mirror of
https://github.com/go-gitea/gitea.git
synced 2026-09-20 13:16:09 +00:00
Joe (Agent) Stump
3bec08f998
Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.
1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
196 lines
9.3 KiB
Go
196 lines
9.3 KiB
Go
// Copyright 2024 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package user
|
|
|
|
import (
|
|
"testing"
|
|
|
|
audit_model "gitea.dev/models/audit"
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
password_module "gitea.dev/modules/auth/password"
|
|
"gitea.dev/modules/optional"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/structs"
|
|
"gitea.dev/modules/test"
|
|
"gitea.dev/modules/util"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestUpdateUser(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
|
|
|
|
assert.Error(t, UpdateUser(t.Context(), admin, &UpdateOptions{
|
|
IsAdmin: UpdateOptionFieldFromValue(false),
|
|
}))
|
|
|
|
assert.NoError(t, UpdateUser(t.Context(), admin, &UpdateOptions{
|
|
IsAdmin: UpdateOptionFieldFromSync(false),
|
|
}))
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
|
|
|
|
opts := &UpdateOptions{
|
|
KeepEmailPrivate: optional.Some(false),
|
|
FullName: optional.Some("Changed Name"),
|
|
Website: optional.Some("https://gitea.com/"),
|
|
Location: optional.Some("location"),
|
|
Description: optional.Some("description"),
|
|
AllowGitHook: optional.Some(true),
|
|
AllowImportLocal: optional.Some(true),
|
|
MaxRepoCreation: optional.Some(10),
|
|
IsRestricted: optional.Some(true),
|
|
IsActive: optional.Some(false),
|
|
IsAdmin: UpdateOptionFieldFromValue(true),
|
|
Visibility: optional.Some(structs.VisibleTypePrivate),
|
|
KeepActivityPrivate: optional.Some(true),
|
|
Language: optional.Some("lang"),
|
|
Theme: optional.Some("theme"),
|
|
DiffViewStyle: optional.Some("split"),
|
|
AllowCreateOrganization: optional.Some(false),
|
|
EmailNotificationsPreference: optional.Some("disabled"),
|
|
SetLastLogin: true,
|
|
}
|
|
assert.NoError(t, UpdateUser(t.Context(), user, opts))
|
|
|
|
assert.Equal(t, opts.KeepEmailPrivate.Value(), user.KeepEmailPrivate)
|
|
assert.Equal(t, opts.FullName.Value(), user.FullName)
|
|
assert.Equal(t, opts.Website.Value(), user.Website)
|
|
assert.Equal(t, opts.Location.Value(), user.Location)
|
|
assert.Equal(t, opts.Description.Value(), user.Description)
|
|
assert.Equal(t, opts.AllowGitHook.Value(), user.AllowGitHook)
|
|
assert.Equal(t, opts.AllowImportLocal.Value(), user.AllowImportLocal)
|
|
assert.Equal(t, opts.MaxRepoCreation.Value(), user.MaxRepoCreation)
|
|
assert.Equal(t, opts.IsRestricted.Value(), user.IsRestricted)
|
|
assert.Equal(t, opts.IsActive.Value(), user.IsActive)
|
|
assert.Equal(t, opts.IsAdmin.Value().FieldValue, user.IsAdmin)
|
|
assert.Equal(t, opts.Visibility.Value(), user.Visibility)
|
|
assert.Equal(t, opts.KeepActivityPrivate.Value(), user.KeepActivityPrivate)
|
|
assert.Equal(t, opts.Language.Value(), user.Language)
|
|
assert.Equal(t, opts.Theme.Value(), user.Theme)
|
|
assert.Equal(t, opts.DiffViewStyle.Value(), user.DiffViewStyle)
|
|
assert.Equal(t, opts.AllowCreateOrganization.Value(), user.AllowCreateOrganization)
|
|
assert.Equal(t, opts.EmailNotificationsPreference.Value(), user.EmailNotificationsPreference)
|
|
|
|
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
|
|
assert.Equal(t, opts.KeepEmailPrivate.Value(), user.KeepEmailPrivate)
|
|
assert.Equal(t, opts.FullName.Value(), user.FullName)
|
|
assert.Equal(t, opts.Website.Value(), user.Website)
|
|
assert.Equal(t, opts.Location.Value(), user.Location)
|
|
assert.Equal(t, opts.Description.Value(), user.Description)
|
|
assert.Equal(t, opts.AllowGitHook.Value(), user.AllowGitHook)
|
|
assert.Equal(t, opts.AllowImportLocal.Value(), user.AllowImportLocal)
|
|
assert.Equal(t, opts.MaxRepoCreation.Value(), user.MaxRepoCreation)
|
|
assert.Equal(t, opts.IsRestricted.Value(), user.IsRestricted)
|
|
assert.Equal(t, opts.IsActive.Value(), user.IsActive)
|
|
assert.Equal(t, opts.IsAdmin.Value().FieldValue, user.IsAdmin)
|
|
assert.Equal(t, opts.Visibility.Value(), user.Visibility)
|
|
assert.Equal(t, opts.KeepActivityPrivate.Value(), user.KeepActivityPrivate)
|
|
assert.Equal(t, opts.Language.Value(), user.Language)
|
|
assert.Equal(t, opts.Theme.Value(), user.Theme)
|
|
assert.Equal(t, opts.DiffViewStyle.Value(), user.DiffViewStyle)
|
|
assert.Equal(t, opts.AllowCreateOrganization.Value(), user.AllowCreateOrganization)
|
|
assert.Equal(t, opts.EmailNotificationsPreference.Value(), user.EmailNotificationsPreference)
|
|
}
|
|
|
|
func TestUpdateAuth(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
|
|
userCopy := *user
|
|
|
|
assert.NoError(t, UpdateAuth(t.Context(), user, &UpdateAuthOptions{
|
|
