mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-28 15:45:41 +00:00
ToastyTheBot
646ea0f253
Deploy keys only work over SSH. A deploy token is their counterpart for HTTPS: a repository scoped credential, used as the password of a Git request, with read or read and write access. It covers Git operations and LFS, and can be regenerated in place. Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude Mythos <noreply@anthropic.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
100 lines
2.5 KiB
Go
100 lines
2.5 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package deploykey
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"gitea.dev/models/asymkey"
|
|
"gitea.dev/models/db"
|
|
"gitea.dev/models/perm"
|
|
"gitea.dev/modules/timeutil"
|
|
|
|
"xorm.io/builder"
|
|
)
|
|
|
|
type KeyType int // SSH public key or HTTP auth token
|
|
|
|
const (
|
|
KeyTypeSSH KeyType = iota + 1
|
|
KeyTypeToken
|
|
)
|
|
|
|
type DeployKey struct {
|
|
ID int64 `xorm:"pk autoincr"`
|
|
KeyID int64 `xorm:"INDEX"`
|
|
RepoID int64 `xorm:"INDEX"`
|
|
Name string
|
|
|
|
KeyType KeyType `xorm:"NOT NULL DEFAULT 1"`
|
|
|
|
Fingerprint string
|
|
PublicKey *asymkey.PublicKey `xorm:"-"`
|
|
|
|
TokenHash string `xorm:"INDEX"` // sha256 of the token, which carries enough entropy to need no salt
|
|
Token string `xorm:"-"` // only set when the token is created
|
|
|
|
Mode perm.AccessMode `xorm:"NOT NULL DEFAULT 1"`
|
|
|
|
CreatedUnix timeutil.TimeStamp `xorm:"created"`
|
|
UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
|
|
}
|
|
|
|
// these methods below are mainly used by templates
|
|
|
|
func (key *DeployKey) HasRecentActivity() bool {
|
|
return key.UpdatedUnix.AddDuration(7*24*time.Hour) > timeutil.TimeStampNow()
|
|
}
|
|
|
|
func (key *DeployKey) HasUsed() bool { return key.UpdatedUnix > key.CreatedUnix }
|
|
|
|
func (key *DeployKey) IsReadOnly() bool { return key.Mode == perm.AccessModeRead }
|
|
|
|
func (key *DeployKey) IsKeyTypeToken() bool { return key.KeyType == KeyTypeToken }
|
|
|
|
func init() {
|
|
db.RegisterModel(new(DeployKey))
|
|
}
|
|
|
|
func checkDeployKeyName(ctx context.Context, repoID int64, name string) error {
|
|
has, err := db.Exist[DeployKey](ctx, builder.Eq{"repo_id": repoID, "name": name})
|
|
if err != nil {
|
|
return err
|
|
} else if has {
|
|
return ErrDeployKeyNameAlreadyUsed{repoID, name}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// UpdateDeployKeyLastUsed marks the key as used now.
|
|
func UpdateDeployKeyLastUsed(ctx context.Context, id int64) error {
|
|
_, err := db.GetEngine(ctx).ID(id).Cols("updated_unix").Update(&DeployKey{UpdatedUnix: timeutil.TimeStampNow()})
|
|
return err
|
|
}
|
|
|
|
// ListDeployKeysOptions are options for ListDeployKeys
|
|
type ListDeployKeysOptions struct {
|
|
db.ListOptions
|
|
RepoID int64
|
|
KeyID int64
|
|
Fingerprint string
|
|
}
|
|
|
|
func (opt ListDeployKeysOptions) ToOrders() string {
|
|
return "name"
|
|
}
|
|
|
|
func (opt ListDeployKeysOptions) ToConds() builder.Cond {
|
|
cond := builder.NewCond()
|
|
cond = cond.And(builder.Eq{"repo_id": opt.RepoID}) // repo ID must be used
|
|
if opt.KeyID != 0 {
|
|
cond = cond.And(builder.Eq{"key_id": opt.KeyID})
|
|
}
|
|
if opt.Fingerprint != "" {
|
|
cond = cond.And(builder.Eq{"fingerprint": opt.Fingerprint})
|
|
}
|
|
return cond
|
|
}
|