mirror of
https://github.com/go-gitea/gitea.git
synced 2026-09-20 13:16:09 +00:00
Joe (Agent) Stump
3bec08f998
Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.
1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
95 lines
2.4 KiB
Go
95 lines
2.4 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package user
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"gitea.dev/modules/util"
|
|
)
|
|
|
|
// ErrUserAlreadyExist represents a "user already exists" error.
|
|
type ErrUserAlreadyExist struct {
|
|
Name string
|
|
}
|
|
|
|
// IsErrUserAlreadyExist checks if an error is a ErrUserAlreadyExists.
|
|
func IsErrUserAlreadyExist(err error) bool {
|
|
_, ok := err.(ErrUserAlreadyExist)
|
|
return ok
|
|
}
|
|
|
|
func (err ErrUserAlreadyExist) Error() string {
|
|
return fmt.Sprintf("user already exists [name: %s]", err.Name)
|
|
}
|
|
|
|
// Unwrap unwraps this error as a ErrExist error
|
|
func (err ErrUserAlreadyExist) Unwrap() error {
|
|
return util.ErrAlreadyExist
|
|
}
|
|
|
|
// ErrUserNotExist represents a "UserNotExist" kind of error.
|
|
type ErrUserNotExist struct {
|
|
UID int64
|
|
Name string
|
|
}
|
|
|
|
// IsErrUserNotExist checks if an error is a ErrUserNotExist.
|
|
func IsErrUserNotExist(err error) bool {
|
|
_, ok := err.(ErrUserNotExist)
|
|
return ok
|
|
}
|
|
|
|
func (err ErrUserNotExist) Error() string {
|
|
return fmt.Sprintf("user does not exist [uid: %d, name: %s]", err.UID, err.Name)
|
|
}
|
|
|
|
// Unwrap unwraps this error as a ErrNotExist error
|
|
func (err ErrUserNotExist) Unwrap() error {
|
|
return util.ErrNotExist
|
|
}
|
|
|
|
// ErrUserProhibitLogin represents a "ErrUserProhibitLogin" kind of error.
|
|
type ErrUserProhibitLogin struct {
|
|
UID int64
|
|
Name string
|
|
}
|
|
|
|
// IsErrUserProhibitLogin checks if an error is a ErrUserProhibitLogin
|
|
func IsErrUserProhibitLogin(err error) bool {
|
|
_, ok := err.(ErrUserProhibitLogin)
|
|
return ok
|
|
}
|
|
|
|
func (err ErrUserProhibitLogin) Error() string {
|
|
return fmt.Sprintf("user is not allowed login [uid: %d, name: %s]", err.UID, err.Name)
|
|
}
|
|
|
|
// Unwrap unwraps this error as a ErrPermission error
|
|
func (err ErrUserProhibitLogin) Unwrap() error {
|
|
return util.ErrPermissionDenied
|
|
}
|
|
|
|
// ErrUserIsNotLocal represents a "ErrUserIsNotLocal" kind of error.
|
|
type ErrUserIsNotLocal struct {
|
|
UID int64
|
|
Name string
|
|
}
|
|
|
|
func (err ErrUserIsNotLocal) Error() string {
|
|
return fmt.Sprintf("user is not local type [uid: %d, name: %s]", err.UID, err.Name)
|
|
}
|
|
|
|
// IsErrUserIsNotLocal
|
|
func IsErrUserIsNotLocal(err error) bool {
|
|
_, ok := err.(ErrUserIsNotLocal)
|
|
return ok
|
|
}
|
|
|
|
var (
|
|
ErrBotCanNotBeAdmin = util.NewInvalidArgumentErrorf("bot user can not be a site administrator")
|
|
ErrBotMustBeLocal = util.NewInvalidArgumentErrorf("bot user must use local authentication")
|
|
ErrUserTypeCanNotConvert = util.NewInvalidArgumentErrorf("user type can not be converted")
|
|
)
|