Commit graph

13 commits

Author SHA1 Message Date
wxiaoguang 62d3e5255f
Port "Use general token signing secret"
Port of https://github.com/go-gitea/gitea/pull/29205

Use a clearly defined "signing secret" for token signing.

(cherry picked from commit 8be198cdef0a486f417663b1fd6878458d7e5d92)
2024-02-19 20:49:37 +01:00
Gusted 464ae81a36
[GITEA] Refactor generation of JWT secret
- Remove non base64-ed version of JWT secret generation. Because all
occurences need the Base64 version.

(cherry picked from commit 6a6b5a31a8e38cb953fcca1c8847ea219234f10c)
(cherry picked from commit 066b8ca6b40a7342352983de35f1ca6683927426)
2024-02-05 16:54:44 +01:00
wackbyte d9b3849454
Fix inconsistent naming of OAuth 2.0 ENABLE setting ()
Renames it to `ENABLED` to be consistent with other settings and
deprecates it.

I believe this change is necessary because other setting groups such as
`attachment`, `cors`, `mailer`, etc. have an `ENABLED` setting, but
`oauth2` is the only one with an `ENABLE` setting, which could cause
confusion for users.

This is no longer a breaking change because `ENABLE` has been set as
deprecated and as an alias to `ENABLED`.
2024-01-28 12:36:44 +00:00
Kyle D 54acf7b0d4
Normalize oauth email username () 2024-01-03 18:48:20 -06:00
M Hickford a825cc0f34
Pre-register OAuth application for tea ()
It remains to implement OAuth login in tea
https://gitea.com/gitea/tea/issues/598

Fixes 
2023-10-08 03:51:08 +00:00
wxiaoguang ed1be4ca68
Handle base64 decoding correctly to avoid panic ()
Fix the panic if the "base64 secret" is too long.
2023-08-14 10:30:16 +00:00
Denys Konovalov 63ab92d797
Pre-register OAuth2 applications for git credential helpers ()
This PR is an extended implementation of  and builds upon the
proposal by @hickford in , utilizing some ideas proposed
internally by @wxiaoguang.

Mainly, this PR consists of a mechanism to pre-register OAuth2
applications on startup, which can be enabled or disabled by modifying
the `[oauth2].DEFAULT_APPLICATIONS` parameter in app.ini. The OAuth2
applications registered this way are being marked as "locked" and
neither be deleted nor edited over UI to prevent confusing/unexpected
behavior. Instead, they're being removed if no longer enabled in config.


![grafik](https://github.com/go-gitea/gitea/assets/47871822/81a78b1c-4b68-40a7-9e99-c272ebb8f62e)

The implemented mechanism can also be used to pre-register other OAuth2
applications in the future, if wanted.

Co-authored-by: hickford <mirth.hickford@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

---------

Co-authored-by: M Hickford <mirth.hickford@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2023-08-09 14:24:07 +02:00
wxiaoguang b4d0036fc3
Do not prepare oauth2 config if it is not enabled, do not write config in some sub-commands ()
Ref:

* https://github.com/go-gitea/gitea/issues/25377#issuecomment-1609757289

And some sub-commands like "generate" / "docs", they do not need to use
the ini config
2023-06-28 23:30:06 +02:00
techknowlogick c0fc53e226
Import additional secrets via file uri () 2023-06-23 00:16:12 +00:00
wxiaoguang df5cf5ddbd
Avoid polluting config file when "save" ()
That's a longstanding INI package problem: the "MustXxx" calls change
the option values, and the following "Save" will save a lot of garbage
options into the user's config file.

Ideally we should refactor the INI package to a clear solution, but it's
a huge work.

A clear workaround is what this PR does: when "Save", load a clear INI
instance and save it.

Partially fix , the "install" page needs more fine tunes.
2023-06-21 10:31:40 +08:00
wxiaoguang a5d0246fff
Avoid polluting the config ()
Caught by 

Co-authored-by: Giteabot <teabot@gitea.io>
2023-06-18 16:10:44 +00:00
Lunny Xiao 5cf7da63ee
Refactor config provider ()
This PR introduces more abstract about `ConfigProvider` and hides more `ini` references.

---------

Co-authored-by: delvh <dev.lh@web.de>
2023-04-25 23:06:39 +08:00
Lunny Xiao c53ad052d8
Refactor the setting to make unit test easier ()
Some bugs caused by less unit tests in fundamental packages. This PR
refactor `setting` package so that create a unit test will be easier
than before.

- All `LoadFromXXX` files has been splited as two functions, one is
`InitProviderFromXXX` and `LoadCommonSettings`. The first functions will
only include the code to create or new a ini file. The second function
will load common settings.
- It also renames all functions in setting from `newXXXService` to
`loadXXXSetting` or `loadXXXFrom` to make the function name less
confusing.
- Move `XORMLog` to `SQLLog` because it's a better name for that.

Maybe we should finally move these `loadXXXSetting` into the `XXXInit`
function? Any idea?

---------

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: delvh <dev.lh@web.de>
2023-02-20 00:12:01 +08:00
Renamed from modules/setting/oauth2_client.go (Browse further)