From 0e2a188d8ece164a7a76664df6f928a3fdcbd2a4 Mon Sep 17 00:00:00 2001 From: Giteabot Date: Fri, 16 Oct 2026 12:40:16 -0700 Subject: [PATCH] enhance(oauth): pre-register a builtin OAuth2 application for gitea-vscode (#39785) (#39801) Backport #39785 by @bircni The [Gitea VS Code extension](https://gitea.com/gitea/gitea-vscode) currently signs in through the builtin `tea` OAuth2 application. Gitea keeps one grant per user and application, so anyone who has already signed in with the tea CLI gets `a grant exists with different scope` when the extension requests its own scopes, and sign-in fails (gitea/gitea-vscode#24). This adds a dedicated builtin application for the extension, following the same mechanism as the existing CLI entries: | | | |---|---| | client ID | `75a9ec3e-42b5-40cb-9144-9ea96ecd56a6` | | config name | `gitea-vscode` | | display name | `gitea-vscode` | | redirect URIs | `http://127.0.0.1`, `https://127.0.0.1` (loopback, any port) | It is enabled by default via `[oauth2].DEFAULT_APPLICATIONS`. Instances that set that option explicitly need to add `gitea-vscode` to use it. The extension will use this client on Gitea >= 28.2.0 and keep falling back to `tea` on older servers, so this should be backported to v28. Co-authored-by: bircni --- custom/conf/app.example.ini | 3 ++- models/auth/oauth2.go | 10 ++++++++++ modules/setting/oauth2.go | 2 +- modules/setting/oauth2_test.go | 2 +- 4 files changed, 14 insertions(+), 3 deletions(-) diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini index 8fe4adc9b6c..43c40c0fc0c 100644 --- a/custom/conf/app.example.ini +++ b/custom/conf/app.example.ini @@ -638,7 +638,8 @@ ENABLED = true ;; * https://github.com/git-ecosystem/git-credential-manager ;; * https://gitea.com/gitea/tea ;; * Gitea App (the official Gitea mobile app) -;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app +;; * https://gitea.com/gitea/gitea-vscode +;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app, gitea-vscode ;; ;; By default, OAuth2 applications can only use "http" and "https" as their redirect URI schemes. ;; If you need to use other schemes (e.g. for desktop applications), you can specify them here as a comma-separated list. diff --git a/models/auth/oauth2.go b/models/auth/oauth2.go index 5a018922d31..87d566b43cf 100644 --- a/models/auth/oauth2.go +++ b/models/auth/oauth2.go @@ -88,6 +88,16 @@ func BuiltinApplications() map[string]*BuiltinOAuth2Application { DisplayName: "Gitea App", RedirectURIs: []string{"com.gitea.app://oauth/callback"}, } + m["75a9ec3e-42b5-40cb-9144-9ea96ecd56a6"] = &BuiltinOAuth2Application{ + ConfigName: "gitea-vscode", + DisplayName: "gitea-vscode", + RedirectURIs: []string{ + "http://127.0.0.1", + "https://127.0.0.1", + "vscode://gitea.gitea-for-vscode/auth/callback", + "vscode-insiders://gitea.gitea-for-vscode/auth/callback", + }, + } return m } diff --git a/modules/setting/oauth2.go b/modules/setting/oauth2.go index 94bdf780dd4..d68b4344578 100644 --- a/modules/setting/oauth2.go +++ b/modules/setting/oauth2.go @@ -108,7 +108,7 @@ var OAuth2 = struct { JWTSigningAlgorithm: "RS256", JWTSigningPrivateKeyFile: "jwt/private.pem", MaxTokenLength: math.MaxInt16, - DefaultApplications: []string{"git-credential-oauth", "git-credential-manager", "tea", "gitea-app"}, + DefaultApplications: []string{"git-credential-oauth", "git-credential-manager", "tea", "gitea-app", "gitea-vscode"}, } func loadOAuth2From(rootCfg ConfigProvider) { diff --git a/modules/setting/oauth2_test.go b/modules/setting/oauth2_test.go index 7da186a9f49..4e5a647741a 100644 --- a/modules/setting/oauth2_test.go +++ b/modules/setting/oauth2_test.go @@ -62,7 +62,7 @@ func TestGetGeneralSigningSecretSave(t *testing.T) { func TestOauth2DefaultApplications(t *testing.T) { cfg, _ := NewConfigProviderFromData(``) loadOAuth2From(cfg) - assert.Equal(t, []string{"git-credential-oauth", "git-credential-manager", "tea", "gitea-app"}, OAuth2.DefaultApplications) + assert.Equal(t, []string{"git-credential-oauth", "git-credential-manager", "tea", "gitea-app", "gitea-vscode"}, OAuth2.DefaultApplications) cfg, _ = NewConfigProviderFromData(`[oauth2] DEFAULT_APPLICATIONS = tea