feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

tests/integration/admin_audit_test.go

@@ -35,7 +35,7 @@ func TestAdminAuditLogImpersonation(t *testing.T) {
 	session.MakeRequest(t, NewRequestWithValues(t, "POST", "/user/settings/applications", map[string]string{
 		"name":        "impersonated-token",
 		"scope-dummy": "read:user",
-	}), http.StatusSeeOther)
+	}), http.StatusOK)
 
 	session.MakeRequest(t, NewRequest(t, "GET", "/user/logout"), http.StatusSeeOther)
 

tests/integration/admin_user_test.go

@@ -9,8 +9,13 @@ import (
 	"strconv"
 	"testing"
 
+	audit_model "gitea.dev/models/audit"
+	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -145,3 +150,128 @@ func TestAdminImpersonatedUser(t *testing.T) {
 	session.MakeRequest(t, NewRequest(t, "GET", "/user/logout"), http.StatusSeeOther)
 	assert.Equal(t, "", currentUsername(homeDoc(t)))
 }
+
+func TestAdminBotUser(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	session := loginUser(t, "user1")
+
+	t.Run("CreateWithoutPassword", func(t *testing.T) {
+		req := NewRequestWithValues(t, "POST", "/-/admin/users/new", map[string]string{
+			"user_type":  "Bot",
+			"login_type": "0-0",
+			"user_name":  "bot-user",
+			"email":      "bot-user@example.com",
+			"visibility": "0",
+		})
+		session.MakeRequest(t, req, http.StatusSeeOther)
+
+		bot := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "bot-user"})
+		assert.True(t, bot.IsTypeBot())
+		assert.Empty(t, bot.Passwd)
+		assert.False(t, bot.MustChangePassword)
+
+		doc := NewHTMLParser(t, session.MakeRequest(t, NewRequest(t, "GET", fmt.Sprintf("/-/admin/users/%d/edit", bot.ID)), http.StatusOK).Body)
+		assert.Equal(t, "Bot", doc.Find("#user_type").AttrOr("value", ""))
+		assert.Empty(t, doc.Find("#login_type").Nodes)
+		assert.Empty(t, doc.Find("#password").Nodes)
+		doc = NewHTMLParser(t, session.MakeRequest(t, NewRequest(t, "GET", fmt.Sprintf("/-/admin/users/%d", bot.ID)), http.StatusOK).Body)
+		assert.NotEmpty(t, doc.Find(`form[action$="/access_tokens"]`).Nodes)
+	})
+
+	t.Run("EditWithoutAuthSource", func(t *testing.T) {
+		bot := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "bot-user"})
+		req := NewRequestWithValues(t, "POST", fmt.Sprintf("/-/admin/users/%d/edit", bot.ID), map[string]string{
+			"user_name":  "bot-user",
+			"login_type": "0-0",
+			"email":      "bot-user@example.com",
+			"full_name":  "Bot User",
+		})
+		session.MakeRequest(t, req, http.StatusSeeOther)
+
+		assert.Equal(t, "Bot User", unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: bot.ID}).FullName)
+	})
+
+	t.Run("TokenScope", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.Audit.RecordOutput, setting.AuditRecordOutputDatabase)()
+		bot := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "bot-user"})
+		tokenURL := fmt.Sprintf("/-/admin/users/%d/access_tokens", bot.ID)
+
+		resp := session.MakeRequest(t, NewRequestWithValues(t, "POST", tokenURL, map[string]string{
+			"name": "no-scope",
+		}), http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "at least one permission")
+		assert.Equal(t, 0, unittest.GetCount(t, &auth_model.AccessToken{UID: bot.ID}))
+
+		resp = session.MakeRequest(t, NewRequestWithValues(t, "POST", tokenURL, map[string]string{
+			"name":             "ci",
+			"scope-repository": "write:repository",
+		}), http.StatusOK)
+		panel := NewHTMLParser(t, resp.Body)
+		assert.NotEmpty(t, panel.Find("#new-access-token-value").Text())
+		assert.Equal(t, 1, panel.Find(`[data-clipboard-target="#new-access-token-value"]`).Length())
+		assert.Equal(t, tokenURL, panel.Find("form.form-fetch-action").AttrOr("action", ""))
+		assert.Equal(t, 1, unittest.GetCount(t, &auth_model.AccessToken{UID: bot.ID}))
+
