feat: initial repo — docs and scripts for Gitea read-only token access
Three-layer access scheme: owner -> reader account -> scoped API token. Includes 6 automation scripts, config template, EN/RU docs, and manual curl guide. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
delta-cloud-208e
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@@ -0,0 +1 @@
|
|||||||
|
config.ini
|
||||||
108
README.md
Normal file
108
README.md
Normal file
@@ -0,0 +1,108 @@
|
|||||||
|
# gitea-token-access
|
||||||
|
|
||||||
|
Scripts and documentation for setting up restricted read-only access to private Gitea repositories.
|
||||||
|
|
||||||
|
## Problem
|
||||||
|
|
||||||
|
You have private repos on a Gitea server and need to give automated tools (installers, CI/CD, scripts) read access — without exposing your admin credentials.
|
||||||
|
|
||||||
|
## Solution
|
||||||
|
|
||||||
|
A three-layer scheme:
|
||||||
|
|
||||||
|
1. **Owner account** — full admin access, owns all repos
|
||||||
|
2. **Reader account** — restricted "hobo" account with no admin rights, only sees repos where explicitly added as collaborator
|
||||||
|
3. **API token** — scoped to `read:repository`, can only read what the reader account can see
|
||||||
|
|
||||||
|
If the token leaks, revoke it and rotate — no admin credentials are exposed.
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. Copy and fill in your config
|
||||||
|
cp config.example.ini config.ini
|
||||||
|
nano config.ini
|
||||||
|
|
||||||
|
# 2. Create reader account and token
|
||||||
|
bash scripts/setup-reader.sh
|
||||||
|
|
||||||
|
# 3. Grant access to a specific repo
|
||||||
|
bash scripts/grant-access.sh my-private-repo
|
||||||
|
|
||||||
|
# 4. Verify it works
|
||||||
|
bash scripts/test-access.sh my-private-repo
|
||||||
|
```
|
||||||
|
|
||||||
|
## Scripts
|
||||||
|
|
||||||
|
| Script | Description |
|
||||||
|
|--------|-------------|
|
||||||
|
| `setup-reader.sh` | Create reader account + API token |
|
||||||
|
| `grant-access.sh <repo>` | Grant read access to a repo |
|
||||||
|
| `revoke-access.sh <repo>` | Revoke access from a repo |
|
||||||
|
| `list-access.sh` | List all accessible repos |
|
||||||
|
| `rotate-token.sh` | Delete old token, create new one |
|
||||||
|
| `test-access.sh [repo]` | Verify token and access work |
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
Copy `config.example.ini` to `config.ini` and fill in your values:
|
||||||
|
|
||||||
|
```ini
|
||||||
|
[gitea]
|
||||||
|
url = https://git.example.com
|
||||||
|
api_url = https://git.example.com/api/v1
|
||||||
|
|
||||||
|
[owner]
|
||||||
|
username = admin-user
|
||||||
|
password = admin-password
|
||||||
|
|
||||||
|
[reader]
|
||||||
|
username = readonly-user
|
||||||
|
password = reader-password
|
||||||
|
email = reader@noreply.local
|
||||||
|
token_name = installer-readonly
|
||||||
|
token_scope = read:repository
|
||||||
|
```
|
||||||
|
|
||||||
|
The `config.ini` file is gitignored and will never be committed.
|
||||||
|
|
||||||
|
## Using the Token
|
||||||
|
|
||||||
|
### In scripts (curl)
|
||||||
|
```bash
|
||||||
|
curl -H "Authorization: token YOUR_TOKEN" \
|
||||||
|
https://git.example.com/api/v1/repos/owner/repo/raw/file.txt
|
||||||
|
```
|
||||||
|
|
||||||
|
### Git clone
|
||||||
|
```bash
|
||||||
|
git clone https://reader:YOUR_TOKEN@git.example.com/owner/repo.git
|
||||||
|
```
|
||||||
|
|
||||||
|
### Git credential store
|
||||||
|
```bash
|
||||||
|
echo "https://reader:YOUR_TOKEN@git.example.com" >> ~/.git-credentials
|
||||||
|
git config --global credential.helper store
|
||||||
|
git clone https://git.example.com/owner/repo.git
|
||||||
|
```
|
||||||
|
|
||||||
|
## Documentation
|
||||||
|
|
||||||
|
- [Architecture](docs/architecture.md) — how the owner/reader/token scheme works
|
||||||
|
- [Manual Setup](docs/manual-setup.md) — step-by-step curl commands
|
||||||
|
- [README (Russian)](README_ru.md)
|
||||||
|
|
||||||
|
## Security Notes
|
||||||
|
|
||||||
|
- The token has `read:repository` scope only — it cannot write, delete, or access admin APIs
|
||||||
|
- Access is per-repo: the reader only sees repos where they are an explicit collaborator
|
||||||
|
- If the token is compromised: run `rotate-token.sh` to invalidate old token and create a new one
|
||||||
|
- `config.ini` contains credentials — it is gitignored and must never be committed
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
- Gitea instance with API enabled
|
||||||
|
- Owner account with admin privileges
|
||||||
|
- `curl` and `bash`
|
||||||
|
- No external dependencies (no jq, python, etc.)
|
||||||
158
README_ru.md
Normal file
158
README_ru.md
Normal file
@@ -0,0 +1,158 @@
|
|||||||
|
# gitea-token-access
|
||||||
|
|
||||||
|
Скрипты и документация для настройки ограниченного read-only доступа к приватным репозиториям Gitea.
|
||||||
|
|
||||||
|
## Зачем это нужно
|
||||||
|
|
||||||
|
Есть приватные репо на Gitea-сервере. Нужно дать автоматическим инструментам (установщики, CI/CD, скрипты) доступ на чтение — без раскрытия админских учётных данных.
