feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

models/activities/notification.go

@@ -125,7 +125,10 @@ func CreateRepoTransferNotification(ctx context.Context, doer, newOwner *user_mo
 			if err != nil || len(users) == 0 {
 				return err
 			}
-			for i := range users {
+			for i, user := range users {
+				if user.IsTypeBot() {
+					continue
+				}
 				notify = append(notify, &Notification{
 					UserID:    i,
 					RepoID:    repo.ID,
@@ -134,7 +137,7 @@ func CreateRepoTransferNotification(ctx context.Context, doer, newOwner *user_mo
 					Source:    NotificationSourceRepository,
 				})
 			}
-		} else {
+		} else if !newOwner.IsTypeBot() {
 			notify = []*Notification{{
 				UserID:    newOwner.ID,
 				RepoID:    repo.ID,
@@ -144,6 +147,9 @@ func CreateRepoTransferNotification(ctx context.Context, doer, newOwner *user_mo
 			}}
 		}
 
+		if len(notify) == 0 {
+			return nil
+		}
 		return db.Insert(ctx, notify)
 	})
 }

models/activities/notification_list.go

@@ -168,6 +168,9 @@ func createOrUpdateIssueNotifications(ctx context.Context, issueID, commentID, n
 
 			return nil, err
 		}
+		if user.IsTypeBot() {
+			continue
+		}
 		if issue.IsPull && !access_model.CheckRepoUnitUser(ctx, issue.Repo, user, unit.TypePullRequests) {
 			continue
 		}

models/activities/notification_test.go

@@ -66,6 +66,28 @@ func TestCreateOrUpdateIssueNotificationsIgnored(t *testing.T) {
 	assert.Empty(t, notified)
 }
 
+func TestNotificationsSkipBots(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	for _, id := range []int64{4, 28} {
+		assert.NoError(t, user_model.UpdateUserCols(t.Context(), &user_model.User{ID: id, Type: user_model.UserTypeBot}, "type"))
+	}
+
+	notifiedIDs, err := activities_model.CreateOrUpdateIssueNotifications(t.Context(), 1, 0, 2, 0)
+	assert.NoError(t, err)
+	assert.Contains(t, notifiedIDs, int64(1))
+	assert.NotContains(t, notifiedIDs, int64(4))
+
+	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+	org := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3})
+	assert.NoError(t, activities_model.CreateRepoTransferNotification(t.Context(), doer, org, unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})))
+	unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{UserID: 2, RepoID: 3, Source: activities_model.NotificationSourceRepository})
+	unittest.AssertNotExistsBean(t, &activities_model.Notification{UserID: 28, RepoID: 3, Source: activities_model.NotificationSourceRepository})
+
+	bot := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+	assert.NoError(t, activities_model.CreateRepoTransferNotification(t.Context(), doer, bot, unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})))
+	unittest.AssertNotExistsBean(t, &activities_model.Notification{UserID: 4, RepoID: 1, Source: activities_model.NotificationSourceRepository})
+}
+
 func TestNotificationsForUser(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})

models/audit/action.go

@@ -71,6 +71,7 @@ var (
 	UserActive                      = define("user:status:active", "Changed activation status of user {scope} to {active}.")
 	UserRestricted                  = define("user:status:restricted", "Changed restricted status of user {scope} to {restricted}.")
 	UserAdmin                       = define("user:status:admin", "Changed admin status of user {scope} to {admin}.")
+	UserType                        = define("user:type:update", "Changed type of user {scope} to {user_type}.")
 	UserName                        = define("user:name:update", "Changed user name from {previous_name} to {scope}.")
 	UserPassword                    = define("user:password", "Changed password of user {scope}.")
 	UserPasswordResetRequest        = define("user:password:resetrequest", "Requested password reset for user {scope}.")

