mirror of
https://github.com/go-gitea/gitea.git
synced 2026-09-20 19:53:41 +09:00
feat: manage bot accounts from the admin UI, API and CLI (#38966)
Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.
1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This commit is contained in:
Joe (Agent) Stump
co-authored by
Nicolas
joestump
Joe Stump
silverwind
Lunny Xiao
Nicolas
joestump
Joe Stump
silverwind
Lunny Xiao
parent
db7dbd5a6b
commit
3bec08f998
@@ -10,24 +10,41 @@
|
||||
<label for="user_name">{{ctx.Locale.Tr "username"}}</label>
|
||||
<input id="user_name" name="user_name" value="{{.User.Name}}" maxlength="40">
|
||||
</div>
|
||||
<!-- Types and name -->
|
||||
<div class="inline required field {{if .Err_LoginType}}error{{end}}">
|
||||
<label>{{ctx.Locale.Tr "admin.users.auth_source"}}</label>
|
||||
<div class="ui selection type dropdown">
|
||||
<input type="hidden" id="login_type" name="login_type" value="{{.LoginSource.Type.Int}}-{{.LoginSource.ID}}" required>
|
||||
<div class="text">{{ctx.Locale.Tr "admin.users.local"}}</div>
|
||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
|
||||
<div class="menu">
|
||||
<div class="item" data-value="0-0">{{ctx.Locale.Tr "admin.users.local"}}</div>
|
||||
{{range .Sources}}
|
||||
<div class="item" data-value="{{.Type.Int}}-{{.ID}}">{{.Name}}</div>
|
||||
{{end}}
|
||||
{{if .CanConvertUserType}}
|
||||
<div class="required field">
|
||||
<label for="user_type">{{ctx.Locale.Tr "admin.users.user_type"}}</label>
|
||||
<div class="ui selection type dropdown">
|
||||
<input type="hidden" id="user_type" name="user_type" value="{{Iif .User.IsTypeBot "Bot" "User"}}" required>
|
||||
<div class="text">{{ctx.Locale.Tr (Iif .User.IsTypeBot "concept_user_bot" "concept_user_user")}}</div>
|
||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
|
||||
<div class="menu">
|
||||
<div class="item" data-value="User">{{ctx.Locale.Tr "concept_user_user"}}</div>
|
||||
<div class="item" data-value="Bot">{{ctx.Locale.Tr "concept_user_bot"}}</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
{{if not .User.IsTypeBot}}
|
||||
<div class="required js-non-bot field {{if .Err_LoginType}}error{{end}}">
|
||||
<label for="login_type">{{ctx.Locale.Tr "admin.users.auth_source"}}</label>
|
||||
<div class="ui selection type dropdown">
|
||||
<input type="hidden" id="login_type" name="login_type" value="{{.LoginSource.Type.Int}}-{{.LoginSource.ID}}" required>
|
||||
<div class="text">{{ctx.Locale.Tr "admin.users.local"}}</div>
|
||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
|
||||
<div class="menu">
|
||||
<div class="item" data-value="0-0">{{ctx.Locale.Tr "admin.users.local"}}</div>
|
||||
{{range .Sources}}
|
||||
<div class="item" data-value="{{.Type.Int}}-{{.ID}}">{{.Name}}</div>
|
||||
{{end}}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{{else}}
|
||||
<input type="hidden" name="login_type" value="0-0">
|
||||
{{end}}
|
||||
|
||||
<div class="inline field {{if .Err_Visibility}}error{{end}}">
|
||||
<span class="inline required field"><label for="visibility">{{ctx.Locale.Tr "settings.visibility"}}</label></span>
|
||||
<div class="required field {{if .Err_Visibility}}error{{end}}">
|
||||
<label for="visibility">{{ctx.Locale.Tr "settings.visibility"}}</label>
|
||||
<div class="ui selection type dropdown">
|
||||
<input type="hidden" id="visibility" name="visibility" value="{{if .User.Visibility.IsPublic}}0{{else if .User.Visibility.IsLimited}}1{{else}}2{{end}}">
|
||||
<div class="text">
|
||||
@@ -50,7 +67,7 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="required non-local field {{if .Err_LoginName}}error{{end}} {{if eq .User.LoginSource 0}}tw-hidden{{end}}">
|
||||
<div class="required js-non-local js-non-bot field {{if .Err_LoginName}}error{{end}} {{if eq .User.LoginSource 0}}tw-hidden{{end}}">
|
||||