|
||||||
|
|
||||||
|
## Схема
|
||||||
|
|
||||||
|
Трёхуровневая модель доступа:
|
||||||
|
|
||||||
|
```
|
||||||
|
Владелец (admin)
|
||||||
|
│
|
||||||
|
├── создаёт "бомж"-аккаунт (через Admin API)
|
||||||
|
├── выдаёт доступ к конкретным репо (collaborator, read)
|
||||||
|
│
|
||||||
|
v
|
||||||
|
Бомж-аккаунт (reader)
|
||||||
|
│
|
||||||
|
├── не имеет админ-прав
|
||||||
|
├── видит только те репо, куда его добавили
|
||||||
|
│
|
||||||
|
v
|
||||||
|
API-токен (scope: read:repository)
|
||||||
|
│
|
||||||
|
├── может только читать
|
||||||
|
├── используется в скриптах/установщиках
|
||||||
|
└── при утечке — ротируем, админ-данные не раскрыты
|
||||||
|
```
|
||||||
|
|
||||||
|
## Быстрый старт
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. Скопировать и заполнить конфиг
|
||||||
|
cp config.example.ini config.ini
|
||||||
|
nano config.ini
|
||||||
|
|
||||||
|
# 2. Создать бомж-аккаунт и токен
|
||||||
|
bash scripts/setup-reader.sh
|
||||||
|
|
||||||
|
# 3. Дать доступ к конкретному репо
|
||||||
|
bash scripts/grant-access.sh my-private-repo
|
||||||
|
|
||||||
|
# 4. Проверить что всё работает
|
||||||
|
bash scripts/test-access.sh my-private-repo
|
||||||
|
```
|
||||||
|
|
||||||
|
## Скрипты
|
||||||
|
|
||||||
|
| Скрипт | Описание |
|
||||||
|
|--------|----------|
|
||||||
|
| `setup-reader.sh` | Создать бомж-аккаунт + API-токен |
|
||||||
|
| `grant-access.sh <repo>` | Выдать доступ на чтение к репо |
|
||||||
|
| `revoke-access.sh <repo>` | Забрать доступ |
|
||||||
|
| `list-access.sh` | Показать все доступные репо |
|
||||||
|
| `rotate-token.sh` | Удалить старый токен, создать новый |
|
||||||
|
| `test-access.sh [repo]` | Проверить что токен и доступ работают |
|
||||||
|
|
||||||
|
## Конфигурация
|
||||||
|
|
||||||
|
Скопируйте `config.example.ini` в `config.ini` и заполните своими данными:
|
||||||
|
|
||||||
|
```ini
|
||||||
|
[gitea]
|
||||||
|
url = https://git.example.com
|
||||||
|
api_url = https://git.example.com/api/v1
|
||||||
|
|
||||||
|
[owner]
|
||||||
|
username = ваш-админ
|
||||||
|
password = ваш-пароль
|
||||||
|
|
||||||
|
[reader]
|
||||||
|
username = reader-аккаунт
|
||||||
|
password = пароль-reader
|
||||||
|
email = reader@noreply.local
|
||||||
|
token_name = installer-readonly
|
||||||
|
token_scope = read:repository
|
||||||
|
```
|
||||||
|
|
||||||
|
Файл `config.ini` добавлен в `.gitignore` и никогда не будет закоммичен.
|
||||||
|
|
||||||
|
## Использование токена
|
||||||
|
|
||||||
|
### В скриптах (curl)
|
||||||
|
```bash
|
||||||
|
curl -H "Authorization: token ВАШ_ТОКЕН" \
|
||||||
|
https://git.example.com/api/v1/repos/owner/repo/raw/file.txt
|
||||||
|
```
|
||||||
|
|
||||||
|
### Git clone
|
||||||
|
```bash
|
||||||
|
git clone https://reader:ВАШ_ТОКЕН@git.example.com/owner/repo.git
|
||||||
|
```
|
||||||
|
|
||||||
|
### Git credential store
|
||||||
|
```bash
|
||||||
|
echo "https://reader:ВАШ_ТОКЕН@git.example.com" >> ~/.git-credentials
|
||||||
|
git config --global credential.helper store
|
||||||
|
git clone https://git.example.com/owner/repo.git
|
||||||
|
```
|
||||||
|
|
||||||
|
## FAQ
|
||||||
|
|
||||||
|
### Что делать если токен утёк?
|
||||||
|
|
||||||
|
```bash
|
||||||
|
bash scripts/rotate-token.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Старый токен будет удалён и перестанет работать. Новый будет записан в `config.ini`. Обновите токен во всех системах, которые его используют.
|
||||||
|
|
||||||
|
### Как дать доступ к новому репо?
|
||||||
|
|
||||||
|
```bash
|
||||||
|
bash scripts/grant-access.sh имя-нового-репо
|
||||||
|
```
|
||||||
|
|
||||||
|
### Как убрать доступ к репо?
|
||||||
|
|
||||||
|
```bash
|
||||||
|
bash scripts/revoke-access.sh имя-репо
|
||||||
|
```
|
||||||
|
|
||||||
|
### Как посмотреть к чему есть доступ?
|
||||||
|
|
||||||
|
```bash
|
||||||
|
bash scripts/list-access.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### Можно ли использовать для другого Gitea-сервера?
|
||||||
|
|
||||||
|
Да. Просто измените `url` и `api_url` в `config.ini`. Скрипты универсальны и работают с любым Gitea-инстансом.
