mirror of
https://github.com/go-gitea/gitea.git
synced 2026-09-20 03:33:39 +09:00
3bec08f998
Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.
1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
48 lines
1.4 KiB
Go
48 lines
1.4 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/db"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type mockBotSource struct {
|
|
auth_model.ConfigBase
|
|
}
|
|
|
|
func (s *mockBotSource) FromDB(bs []byte) error { return nil }
|
|
func (s *mockBotSource) ToDB() ([]byte, error) { return []byte("{}"), nil }
|
|
|
|
func (s *mockBotSource) Authenticate(ctx context.Context, _ *user_model.User, login, _ string) (*user_model.User, error) {
|
|
return user_model.GetUserByName(ctx, login)
|
|
}
|
|
|
|
const mockBotSourceType auth_model.Type = 100
|
|
|
|
func TestUserSignIn_BotCannotSignIn(t *testing.T) {
|
|
assert.NoError(t, unittest.PrepareTestDatabase())
|
|
auth_model.RegisterTypeConfig(mockBotSourceType, &mockBotSource{})
|
|
|
|
bot := &user_model.User{Name: "test-bot", Email: "test-bot@example.com", Type: user_model.UserTypeBot, IsActive: true}
|
|
require.NoError(t, user_model.AdminCreateUser(t.Context(), bot, &user_model.Meta{}))
|
|
require.NoError(t, db.Insert(t.Context(), &auth_model.Source{
|
|
Type: mockBotSourceType,
|
|
Name: "mock-bot-source",
|
|
IsActive: true,
|
|
Cfg: &mockBotSource{},
|
|
}))
|
|
|
|
_, _, err := UserSignIn(t.Context(), "test-bot", "")
|
|
assert.ErrorAs(t, err, &user_model.ErrUserNotExist{})
|
|
}
|