<label for="login_name">{{ctx.Locale.Tr "admin.users.auth_login_name"}}</label>
|
||||
<input id="login_name" name="login_name" value="{{.User.LoginName}}">
|
||||
</div>
|
||||
@@ -62,11 +79,13 @@
|
||||
<label for="email">{{ctx.Locale.Tr "email"}}</label>
|
||||
<input id="email" name="email" type="email" value="{{.User.Email}}" required>
|
||||
</div>
|
||||
<div class="local field {{if .Err_Password}}error{{end}} {{if not (or (.User.IsLocal) (.User.IsOAuth2))}}tw-hidden{{end}}">
|
||||
<label for="password">{{ctx.Locale.Tr "password"}}</label>
|
||||
<input id="password" name="password" type="password" autocomplete="new-password">
|
||||
<p class="help">{{ctx.Locale.Tr "admin.users.password_helper"}}</p>
|
||||
</div>
|
||||
{{if not .User.IsTypeBot}}
|
||||
<div class="js-local js-non-bot field {{if .Err_Password}}error{{end}} {{if not (or .User.IsLocal .User.IsOAuth2)}}tw-hidden{{end}}">
|
||||
<label for="password">{{ctx.Locale.Tr "password"}}</label>
|
||||
<input id="password" name="password" type="password" autocomplete="new-password">
|
||||
<p class="help">{{ctx.Locale.Tr "admin.users.password_helper"}}</p>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
<div class="field {{if .Err_Language}}error{{end}}">
|
||||
<label for="language">{{ctx.Locale.Tr "settings.language"}}</label>
|
||||
@@ -113,12 +132,14 @@
|
||||
<input name="prohibit_login" type="checkbox" {{if .User.ProhibitLogin}}checked{{end}} {{if (eq .User.ID .SignedUserID)}}disabled{{end}}>
|
||||
</div>
|
||||
</div>
|
||||
<div class="inline field">
|
||||
<div class="ui checkbox">
|
||||
<label><strong>{{ctx.Locale.Tr "admin.users.is_admin"}}</strong></label>
|
||||
<input name="admin" type="checkbox" {{if .User.IsAdmin}}checked{{end}}>
|
||||
{{if not .User.IsTypeBot}}
|
||||
<div class="inline js-non-bot field">
|
||||
<div class="ui checkbox">
|
||||
<label><strong>{{ctx.Locale.Tr "admin.users.is_admin"}}</strong></label>
|
||||
<input name="admin" type="checkbox" {{if .User.IsAdmin}}checked{{end}}>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
<div class="inline field">
|
||||
<div class="ui checkbox">
|
||||
<label><strong>{{ctx.Locale.Tr "admin.users.is_restricted"}}</strong></label>
|
||||
|
||||
@@ -18,7 +18,7 @@
|
||||
<span class="text">{{ctx.Locale.Tr "admin.users.list_status_filter.menu_text"}}</span>
|
||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
|
||||
<div class="menu flex-items-menu">
|
||||
<a class="item j-reset-status-filter">{{ctx.Locale.Tr "admin.users.list_status_filter.reset"}}</a>
|
||||
<a class="item js-reset-status-filter">{{ctx.Locale.Tr "admin.users.list_status_filter.reset"}}</a>
|
||||
<div class="divider"></div>
|
||||
<label class="item"><input type="radio" name="status_filter[is_admin]" value="1"> {{ctx.Locale.Tr "admin.users.list_status_filter.is_admin"}}</label>
|
||||
<label class="item"><input type="radio" name="status_filter[is_admin]" value="0"> {{ctx.Locale.Tr "admin.users.list_status_filter.not_admin"}}</label>
|
||||
@@ -37,6 +37,16 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="ui dropdown type jump item">
|
||||
<span class="text">{{ctx.Locale.Tr "admin.users.user_type"}}</span>
|
||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
|
||||
<div class="menu flex-items-menu">
|
||||
<label class="item"><input type="radio" name="user_type" value="" {{if not $.UserTypeFilter}}checked{{end}}> {{ctx.Locale.Tr "all"}}</label>
|
||||
<label class="item"><input type="radio" name="user_type" value="User" {{if eq $.UserTypeFilter "User"}}checked{{end}}> {{ctx.Locale.Tr "concept_user_user"}}</label>
|
||||
<label class="item"><input type="radio" name="user_type" value="Bot" {{if eq $.UserTypeFilter "Bot"}}checked{{end}}> {{ctx.Locale.Tr "concept_user_bot"}}</label>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Sort Menu Item -->
|
||||