|
||||||
|
|
||||||
|
### Нужен ли jq или python?
|
||||||
|
|
||||||
|
Нет. Скрипты используют только `bash`, `curl`, `grep`, `sed` — стандартные утилиты Linux.
|
||||||
|
|
||||||
|
## Документация
|
||||||
|
|
||||||
|
- [Архитектура](docs/architecture.md) — схема владелец/бомж/токен
|
||||||
|
- [Ручная настройка](docs/manual-setup.md) — пошаговые curl-команды
|
||||||
|
- [README (English)](README.md)
|
||||||
|
|
||||||
|
## Безопасность
|
||||||
|
|
||||||
|
- Токен имеет scope `read:repository` — не может писать, удалять или использовать админ API
|
||||||
|
- Доступ гранулярный: бомж видит только те репо, где он явно добавлен как collaborator
|
||||||
|
- При компрометации токена: запустите `rotate-token.sh`
|
||||||
|
- `config.ini` содержит учётные данные — он в `.gitignore` и не коммитится
|
||||||
|
|
||||||
|
## Требования
|
||||||
|
|
||||||
|
- Gitea-инстанс с включённым API
|
||||||
|
- Аккаунт владельца с правами администратора
|
||||||
|
- `curl` и `bash`
|
||||||
|
- Никаких внешних зависимостей
|
||||||
18
config.example.ini
Normal file
18
config.example.ini
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
[gitea]
|
||||||
|
url = https://git.example.com
|
||||||
|
api_url = https://git.example.com/api/v1
|
||||||
|
|
||||||
|
[owner]
|
||||||
|
# Admin account that owns the repositories
|
||||||
|
username = myuser
|
||||||
|
password = mypassword
|
||||||
|
|
||||||
|
[reader]
|
||||||
|
# Restricted read-only account
|
||||||
|
username = myreader
|
||||||
|
password = readerpassword
|
||||||
|
email = myreader@noreply.local
|
||||||
|
token_name = installer-readonly
|
||||||
|
token_scope = read:repository
|
||||||
|
# After running setup-reader.sh, the token will be written here:
|
||||||
|
# token = sha1_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||||
68
docs/architecture.md
Normal file
68
docs/architecture.md
Normal file
@@ -0,0 +1,68 @@
|
|||||||
|
# Architecture: Read-Only Token Access for Gitea
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
This scheme provides controlled, minimal-privilege access to private Gitea repositories without sharing the owner's credentials.
|
||||||
|
|
||||||
|
## Components
|
||||||
|
|
||||||
|
```
|
||||||
|
+-------------------+
|
||||||
|
| Owner Account | Full admin access to Gitea
|
||||||
|
| (e.g. aibot777) | Owns all repositories
|
||||||
|
+--------+----------+
|
||||||
|
|
|
||||||
|
| Creates & manages via Admin API
|
||||||
|
v
|
||||||
|
+-------------------+
|
||||||
|
| Reader Account | Restricted account ("hobo account")
|
||||||
|
| (e.g. uclaude- | No admin rights
|
||||||
|
| reader) | Can only access repos where explicitly
|
||||||
|
+--------+----------+ added as collaborator (read permission)
|
||||||
|
|
|
||||||
|
| Authenticates via
|
||||||
|
v
|
||||||
|
+-------------------+
|
||||||
|
| API Token | scope: read:repository
|
||||||
|
| (sha1_xxx...) | Can only READ repos the reader
|
||||||
|
+--------+----------+ account has access to
|
||||||
|
|
|
||||||
|
| Used by
|
||||||
|
v
|
||||||
|
+-------------------+
|
||||||
|
| Scripts/Installers| git clone, curl, wget
|
||||||
|
| CI/CD pipelines | Any tool that needs read access
|
||||||
|
+-------------------+
|
||||||
|
```
|
||||||
|
|
||||||
|
## Access Flow
|
||||||
|
|
||||||
|
1. **Owner** creates the reader account (one-time setup)
|
||||||
|
2. **Owner** grants the reader access to specific repos (per-repo)
|
||||||
|
3. **Reader's token** is used by automated tools to read those repos
|
||||||
|
4. If the token leaks — revoke it, rotate, no owner credentials exposed
|
||||||
|
|
||||||
|
## Security Properties
|
||||||
|
|
||||||
|
| Property | Status |
|
||||||
|
|----------|--------|
|
||||||
|
| Owner credentials exposed | No |
|
||||||
|
| Token can write to repos | No (read:repository scope) |
|
||||||
|
| Token can access admin API | No |
|
||||||
|
| Token can access repos not granted | No |
|
||||||
|
| Token can be rotated independently | Yes |
|
||||||
|
| Access is per-repo granular | Yes |
|
||||||
|
|
||||||
|
## Gitea API Endpoints Used
|
||||||
|
|
||||||
|
| Action | Method | Endpoint | Auth |
|
||||||
|
|--------|--------|----------|------|
|
||||||
|
| Create user | POST | `/admin/users` | Owner (admin) |
|
||||||
|
| Activate user | PATCH | `/admin/users/{username}` | Owner (admin) |
|
||||||
|
| Create token | POST | `/users/{username}/tokens` | Reader (basic) |
|
||||||
|
| Delete token | DELETE | `/users/{username}/tokens/{name}` | Reader (basic) |
|
||||||
|
| Add collaborator | PUT | `/repos/{owner}/{repo}/collaborators/{user}` | Owner |
|
||||||
|
| Remove collaborator | DELETE | `/repos/{owner}/{repo}/collaborators/{user}` | Owner |
|
||||||
|
| List repos | GET | `/user/repos` | Reader (token) |
|
||||||
|
| Get repo | GET | `/repos/{owner}/{repo}` | Reader (token) |
|
||||||
|
| Get raw file | GET | `/repos/{owner}/{repo}/raw/{path}` | Reader (token) |
|
||||||
137
docs/manual-setup.md
Normal file
137
docs/manual-setup.md
Normal file
@@ -0,0 +1,137 @@
|
|||||||
|
# Manual Setup via curl
|
||||||
|
|
||||||
|
Step-by-step commands for setting up read-only access manually.
