access for issues operations, such as getting issue comments, issue attachments, and milestones. |
65
+
| **write:issue**| Grants read/write/delete access for issues operations, such as posting or editing an issue comment or attachment, and updating milestones. |
66
+
|**misc**| miscellaneous and settings top-level API routes. |
67
+
| **read:misc**| Grants read access to miscellaneous operations, such as getting label and gitignore templates. |
68
+
| **write:misc**| Grants read/write/delete access to miscellaneous operations, such as markup utility operations. |
69
+
|**notification**|`notification/*` API routes: user notification operations. |
70
+
| **read:notification**| Grants read access to user notifications, such as which notifications users are subscribed to and read new notifications. |
71
+
| **write:notification**| Grants read/write/delete access to user notifications, such as marking notifications as read. |
72
+
|**organization**|`orgs/*` and `teams/*` API routes: Organization and team management operations. |
73
+
| **read:organization**| Grants read access to org and team status, such as listing all orgs a user has visibility to, teams, and team members. |
74
+
| **write:organization**| Grants read/write/delete access to org and team status, such as creating and updating teams and updating org settings. |
75
+
|**package**|`/packages/*` API routes: Packages operations |
76
+
| **read:package**| Grants read access to package operations, such as reading and downloading available packages. |
77
+
| **write:package**| Grants read/write/delete access to package operations. Currently the same as `read:package`. |
78
+
|**repository**|`/repos/*` API routes except `/repos/issues/*`: Repository file, pull-request, and release operations. |
79
+
| **read:repository**| Grants read access to repository operations, such as getting repository files, releases, collaborators. |
80
+
| **write:repository**| Grants read/write/delete access to repository operations, such as getting updating repository files, creating pull requests, updating collaborators. |
81
+
|**user**|`/user/*` and `/users/*` API routes: User-related operations. |
82
+
| **read:user**| Grants read access to user operations, such as getting user repo subscriptions and user settings. |
83
+
| **write:user**| Grants read/write/delete access to user operations, such as updating user repo subscriptions, followed users, and user settings. |
83
84
84
85
## Client types
85
86
86
87
Gitea supports both confidential and public client types, [as defined by RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1).
87
88
88
89
For public clients, a redirect URI of a loopback IP address such as `http://127.0.0.1/` allows any port. Avoid using `localhost`, [as recommended by RFC 8252](https://datatracker.ietf.org/doc/html/rfc8252#section-8.3).
89
90
90
-
## Example
91
+
## Examples
92
+
93
+
### Confidential client
91
94
92
95
**Note:** This example does not use PKCE.
93
96
94
-
1. Redirect to user to the authorization endpoint in order to get their consent for accessing the resources:
97
+
1. Redirect the user to the authorization endpoint in order to get their consent for accessing the resources:
The `CLIENT_ID` can be obtained by registering an application in the settings. The `STATE` is a random string that will be send back to your application after the user authorizes. The `state` parameter is optional but should be used to prevent CSRF attacks.
103
+
The `CLIENT_ID` can be obtained by registering an application in the settings. The `STATE` is a random string that will be sent back to your application after the user authorizes. The `state` parameter is optional, but should be used to prevent CSRF attacks.
101
104
102
105
103
106
@@ -107,7 +110,7 @@ For public clients, a redirect URI of a loopback IP address such as `http://127.
2. Using the provided `code` from the redirect, you can request a new application and refresh token. The access token endpoints accepts POST requests with `application/json` and `application/x-www-form-urlencoded` body, for example:
113
+
2. Using the provided `code` from the redirect, you can request a new application and refresh token. The access token endpoint accepts POST requests with `application/json` and `application/x-www-form-urlencoded` body, for example:
111
114
112
115
```curl
113
116
POST https://[YOUR-GITEA-URL]/login/oauth/access_token
@@ -134,7 +137,69 @@ For public clients, a redirect URI of a loopback IP address such as `http://127.
134
137
}
135
138
```
136
139
137
-
The `CLIENT_SECRET` is the unique secret code generated for this application. Please note that the secret will only be visible after you created/registered the application with Gitea and cannot be recovered. If you lose the secret you must regenerate the secret via the application's settings.
140
+
The `CLIENT_SECRET` is the unique secret code generated for this application. Please note that the secret will only be visible after you created/registered the application with Gitea and cannot be recovered. If you lose the secret, you must regenerate the secret via the application's settings.
141
+
142
+
The `REDIRECT_URI` in the `access_token` request must match the `REDIRECT_URI` in the `authorize` request.
143
+
144
+
3. Use the `access_token` to make [API requests](https://docs.gitea.io/en-us/api-usage#oauth2) to access the user's resources.
145
+
146
+
### Public client (PKCE)
147
+
148
+
PKCE (Proof Key for Code Exchange) is an extension to the OAuth flow which allows for a secure credential exchange without the requirement to provide a client secret.
149
+
150
+
**Note**: Please ensure you have registered your OAuth application as a public client.
151
+
152
+
To achieve this, you have to provide a `code_verifier` for every authorization request. A `code_verifier` has to be a random string with a minimum length of 43 characters and a maximum length of 128 characters. It can contain alphanumeric characters as well as the characters `-`, `.`, `_` and `~`.
153
+
154
+
Using this `code_verifier` string, a new one called `code_challenge` is created by using one of two methods:
155
+
156
+
- If you have the required functionality on your client, set `code_challenge` to be a URL-safe base64-encoded string of the SHA256 hash of `code_verifier`. In that case, your `code_challenge_method` becomes `S256`.
157
+
- If you are unable to do so, you can provide your `code_verifier` as a plain string to `code_challenge`. Then you have to set your `code_challenge_method` as `plain`.
158
+
159
+
After you have generated this values, you can continue with your request.
160
+
161
+
1. Redirect the user to the authorization endpoint in order to get their consent for accessing the resources:
The `CLIENT_ID` can be obtained by registering an application in the settings. The `STATE` is a random string that will be sent back to your application after the user authorizes. The `state` parameter is optional, but should be used to prevent CSRF attacks.
168
+
169
+
170
+
171
+
The user will now be asked to authorize your application. If they authorize it, the user will be redirected to the `REDIRECT_URL`, for example:
2. Using the provided `code` from the redirect, you can request a new application and refresh token. The access token endpoint accepts POST requests with `application/json` and `application/x-www-form-urlencoded` body, for example:
178
+
179
+
```curl
180
+
POST https://[YOUR-GITEA-URL]/login/oauth/access_token
Copy file name to clipboardexpand all lines: docs/content/doc/installation/from-source.en-us.md
+2
Original file line number
Diff line number
Diff line change
@@ -132,6 +132,8 @@ If pre-built frontend files are present it is possible to only build the backend
132
132
TAGS="bindata" make backend
133
133
```
134
134
135
+
Webpack source maps are by default enabled in development builds and disabled in production builds. They can be enabled by setting the `ENABLE_SOURCEMAP=true` environment variable.
136
+
135
137
## Test
136
138
137
139
After following the steps above, a `gitea` binary will be available in the working directory.
0 commit comments