feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

services/auth/basic.go

@@ -82,6 +82,9 @@ func (b *Basic) VerifyAuthToken(req *http.Request, w http.ResponseWriter, store
 			log.Error("GetUserByID:  %v", err)
 			return nil, err
 		}
+		if !u.IsIndividual() {
+			return nil, nil //nolint:nilnil // the auth method is not applicable
+		}
 
 		store.GetData()["LoginMethod"] = OAuth2TokenMethodName
 		store.GetData()["ApiTokenScope"] = accessTokenScope

services/auth/oauth2.go

@@ -120,11 +120,13 @@ func (o *OAuth2) userFromToken(ctx context.Context, tokenSHA string, store DataS
 
 		// Otherwise, check if this is an OAuth access token
 		accessTokenScope, uid, grantID := GetOAuthAccessTokenScopeAndUserID(ctx, tokenSHA)
-		if uid != 0 {
-			store.GetData()["ApiTokenScope"] = accessTokenScope
-			setAuthCredential(store, credentialOAuth2Grant, grantID)
+		user, err := user_model.GetUserByID(ctx, uid)
+		if err != nil || !user.IsIndividual() {
+			return nil, err
 		}
-		return user_model.GetUserByID(ctx, uid)
+		store.GetData()["ApiTokenScope"] = accessTokenScope
+		setAuthCredential(store, credentialOAuth2Grant, grantID)
+		return user, nil
 	}
 	t, err := auth_model.GetAccessTokenBySHA(ctx, tokenSHA)
 	if err != nil {

services/auth/reverseproxy.go

@@ -114,9 +114,9 @@ func (r *ReverseProxy) Verify(req *http.Request, w http.ResponseWriter, store Da
 	}
 	if user == nil {
 		user = r.getUserFromAuthEmail(req)
-		if user == nil {
-			return nil, nil //nolint:nilnil // the auth method is not applicable
-		}
+	}
+	if user == nil || !user.IsIndividual() {
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	if r.CreateSession && sess != nil {

services/auth/reverseproxy_test.go

@@ -4,6 +4,7 @@
 package auth
 
 import (
+	"net/http"
 	"testing"
 
 	"gitea.dev/models/unittest"
@@ -17,6 +18,22 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestReverseProxyIgnoresBot(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	defer test.MockVariableValue(&setting.ReverseProxyAuthUser, "X-WEBAUTH-USER")()
+	defer test.MockVariableValue(&setting.ReverseProxyAuthEmail, "X-WEBAUTH-EMAIL")()
+	defer test.MockVariableValue(&setting.Service.EnableReverseProxyEmail, true)()
+	require.NoError(t, user_model.UpdateUserCols(t.Context(), &user_model.User{ID: 2, Type: user_model.UserTypeBot}, "type"))
+
+	req, err := http.NewRequest(http.MethodGet, "/", nil)
+	require.NoError(t, err)
+	req.Header.Set(setting.ReverseProxyAuthUser, "user2")
+	req.Header.Set(setting.ReverseProxyAuthEmail, "user2@example.com")
+	user, err := (&ReverseProxy{}).Verify(req, nil, nil, nil)
+	require.NoError(t, err)
+	assert.Nil(t, user)
+}
+
 func TestReverseProxyLastLogin(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	defer test.MockVariableValue(&setting.ReverseProxyAuthUser, "X-WEBAUTH-USER")()

services/auth/session.go

@@ -50,6 +50,12 @@ func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataSto
 		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
+	// sessions can't be enumerated per user, so one opened before a conversion to bot is rejected here
+	if !user.IsIndividual() {
+		log.Trace("Session Authorization: user %-v is not an individual, ignoring the session", user)
+		return nil, nil //nolint:nilnil // the auth method is not applicable
+	}
+
 	log.Trace("Session Authorization: Logged in user %-v", user)
 	return user, nil
 }

services/auth/session_test.go

@@ -0,0 +1,38 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+	"net/http"
+	"testing"
+
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/session"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSessionVerify(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	req, err := http.NewRequest(http.MethodGet, "/", nil)
+	require.NoError(t, err)
+
+	sess := session.NewMockMemStore("dummy-sid")
+	method := &Session{}
+
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	require.NoError(t, sess.Set(session.KeyUID, user.ID))
+	u, err := method.Verify(req, nil, nil, sess)
+	assert.NoError(t, err)
+	require.NotNil(t, u)
+	assert.Equal(t, user.ID, u.ID)
+
+	require.NoError(t, user_model.UpdateUserCols(t.Context(), &user_model.User{ID: user.ID, Type: user_model.UserTypeBot}, "type"))
+	u, err = method.Verify(req, nil, nil, sess)
+	assert.NoError(t, err)
+	assert.Nil(t, u)
+}

services/auth/signin.go

@@ -122,10 +122,14 @@ func UserSignIn(ctx context.Context, username, password string) (*user_model.Use
 		authUser, err := authenticator.Authenticate(ctx, nil, username, password)
 
 		if err == nil {
-			if !authUser.ProhibitLogin {
+			switch {
+			case !authUser.IsIndividual():
+				err = user_model.ErrUserNotExist{Name: username}
+			case authUser.ProhibitLogin:
+				err = user_model.ErrUserProhibitLogin{UID: authUser.ID, Name: authUser.Name}
+			default:
 				return authUser, source, nil
 			}
-			err = user_model.ErrUserProhibitLogin{UID: authUser.ID, Name: authUser.Name}
 		}
 
 		if user_model.IsErrUserNotExist(err) {

services/auth/signin_test.go

@@ -0,0 +1,47 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+	"context"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type mockBotSource struct {
+	auth_model.ConfigBase
+}
+
+func (s *mockBotSource) FromDB(bs []byte) error { return nil }
+func (s *mockBotSource) ToDB() ([]byte, error)  { return []byte("{}"), nil }
+
+func (s *mockBotSource) Authenticate(ctx context.Context, _ *user_model.User, login, _ string) (*user_model.User, error) {
+	return user_model.GetUserByName(ctx, login)
+}
+
+const mockBotSourceType auth_model.Type = 100
+
+func TestUserSignIn_BotCannotSignIn(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	auth_model.RegisterTypeConfig(mockBotSourceType, &mockBotSource{})
+
+	bot := &user_model.User{Name: "test-bot", Email: "test-bot@example.com", Type: user_model.UserTypeBot, IsActive: true}
+	require.NoError(t, user_model.AdminCreateUser(t.Context(), bot, &user_model.Meta{}))
+	require.NoError(t, db.Insert(t.Context(), &auth_model.Source{
+		Type:     mockBotSourceType,
+		Name:     "mock-bot-source",
+		IsActive: true,
+		Cfg:      &mockBotSource{},
+	}))
+
+	_, _, err := UserSignIn(t.Context(), "test-bot", "")
+	assert.ErrorAs(t, err, &user_model.ErrUserNotExist{})
+}

services/auth/sspi.go

@@ -119,6 +119,9 @@ func (s *SSPI) Verify(req *http.Request, w http.ResponseWriter, store DataStore,
 			log.Error("CreateUser: %v", err)
 			return nil, err
 		}
+	} else if !user.IsIndividual() {
+		log.Trace("SSPI Authorization: user %q is not an individual, ignoring", username)
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	if s.CreateSession {