|
||||||
|
Replace placeholders with your actual values.
|
||||||
|
|
||||||
|
## Variables
|
||||||
|
|
||||||
|
```bash
|
||||||
|
GITEA_API="https://git.example.com/api/v1"
|
||||||
|
OWNER="myuser"
|
||||||
|
OWNER_PASS="mypassword"
|
||||||
|
READER="myreader"
|
||||||
|
READER_PASS="readerpassword"
|
||||||
|
READER_EMAIL="myreader@noreply.local"
|
||||||
|
```
|
||||||
|
|
||||||
|
## 1. Create Reader Account
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -X POST "$GITEA_API/admin/users" \
|
||||||
|
-u "$OWNER:$OWNER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d '{
|
||||||
|
"username": "'"$READER"'",
|
||||||
|
"password": "'"$READER_PASS"'",
|
||||||
|
"email": "'"$READER_EMAIL"'",
|
||||||
|
"must_change_password": false,
|
||||||
|
"visibility": "public"
|
||||||
|
}'
|
||||||
|
```
|
||||||
|
|
||||||
|
Expected: HTTP 201
|
||||||
|
|
||||||
|
## 2. Activate Account
|
||||||
|
|
||||||
|
Some Gitea configurations require explicit activation:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -X PATCH "$GITEA_API/admin/users/$READER" \
|
||||||
|
-u "$OWNER:$OWNER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d '{
|
||||||
|
"active": true,
|
||||||
|
"visibility": "public",
|
||||||
|
"login_name": "'"$READER"'"
|
||||||
|
}'
|
||||||
|
```
|
||||||
|
|
||||||
|
## 3. Create API Token
|
||||||
|
|
||||||
|
Authenticate as the reader to create a token with limited scope:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -X POST "$GITEA_API/users/$READER/tokens" \
|
||||||
|
-u "$READER:$READER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d '{
|
||||||
|
"name": "installer-readonly",
|
||||||
|
"scopes": ["read:repository"]
|
||||||
|
}'
|
||||||
|
```
|
||||||
|
|
||||||
|
Response:
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"id": 1,
|
||||||
|
"name": "installer-readonly",
|
||||||
|
"sha1": "abc123...",
|
||||||
|
"token_last_eight": "abc12345"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Save the `sha1` value — it is only shown once.
|
||||||
|
|
||||||
|
## 4. Grant Access to a Repository
|
||||||
|
|
||||||
|
```bash
|
||||||
|
REPO="my-private-repo"
|
||||||
|
|
||||||
|
curl -X PUT "$GITEA_API/repos/$OWNER/$REPO/collaborators/$READER" \
|
||||||
|
-u "$OWNER:$OWNER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d '{"permission": "read"}'
|
||||||
|
```
|
||||||
|
|
||||||
|
Expected: HTTP 204
|
||||||
|
|
||||||
|
## 5. Verify Access
|
||||||
|
|
||||||
|
With token (should work):
|
||||||
|
```bash
|
||||||
|
TOKEN="abc123..."
|
||||||
|
|
||||||
|
curl -H "Authorization: token $TOKEN" \
|
||||||
|
"$GITEA_API/repos/$OWNER/$REPO"
|
||||||
|
```
|
||||||
|
|
||||||
|
Without token (should return 404 for private repo):
|
||||||
|
```bash
|
||||||
|
curl "$GITEA_API/repos/$OWNER/$REPO"
|
||||||
|
```
|
||||||
|
|
||||||
|
## 6. Clone with Token
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone "https://$READER:$TOKEN@git.example.com/$OWNER/$REPO.git"
|
||||||
|
```
|
||||||
|
|
||||||
|
Or download a specific file:
|
||||||
|
```bash
|
||||||
|
curl -H "Authorization: token $TOKEN" \
|
||||||
|
"$GITEA_API/repos/$OWNER/$REPO/raw/README.md"
|
||||||
|
```
|
||||||
|
|
||||||
|
## 7. Revoke Access
|
||||||
|
|
||||||
|
Remove from collaborators:
|
||||||
|
```bash
|
||||||
|
curl -X DELETE "$GITEA_API/repos/$OWNER/$REPO/collaborators/$READER" \
|
||||||
|
-u "$OWNER:$OWNER_PASS"
|
||||||
|
```
|
||||||
|
|
||||||
|
## 8. Rotate Token
|
||||||
|
|
||||||
|
Delete old:
|
||||||
|
```bash
|
||||||
|
curl -X DELETE "$GITEA_API/users/$READER/tokens/installer-readonly" \
|
||||||
|
-u "$READER:$READER_PASS"
|
||||||
|
```
|
||||||
|
|
||||||
|
Create new:
|
||||||
|
```bash
|
||||||
|
curl -X POST "$GITEA_API/users/$READER/tokens" \
|
||||||
|
-u "$READER:$READER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d '{"name": "installer-readonly", "scopes": ["read:repository"]}'
|
||||||
|
```
|
||||||
85
scripts/grant-access.sh
Executable file
85
scripts/grant-access.sh
Executable file
@@ -0,0 +1,85 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
CONFIG="${SCRIPT_DIR}/../config.ini"
|
||||||
|
|
||||||
|
if [[ $# -lt 1 ]]; then
|
||||||
|
echo "Usage: $0 <repo-name> [config.ini]"
|
||||||
|
echo "Grant read access to a repository for the reader account."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
REPO="$1"
|
||||||
|
[[ -n "${2:-}" ]] && CONFIG="$2"
|
||||||
|
|
||||||
|
if [[ ! -f "$CONFIG" ]]; then
|
||||||
|
echo "ERROR: config file not found: $CONFIG"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Parse INI ---
|
||||||
|
parse_ini() {
|
||||||
|
local file="$1" section="$2" key="$3"
|
||||||
|
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
|
||||||
|
}
|
||||||
|
|
||||||
|
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
|
||||||
|
OWNER_USER=$(parse_ini "$CONFIG" owner username)
|
||||||
|
OWNER_PASS=$(parse_ini "$CONFIG" owner password)
|
||||||
|
READER_USER=$(parse_ini "$CONFIG" reader username)
|
||||||
|
READER_PASS=$(parse_ini "$CONFIG" reader password)
|
||||||
|
TOKEN=$(parse_ini "$CONFIG" reader token)
|
||||||
|
|
||||||
|
echo "=== Grant Access: $OWNER_USER/$REPO -> $READER_USER ==="
|
||||||
|
|
||||||
|
# --- Add as collaborator (read permission) ---
|
||||||
|
echo "[1/3] Adding '$READER_USER' as collaborator (read)..."
