feat: initial repo — docs and scripts for Gitea read-only token access

Three-layer access scheme: owner -> reader account -> scoped API token.
Includes 6 automation scripts, config template, EN/RU docs, and manual curl guide.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
delta-cloud-208e
2026-02-21 14:47:04 +00:00
commit 295afe9b2a
12 changed files with 950 additions and 0 deletions

85
scripts/grant-access.sh Executable file
View File

@@ -0,0 +1,85 @@
#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CONFIG="${SCRIPT_DIR}/../config.ini"
if [[ $# -lt 1 ]]; then
echo "Usage: $0 <repo-name> [config.ini]"
echo "Grant read access to a repository for the reader account."
exit 1
fi
REPO="$1"
[[ -n "${2:-}" ]] && CONFIG="$2"
if [[ ! -f "$CONFIG" ]]; then
echo "ERROR: config file not found: $CONFIG"
exit 1
fi
# --- Parse INI ---
parse_ini() {
local file="$1" section="$2" key="$3"
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
}
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
OWNER_USER=$(parse_ini "$CONFIG" owner username)
OWNER_PASS=$(parse_ini "$CONFIG" owner password)
READER_USER=$(parse_ini "$CONFIG" reader username)
READER_PASS=$(parse_ini "$CONFIG" reader password)
TOKEN=$(parse_ini "$CONFIG" reader token)
echo "=== Grant Access: $OWNER_USER/$REPO -> $READER_USER ==="
# --- Add as collaborator (read permission) ---
echo "[1/3] Adding '$READER_USER' as collaborator (read)..."
HTTP_CODE=$(curl -s -o /tmp/gitea_grant.json -w "%{http_code}" \
-X PUT "$GITEA_API/repos/$OWNER_USER/$REPO/collaborators/$READER_USER" \
-u "$OWNER_USER:$OWNER_PASS" \
-H "Content-Type: application/json" \
-d '{"permission": "read"}')
if [[ "$HTTP_CODE" == "204" || "$HTTP_CODE" == "200" ]]; then
echo " -> Collaborator added."
else
echo " -> ERROR: HTTP $HTTP_CODE"
cat /tmp/gitea_grant.json
exit 1
fi
# --- Accept invitation (if required by Gitea) ---
echo "[2/3] Accepting collaboration invite (if any)..."
# List pending notifications/invitations and accept
PENDING=$(curl -s \
-u "$READER_USER:$READER_PASS" \
"$GITEA_API/user/repos" | grep -c "\"name\":\"$REPO\"" 2>/dev/null || echo "0")
if [[ "$PENDING" == "0" ]]; then
# Try to accept via notifications — some Gitea versions auto-accept
echo " -> Auto-accepted or no invite needed."
else
echo " -> Already accessible."
fi
# --- Verify access with token ---
echo "[3/3] Verifying access with token..."
if [[ -z "$TOKEN" ]]; then
echo " -> WARNING: No token in config.ini, skipping verification."
echo " -> Run setup-reader.sh first to create a token."
else
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: token $TOKEN" \
"$GITEA_API/repos/$OWNER_USER/$REPO")
if [[ "$HTTP_CODE" == "200" ]]; then
echo " -> Access confirmed (HTTP 200)."
else
echo " -> WARNING: HTTP $HTTP_CODE — access may not be working yet."
fi
fi
echo ""
echo "=== Done ==="
echo "Repo '$OWNER_USER/$REPO' is now readable by '$READER_USER'."

41
scripts/list-access.sh Executable file
View File

@@ -0,0 +1,41 @@
#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CONFIG="${1:-$SCRIPT_DIR/../config.ini}"
if [[ ! -f "$CONFIG" ]]; then
echo "ERROR: config file not found: $CONFIG"
exit 1
fi
# --- Parse INI ---
parse_ini() {
local file="$1" section="$2" key="$3"
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
}
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
READER_USER=$(parse_ini "$CONFIG" reader username)
TOKEN=$(parse_ini "$CONFIG" reader token)
if [[ -z "$TOKEN" ]]; then
echo "ERROR: No token found in config.ini. Run setup-reader.sh first."
exit 1
fi
echo "=== Repositories accessible by '$READER_USER' ==="
echo ""
REPOS=$(curl -s \
-H "Authorization: token $TOKEN" \
"$GITEA_API/user/repos?limit=50")
# Parse JSON with grep/sed (no jq dependency)
echo "$REPOS" | grep -o '"full_name":"[^"]*"' | sed 's/"full_name":"//;s/"//' | while read -r repo; do
echo " - $repo"
done
COUNT=$(echo "$REPOS" | grep -o '"full_name":"[^"]*"' | wc -l)
echo ""
echo "Total: $COUNT repositories"

