ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-14 00:43:22 +09:00
Code Issues Projects Releases Wiki Activity

chore: fix system users (#39299)

Browse Source
This commit is contained in:
wxiaoguang
2026-09-12 16:26:20 +00:00
committed by GitHub
parent 1e13badb39
commit 1280de5704
14 changed files with 26 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/audit.go
+1 -1
View File
@@ -13,5 +13,5 @@ import (
func cliAuditContext(ctx context.Context) context.Context {
ctx = audit.WithOrigin(ctx, audit_model.OriginCLI)
return audit.WithDoer(ctx, user_model.NewCLIUser())
return audit.WithDoer(ctx, user_model.NewCliUser())
}
models/user/user.go
+1 -1
View File
@@ -580,7 +580,7 @@ var globalVars = sync.OnceValue(func() *globalVarsStruct {
emailRegexp: regexp.MustCompile("^[a-zA-Z0-9.!#$%&'*+-/=?^_`{|}~]*@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$"),
}
userFuncs := []func() *User{NewGhostUser, NewActionsUser, NewDeployKeyUser}
userFuncs := []func() *User{NewGhostUser, NewActionsUser, NewDeployKeyUser, NewCliUser, NewAuthSourceUser}
ret.systemUserNewFuncs = map[int64]func() *User{}
ret.systemUserNameIdMap = map[string]int64{}
for _, fn := range userFuncs {
models/user/user_system.go
+12 -25
View File
@@ -47,8 +47,10 @@ func newSystemUser(id int64, name, fullName string) *User {
}
const (
ActionsUserID int64 = -2
DeployKeyUserID int64 = -3
ActionsUserID int64 = -2
DeployKeyUserID int64 = -3
CliUserID int64 = -4
AuthSourceUserID int64 = -5
)
// NewActionsUser creates and returns a fake user for running the actions.
@@ -90,30 +92,14 @@ func NewDeployKeyUserWithKeyID(id int64) *User {
return u
}
const (
CLIUserID int64 = -4
CLIUserName = "CLI"
)
func NewCLIUser() *User {
return &User{
ID: CLIUserID,
Name: CLIUserName,
LowerName: strings.ToLower(CLIUserName),
}
func NewCliUser() *User {
// for audit log only
return newSystemUser(CliUserID, "(gitea-cli)", "Gitea CLI")
}
const (
AuthenticationSourceUserID int64 = -5
AuthenticationSourceUserName = "AuthenticationSource"
)
func NewAuthenticationSourceUser() *User {
return &User{
ID: AuthenticationSourceUserID,
Name: AuthenticationSourceUserName,
LowerName: strings.ToLower(AuthenticationSourceUserName),
}
func NewAuthSourceUser() *User {
// for audit log only
return newSystemUser(AuthSourceUserID, "(gitea-auth-source)", "Gitea Auth Source")
}
func GetSystemUserByName(name string) *User {
@@ -125,7 +111,7 @@ func GetSystemUserByName(name string) *User {
return nil
}
func GetDoerUser(ctx context.Context, id int64, extDoerData string) (u *User, _ error) {
func GetDoerPermissionUser(ctx context.Context, id int64, extDoerData string) (u *User, _ error) {
if id > 0 {
return GetUserByID(ctx, id)
}
@@ -137,6 +123,7 @@ func GetDoerUser(ctx context.Context, id int64, extDoerData string) (u *User, _
u = NewDeployKeyUser()
u.ExtDoerData = &extDoerDeployKey{}
default:
// other system users are not real doers for the permission system
return nil, ErrUserNotExist{UID: id}
}
return u, u.ExtDoerData.DecodeFromString(extDoerData)
routers/private/internal_repo.go
+1 -1
View File
@@ -45,7 +45,7 @@ func loadRepository(ctx *gitea_context.PrivateContext, ownerName, repoName strin
}
func loadContextDoerPermission(ctx *gitea_context.PrivateContext, userID int64, extDoerData string) bool {
doer, err := user.GetDoerUser(ctx, userID, extDoerData)
doer, err := user.GetDoerPermissionUser(ctx, userID, extDoerData)
if err != nil {
ctx.PrivateInternalErrorf("Failed to get user: %d, error: %v", userID, err)
return false
routers/web/auth/oauth.go
+2 -2
View File
@@ -420,7 +420,7 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m
// Register last login
opts.SetLastLogin = true
if err := user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser()), u, opts); err != nil {
if err := user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthSourceUser()), u, opts); err != nil {
ctx.ServerError("UpdateUser", err)
return
}
@@ -449,7 +449,7 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m
}
if opts.IsActive.Has() || opts.IsAdmin.Has() || opts.IsRestricted.Has() {
if err := user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser()), u, opts); err != nil {
if err := user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthSourceUser()), u, opts); err != nil {
ctx.ServerError("UpdateUser", err)
return
}
routers/web/auth/oauth_signin_sync.go
+1 -1
View File
@@ -55,7 +55,7 @@ func oauth2SignInSync(ctx *context.Context, authSourceID int64, u *user_model.Us
// sync user flags (admin/restricted)
isAdmin, isRestricted := getUserAdminAndRestrictedFromGroupClaims(oauth2Source, &gothUser)
if isAdmin.Has() || isRestricted.Has() {
if err = user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser()), u, &user_service.UpdateOptions{IsAdmin: isAdmin, IsRestricted: isRestricted}); err != nil {
if err = user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthSourceUser()), u, &user_service.UpdateOptions{IsAdmin: isAdmin, IsRestricted: isRestricted}); err != nil {
log.Error("Unable to sync OAuth2 user admin or restricted status %s: %v", gothUser.Provider, err)
}
}
services/auth/reverseproxy.go
+1 -1
View File
@@ -173,7 +173,7 @@ func (r *ReverseProxy) newUser(req *http.Request) *user_model.User {
return nil
}
audit.RecordAs(req.Context(), user_model.NewAuthenticationSourceUser(), audit_model.UserCreate, user)
audit.RecordAs(req.Context(), user_model.NewAuthSourceUser(), audit_model.UserCreate, user)
return user
}
services/auth/source/ldap/source_authenticate.go
+1 -1
View File
@@ -23,7 +23,7 @@ import (
// Authenticate queries if login/password is valid against the LDAP directory pool,
// and create a local user if success when enabled.