|
||||||
|
HTTP_CODE=$(curl -s -o /tmp/gitea_grant.json -w "%{http_code}" \
|
||||||
|
-X PUT "$GITEA_API/repos/$OWNER_USER/$REPO/collaborators/$READER_USER" \
|
||||||
|
-u "$OWNER_USER:$OWNER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d '{"permission": "read"}')
|
||||||
|
|
||||||
|
if [[ "$HTTP_CODE" == "204" || "$HTTP_CODE" == "200" ]]; then
|
||||||
|
echo " -> Collaborator added."
|
||||||
|
else
|
||||||
|
echo " -> ERROR: HTTP $HTTP_CODE"
|
||||||
|
cat /tmp/gitea_grant.json
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Accept invitation (if required by Gitea) ---
|
||||||
|
echo "[2/3] Accepting collaboration invite (if any)..."
|
||||||
|
# List pending notifications/invitations and accept
|
||||||
|
PENDING=$(curl -s \
|
||||||
|
-u "$READER_USER:$READER_PASS" \
|
||||||
|
"$GITEA_API/user/repos" | grep -c "\"name\":\"$REPO\"" 2>/dev/null || echo "0")
|
||||||
|
|
||||||
|
if [[ "$PENDING" == "0" ]]; then
|
||||||
|
# Try to accept via notifications — some Gitea versions auto-accept
|
||||||
|
echo " -> Auto-accepted or no invite needed."
|
||||||
|
else
|
||||||
|
echo " -> Already accessible."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Verify access with token ---
|
||||||
|
echo "[3/3] Verifying access with token..."
|
||||||
|
if [[ -z "$TOKEN" ]]; then
|
||||||
|
echo " -> WARNING: No token in config.ini, skipping verification."
|
||||||
|
echo " -> Run setup-reader.sh first to create a token."
|
||||||
|
else
|
||||||
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||||
|
-H "Authorization: token $TOKEN" \
|
||||||
|
"$GITEA_API/repos/$OWNER_USER/$REPO")
|
||||||
|
|
||||||
|
if [[ "$HTTP_CODE" == "200" ]]; then
|
||||||
|
echo " -> Access confirmed (HTTP 200)."
|
||||||
|
else
|
||||||
|
echo " -> WARNING: HTTP $HTTP_CODE — access may not be working yet."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== Done ==="
|
||||||
|
echo "Repo '$OWNER_USER/$REPO' is now readable by '$READER_USER'."
|
||||||
41
scripts/list-access.sh
Executable file
41
scripts/list-access.sh
Executable file
@@ -0,0 +1,41 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
CONFIG="${1:-$SCRIPT_DIR/../config.ini}"
|
||||||
|
|
||||||
|
if [[ ! -f "$CONFIG" ]]; then
|
||||||
|
echo "ERROR: config file not found: $CONFIG"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Parse INI ---
|
||||||
|
parse_ini() {
|
||||||
|
local file="$1" section="$2" key="$3"
|
||||||
|
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
|
||||||
|
}
|
||||||
|
|
||||||
|
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
|
||||||
|
READER_USER=$(parse_ini "$CONFIG" reader username)
|
||||||
|
TOKEN=$(parse_ini "$CONFIG" reader token)
|
||||||
|
|
||||||
|
if [[ -z "$TOKEN" ]]; then
|
||||||
|
echo "ERROR: No token found in config.ini. Run setup-reader.sh first."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "=== Repositories accessible by '$READER_USER' ==="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
REPOS=$(curl -s \
|
||||||
|
-H "Authorization: token $TOKEN" \
|
||||||
|
"$GITEA_API/user/repos?limit=50")
|
||||||
|
|
||||||
|
# Parse JSON with grep/sed (no jq dependency)
|
||||||
|
echo "$REPOS" | grep -o '"full_name":"[^"]*"' | sed 's/"full_name":"//;s/"//' | while read -r repo; do
|
||||||
|
echo " - $repo"
|
||||||
|
done
|
||||||
|
|
||||||
|
COUNT=$(echo "$REPOS" | grep -o '"full_name":"[^"]*"' | wc -l)
|
||||||
|
echo ""
|
||||||
|
echo "Total: $COUNT repositories"
|
||||||
45
scripts/revoke-access.sh
Executable file
45
scripts/revoke-access.sh
Executable file
@@ -0,0 +1,45 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
CONFIG="${SCRIPT_DIR}/../config.ini"
|
||||||
|
|
||||||
|
if [[ $# -lt 1 ]]; then
|
||||||
|
echo "Usage: $0 <repo-name> [config.ini]"
|
||||||
|
echo "Revoke reader access from a repository."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
REPO="$1"
|
||||||
|
[[ -n "${2:-}" ]] && CONFIG="$2"
|
||||||
|
|
||||||
|
if [[ ! -f "$CONFIG" ]]; then
|
||||||
|
echo "ERROR: config file not found: $CONFIG"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Parse INI ---