LoginName: optional.Some("new-login"),
|
|
}))
|
|
assert.Equal(t, "new-login", user.LoginName)
|
|
|
|
assert.NoError(t, UpdateAuth(t.Context(), user, &UpdateAuthOptions{
|
|
Password: optional.Some("%$DRZUVB576tfzgu"),
|
|
MustChangePassword: optional.Some(true),
|
|
}))
|
|
assert.True(t, user.MustChangePassword)
|
|
assert.NotEqual(t, userCopy.Passwd, user.Passwd)
|
|
assert.NotEqual(t, userCopy.Salt, user.Salt)
|
|
|
|
assert.NoError(t, UpdateAuth(t.Context(), user, &UpdateAuthOptions{
|
|
ProhibitLogin: optional.Some(true),
|
|
}))
|
|
assert.True(t, user.ProhibitLogin)
|
|
|
|
assert.ErrorIs(t, UpdateAuth(t.Context(), user, &UpdateAuthOptions{
|
|
Password: optional.Some("aaaa"),
|
|
}), password_module.ErrMinLength)
|
|
}
|
|
|
|
func TestUpdateUserVisibility(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
// user28's current visibility is public, e.g. an account created before public was disallowed
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
|
|
assert.Equal(t, structs.VisibleTypePublic, user.Visibility)
|
|
|
|
// public is no longer an allowed visibility mode, e.g. ALLOWED_USER_VISIBILITY_MODES = limited, private
|
|
defer test.MockVariableValue(&setting.Service.AllowedUserVisibilityModesSlice, setting.AllowedVisibility{false, true, true})()
|
|
|
|
// re-submitting the unchanged (now-disallowed) visibility must not fail the whole update
|
|
assert.NoError(t, UpdateUser(t.Context(), user, &UpdateOptions{
|
|
FullName: optional.Some("Changed Name"),
|
|
Visibility: optional.Some(structs.VisibleTypePublic),
|
|
}))
|
|
assert.Equal(t, "Changed Name", user.FullName)
|
|
assert.Equal(t, structs.VisibleTypePublic, user.Visibility)
|
|
|
|
// changing to an allowed visibility still works
|
|
assert.NoError(t, UpdateUser(t.Context(), user, &UpdateOptions{
|
|
Visibility: optional.Some(structs.VisibleTypePrivate),
|
|
}))
|
|
assert.Equal(t, structs.VisibleTypePrivate, user.Visibility)
|
|
|
|
// genuinely changing to a disallowed visibility is still rejected
|
|
assert.Error(t, UpdateUser(t.Context(), user, &UpdateOptions{
|
|
Visibility: optional.Some(structs.VisibleTypePublic),
|
|
}))
|
|
}
|
|
|
|
func TestConvertUserType(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
before := *user
|
|
tokensBefore := unittest.GetCount(t, &auth_model.AccessToken{UID: user.ID})
|
|
assert.NotEmpty(t, before.Passwd)
|
|
assert.Positive(t, tokensBefore)
|
|
|
|
defer test.MockVariableValue(&setting.Audit.RecordOutput, setting.AuditRecordOutputDatabase)()
|
|
assert.NoError(t, UpdateUser(t.Context(), user, &UpdateOptions{UserType: optional.Some(user_model.UserTypeBot)}))
|
|
assert.True(t, user.IsTypeBot())
|
|
unittest.AssertExistsAndLoadBean(t, &audit_model.Event{Action: audit_model.UserType, ScopeType: audit_model.ScopeUser, ScopeID: user.ID})
|
|
|
|
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
before.Type, before.UpdatedUnix = user_model.UserTypeBot, user.UpdatedUnix
|
|
assert.Equal(t, before, *user)
|
|
assert.Equal(t, tokensBefore, unittest.GetCount(t, &auth_model.AccessToken{UID: user.ID}))
|
|
|
|
assert.ErrorIs(t, UpdateAuth(t.Context(), user, &UpdateAuthOptions{Password: optional.Some("%$DRZUVB576tfzgu")}), util.ErrInvalidArgument)
|
|
assert.ErrorIs(t, UpdateAuth(t.Context(), user, &UpdateAuthOptions{LoginSource: optional.Some(int64(1))}), util.ErrInvalidArgument)
|
|
assert.ErrorIs(t, UpdateAuth(t.Context(), user, &UpdateAuthOptions{LoginName: optional.Some("cn=bot")}), util.ErrInvalidArgument)
|
|
assert.ErrorIs(t, UpdateUser(t.Context(), user, &UpdateOptions{IsAdmin: UpdateOptionFieldFromValue(true)}), user_model.ErrBotCanNotBeAdmin)
|
|
assert.False(t, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}).IsAdmin)
|
|
|
|
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
assert.NoError(t, UpdateUser(t.Context(), user, &UpdateOptions{UserType: optional.Some(user_model.UserTypeIndividual)}))
|
|
assert.True(t, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}).IsIndividual())
|
|
|
|
toBot := &UpdateOptions{UserType: optional.Some(user_model.UserTypeBot)}
|
|
assert.ErrorIs(t, UpdateUser(t.Context(), unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3}), toBot), user_model.ErrUserTypeCanNotConvert)
|
|
assert.ErrorIs(t, UpdateUser(t.Context(), unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}), toBot), user_model.ErrBotCanNotBeAdmin)
|
|
assert.True(t, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}).IsIndividual())
|
|
assert.NoError(t, user_model.UpdateUserCols(t.Context(), &user_model.User{ID: 4, LoginType: auth_model.LDAP}, "login_type"))
|
|
assert.ErrorIs(t, UpdateUser(t.Context(), unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4}), toBot), user_model.ErrBotMustBeLocal)
|
|
}
|