Skip to content

Commit db16f20

Browse files
kemzebwxiaoguang
kemzeb
authored and
wxiaoguang
committed
Add new CLI flags to set name and scopes when creating a user with access token (go-gitea#34080)
Resolves go-gitea#33474. --------- Co-authored-by: wxiaoguang <[email protected]> # Conflicts: # cmd/admin_user_create_test.go # routers/web/user/setting/applications.go
1 parent 8f75f61 commit db16f20

File tree

4 files changed

+125
-20
lines changed

4 files changed

+125
-20
lines changed

‎cmd/admin_user_create.go

+36-9
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"context"
88
"errors"
99
"fmt"
10+
"strings"
1011

1112
auth_model "code.gitea.io/gitea/models/auth"
1213
"code.gitea.io/gitea/models/db"
@@ -61,6 +62,16 @@ var microcmdUserCreate = &cli.Command{
6162
Name: "access-token",
6263
Usage: "Generate access token for the user",
6364
},
65+
&cli.StringFlag{
66+
Name: "access-token-name",
67+
Usage: `Name of the generated access token`,
68+
Value: "gitea-admin",
69+
},
70+
&cli.StringFlag{
71+
Name: "access-token-scopes",
72+
Usage: `Scopes of the generated access token, comma separated. Examples: "all", "public-only,read:issue", "write:repository,write:user"`,
73+
Value: "all",
74+
},
6475
&cli.BoolFlag{
6576
Name: "restricted",
6677
Usage: "Make a restricted user account",
@@ -162,23 +173,39 @@ func runCreateUser(c *cli.Context) error {
162173
IsRestricted: restricted,
163174
}
164175

165-
if err := user_model.CreateUser(ctx, u, &user_model.Meta{}, overwriteDefault); err != nil {
166-
return fmt.Errorf("CreateUser: %w", err)
176+
var accessTokenName string
177+
var accessTokenScope auth_model.AccessTokenScope
178+
if c.IsSet("access-token") {
179+
accessTokenName = strings.TrimSpace(c.String("access-token-name"))
180+
if accessTokenName == "" {
181+
return errors.New("access-token-name cannot be empty")
182+
}
183+
var err error
184+
accessTokenScope, err = auth_model.AccessTokenScope(c.String("access-token-scopes")).Normalize()
185+
if err != nil {
186+
return fmt.Errorf("invalid access token scope provided: %w", err)
187+
}
188+
if !accessTokenScope.HasPermissionScope() {
189+
return errors.New("access token does not have any permission")
190+
}
191+
} else if c.IsSet("access-token-name") || c.IsSet("access-token-scopes") {
192+
return errors.New("access-token-name and access-token-scopes flags are only valid when access-token flag is set")
167193
}
168194

169-
if c.Bool("access-token") {
170-
t := &auth_model.AccessToken{
171-
Name: "gitea-admin",
172-
UID: u.ID,
173-
}
195+
// arguments should be prepared before creating the user & access token, in case there is anything wrong
174196

197+
// create the user
198+
if err := user_model.CreateUser(ctx, u, &user_model.Meta{}, overwriteDefault); err != nil {
199+
return fmt.Errorf("CreateUser: %w", err)
200+
}
201+
// create the access token
202+
if accessTokenScope != "" {
203+
t := &auth_model.AccessToken{Name: accessTokenName, UID: u.ID, Scope: accessTokenScope}
175204
if err := auth_model.NewAccessToken(ctx, t); err != nil {
176205
return err
177206
}
178-
179207
fmt.Printf("Access token was successfully created... %s\n", t.Token)
180208
}
181-
182209
fmt.Printf("New user '%s' has been successfully created!\n", username)
183210
return nil
184211
}

‎cmd/admin_user_create_test.go

+79-8
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"strings"
99
"testing"
1010

11+
auth_model "code.gitea.io/gitea/models/auth"
1112
"code.gitea.io/gitea/models/db"
1213
"code.gitea.io/gitea/models/unittest"
1314
user_model "code.gitea.io/gitea/models/user"
@@ -19,8 +20,9 @@ func TestAdminUserCreate(t *testing.T) {
1920
app := NewMainApp(AppVersion{})
2021