models/shared/types/ownertype.go

@@ -19,7 +19,7 @@ func (o OwnerType) LocaleString(locale translation.Locale) string {
 	case OwnerTypeSystemGlobal:
 		return locale.TrString("concept_system_global")
 	case OwnerTypeIndividual:
-		return locale.TrString("concept_user_individual")
+		return locale.TrString("concept_user_user")
 	case OwnerTypeRepository:
 		return locale.TrString("concept_code_repository")
 	case OwnerTypeOrganization:

models/user/error.go

@@ -86,3 +86,9 @@ func IsErrUserIsNotLocal(err error) bool {
 	_, ok := err.(ErrUserIsNotLocal)
 	return ok
 }
+
+var (
+	ErrBotCanNotBeAdmin      = util.NewInvalidArgumentErrorf("bot user can not be a site administrator")
+	ErrBotMustBeLocal        = util.NewInvalidArgumentErrorf("bot user must use local authentication")
+	ErrUserTypeCanNotConvert = util.NewInvalidArgumentErrorf("user type can not be converted")
+)

models/user/search.go

@@ -6,7 +6,6 @@ package user
 import (
 	"context"
 	"fmt"
-	"slices"
 	"strings"
 
 	"gitea.dev/models/db"
@@ -55,7 +54,6 @@ type SearchUserOptions struct {
 	IsRestricted       optional.Option[bool]
 	IsTwoFactorEnabled optional.Option[bool]
 	IsProhibitLogin    optional.Option[bool]
-	IncludeReserved    bool
 }
 
 func (opts *SearchUserOptions) ToOrders() string {
@@ -71,18 +69,6 @@ func (opts *SearchUserOptions) ApplyPublicOnly(publicOnly bool) {
 func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) db.Session {
 	var cond builder.Cond
 	cond = builder.In("type", opts.Types)
-	if opts.IncludeReserved {
-		switch {
-		case slices.Contains(opts.Types, UserTypeIndividual):
-			cond = cond.Or(builder.Eq{"type": UserTypeUserReserved}).Or(
-				builder.Eq{"type": UserTypeBot},
-			).Or(
-				builder.Eq{"type": UserTypeRemoteUser},
-			)
-		case slices.Contains(opts.Types, UserTypeOrganization):
-			cond = cond.Or(builder.Eq{"type": UserTypeOrganizationReserved})
-		}
-	}
 
 	if len(opts.Keyword) > 0 {
 		lowerKeyword := strings.ToLower(opts.Keyword)

models/user/user.go

@@ -68,6 +68,18 @@ const (
 	UserTypeRemoteUser // 5
 )
 
+// DisplayName returns the English name of the user type for logs and the CLI, the UI translates "concept_user_*" instead
+func (t UserType) DisplayName() string {
+	switch t {
+	case UserTypeOrganization, UserTypeOrganizationReserved:
+		return "Organization"
+	case UserTypeBot:
+		return "Bot"
+	default:
+		return "User"
+	}
+}
+
 const (
 	// EmailNotificationsEnabled indicates that the user would like to receive all email notifications except your own
 	EmailNotificationsEnabled = "enabled"
@@ -907,7 +919,7 @@ func GetVerifyUser(ctx context.Context, code string) (user *User) {
 	// use tail hex username query user
 	hexStr := code[base.TimeLimitCodeLength:]
 	if b, err := hex.DecodeString(hexStr); err == nil {
-		if user, err = GetUserByName(ctx, string(b)); user != nil {
+		if user, err = GetUserByName(ctx, string(b)); user != nil && user.IsIndividual() {
 			return user
 		}
 		log.Error("user.getVerifyUser: %v", err)
@@ -962,6 +974,9 @@ func ValidateUser(u *User, cols ...string) error {
 			return fmt.Errorf("visibility Mode not allowed: %s", u.Visibility.String())
 		}
 	}
+	if u.IsAdmin && u.IsTypeBot() {
+		return ErrBotCanNotBeAdmin
+	}
 
 	return nil
 }