|
||||||
|
parse_ini() {
|
||||||
|
local file="$1" section="$2" key="$3"
|
||||||
|
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
|
||||||
|
}
|
||||||
|
|
||||||
|
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
|
||||||
|
OWNER_USER=$(parse_ini "$CONFIG" owner username)
|
||||||
|
OWNER_PASS=$(parse_ini "$CONFIG" owner password)
|
||||||
|
READER_USER=$(parse_ini "$CONFIG" reader username)
|
||||||
|
|
||||||
|
echo "=== Revoke Access: $OWNER_USER/$REPO -> $READER_USER ==="
|
||||||
|
|
||||||
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||||
|
-X DELETE "$GITEA_API/repos/$OWNER_USER/$REPO/collaborators/$READER_USER" \
|
||||||
|
-u "$OWNER_USER:$OWNER_PASS")
|
||||||
|
|
||||||
|
if [[ "$HTTP_CODE" == "204" || "$HTTP_CODE" == "200" ]]; then
|
||||||
|
echo "-> Access revoked successfully."
|
||||||
|
elif [[ "$HTTP_CODE" == "404" ]]; then
|
||||||
|
echo "-> User was not a collaborator (404)."
|
||||||
|
else
|
||||||
|
echo "-> ERROR: HTTP $HTTP_CODE"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
76
scripts/rotate-token.sh
Executable file
76
scripts/rotate-token.sh
Executable file
@@ -0,0 +1,76 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
CONFIG="${1:-$SCRIPT_DIR/../config.ini}"
|
||||||
|
|
||||||
|
if [[ ! -f "$CONFIG" ]]; then
|
||||||
|
echo "ERROR: config file not found: $CONFIG"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Parse INI ---
|
||||||
|
parse_ini() {
|
||||||
|
local file="$1" section="$2" key="$3"
|
||||||
|
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
|
||||||
|
}
|
||||||
|
|
||||||
|
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
|
||||||
|
READER_USER=$(parse_ini "$CONFIG" reader username)
|
||||||
|
READER_PASS=$(parse_ini "$CONFIG" reader password)
|
||||||
|
TOKEN_NAME=$(parse_ini "$CONFIG" reader token_name)
|
||||||
|
TOKEN_SCOPE=$(parse_ini "$CONFIG" reader token_scope)
|
||||||
|
|
||||||
|
TOKEN_NAME="${TOKEN_NAME:-installer-readonly}"
|
||||||
|
TOKEN_SCOPE="${TOKEN_SCOPE:-read:repository}"
|
||||||
|
|
||||||
|
echo "=== Token Rotation for '$READER_USER' ==="
|
||||||
|
|
||||||
|
# --- Delete old token ---
|
||||||
|
echo "[1/2] Deleting old token '$TOKEN_NAME'..."
|
||||||
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||||
|
-X DELETE "$GITEA_API/users/$READER_USER/tokens/$TOKEN_NAME" \
|
||||||
|
-u "$READER_USER:$READER_PASS")
|
||||||
|
|
||||||
|
if [[ "$HTTP_CODE" == "204" || "$HTTP_CODE" == "200" ]]; then
|
||||||
|
echo " -> Old token deleted."
|
||||||
|
elif [[ "$HTTP_CODE" == "404" ]]; then
|
||||||
|
echo " -> No existing token found (404), creating fresh."
|
||||||
|
else
|
||||||
|
echo " -> WARNING: HTTP $HTTP_CODE while deleting old token."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Create new token ---
|
||||||
|
echo "[2/2] Creating new token '$TOKEN_NAME' (scope: $TOKEN_SCOPE)..."
|
||||||
|
TOKEN_RESPONSE=$(curl -s \
|
||||||
|
-X POST "$GITEA_API/users/$READER_USER/tokens" \
|
||||||
|
-u "$READER_USER:$READER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "{\"name\": \"$TOKEN_NAME\", \"scopes\": [\"$TOKEN_SCOPE\"]}")
|
||||||
|
|
||||||
|
TOKEN_VALUE=$(echo "$TOKEN_RESPONSE" | grep -o '"sha1":"[^"]*"' | sed 's/"sha1":"//;s/"//')
|
||||||
|
|
||||||
|
if [[ -z "$TOKEN_VALUE" ]]; then
|
||||||
|
echo " -> ERROR: Failed to create new token:"
|
||||||
|
echo "$TOKEN_RESPONSE"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo " -> New token: ${TOKEN_VALUE:0:8}..."
|
||||||
|
|
||||||
|
# --- Update config.ini ---
|
||||||
|
if grep -q "^token\s*=" "$CONFIG" 2>/dev/null; then
|
||||||
|
sed -i "s|^token\s*=.*|token = $TOKEN_VALUE|" "$CONFIG"
|
||||||
|
echo " -> Token updated in $CONFIG"
|
||||||
|
else
|
||||||
|
sed -i "/^\[reader\]/,/^\[/{
|
||||||
|
/^token_scope/a token = $TOKEN_VALUE
|
||||||
|
}" "$CONFIG"
|
||||||
|
echo " -> Token added to $CONFIG"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== Rotation Complete ==="
|
||||||
|
echo "New token (first 8): ${TOKEN_VALUE:0:8}..."