2122
reset := func() {
22-
assert.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.User{}))
23-
assert.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.EmailAddress{}))
23+
require.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.User{}))
24+
require.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.EmailAddress{}))
25+
require.NoError(t, db.TruncateBeans(db.DefaultContext, &auth_model.AccessToken{}))
2426
}
2527

2628
type createCheck struct{ IsAdmin, MustChangePassword bool }
@@ -35,10 +37,79 @@ func TestAdminUserCreate(t *testing.T) {
3537
reset()
3638
assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: false}, createUser("u", "--admin"), "first admin user doesn't need to change password")
3739

38-
reset()
39-
assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: true}, createUser("u", "--admin --must-change-password"))
40-
assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: true}, createUser("u2", "--admin"))
41-
assert.Equal(t, createCheck{IsAdmin: true, MustChangePassword: false}, createUser("u3", "--admin --must-change-password=false"))
42-
assert.Equal(t, createCheck{IsAdmin: false, MustChangePassword: true}, createUser("u4", ""))
43-
assert.Equal(t, createCheck{IsAdmin: false, MustChangePassword: false}, createUser("u5", "--must-change-password=false"))
40+
reset()
41+
assert.Equal(t, check{IsAdmin: true, MustChangePassword: true}, createCheck("u", "--admin --must-change-password"))
42+
assert.Equal(t, check{IsAdmin: true, MustChangePassword: true}, createCheck("u2", "--admin"))
43+
assert.Equal(t, check{IsAdmin: true, MustChangePassword: false}, createCheck("u3", "--admin --must-change-password=false"))
44+
assert.Equal(t, check{IsAdmin: false, MustChangePassword: true}, createCheck("u4", ""))
45+
assert.Equal(t, check{IsAdmin: false, MustChangePassword: false}, createCheck("u5", "--must-change-password=false"))
46+
})
47+
48+
createUser := func(name, args string) error {
49+
return app.Run(strings.Fields(fmt.Sprintf("./gitea admin user create --username %s --email %[email protected] %s", name, name, args)))
50+
}
51+
52+
t.Run("UserType", func(t *testing.T) {
53+
reset()
54+
assert.ErrorContains(t, createUser("u", "--user-type invalid"), "invalid user type")
55+
assert.ErrorContains(t, createUser("u", "--user-type bot --password 123"), "can only be set for individual users")
56+
assert.ErrorContains(t, createUser("u", "--user-type bot --must-change-password"), "can only be set for individual users")
57+
58+
assert.NoError(t, createUser("u", "--user-type bot"))
59+
u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "u"})
60+
assert.Equal(t, user_model.UserTypeBot, u.Type)
61+
assert.Empty(t, u.Passwd)
62+
})
63+
64+
t.Run("AccessToken", func(t *testing.T) {
65+
// no generated access token
66+
reset()
67+
assert.NoError(t, createUser("u", "--random-password"))
68+
assert.Equal(t, 1, unittest.GetCount(t, &user_model.User{}))
69+
assert.Equal(t, 0, unittest.GetCount(t, &auth_model.AccessToken{}))
70+
71+
// using "--access-token" only means "all" access
72+
reset()
73+
assert.NoError(t, createUser("u", "--random-password --access-token"))
74+
assert.Equal(t, 1, unittest.GetCount(t, &user_model.User{}))
75+
assert.Equal(t, 1, unittest.GetCount(t, &auth_model.AccessToken{}))
76+
accessToken := unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{Name: "gitea-admin"})
77+
hasScopes, err := accessToken.Scope.HasScope(auth_model.AccessTokenScopeWriteAdmin, auth_model.AccessTokenScopeWriteRepository)
78+
assert.NoError(t, err)
79+
assert.True(t, hasScopes)
80+
81+
// using "--access-token" with name & scopes
82+
reset()
83+
assert.NoError(t, createUser("u", "--random-password --access-token --access-token-name new-token-name --access-token-scopes read:issue,read:user"))
84+
assert.Equal(t, 1, unittest.GetCount(t, &user_model.User{}))
85+
assert.Equal(t, 1, unittest.GetCount(t, &auth_model.AccessToken{}))
86+
accessToken = unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{Name: "new-token-name"})
87+
hasScopes, err = accessToken.Scope.HasScope(auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopeReadUser)
88+
assert.NoError(t, err)
89+
assert.True(t, hasScopes)
90+
hasScopes, err = accessToken.Scope.HasScope(auth_model.AccessTokenScopeWriteAdmin, auth_model.AccessTokenScopeWriteRepository)
91+
assert.NoError(t, err)
92+
assert.False(t, hasScopes)
93+
94+
// using "--access-token-name" without "--access-token"
95+
reset()
96+
err = createUser("u", "--random-password --access-token-name new-token-name")
97+
assert.Equal(t, 0, unittest.GetCount(t, &user_model.User{}))
98+
assert.Equal(t, 0, unittest.GetCount(t, &auth_model.AccessToken{}))
99+
assert.ErrorContains(t, err, "access-token-name and access-token-scopes flags are only valid when access-token flag is set")
100+
101+
// using "--access-token-scopes" without "--access-token"
102+
reset()
103+
err = createUser("u", "--random-password --access-token-scopes read:issue")
104+
assert.Equal(t, 0, unittest.GetCount(t, &user_model.User{}))
105+
assert.Equal(t, 0, unittest.GetCount(t, &auth_model.AccessToken{}))
106+
assert.ErrorContains(t, err, "access-token-name and access-token-scopes flags are only valid when access-token flag is set")
107+
108+
// empty permission
109+
reset()
110+
err = createUser("u", "--random-password --access-token --access-token-scopes public-only")
111+
assert.Equal(t, 0, unittest.GetCount(t, &user_model.User{}))
112+
assert.Equal(t, 0, unittest.GetCount(t, &auth_model.AccessToken{}))
113+
assert.ErrorContains(t, err, "access token does not have any permission")
114+
})
44115
}