45
scripts/revoke-access.sh Executable file
View File

@@ -0,0 +1,45 @@
#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CONFIG="${SCRIPT_DIR}/../config.ini"
if [[ $# -lt 1 ]]; then
echo "Usage: $0 <repo-name> [config.ini]"
echo "Revoke reader access from a repository."
exit 1
fi
REPO="$1"
[[ -n "${2:-}" ]] && CONFIG="$2"
if [[ ! -f "$CONFIG" ]]; then
echo "ERROR: config file not found: $CONFIG"
exit 1
fi
# --- Parse INI ---
parse_ini() {
local file="$1" section="$2" key="$3"
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
}
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
OWNER_USER=$(parse_ini "$CONFIG" owner username)
OWNER_PASS=$(parse_ini "$CONFIG" owner password)
READER_USER=$(parse_ini "$CONFIG" reader username)
echo "=== Revoke Access: $OWNER_USER/$REPO -> $READER_USER ==="
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-X DELETE "$GITEA_API/repos/$OWNER_USER/$REPO/collaborators/$READER_USER" \
-u "$OWNER_USER:$OWNER_PASS")
if [[ "$HTTP_CODE" == "204" || "$HTTP_CODE" == "200" ]]; then
echo "-> Access revoked successfully."
elif [[ "$HTTP_CODE" == "404" ]]; then
echo "-> User was not a collaborator (404)."
else
echo "-> ERROR: HTTP $HTTP_CODE"
exit 1
fi

76
scripts/rotate-token.sh Executable file
View File

@@ -0,0 +1,76 @@
#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CONFIG="${1:-$SCRIPT_DIR/../config.ini}"
if [[ ! -f "$CONFIG" ]]; then
echo "ERROR: config file not found: $CONFIG"
exit 1
fi
# --- Parse INI ---
parse_ini() {
local file="$1" section="$2" key="$3"
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
}
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
READER_USER=$(parse_ini "$CONFIG" reader username)
READER_PASS=$(parse_ini "$CONFIG" reader password)
TOKEN_NAME=$(parse_ini "$CONFIG" reader token_name)
TOKEN_SCOPE=$(parse_ini "$CONFIG" reader token_scope)
TOKEN_NAME="${TOKEN_NAME:-installer-readonly}"
TOKEN_SCOPE="${TOKEN_SCOPE:-read:repository}"
echo "=== Token Rotation for '$READER_USER' ==="
# --- Delete old token ---
echo "[1/2] Deleting old token '$TOKEN_NAME'..."
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-X DELETE "$GITEA_API/users/$READER_USER/tokens/$TOKEN_NAME" \
-u "$READER_USER:$READER_PASS")
if [[ "$HTTP_CODE" == "204" || "$HTTP_CODE" == "200" ]]; then
echo " -> Old token deleted."
elif [[ "$HTTP_CODE" == "404" ]]; then
echo " -> No existing token found (404), creating fresh."
else
echo " -> WARNING: HTTP $HTTP_CODE while deleting old token."
fi
# --- Create new token ---
echo "[2/2] Creating new token '$TOKEN_NAME' (scope: $TOKEN_SCOPE)..."
TOKEN_RESPONSE=$(curl -s \
-X POST "$GITEA_API/users/$READER_USER/tokens" \
-u "$READER_USER:$READER_PASS" \
-H "Content-Type: application/json" \
-d "{\"name\": \"$TOKEN_NAME\", \"scopes\": [\"$TOKEN_SCOPE\"]}")
TOKEN_VALUE=$(echo "$TOKEN_RESPONSE" | grep -o '"sha1":"[^"]*"' | sed 's/"sha1":"//;s/"//')
if [[ -z "$TOKEN_VALUE" ]]; then
echo " -> ERROR: Failed to create new token:"
echo "$TOKEN_RESPONSE"
exit 1
fi
echo " -> New token: ${TOKEN_VALUE:0:8}..."
# --- Update config.ini ---
if grep -q "^token\s*=" "$CONFIG" 2>/dev/null; then
sed -i "s|^token\s*=.*|token = $TOKEN_VALUE|" "$CONFIG"
echo " -> Token updated in $CONFIG"
else
sed -i "/^\[reader\]/,/^\[/{
/^token_scope/a token = $TOKEN_VALUE
}" "$CONFIG"
echo " -> Token added to $CONFIG"
fi
echo ""
echo "=== Rotation Complete ==="
echo "New token (first 8): ${TOKEN_VALUE:0:8}..."
echo ""
echo "IMPORTANT: Update any systems using the old token!"

