21 Commits

Author	SHA1	Message	Date
delvh	0ebb45cfe7	Replace all instances of fmt.Errorf(%v) with fmt.Errorf(%w) (#21551) ... Found using `find . -type f -name '*.go' -print -exec vim {} -c ':%s/fmt\.Errorf(\(.*\)%v\(.*\)err/fmt.Errorf(\1%w\2err/g' -c ':wq' \;` Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2022-10-24 20:29:17 +01:00
M Hickford	191a74d622	Record OAuth client type at registration (#21316) ... The OAuth spec [defines two types of client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1), confidential and public. Previously Gitea assumed all clients to be confidential. > OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to > maintain the confidentiality of their client credentials): > > confidential > Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with > restricted access to the client credentials), or capable of secure client authentication using other means. > > **public > Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.** > > The client type designation is based on the authorization server's definition of secure authentication and its acceptable exposure levels of client credentials. The authorization server SHOULD NOT make assumptions about the client type. https://datatracker.ietf.org/doc/html/rfc8252#section-8.4 > Authorization servers MUST record the client type in the client registration details in order to identify and process requests accordingly. Require PKCE for public clients: https://datatracker.ietf.org/doc/html/rfc8252#section-8.1 > Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message Fixes #21299 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-10-24 15:59:24 +08:00
zeripath	716fcfcf72	Make every not exist error unwrappable to a fs.ErrNotExist (#20891) ... A lot of our code is repeatedly testing if individual errors are specific types of Not Exist errors. This is repetitative and unnecesary. `Unwrap() error` provides a common way of labelling an error as a NotExist error and we can/should use this. This PR has chosen to use the common `io/fs` errors e.g. `fs.ErrNotExist` for our errors. This is in some ways not completely correct as these are not filesystem errors but it seems like a reasonable thing to do and would allow us to simplify a lot of our code to `errors.Is(err, fs.ErrNotExist)` instead of `package.IsErr...NotExist(err)` I am open to suggestions to use a different base error - perhaps `models/db.ErrNotExist` if that would be felt to be better. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de>	2022-10-18 07:50:37 +02:00
qwerty287	a813c9d8f3	Allow creation of OAuth2 applications for orgs (#18084) ... Adds the settings pages to create OAuth2 apps also to the org settings and allows to create apps for orgs. Refactoring: the oauth2 related templates are shared for instance-wide/org/user, and the backend code uses `OAuth2CommonHandlers` to share code for instance-wide/org/user. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2022-10-09 20:07:41 +08:00
M Hickford	6a45a691c1	Ignore port for loopback redirect URIs (#21293) ... Following https://datatracker.ietf.org/doc/html/rfc8252#section-7.3 Fixes #21285	2022-09-29 00:19:55 +02:00
Lunny Xiao	1d8543e7db	Move some files into models' sub packages (#20262) ... * Move some files into models' sub packages * Move functions * merge main branch * Fix check * fix check * Fix some tests * Fix lint * Fix lint * Revert lint changes * Fix error comments * Fix lint Co-authored-by: 6543 <6543@obermui.de>	2022-08-25 10:31:57 +08:00
Balki	c138e76c1c	Fix panic when an invalid oauth2 name is passed (#20820)	2022-08-17 14:25:28 -04:00
Lunny Xiao	86c85c19b6	Refactor AssertExistsAndLoadBean to use generics (#20797) ... * Refactor AssertExistsAndLoadBean to use generics * Fix tests Co-authored-by: zeripath <art27@cantab.net>	2022-08-16 10:22:25 +08:00
zeripath	e819da0837	WebAuthn CredentialID field needs to be increased in size (#20530) ... WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. The PR changes the struct to add CredentialIDBytes and migrates the CredentialID string to the bytes field before another migration drops the old CredentialID field. Another migration renames this field back. Fix #20457 Signed-off-by: Andrew Thornton <art27@cantab.net>	2022-07-30 15:25:26 +02:00
Wim	cb50375e2b	Add more linters to improve code readability (#19989) ... Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)	2022-06-20 12:02:49 +02:00
Lunny Xiao	fd7d83ace6	Move almost all functions' parameter db.Engine to context.Context (#19748) ... * Move almost all functions' parameter db.Engine to context.Context * remove some unnecessary wrap functions	2022-05-20 22:08:52 +08:00
6543	f41c2bec4c	Delete user related oauth stuff on user deletion too (#19677) ... * delete user related oauth stuff on user deletion too * extend doctor check-db-consistency	2022-05-11 13:16:35 +02:00
Lunny Xiao	772ad761eb	Fix some slice problems (incorrect slice length) (#19592)	2022-05-03 17:04:23 +08:00
Lunny Xiao	b8911fb456	Use a struct as test options (#19393) ... * Use a struct as test options * Fix name * Fix test	2022-04-14 21:58:21 +08:00
zeripath	3a29a23cdc	Attempt to fix the webauthn migration again - part 3 (#18770) ... v208.go is seriously broken as it misses an ID() check. We need to no-op and remigrate all of the u2f keys. See #18756 Signed-off-by: Andrew Thornton <art27@cantab.net>	2022-02-16 21:03:58 +00:00
Gusted	aa23f477b7	Use CryptoRandomBytes instead of CryptoRandomString (#18439) ... - Switch to use `CryptoRandomBytes` instead of `CryptoRandomString`, OAuth's secrets are copied pasted and don't need to avoid dubious characters etc. - `CryptoRandomBytes` gives  `CryptoRandomString` gives  possible states. - Add a prefix, such that code scanners can easily grep these in source code. - 32 Bytes + prefix	2022-02-04 18:03:15 +01:00
wxiaoguang	49dd906753	Use base32 for 2FA scratch token (#18384) ... * Use base32 for 2FA scratch token * rename Secure* to Crypto*, add comments	2022-01-26 12:10:10 +08:00
6543	54e9ee37a7	format with gofumpt (#18184) ... * gofumpt -w -l . * gofumpt -w -l -extra . * Add linter * manual fix * change make fmt	2022-01-20 18:46:10 +01:00
zeripath	d7c2a2951c	Webauthn nits (#18284) ... This contains some additional fixes and small nits related to #17957 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2022-01-15 17:52:56 +01:00
Lunny Xiao	35c3553870	Support webauthn (#17957) ... Migrate from U2F to Webauthn Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2022-01-14 16:03:31 +01:00
Lunny Xiao	de8e3948a5	Refactor auth package (#17962)	2022-01-02 21:12:35 +08:00