+		resp = session.MakeRequest(t, NewRequestWithValues(t, "POST", "/-/admin/users/2/access_tokens", map[string]string{
+			"name":             "not-a-bot",
+			"scope-repository": "write:repository",
+		}), http.StatusBadRequest)
+		assert.Contains(t, resp.Body.String(), "only be generated for bot accounts")
+		unittest.AssertNotExistsBean(t, &auth_model.AccessToken{UID: 2, Name: "not-a-bot"})
+
+		token := unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{UID: bot.ID, Name: "ci"})
+		session.MakeRequest(t, NewRequestWithValues(t, "POST", tokenURL+"/delete", map[string]string{
+			"id": strconv.FormatInt(token.ID, 10),
+		}), http.StatusOK)
+		assert.Equal(t, 0, unittest.GetCount(t, &auth_model.AccessToken{UID: bot.ID}))
+
+		for _, action := range []audit_model.Action{audit_model.UserAccessTokenAdd, audit_model.UserAccessTokenRemove} {
+			events, _, err := audit_model.FindEvents(t.Context(), &audit_model.EventSearchOptions{Action: action, ScopeType: audit_model.ScopeUser, ScopeID: bot.ID})
+			require.NoError(t, err)
+			require.Len(t, events, 1, "audit events for %s", action)
+			assert.Equal(t, int64(1), events[0].ActorID)
+			assert.Equal(t, "ci", audit_model.DecodeMetadata(events[0].Metadata)["token"])
+		}
+	})
+
+	t.Run("APIRejectsAuthSource", func(t *testing.T) {
+		bot := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "bot-user"})
+		req := NewRequestWithJSON(t, "PATCH", "/api/v1/admin/users/"+bot.Name, map[string]any{"source_id": 1}).AddBasicAuth("user1")
+		MakeRequest(t, req, http.StatusBadRequest)
+
+		bot = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: bot.ID})
+		assert.True(t, bot.IsLocal())
+		assert.Empty(t, bot.LoginName)
+	})
+
+	t.Run("ConvertType", func(t *testing.T) {
+		editUserType := func(userID int64, userType string) {
+			user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: userID})
+			session.MakeRequest(t, NewRequestWithValues(t, "POST", fmt.Sprintf("/-/admin/users/%d/edit", userID), map[string]string{
+				"user_name":  user.Name,
+				"login_type": "0-0",
+				"login_name": user.LoginName,
+				"password":   "Bot-Password-1234",
+				"email":      user.Email,
+				"user_type":  userType,
+				"visibility": "0",
+			}), http.StatusSeeOther)
+		}
+
+		MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/admin/users/user4/convert-type", map[string]string{"user_type": "Bot"}).AddBasicAuth("user1"), http.StatusNoContent)
+		user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+		assert.True(t, user4.IsTypeBot())
+		resp := MakeRequest(t, NewRequest(t, "GET", "/api/v1/users/user4"), http.StatusOK)
+		assert.Equal(t, api.UserTypeStringBot, DecodeJSON(t, resp, &api.User{}).Type)
+		session.MakeRequest(t, NewRequest(t, "POST", "/-/admin/users/4/impersonate"), http.StatusBadRequest)
+
+		editUserType(4, "User")
+		assert.True(t, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4}).IsIndividual())
+
+		editUserType(4, "Bot")
+		converted := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+		assert.True(t, converted.IsTypeBot())
+		assert.Equal(t, user4.Passwd, converted.Passwd)
+	})
+}

tests/integration/integration_test.go

@@ -189,13 +189,8 @@ func getTokenForLoggedInUser(t testing.TB, session *TestSession, scopes ...auth.
 		urlValues.Add("scope-dummy", string(scope)) // it only needs to start with "scope-" to be accepted
 	}
 	req := NewRequestWithURLValues(t, "POST", "/user/settings/applications", urlValues)
-	session.MakeRequest(t, req, http.StatusSeeOther)
-	flashes := session.GetCookieFlashMessage()
-	assert.NotNil(t, flashes)
-	if flashes != nil {
-		return flashes.InfoMsg
-	}
-	return ""
+	resp := session.MakeRequest(t, req, http.StatusOK)
+	return NewHTMLParser(t, resp.Body).Find("#new-access-token-value").Text()
 }
 
 type RequestWrapper struct {