120
scripts/setup-reader.sh Executable file
View File

@@ -0,0 +1,120 @@
#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CONFIG="${1:-$SCRIPT_DIR/../config.ini}"
if [[ ! -f "$CONFIG" ]]; then
echo "ERROR: config file not found: $CONFIG"
echo "Usage: $0 [path/to/config.ini]"
echo "Copy config.example.ini to config.ini and fill in your values."
exit 1
fi
# --- Parse INI ---
parse_ini() {
local file="$1" section="$2" key="$3"
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
}
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
OWNER_USER=$(parse_ini "$CONFIG" owner username)
OWNER_PASS=$(parse_ini "$CONFIG" owner password)
READER_USER=$(parse_ini "$CONFIG" reader username)
READER_PASS=$(parse_ini "$CONFIG" reader password)
READER_EMAIL=$(parse_ini "$CONFIG" reader email)
TOKEN_NAME=$(parse_ini "$CONFIG" reader token_name)
TOKEN_SCOPE=$(parse_ini "$CONFIG" reader token_scope)
if [[ -z "$GITEA_API" || -z "$OWNER_USER" || -z "$OWNER_PASS" || -z "$READER_USER" || -z "$READER_PASS" ]]; then
echo "ERROR: missing required fields in config.ini"
exit 1
fi
READER_EMAIL="${READER_EMAIL:-${READER_USER}@noreply.local}"
TOKEN_NAME="${TOKEN_NAME:-installer-readonly}"
TOKEN_SCOPE="${TOKEN_SCOPE:-read:repository}"
echo "=== Gitea Reader Account Setup ==="
echo "Server: $GITEA_API"
echo "Owner: $OWNER_USER"
echo "Reader: $READER_USER"
echo ""
# --- Step 1: Create reader account ---
echo "[1/4] Creating reader account '$READER_USER'..."
HTTP_CODE=$(curl -s -o /tmp/gitea_create_user.json -w "%{http_code}" \
-X POST "$GITEA_API/admin/users" \
-u "$OWNER_USER:$OWNER_PASS" \
-H "Content-Type: application/json" \
-d "{
\"username\": \"$READER_USER\",
\"password\": \"$READER_PASS\",
\"email\": \"$READER_EMAIL\",
\"must_change_password\": false,
\"visibility\": \"public\"
}")
if [[ "$HTTP_CODE" == "201" ]]; then
echo " -> Account created."
elif [[ "$HTTP_CODE" == "422" ]]; then
echo " -> Account already exists (422), continuing."
else
echo " -> ERROR: HTTP $HTTP_CODE"
cat /tmp/gitea_create_user.json
exit 1
fi
# --- Step 2: Activate account ---
echo "[2/4] Activating account and setting visibility..."
curl -s -o /dev/null -w "" \
-X PATCH "$GITEA_API/admin/users/$READER_USER" \
-u "$OWNER_USER:$OWNER_PASS" \
-H "Content-Type: application/json" \
-d '{"active": true, "visibility": "public", "login_name": "'"$READER_USER"'"}'
echo " -> Done."
# --- Step 3: Delete existing token with same name (if any) ---
echo "[3/4] Cleaning up old tokens..."
curl -s -o /dev/null -w "" \
-X DELETE "$GITEA_API/users/$READER_USER/tokens/$TOKEN_NAME" \
-u "$READER_USER:$READER_PASS" 2>/dev/null || true
echo " -> Done."
# --- Step 4: Create API token ---
echo "[4/4] Creating API token '$TOKEN_NAME' (scope: $TOKEN_SCOPE)..."
TOKEN_RESPONSE=$(curl -s \
-X POST "$GITEA_API/users/$READER_USER/tokens" \
-u "$READER_USER:$READER_PASS" \
-H "Content-Type: application/json" \
-d "{\"name\": \"$TOKEN_NAME\", \"scopes\": [\"$TOKEN_SCOPE\"]}")
TOKEN_VALUE=$(echo "$TOKEN_RESPONSE" | grep -o '"sha1":"[^"]*"' | sed 's/"sha1":"//;s/"//')
if [[ -z "$TOKEN_VALUE" ]]; then
echo " -> ERROR: Failed to extract token from response:"
echo "$TOKEN_RESPONSE"
exit 1
fi
echo " -> Token created: ${TOKEN_VALUE:0:8}..."
# --- Write token back to config.ini ---
if grep -q "^token\s*=" "$CONFIG" 2>/dev/null; then
sed -i "s|^token\s*=.*|token = $TOKEN_VALUE|" "$CONFIG"
else
# Add token under [reader] section
sed -i "/^\[reader\]/,/^\[/{
/^token_scope/a token = $TOKEN_VALUE
}" "$CONFIG"
fi
echo ""
echo "=== Setup Complete ==="
echo "Reader account: $READER_USER"
echo "Token (first 8): ${TOKEN_VALUE:0:8}..."
echo "Token written to: $CONFIG"
echo ""
echo "Next steps:"
echo " bash scripts/grant-access.sh <repo-name>"
echo " bash scripts/test-access.sh <repo-name>"

