mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-21 21:30:36 +00:00
Giteabot
76c768edca
Backport #39007 by @bircni Reject public-only tokens for repository migrations and require repository scope for canonical organization repository creation. This aligns both routes with the existing token authorization boundaries. _Assisted-by: Codex:GPT-5_ Co-authored-by: bircni <bircni@icloud.com>
56 lines
2.0 KiB
Go
56 lines
2.0 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
api "gitea.dev/modules/structs"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAPIRepositoryCreationTokenScopes(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user2"})
|
|
|
|
t.Run("migration rejects public-only tokens", func(t *testing.T) {
|
|
publicOnlyToken := getUserToken(t, user.Name,
|
|
auth_model.AccessTokenScopeWriteRepository,
|
|
auth_model.AccessTokenScopePublicOnly,
|
|
)
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/repos/migrate", &api.MigrateRepoOptions{Private: true}).
|
|
AddTokenAuth(publicOnlyToken)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
writeRepoToken := getUserToken(t, user.Name, auth_model.AccessTokenScopeWriteRepository)
|
|
req = NewRequestWithJSON(t, "POST", "/api/v1/repos/migrate", &api.MigrateRepoOptions{Private: true}).
|
|
AddTokenAuth(writeRepoToken)
|
|
MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
})
|
|
|
|
t.Run("organization creation requires repository scope", func(t *testing.T) {
|
|
orgOnlyToken := getUserToken(t, user.Name, auth_model.AccessTokenScopeWriteOrganization)
|
|
req := NewRequestWithJSON(t, "POST", "/api/v1/orgs/org3/repos", &api.CreateRepoOption{Name: "missing-repository-scope"}).
|
|
AddTokenAuth(orgOnlyToken)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
orgRepoToken := getUserToken(t, user.Name,
|
|
auth_model.AccessTokenScopeWriteOrganization,
|
|
auth_model.AccessTokenScopeWriteRepository,
|
|
)
|
|
req = NewRequestWithJSON(t, "POST", "/api/v1/orgs/org3/repos", &api.CreateRepoOption{Name: "repository-scope-allowed"}).
|
|
AddTokenAuth(orgRepoToken)
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
createdRepo := DecodeJSON(t, resp, &api.Repository{})
|
|
require.Equal(t, "org3/repository-scope-allowed", createdRepo.FullName)
|
|
})
|
|
}
|