<div class="ui dropdown type jump item">
|
||||
<span class="text">
|
||||
@@ -83,14 +93,13 @@
|
||||
<td>
|
||||
<a href="{{.HomeLink}}">{{.Name}}</a>
|
||||
{{if .IsAdmin}}
|
||||
<span class="ui mini label">{{ctx.Locale.Tr "admin.users.admin"}}</span>
|
||||
<span class="ui basic label tw-py-0 tw-align-baseline">{{ctx.Locale.Tr "admin.users.admin"}}</span>
|
||||
{{else if eq 2 .Type}}{{/* Reserved user */}}
|
||||
<span class="ui mini label">{{ctx.Locale.Tr "admin.users.reserved"}}</span>
|
||||
{{else if eq 4 .Type}}{{/* Bot "user" */}}
|
||||
<span class="ui mini label">{{ctx.Locale.Tr "admin.users.bot"}}</span>
|
||||
<span class="ui basic label tw-py-0 tw-align-baseline">{{ctx.Locale.Tr "admin.users.reserved"}}</span>
|
||||
{{else if eq 5 .Type}}{{/* Remote user */}}
|
||||
<span class="ui mini label">{{ctx.Locale.Tr "admin.users.remote"}}</span>
|
||||
<span class="ui basic label tw-py-0 tw-align-baseline">{{ctx.Locale.Tr "admin.users.remote"}}</span>
|
||||
{{end}}
|
||||
{{template "shared/user/user_type_label" .}}
|
||||
</td>
|
||||
<td class="gt-ellipsis tw-max-w-48">{{.Email}}</td>
|
||||
<td>{{svg (Iif .IsActive "octicon-check" "octicon-x")}}</td>
|
||||
|
||||
@@ -6,11 +6,26 @@
|
||||
<div class="ui attached segment">
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{template "base/disable_form_autofill"}}
|
||||
<!-- Types and name -->
|
||||
<div class="inline required field {{if .Err_LoginType}}error{{end}}">
|
||||
<label>{{ctx.Locale.Tr "admin.users.auth_source"}}</label>
|
||||
<div class="required field {{if .Err_UserName}}error{{end}}">
|
||||
<label for="user_name">{{ctx.Locale.Tr "username"}}</label>
|
||||
<input id="user_name" type="text" name="user_name" value="{{.user_name}}" autofocus required maxlength="40">
|
||||
</div>
|
||||
<div class="required field">
|
||||
<label for="user_type">{{ctx.Locale.Tr "admin.users.user_type"}}</label>
|
||||
<div class="ui selection type dropdown">
|
||||
<input type="hidden" id="login_type" name="login_type" value="{{.login_type}}" data-password="required" required>
|
||||
<input type="hidden" id="user_type" name="user_type" value="{{.user_type}}" required>
|
||||
<div class="text">{{ctx.Locale.Tr "concept_user_user"}}</div>
|
||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
|
||||
<div class="menu">
|
||||
<div class="item" data-value="User">{{ctx.Locale.Tr "concept_user_user"}}</div>
|
||||
<div class="item" data-value="Bot">{{ctx.Locale.Tr "concept_user_bot"}}</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="required field js-non-bot {{if .Err_LoginType}}error{{end}}">
|
||||
<label for="login_type">{{ctx.Locale.Tr "admin.users.auth_source"}}</label>
|
||||
<div class="ui selection type dropdown">
|
||||
<input type="hidden" id="login_type" name="login_type" value="{{.login_type}}" required>
|
||||
<div class="text">{{ctx.Locale.Tr "admin.users.local"}}</div>
|
||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
|
||||
<div class="menu">
|
||||
@@ -22,8 +37,8 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="inline field {{if .Err_Visibility}}error{{end}}">
|
||||
<span class="inline required field"><label for="visibility">{{ctx.Locale.Tr "settings.visibility"}}</label></span>
|
||||
<div class="required field {{if .Err_Visibility}}error{{end}}">
|
||||
<label for="visibility">{{ctx.Locale.Tr "settings.visibility"}}</label>
|
||||
<div class="ui selection type dropdown">
|
||||
<input type="hidden" id="visibility" name="visibility" value="{{if .visibility}}{{printf "%d" .visibility}}{{else}}{{printf "%d" .DefaultUserVisibilityMode}}{{end}}">
|
||||
<div class="text">
|
||||
@@ -46,24 +61,20 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="required non-local field {{if .Err_LoginName}}error{{end}} {{if eq .login_type "0-0"}}tw-hidden{{end}}">
|
||||