93
scripts/test-access.sh Executable file
View File

@@ -0,0 +1,93 @@
#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CONFIG="${SCRIPT_DIR}/../config.ini"
REPO="${1:-}"
[[ -n "${2:-}" ]] && CONFIG="$2"
if [[ ! -f "$CONFIG" ]]; then
echo "ERROR: config file not found: $CONFIG"
exit 1
fi
# --- Parse INI ---
parse_ini() {
local file="$1" section="$2" key="$3"
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
}
GITEA_URL=$(parse_ini "$CONFIG" gitea url)
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
OWNER_USER=$(parse_ini "$CONFIG" owner username)
READER_USER=$(parse_ini "$CONFIG" reader username)
TOKEN=$(parse_ini "$CONFIG" reader token)
if [[ -z "$TOKEN" ]]; then
echo "ERROR: No token found in config.ini. Run setup-reader.sh first."
exit 1
fi
PASS=0
FAIL=0
check() {
local desc="$1" expected="$2" actual="$3"
if [[ "$actual" == "$expected" ]]; then
echo " PASS: $desc (HTTP $actual)"
((PASS++))
else
echo " FAIL: $desc (expected $expected, got $actual)"
((FAIL++))
fi
}
echo "=== Access Test for '$READER_USER' ==="
echo "Server: $GITEA_API"
echo ""
# --- Test 1: Token is valid (list repos) ---
echo "[Test 1] Token validity — list repos..."
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: token $TOKEN" \
"$GITEA_API/user/repos")
check "GET /user/repos with token" "200" "$HTTP_CODE"
# --- Test 2: Token scope limitation (should NOT access admin endpoints) ---
echo "[Test 2] Token scope — admin API should be denied..."
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: token $TOKEN" \
"$GITEA_API/admin/users")
check "GET /admin/users with read-only token" "403" "$HTTP_CODE"
if [[ -n "$REPO" ]]; then
echo ""
echo "[Test 3] Repo access — $OWNER_USER/$REPO..."
# --- Test 3a: Access with token ---
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: token $TOKEN" \
"$GITEA_API/repos/$OWNER_USER/$REPO")
check "GET /repos/$OWNER_USER/$REPO with token" "200" "$HTTP_CODE"
# --- Test 3b: Access without token (private repo should be 404) ---
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
"$GITEA_API/repos/$OWNER_USER/$REPO")
check "GET /repos/$OWNER_USER/$REPO without token (expect 404)" "404" "$HTTP_CODE"
# --- Test 3c: Clone URL with token ---
echo ""
echo "[Info] Clone URL for scripts/installers:"
echo " git clone https://${READER_USER}:${TOKEN}@${GITEA_URL#https://}/${OWNER_USER}/${REPO}.git"
echo " (or use: Authorization: token $TOKEN header)"
else
echo ""
echo "[Info] Pass a repo name to test specific repo access:"
echo " $0 <repo-name>"
fi
echo ""
echo "=== Results: $PASS passed, $FAIL failed ==="
[[ "$FAIL" -gt 0 ]] && exit 1
exit 0