|
||||||
|
echo ""
|
||||||
|
echo "IMPORTANT: Update any systems using the old token!"
|
||||||
120
scripts/setup-reader.sh
Executable file
120
scripts/setup-reader.sh
Executable file
@@ -0,0 +1,120 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
CONFIG="${1:-$SCRIPT_DIR/../config.ini}"
|
||||||
|
|
||||||
|
if [[ ! -f "$CONFIG" ]]; then
|
||||||
|
echo "ERROR: config file not found: $CONFIG"
|
||||||
|
echo "Usage: $0 [path/to/config.ini]"
|
||||||
|
echo "Copy config.example.ini to config.ini and fill in your values."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Parse INI ---
|
||||||
|
parse_ini() {
|
||||||
|
local file="$1" section="$2" key="$3"
|
||||||
|
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
|
||||||
|
}
|
||||||
|
|
||||||
|
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
|
||||||
|
OWNER_USER=$(parse_ini "$CONFIG" owner username)
|
||||||
|
OWNER_PASS=$(parse_ini "$CONFIG" owner password)
|
||||||
|
READER_USER=$(parse_ini "$CONFIG" reader username)
|
||||||
|
READER_PASS=$(parse_ini "$CONFIG" reader password)
|
||||||
|
READER_EMAIL=$(parse_ini "$CONFIG" reader email)
|
||||||
|
TOKEN_NAME=$(parse_ini "$CONFIG" reader token_name)
|
||||||
|
TOKEN_SCOPE=$(parse_ini "$CONFIG" reader token_scope)
|
||||||
|
|
||||||
|
if [[ -z "$GITEA_API" || -z "$OWNER_USER" || -z "$OWNER_PASS" || -z "$READER_USER" || -z "$READER_PASS" ]]; then
|
||||||
|
echo "ERROR: missing required fields in config.ini"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
READER_EMAIL="${READER_EMAIL:-${READER_USER}@noreply.local}"
|
||||||
|
TOKEN_NAME="${TOKEN_NAME:-installer-readonly}"
|
||||||
|
TOKEN_SCOPE="${TOKEN_SCOPE:-read:repository}"
|
||||||
|
|
||||||
|
echo "=== Gitea Reader Account Setup ==="
|
||||||
|
echo "Server: $GITEA_API"
|
||||||
|
echo "Owner: $OWNER_USER"
|
||||||
|
echo "Reader: $READER_USER"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Step 1: Create reader account ---
|
||||||
|
echo "[1/4] Creating reader account '$READER_USER'..."
|
||||||
|
HTTP_CODE=$(curl -s -o /tmp/gitea_create_user.json -w "%{http_code}" \
|
||||||
|
-X POST "$GITEA_API/admin/users" \
|
||||||
|
-u "$OWNER_USER:$OWNER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "{
|
||||||
|
\"username\": \"$READER_USER\",
|
||||||
|
\"password\": \"$READER_PASS\",
|
||||||
|
\"email\": \"$READER_EMAIL\",
|
||||||
|
\"must_change_password\": false,
|
||||||
|
\"visibility\": \"public\"
|
||||||
|
}")
|
||||||
|
|
||||||
|
if [[ "$HTTP_CODE" == "201" ]]; then
|
||||||
|
echo " -> Account created."
|
||||||
|
elif [[ "$HTTP_CODE" == "422" ]]; then
|
||||||
|
echo " -> Account already exists (422), continuing."
|
||||||
|
else
|
||||||
|
echo " -> ERROR: HTTP $HTTP_CODE"
|
||||||
|
cat /tmp/gitea_create_user.json
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Step 2: Activate account ---
|
||||||
|
echo "[2/4] Activating account and setting visibility..."
|
||||||
|
curl -s -o /dev/null -w "" \
|
||||||
|
-X PATCH "$GITEA_API/admin/users/$READER_USER" \
|
||||||
|
-u "$OWNER_USER:$OWNER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d '{"active": true, "visibility": "public", "login_name": "'"$READER_USER"'"}'
|
||||||
|
echo " -> Done."
|
||||||
|
|
||||||
|
# --- Step 3: Delete existing token with same name (if any) ---
|
||||||
|
echo "[3/4] Cleaning up old tokens..."
|
||||||
|
curl -s -o /dev/null -w "" \
|
||||||
|
-X DELETE "$GITEA_API/users/$READER_USER/tokens/$TOKEN_NAME" \
|
||||||
|
-u "$READER_USER:$READER_PASS" 2>/dev/null || true
|
||||||
|
echo " -> Done."
|
||||||
|
|
||||||
|
# --- Step 4: Create API token ---
|
||||||
|
echo "[4/4] Creating API token '$TOKEN_NAME' (scope: $TOKEN_SCOPE)..."
|
||||||
|
TOKEN_RESPONSE=$(curl -s \
|
||||||
|
-X POST "$GITEA_API/users/$READER_USER/tokens" \
|
||||||
|
-u "$READER_USER:$READER_PASS" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "{\"name\": \"$TOKEN_NAME\", \"scopes\": [\"$TOKEN_SCOPE\"]}")
|
||||||
|
|
||||||
|
TOKEN_VALUE=$(echo "$TOKEN_RESPONSE" | grep -o '"sha1":"[^"]*"' | sed 's/"sha1":"//;s/"//')
|
||||||
|
|
||||||
|
if [[ -z "$TOKEN_VALUE" ]]; then
|
||||||
|
echo " -> ERROR: Failed to extract token from response:"
|
||||||
|
echo "$TOKEN_RESPONSE"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo " -> Token created: ${TOKEN_VALUE:0:8}..."