‎cmd/admin_user_generate_access_token.go

+6-3
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,16 @@ var microcmdUserGenerateAccessToken = &cli.Command{
3434
},
3535
&cli.StringFlag{
3636
Name: "scopes",
37-
Value: "",
38-
Usage: "Comma separated list of scopes to apply to access token",
37+
Value: "all",
38+
Usage: `Comma separated list of scopes to apply to access token, examples: "all", "public-only,read:issue", "write:repository,write:user"`,
3939
},
4040
},
4141
Action: runGenerateAccessToken,
4242
}
4343

4444
func runGenerateAccessToken(c *cli.Context) error {
4545
if !c.IsSet("username") {
46-
return errors.New("You must provide a username to generate a token for")
46+
return errors.New("you must provide a username to generate a token for")
4747
}
4848

4949
ctx, cancel := installSignals()
@@ -77,6 +77,9 @@ func runGenerateAccessToken(c *cli.Context) error {
7777
if err != nil {
7878
return fmt.Errorf("invalid access token scope provided: %w", err)
7979
}
80+
if !accessTokenScope.HasPermissionScope() {
81+
return errors.New("access token does not have any permission")
82+
}
8083
t.Scope = accessTokenScope
8184

8285
// create the token

‎models/auth/access_token_scope.go

+4
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,10 @@ func (s AccessTokenScope) Normalize() (AccessTokenScope, error) {
283283
return bitmap.toScope(), nil
284284
}
285285

286+
func (s AccessTokenScope) HasPermissionScope() bool {
287+
return s != "" && s != AccessTokenScopePublicOnly
288+
}
289+
286290
// PublicOnly checks if this token scope is limited to public resources
287291
func (s AccessTokenScope) PublicOnly() (bool, error) {
288292
bitmap, err := s.parse()

0 commit comments

Comments
 (0)