mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-20 19:53:21 +00:00
Mitrahsoft
7857c5f843
Lets users regenerate a personal access token's value in place, keeping its name and scopes, instead of deleting and recreating it. Useful when a token was shared with a third party (e.g. an AI agent) and needs to be invalidated immediately without redoing scope selection. Follows the same pattern already used for OAuth2 application client secrets (`GenerateClientSecret`/`RegenerateSecret`). **Testing**: added a model unit test and a web integration test; manually verified in the running dev server that the old token stops authenticating and the new one works immediately after regenerating. <img width="1040" height="245" alt="image" src="https://github.com/user-attachments/assets/4de0d8b4-1fc4-49cf-a859-95e24d0b2c0a" /> Fixes #38683. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
94 lines
2.8 KiB
Go
94 lines
2.8 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package runner
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"time"
|
|
|
|
"gitea.dev/actionslib/pkg/protocol"
|
|
actions_model "gitea.dev/models/actions"
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/modules/log"
|
|
"gitea.dev/modules/timeutil"
|
|
"gitea.dev/modules/util"
|
|
|
|
"connectrpc.com/connect"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
)
|
|
|
|
const (
|
|
uuidHeaderKey = protocol.UUIDHeader
|
|
tokenHeaderKey = protocol.TokenHeader
|
|
)
|
|
|
|
var withRunner = connect.WithInterceptors(connect.UnaryInterceptorFunc(func(unaryFunc connect.UnaryFunc) connect.UnaryFunc {
|
|
return func(ctx context.Context, request connect.AnyRequest) (connect.AnyResponse, error) {
|
|
methodName := getMethodName(request)
|
|
if methodName == "Register" {
|
|
return unaryFunc(ctx, request)
|
|
}
|
|
uuid := request.Header().Get(uuidHeaderKey)
|
|
token := request.Header().Get(tokenHeaderKey)
|
|
|
|
runner, err := actions_model.GetRunnerByUUID(ctx, uuid)
|
|
if err != nil {
|
|
if errors.Is(err, util.ErrNotExist) {
|
|
return nil, status.Error(codes.Unauthenticated, "unregistered runner")
|
|
}
|
|
return nil, status.Error(codes.Internal, err.Error())
|
|
}
|
|
if !util.CryptoConstTimeEqual(runner.TokenHash, auth_model.HashToken(token, runner.TokenSalt)) {
|
|
return nil, status.Error(codes.Unauthenticated, "unregistered runner")
|
|
}
|
|
|
|
now := time.Now()
|
|
cols := make([]string, 0, 2)
|
|
// Debounce last_active too: while a runner streams logs, UpdateLog fires
|
|
// many times per second and writing on each is a major source of DB load.
|
|
// Persist only when stale enough to affect the active/idle status.
|
|
if (methodName == "UpdateTask" || methodName == "UpdateLog") &&
|
|
actions_model.ShouldPersistLastActive(runner.LastActive, now) {
|
|
runner.LastActive = timeutil.TimeStamp(now.Unix())
|
|
cols = append(cols, "last_active")
|
|
}
|
|
// Debounce last_online: writing on every poll is a major source of DB load
|
|
// with many runners. Persist only when stale enough to affect offline status.
|
|
if actions_model.ShouldPersistLastOnline(runner.LastOnline, now) {
|
|
runner.LastOnline = timeutil.TimeStamp(now.Unix())
|
|
cols = append(cols, "last_online")
|
|
}
|
|
if len(cols) > 0 {
|
|
if err := actions_model.UpdateRunner(ctx, runner, cols...); err != nil {
|
|
log.Error("can't update runner status: %v", err)
|
|
}
|
|
}
|
|
|
|
ctx = context.WithValue(ctx, runnerCtxKey{}, runner)
|
|
return unaryFunc(ctx, request)
|
|
}
|
|
}))
|
|
|
|
func getMethodName(req connect.AnyRequest) string {
|
|
splits := strings.Split(req.Spec().Procedure, "/")
|
|
if len(splits) > 0 {
|
|
return splits[len(splits)-1]
|
|
}
|
|
return ""
|
|
}
|
|
|
|
type runnerCtxKey struct{}
|
|
|
|
func GetRunner(ctx context.Context) *actions_model.ActionRunner {
|
|
if v := ctx.Value(runnerCtxKey{}); v != nil {
|
|
if r, ok := v.(*actions_model.ActionRunner); ok {
|
|
return r
|
|
}
|
|
}
|
|
return nil
|
|
}
|