295afe9b2a
Three-layer access scheme: owner -> reader account -> scoped API token. Includes 6 automation scripts, config template, EN/RU docs, and manual curl guide. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
121 lines
3.8 KiB
Bash
Executable File
121 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
CONFIG="${1:-$SCRIPT_DIR/../config.ini}"
|
|
|
|
if [[ ! -f "$CONFIG" ]]; then
|
|
echo "ERROR: config file not found: $CONFIG"
|
|
echo "Usage: $0 [path/to/config.ini]"
|
|
echo "Copy config.example.ini to config.ini and fill in your values."
|
|
exit 1
|
|
fi
|
|
|
|
# --- Parse INI ---
|
|
parse_ini() {
|
|
local file="$1" section="$2" key="$3"
|
|
sed -n "/^\[$section\]/,/^\[/p" "$file" | grep "^${key}\s*=" | head -1 | sed 's/^[^=]*=\s*//' | sed 's/\s*$//'
|
|
}
|
|
|
|
GITEA_API=$(parse_ini "$CONFIG" gitea api_url)
|
|
OWNER_USER=$(parse_ini "$CONFIG" owner username)
|
|
OWNER_PASS=$(parse_ini "$CONFIG" owner password)
|
|
READER_USER=$(parse_ini "$CONFIG" reader username)
|
|
READER_PASS=$(parse_ini "$CONFIG" reader password)
|
|
READER_EMAIL=$(parse_ini "$CONFIG" reader email)
|
|
TOKEN_NAME=$(parse_ini "$CONFIG" reader token_name)
|
|
TOKEN_SCOPE=$(parse_ini "$CONFIG" reader token_scope)
|
|
|
|
if [[ -z "$GITEA_API" || -z "$OWNER_USER" || -z "$OWNER_PASS" || -z "$READER_USER" || -z "$READER_PASS" ]]; then
|
|
echo "ERROR: missing required fields in config.ini"
|
|
exit 1
|
|
fi
|
|
|
|
READER_EMAIL="${READER_EMAIL:-${READER_USER}@noreply.local}"
|
|
TOKEN_NAME="${TOKEN_NAME:-installer-readonly}"
|
|
TOKEN_SCOPE="${TOKEN_SCOPE:-read:repository}"
|
|
|
|
echo "=== Gitea Reader Account Setup ==="
|
|
echo "Server: $GITEA_API"
|
|
echo "Owner: $OWNER_USER"
|
|
echo "Reader: $READER_USER"
|
|
echo ""
|
|
|
|
# --- Step 1: Create reader account ---
|
|
echo "[1/4] Creating reader account '$READER_USER'..."
|
|
HTTP_CODE=$(curl -s -o /tmp/gitea_create_user.json -w "%{http_code}" \
|
|
-X POST "$GITEA_API/admin/users" \
|
|
-u "$OWNER_USER:$OWNER_PASS" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"username\": \"$READER_USER\",
|
|
\"password\": \"$READER_PASS\",
|
|
\"email\": \"$READER_EMAIL\",
|
|
\"must_change_password\": false,
|
|
\"visibility\": \"public\"
|
|
}")
|
|
|
|
if [[ "$HTTP_CODE" == "201" ]]; then
|
|
echo " -> Account created."
|
|
elif [[ "$HTTP_CODE" == "422" ]]; then
|
|
echo " -> Account already exists (422), continuing."
|
|
else
|
|
echo " -> ERROR: HTTP $HTTP_CODE"
|
|
cat /tmp/gitea_create_user.json
|
|
exit 1
|
|
fi
|
|
|
|
# --- Step 2: Activate account ---
|
|
echo "[2/4] Activating account and setting visibility..."
|
|
curl -s -o /dev/null -w "" \
|
|
-X PATCH "$GITEA_API/admin/users/$READER_USER" \
|
|
-u "$OWNER_USER:$OWNER_PASS" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"active": true, "visibility": "public", "login_name": "'"$READER_USER"'"}'
|
|
echo " -> Done."
|
|
|
|
# --- Step 3: Delete existing token with same name (if any) ---
|
|
echo "[3/4] Cleaning up old tokens..."
|
|
curl -s -o /dev/null -w "" \
|
|
-X DELETE "$GITEA_API/users/$READER_USER/tokens/$TOKEN_NAME" \
|
|
-u "$READER_USER:$READER_PASS" 2>/dev/null || true
|
|
echo " -> Done."
|
|
|
|
# --- Step 4: Create API token ---
|
|
echo "[4/4] Creating API token '$TOKEN_NAME' (scope: $TOKEN_SCOPE)..."
|
|
TOKEN_RESPONSE=$(curl -s \
|
|
-X POST "$GITEA_API/users/$READER_USER/tokens" \
|
|
-u "$READER_USER:$READER_PASS" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"name\": \"$TOKEN_NAME\", \"scopes\": [\"$TOKEN_SCOPE\"]}")
|
|
|
|
TOKEN_VALUE=$(echo "$TOKEN_RESPONSE" | grep -o '"sha1":"[^"]*"' | sed 's/"sha1":"//;s/"//')
|
|
|
|
if [[ -z "$TOKEN_VALUE" ]]; then
|
|
echo " -> ERROR: Failed to extract token from response:"
|
|
echo "$TOKEN_RESPONSE"
|
|
exit 1
|
|
fi
|
|
|
|
echo " -> Token created: ${TOKEN_VALUE:0:8}..."
|
|
|
|
# --- Write token back to config.ini ---
|
|
if grep -q "^token\s*=" "$CONFIG" 2>/dev/null; then
|
|
sed -i "s|^token\s*=.*|token = $TOKEN_VALUE|" "$CONFIG"
|
|
else
|
|
# Add token under [reader] section
|
|
sed -i "/^\[reader\]/,/^\[/{
|
|
/^token_scope/a token = $TOKEN_VALUE
|
|
}" "$CONFIG"
|
|
fi
|
|
|
|
echo ""
|
|
echo "=== Setup Complete ==="
|
|
echo "Reader account: $READER_USER"
|
|
echo "Token (first 8): ${TOKEN_VALUE:0:8}..."
|
|
echo "Token written to: $CONFIG"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " bash scripts/grant-access.sh <repo-name>"
|
|
echo " bash scripts/test-access.sh <repo-name>"
|