fix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058)

tests/integration/api_org_test.go

@@ -121,6 +121,9 @@ func testAPIOrgGeneral(t *testing.T) {
 	user1Token := getTokenForLoggedInUser(t, user1Session, auth_model.AccessTokenScopeWriteOrganization)
 
 	t.Run("OrgGetAll", func(t *testing.T) {
+		miscToken := getTokenForLoggedInUser(t, user1Session, auth_model.AccessTokenScopeReadMisc)
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/orgs").AddTokenAuth(miscToken), http.StatusForbidden)
+
 		// accessing with a token will return all orgs
 		req := NewRequest(t, "GET", "/api/v1/orgs").AddTokenAuth(user1Token)
 		resp := MakeRequest(t, req, http.StatusOK)
@@ -130,6 +133,14 @@ func testAPIOrgGeneral(t *testing.T) {
 		assert.Equal(t, "Limited Org 36", apiOrgList[1].FullName)
 		assert.Equal(t, api.UserVisibilityLimited, apiOrgList[1].Visibility)
 
+		publicOnlyToken := getTokenForLoggedInUser(t, user1Session, auth_model.AccessTokenScopeReadOrganization, auth_model.AccessTokenScopePublicOnly)
+		resp = MakeRequest(t, NewRequest(t, "GET", "/api/v1/orgs").AddTokenAuth(publicOnlyToken), http.StatusOK)
+		apiOrgList = DecodeJSON(t, resp, []*api.Organization{})
+		assert.Len(t, apiOrgList, 9)
+		for _, org := range apiOrgList {
+			assert.Equal(t, api.UserVisibilityPublic, org.Visibility)
+		}
+
 		// accessing without a token will return only public orgs
 		req = NewRequest(t, "GET", "/api/v1/orgs")
 		resp = MakeRequest(t, req, http.StatusOK)

tests/integration/api_repo_teams_test.go

@@ -9,12 +9,14 @@ import (
 	"testing"
 
 	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/organization"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -63,6 +65,19 @@ func TestAPIRepoTeams(t *testing.T) {
 		AddTokenAuth(token)
 	MakeRequest(t, req, http.StatusForbidden)
 
+	adminTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 12})
+	targetTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2})
+	existingTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 7})
+	assert.NoError(t, repo_service.TeamAddRepository(t.Context(), adminTeam, publicOrgRepo))
+	user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
+	token = getUserToken(t, user.Name, auth_model.AccessTokenScopeWriteRepository)
+	req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), targetTeam.Name)).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+	assert.False(t, repo_service.HasRepository(t.Context(), targetTeam, publicOrgRepo.ID))
+	req = NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), existingTeam.Name)).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+	assert.True(t, repo_service.HasRepository(t.Context(), existingTeam, publicOrgRepo.ID))
+
 	// AddTeam with user2
 	user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	session = loginUser(t, user.Name)

tests/integration/api_team_test.go

@@ -329,6 +329,15 @@ func TestAPIAddRemoveTeamRepositoryRequiresOrgOwnerOrSetting(t *testing.T) {
 	req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
 	MakeRequest(t, req, http.StatusForbidden)
 	unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
+
+	siteAdmin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+	token = getUserToken(t, siteAdmin.Name, auth_model.AccessTokenScopeWriteOrganization)
+	req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusNoContent)
+	unittest.AssertNotExistsBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
+	req = NewRequest(t, "PUT", url).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusNoContent)
+	unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
 }
 
 func TestAPITeamVisibilityAccess(t *testing.T) {

tests/integration/api_user_orgs_test.go

@@ -77,6 +77,9 @@ func TestUserOrgs(t *testing.T) {
 	orgs = getUserOrgs(t, unrelatedUsername, privateMemberUsername)
 	assert.Empty(t, orgs)
 
+	orgs = getUserOrgs(t, "user29", adminUsername)
+	assert.Empty(t, orgs)
+
 	// not authenticated call should not be allowed
 	testUserOrgsUnauthenticated(t, privateMemberUsername)
 }

tests/integration/repo_home_token_scope_test.go

@@ -11,30 +11,33 @@ import (
 	"gitea.dev/tests"
 )
 
-// TestRepoHomeContentTokenScopes ensures the web repository home page enforces the
-// repository read scope (and public-only confinement) of an API token used via basic
-// auth, so a wrongly-scoped token cannot read private repository content.
-func TestRepoHomeContentTokenScopes(t *testing.T) {
+func TestRepoWebTokenScopes(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	// user2/repo2 is a private repository owned by user2
-	const url = "/user2/repo2"
-
-	// a token without repository scope must be denied
 	miscToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadMisc)
-	reqDenied := NewRequest(t, "GET", url)
-	reqDenied.SetBasicAuth("user2", miscToken)
-	MakeRequest(t, reqDenied, http.StatusForbidden)
-
-	// a public-only token must be denied on a private repo
 	publicOnlyToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
-	reqPublicOnly := NewRequest(t, "GET", url)
-	reqPublicOnly.SetBasicAuth("user2", publicOnlyToken)
-	MakeRequest(t, reqPublicOnly, http.StatusForbidden)
+	readToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
 
-	// a token with repository read scope is allowed
-	ownerReadToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
-	reqAllowed := NewRequest(t, "GET", url)
-	reqAllowed.SetBasicAuth("user2", ownerReadToken)
-	MakeRequest(t, reqAllowed, http.StatusOK)
+	for _, test := range []struct {
+		name string
+		url  string
+	}{
+		{"repository home", "/user2/repo2"},
+		{"workflow badge", "/org3/repo3/actions/workflows/test.yml/badge.svg"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			assertBasicAuthStatus(t, test.url, miscToken, http.StatusForbidden)
+			assertBasicAuthStatus(t, test.url, publicOnlyToken, http.StatusForbidden)
+			assertBasicAuthStatus(t, test.url, readToken, http.StatusOK)
+		})
+	}
+
+	assertBasicAuthStatus(t, "/user2/repo1/actions/workflows/test.yml/badge.svg", publicOnlyToken, http.StatusOK)
+}
+
+func assertBasicAuthStatus(t *testing.T, url, token string, status int) {
+	t.Helper()
+	req := NewRequest(t, http.MethodGet, url)
+	req.SetBasicAuth("user2", token)
+	MakeRequest(t, req, status)
 }