gapodo/forgejo
gapodo/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add sudo scope

Browse source
This commit is contained in:
harryzcy 2022-09-06 19:46:36 -04:00
parent cd1385014b
commit 745ec98600
No known key found for this signature in database
GPG key ID: CC2953E050C19686
2 changed files with 24 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
models/auth/token_scope.go
View file

@ -50,6 +50,8 @@ const (
AccessTokenScopeAdminGPGKey = "admin:gpg_key"
AccessTokenScopeWriteGPGKey = "write:gpg_key"
AccessTokenScopeReadGPGKey = "read:gpg_key"
AccessTokenScopeSudo = "sudo"
)
// AllAccessTokenScopes contains all access token scopes.
@ -65,13 +67,14 @@ var AllAccessTokenScopes = []string{
AccessTokenScopeDeleteRepo,
AccessTokenScopePackage, AccessTokenScopeWritePackage, AccessTokenScopeReadPackage, AccessTokenScopeDeletePackage,
AccessTokenScopeAdminGPGKey, AccessTokenScopeWriteGPGKey, AccessTokenScopeReadGPGKey,
AccessTokenScopeSudo,
}
// AccessTokenScopeBitmap represents a bitmap of access token scopes.
type AccessTokenScopeBitmap uint64
// AccessTokenScopeAllBitmap is the bitmap of all access token scopes.
var AccessTokenScopeAllBitmap AccessTokenScopeBitmap = 1<<uint(len(AllAccessTokenScopes)) - 1
var AccessTokenScopeAllBitmap AccessTokenScopeBitmap = 1<<uint(len(AllAccessTokenScopes)-1) - 1 // sudo is a special scope to be excluded, so -1 from the length
// Parse parses the scope string into a bitmap, thus removing possible duplicates.
func (s AccessTokenScope) Parse() (AccessTokenScopeBitmap, error) {
@ -83,7 +86,8 @@ func (s AccessTokenScope) Parse() (AccessTokenScopeBitmap, error) {
continue
}
if v == AccessTokenScopeAll {
return AccessTokenScopeAllBitmap, nil
bitmap |= AccessTokenScopeAllBitmap
continue
}
idx := sliceIndex(AllAccessTokenScopes, v)
@ -161,8 +165,13 @@ func (bitmap AccessTokenScopeBitmap) ToScope() AccessTokenScope {
switch v {
// Parse scopes that contains multiple sub-scopes
case AccessTokenScopeRepo, AccessTokenScopeAdminOrg, AccessTokenScopeAdminPublicKey,
AccessTokenScopeAdminRepoHook, AccessTokenScopeUser, AccessTokenScopePackage, AccessTokenScopeAdminGPGKey:
AccessTokenScopeUser, AccessTokenScopePackage, AccessTokenScopeAdminGPGKey:
groupedScope[v] = struct{}{}
case AccessTokenScopeAdminRepoHook:
groupedScope[v] = struct{}{}
if _, ok := groupedScope[AccessTokenScopeRepo]; ok {
continue
}
// If parent scope is set, all sub-scopes shouldn't be added
case AccessTokenScopeRepoStatus, AccessTokenScopePublicRepo:
@ -181,6 +190,9 @@ func (bitmap AccessTokenScopeBitmap) ToScope() AccessTokenScope {
if _, ok := groupedScope[AccessTokenScopeAdminRepoHook]; ok {
continue
}
if _, ok := groupedScope[AccessTokenScopeRepo]; ok {
continue
}
case AccessTokenScopeReadUser, AccessTokenScopeUserEmail, AccessTokenScopeUserFollow:
if _, ok := groupedScope[AccessTokenScopeUser]; ok {
continue
@ -199,9 +211,11 @@ func (bitmap AccessTokenScopeBitmap) ToScope() AccessTokenScope {
}
scope := AccessTokenScope(strings.Join(scopes, ","))
if scope == "repo,admin:org,admin:public_key,admin:repo_hook,admin:org_hook,notification,user,delete_repo,package,admin:gpg_key" {
return AccessTokenScopeAll
}
scope = AccessTokenScope(strings.ReplaceAll(
string(scope),
"repo,admin:org,admin:public_key,admin:org_hook,notification,user,delete_repo,package,admin:gpg_key",
"all",
))
return scope
}

5
models/auth/token_scope_test.go
View file

@ -24,6 +24,8 @@ func TestAccessTokenScope_Normalize(t *testing.T) {
{"admin:public_key,read:public_key", "admin:public_key", nil},
{"admin:repo_hook,write:repo_hook", "admin:repo_hook", nil},
{"admin:repo_hook,read:repo_hook", "admin:repo_hook", nil},
{"repo,admin:repo_hook,read:repo_hook", "repo", nil}, // admin:repo_hook is a child scope of repo
{"repo,read:repo_hook", "repo", nil}, // read:repo_hook is a child scope of repo
{"user", "user", nil},
{"user,read:user", "user", nil},
{"user,admin:org,write:org", "admin:org,user", nil},
@ -36,6 +38,7 @@ func TestAccessTokenScope_Normalize(t *testing.T) {
{"admin:gpg_key,write:gpg_key,user", "user,admin:gpg_key", nil},
{"all", "all", nil},
{"repo,admin:org,admin:public_key,admin:repo_hook,admin:org_hook,notification,user,delete_repo,package,admin:gpg_key", "all", nil},
{"repo,admin:org,admin:public_key,admin:repo_hook,admin:org_hook,notification,user,delete_repo,package,admin:gpg_key,sudo", "all,sudo", nil},
}
for _, test := range tests {
@ -47,7 +50,7 @@ func TestAccessTokenScope_Normalize(t *testing.T) {
}
}
func TestAccessTokenScope__HasScope(t *testing.T) {
func TestAccessTokenScope_HasScope(t *testing.T) {
tests := []struct {
in AccessTokenScope
scope string