<div class="required js-non-local js-non-bot field {{if .Err_LoginName}}error{{end}} {{if eq .login_type "0-0"}}tw-hidden{{end}}">
|
||||
<label for="login_name">{{ctx.Locale.Tr "admin.users.auth_login_name"}}</label>
|
||||
<input id="login_name" name="login_name" value="{{.login_name}}">
|
||||
</div>
|
||||
<div class="required field {{if .Err_UserName}}error{{end}}">
|
||||
<label for="user_name">{{ctx.Locale.Tr "username"}}</label>
|
||||
<input id="user_name" type="text" name="user_name" value="{{.user_name}}" autofocus required maxlength="40">
|
||||
</div>
|
||||
<div class="required field {{if .Err_Email}}error{{end}}">
|
||||
<label for="email">{{ctx.Locale.Tr "email"}}</label>
|
||||
<input id="email" name="email" type="email" value="{{.email}}" required>
|
||||
</div>
|
||||
<div class="required local field {{if .Err_Password}}error{{end}} {{if not (eq .login_type "0-0")}}tw-hidden{{end}}">
|
||||
<div class="required js-local js-non-bot field {{if .Err_Password}}error{{end}} {{if not (eq .login_type "0-0")}}tw-hidden{{end}}">
|
||||
<label for="password">{{ctx.Locale.Tr "password"}}</label>
|
||||
<input id="password" name="password" type="password" autocomplete="new-password" value="{{.password}}" {{if eq .login_type "0-0"}}required{{end}}>
|
||||
</div>
|
||||
|
||||
<div class="inline field local {{if ne .login_type "0-0"}}tw-hidden{{end}}">
|
||||
<div class="inline field js-local js-non-bot {{if ne .login_type "0-0"}}tw-hidden{{end}}">
|
||||
<div class="ui checkbox">
|
||||
<label><strong>{{ctx.Locale.Tr "auth.allow_password_change"}}</strong></label>
|
||||
<input name="must_change_password" type="checkbox" checked>
|
||||
@@ -72,7 +83,7 @@
|
||||
|
||||
<!-- Send register notify e-mail -->
|
||||
{{if .CanSendEmail}}
|
||||
<div class="inline field">
|
||||
<div class="inline js-non-bot field">
|
||||
<div class="ui checkbox">
|
||||
<label><strong>{{ctx.Locale.Tr "admin.users.send_register_notify"}}</strong></label>
|
||||
<input name="send_notify" type="checkbox" {{if .send_notify}}checked{{end}}>
|
||||
|
||||
@@ -6,7 +6,9 @@
|
||||
<h4 class="ui top attached header flex-left-right">
|
||||
<span>{{.Title}}</span>
|
||||
<span class="flex-text-block">
|
||||
<button type="button" class="ui primary compact tiny basic button link-action" data-url="{{.Link}}/impersonate">{{ctx.Locale.Tr "admin.users.impersonate"}}</button>
|
||||
{{if not .User.IsTypeBot}}
|
||||
<button type="button" class="ui primary compact tiny basic button link-action" data-url="{{.Link}}/impersonate">{{ctx.Locale.Tr "admin.users.impersonate"}}</button>
|
||||
{{end}}
|
||||
<a class="ui primary compact tiny button" href="{{.Link}}/edit">{{ctx.Locale.Tr "admin.users.edit"}}</a>
|
||||
</span>
|
||||
</h4>
|
||||
@@ -23,6 +25,9 @@
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{{if .BotAccessTokens}}
|
||||
{{template "shared/user/access_tokens" .BotAccessTokens}}
|
||||
{{end}}
|
||||
<h4 class="ui top attached header">
|
||||
{{ctx.Locale.Tr "admin.repositories"}} ({{ctx.Locale.Tr "admin.total" .ReposTotal}})
|
||||
</h4>
|
||||
|
||||
@@ -9,9 +9,6 @@
|
||||
{{if .User.IsAdmin}}
|
||||
<span class="ui basic label">{{ctx.Locale.Tr "admin.users.admin"}}</span>
|
||||
{{end}}
|
||||
{{if .User.IsTypeBot}}
|
||||
<span class="ui basic label">{{ctx.Locale.Tr "admin.users.bot"}}</span>
|
||||
{{end}}
|
||||
</div>
|
||||
<div class="item-body">
|
||||
<b>{{ctx.Locale.Tr "admin.users.auth_source"}}:</b>
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
</div>
|
||||
<div class="item-main">
|
||||
<div class="item-title">
|
||||
{{template "shared/user/name" $org}}
|
||||
{{template "shared/user/name" $org.AsUser}}
|
||||
{{if $org.Visibility.IsPrivate}}
|
||||
<span class="ui basic tiny label">{{ctx.Locale.Tr "repo.desc.private"}}</span>
|
||||
{{end}}
|
||||
|
||||
Reference in New Issue
Block a user