feat: add deploy tokens (#37306)

Deploy keys only work over SSH. A deploy token is their counterpart for HTTPS: a repository scoped credential, used as the password of a Git request, with read or read and write access. It covers Git operations and LFS, and can be regenerated in place. Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude Mythos <noreply@anthropic.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-08-28 15:45:41 +00:00 · 2026-08-27 03:32:44 +08:00
parent 3c4d5a6a5c
commit 646ea0f253
76 changed files with 1594 additions and 831 deletions
@@ -0,0 +1,76 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	deploykey_model "gitea.dev/models/deploykey"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	lfs_module "gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDeployTokenGitHTTP(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// need to disable agit, otherwise the "write" permission check is skipped at pre-receive (git-receive-pack) step
+	defer test.MockVariableValue(&git.DefaultFeatures().SupportProcReceive, false)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+	otherRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+	readKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "read", perm.AccessModeRead)
+	require.NoError(t, err)
+	writeKey, err := deploykey_model.AddDeployKeyToken(t.Context(), repo.ID, "write", perm.AccessModeWrite)
+	require.NoError(t, err)
+
+	requestAs := func(t *testing.T, token, path string, expected int) {
+		MakeRequest(t, NewRequest(t, "GET", path).AddBasicAuth("deploy-token", token), expected)
+	}
+
+	t.Run("Clone", func(t *testing.T) {
+		requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusOK)
+	})
+	t.Run("PushWithReadToken", func(t *testing.T) {
+		requestAs(t, readKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusNotFound)
+	})
+	t.Run("PushWithWriteToken", func(t *testing.T) {
+		requestAs(t, writeKey.Token, "/"+repo.FullName()+"/info/refs?service=git-receive-pack", http.StatusOK)
+	})
+	t.Run("OtherRepo", func(t *testing.T) {
+		requestAs(t, readKey.Token, "/"+otherRepo.FullName()+"/info/refs?service=git-upload-pack", http.StatusNotFound)
+	})
+	t.Run("UnknownToken", func(t *testing.T) {
+		requestAs(t, deploykey_model.DeployTokenPrefix+"0123456789abcdef", "/"+repo.FullName()+"/info/refs?service=git-upload-pack", http.StatusUnauthorized)
+	})
+	t.Run("RejectedOutsideGitHTTP", func(t *testing.T) {
+		// the owner of the repo would be able to read it, the token must not act as that owner
+		requestAs(t, readKey.Token, "/api/v1/repos/"+repo.FullName(), http.StatusUnauthorized)
+	})
+
+	t.Run("LFS", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.LFS.StartServer, true)()
+
+		batchAs := func(t *testing.T, token, repoName, operation string, expected int) {
+			req := NewRequestWithJSON(t, "POST", "/"+repoName+"/info/lfs/objects/batch", lfs_module.BatchRequest{Operation: operation}).
+				AddBasicAuth("deploy-token", token).
+				SetHeader("Accept", lfs_module.AcceptHeader).
+				SetHeader("Content-Type", lfs_module.MediaType)
+			MakeRequest(t, req, expected)
+		}
+
+		batchAs(t, readKey.Token, repo.FullName(), "download", http.StatusOK)
+		batchAs(t, readKey.Token, repo.FullName(), "upload", http.StatusUnauthorized)
+		batchAs(t, writeKey.Token, repo.FullName(), "upload", http.StatusOK)
+		batchAs(t, readKey.Token, otherRepo.FullName(), "download", http.StatusUnauthorized)
+	})
+}