|
||||||
|
|
||||||
|
# --- Write token back to config.ini ---
|
||||||
|
if grep -q "^token\s*=" "$CONFIG" 2>/dev/null; then
|
||||||
|
sed -i "s|^token\s*=.*|token = $TOKEN_VALUE|" "$CONFIG"
|
||||||
|
else
|
||||||
|
# Add token under [reader] section
|
||||||
|
sed -i "/^\[reader\]/,/^\[/{
|
||||||
|
/^token_scope/a token = $TOKEN_VALUE
|
||||||
|
}" "$CONFIG"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== Setup Complete ==="
|
||||||
|
echo "Reader account: $READER_USER"
|
||||||
|
echo "Token (first 8): ${TOKEN_VALUE:0:8}..."
|
||||||
|
echo "Token written to: $CONFIG"
|
||||||
|
echo ""
|
||||||
|
echo "Next steps:"
|
||||||
|
echo " bash scripts/grant-access.sh <repo-name>"
|
||||||
|
echo " bash scripts/test-access.sh <repo-name>"
|
||||||
93
scripts/test-access.sh
Executable file
93
scripts/test-access.sh
Executable file
@@ -0,0 +1,93 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
CONFIG="${SCRIPT_DIR}/../config.ini"
|
||||||
|
|
||||||
|
REPO="${1:-}"
|
||||||
|
[[ -n "${2:-}" ]] && CONFIG="$2"
|
||||||
|
|
||||||
|
if [[ ! -f "$CONFIG" ]]; then
|
||||||
|
echo "ERROR: config file not found: $CONFIG"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Parse INI ---
|
||||||
|
parse_ini() {
|
||||||
|
local file="$1" section="$2" key="$3"
|
||||||
|
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
|
||||||
|
}
|
||||||
|
|
||||||
|
GITEA_URL=$(parse_ini "$CONFIG" gitea url)
|
||||||
|
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
|
||||||
|
OWNER_USER=$(parse_ini "$CONFIG" owner username)
|
||||||
|
READER_USER=$(parse_ini "$CONFIG" reader username)
|
||||||
|
TOKEN=$(parse_ini "$CONFIG" reader token)
|
||||||
|
|
||||||
|
if [[ -z "$TOKEN" ]]; then
|
||||||
|
echo "ERROR: No token found in config.ini. Run setup-reader.sh first."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
PASS=0
|
||||||
|
FAIL=0
|
||||||
|
|
||||||
|
check() {
|
||||||
|
local desc="$1" expected="$2" actual="$3"
|
||||||
|
if [[ "$actual" == "$expected" ]]; then
|
||||||
|
echo " PASS: $desc (HTTP $actual)"
|
||||||
|
((PASS++))
|
||||||
|
else
|
||||||
|
echo " FAIL: $desc (expected $expected, got $actual)"
|
||||||
|
((FAIL++))
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "=== Access Test for '$READER_USER' ==="
|
||||||
|
echo "Server: $GITEA_API"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Test 1: Token is valid (list repos) ---
|
||||||
|
echo "[Test 1] Token validity — list repos..."
|
||||||
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||||
|
-H "Authorization: token $TOKEN" \
|
||||||
|
"$GITEA_API/user/repos")
|
||||||
|
check "GET /user/repos with token" "200" "$HTTP_CODE"
|
||||||
|
|
||||||
|
# --- Test 2: Token scope limitation (should NOT access admin endpoints) ---
|
||||||
|
echo "[Test 2] Token scope — admin API should be denied..."
|
||||||
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||||
|
-H "Authorization: token $TOKEN" \
|
||||||
|
"$GITEA_API/admin/users")
|
||||||
|
check "GET /admin/users with read-only token" "403" "$HTTP_CODE"
|
||||||
|
|
||||||
|
if [[ -n "$REPO" ]]; then
|
||||||
|
echo ""
|
||||||
|
echo "[Test 3] Repo access — $OWNER_USER/$REPO..."
|
||||||
|
|
||||||
|
# --- Test 3a: Access with token ---
|
||||||
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||||
|
-H "Authorization: token $TOKEN" \
|
||||||
|
"$GITEA_API/repos/$OWNER_USER/$REPO")
|
||||||
|
check "GET /repos/$OWNER_USER/$REPO with token" "200" "$HTTP_CODE"
|
||||||
|
|
||||||
|
# --- Test 3b: Access without token (private repo should be 404) ---
|
||||||
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||||
|
"$GITEA_API/repos/$OWNER_USER/$REPO")
|
||||||
|
check "GET /repos/$OWNER_USER/$REPO without token (expect 404)" "404" "$HTTP_CODE"
|
||||||
|
|
||||||
|
# --- Test 3c: Clone URL with token ---
|
||||||
|
echo ""
|
||||||
|
echo "[Info] Clone URL for scripts/installers:"
|
||||||
|
echo " git clone https://${READER_USER}:${TOKEN}@${GITEA_URL#https://}/${OWNER_USER}/${REPO}.git"
|
||||||
|
echo " (or use: Authorization: token $TOKEN header)"
|
||||||
|
else
|
||||||
|
echo ""
|
||||||
|
echo "[Info] Pass a repo name to test specific repo access:"
|
||||||
|
echo " $0 <repo-name>"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== Results: $PASS passed, $FAIL failed ==="
|
||||||
|
[[ "$FAIL" -gt 0 ]] && exit 1
|
||||||
|
exit 0
|
||||||
Reference in New Issue
Block a user