func (source *Source) Authenticate(ctx context.Context, user *user_model.User, userName, password string) (*user_model.User, error) {
ctx = audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser())
ctx = audit.WithDoer(ctx, user_model.NewAuthSourceUser())
loginName := userName
if user != nil {
services/auth/source/ldap/source_sync.go
+1 -1
View File
@@ -28,7 +28,7 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
// everything this sync changes is attributed to the authentication source,
// not to a signed-in user
ctx = audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser())
ctx = audit.WithDoer(ctx, user_model.NewAuthSourceUser())
isAttributeSSHPublicKeySet := strings.TrimSpace(source.AttributeSSHPublicKey) != ""
var sshKeysNeedUpdate bool
services/auth/source/pam/source_authenticate.go
+1 -1
View File
@@ -68,7 +68,7 @@ func (source *Source) Authenticate(ctx context.Context, user *user_model.User, u
return user, err
}
audit.RecordAs(ctx, user_model.NewAuthenticationSourceUser(), audit_model.UserCreate, user)
audit.RecordAs(ctx, user_model.NewAuthSourceUser(), audit_model.UserCreate, user)
return user, nil
}
services/auth/source/smtp/source_authenticate.go
+1 -1
View File
@@ -85,7 +85,7 @@ func (source *Source) Authenticate(ctx context.Context, user *user_model.User, u
return user, err
}
audit.RecordAs(ctx, user_model.NewAuthenticationSourceUser(), audit_model.UserCreate, user)
audit.RecordAs(ctx, user_model.NewAuthSourceUser(), audit_model.UserCreate, user)
return user, nil
}
services/auth/source/source_group_sync.go
+1 -1
View File
@@ -33,7 +33,7 @@ func SyncGroupsToTeams(ctx context.Context, user *user_model.User, sourceUserGro
// SyncGroupsToTeamsCached maps authentication source groups to organization and team memberships
func SyncGroupsToTeamsCached(ctx context.Context, user *user_model.User, sourceUserGroups container.Set[string], sourceGroupTeamMapping map[string]map[string][]string, performRemoval bool, orgCache map[string]*organization.Organization, teamCache map[string]*organization.Team) error {
// team membership changes here come from the authentication source mapping
ctx = audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser())
ctx = audit.WithDoer(ctx, user_model.NewAuthSourceUser())
membershipsToAdd, membershipsToRemove := resolveMappedMemberships(sourceUserGroups, sourceGroupTeamMapping)
services/auth/sspi.go
+1 -1
View File
@@ -173,7 +173,7 @@ func (s *SSPI) newUser(ctx context.Context, username string, cfg *sspi.Source) (
return nil, err
}
audit.RecordAs(ctx, user_model.NewAuthenticationSourceUser(), audit_model.UserCreate, user)
audit.RecordAs(ctx, user_model.NewAuthSourceUser(), audit_model.UserCreate, user)
return user, nil
}
services/lfs/server.go
+1 -1
View File
@@ -598,7 +598,7 @@ func handleLFSToken(ctx stdCtx.Context, tokenSHA string, target *repo_model.Repo
return nil, errors.New("invalid token claim")
}
u, err := user_model.GetDoerUser(ctx, claims.UserID, claims.UserExtDoerData)
u, err := user_model.GetDoerPermissionUser(ctx, claims.UserID, claims.UserExtDoerData)
if err != nil {
log.Error("Unable to GetDoerUser[%d]: Error: %v", claims.UserID, err)
return nil, err