From 611dfc9496019294b16779ee7c2a8a6bd6425591 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Mon, 8 Jun 2026 22:53:58 -0700 Subject: [PATCH 1/7] fix: Fix some wrong code and follow 37347 (#37987) --- models/organization/org.go | 59 +++++++++++++++---------------- models/organization/org_test.go | 34 ++++++++---------- routers/web/org/members.go | 13 +++---- templates/org/member/members.tmpl | 11 +++--- 4 files changed, 52 insertions(+), 65 deletions(-) diff --git a/models/organization/org.go b/models/organization/org.go index d9390fc147..c2f77a83dd 100644 --- a/models/organization/org.go +++ b/models/organization/org.go @@ -19,7 +19,6 @@ import ( "gitea.dev/modules/util" "xorm.io/builder" - "xorm.io/xorm" ) // ErrOrgNotExist represents a "OrgNotExist" kind of error. @@ -181,45 +180,43 @@ func (org *Organization) HomeLink() string { // FindOrgMembersOpts represents find org members conditions type FindOrgMembersOpts struct { db.ListOptions - Doer *user_model.User - IsDoerMember bool - OrgID int64 - Keyword string - SearchByEmail bool + Doer *user_model.User + IsDoerMember bool + OrgID int64 + Keyword string } func (opts FindOrgMembersOpts) PublicOnly() bool { return opts.Doer == nil || !(opts.IsDoerMember || opts.Doer.IsAdmin) } -func (opts FindOrgMembersOpts) applyKeywordFilter(sess *xorm.Session) (*xorm.Session, bool) { +// applyKeywordFilter adds keyword search conditions to session +func (opts FindOrgMembersOpts) applyKeywordFilter(sess db.Session) bool { if opts.Keyword == "" { - return sess, false + return false } - lowerKeyword := strings.ToLower(opts.Keyword) keywordCond := builder.Or( - builder.Like{"`user`.lower_name", lowerKeyword}, - builder.Like{"LOWER(`user`.full_name)", lowerKeyword}, + db.BuildCaseInsensitiveLike("`user`.lower_name", opts.Keyword), + db.BuildCaseInsensitiveLike("`user`.full_name", opts.Keyword), ) - if opts.SearchByEmail { - var emailCond builder.Cond = builder.Like{"LOWER(`user`.email)", lowerKeyword} - switch { - case opts.Doer == nil: - emailCond = emailCond.And(builder.Eq{"`user`.keep_email_private": false}) - case !opts.Doer.IsAdmin: - emailCond = emailCond.And( - builder.Or( - builder.Eq{"`user`.keep_email_private": false}, - builder.Eq{"`user`.id": opts.Doer.ID}, - ), - ) - } - keywordCond = keywordCond.Or(emailCond) - } - sess = sess.Join("INNER", "`user`", "org_user.uid = `user`.id").And(keywordCond) - return sess, true + emailCond := db.BuildCaseInsensitiveLike("`user`.email", opts.Keyword) + switch { + case opts.Doer == nil: + emailCond = emailCond.And(builder.Eq{"`user`.keep_email_private": false}) + case !opts.Doer.IsAdmin: + emailCond = emailCond.And( + builder.Or( + builder.Eq{"`user`.keep_email_private": false}, + builder.Eq{"`user`.id": opts.Doer.ID}, + ), + ) + } + keywordCond = keywordCond.Or(emailCond) + + _ = sess.Join("INNER", "`user`", "org_user.uid = `user`.id").And(keywordCond) + return true } // applyTeamMatesOnlyFilter make sure restricted users only see public team members and there own team mates @@ -245,7 +242,7 @@ func CountOrgMembers(ctx context.Context, opts *FindOrgMembersOpts) (int64, erro } else { opts.applyTeamMatesOnlyFilter(sess) } - sess, _ = opts.applyKeywordFilter(sess) + _ = opts.applyKeywordFilter(sess) return sess.Count(new(OrgUser)) } @@ -494,8 +491,8 @@ func GetOrgUsersByOrgID(ctx context.Context, opts *FindOrgMembersOpts) ([]*OrgUs } else { opts.applyTeamMatesOnlyFilter(sess) } - if keywordSess, hasKeyword := opts.applyKeywordFilter(sess); hasKeyword { - sess = keywordSess.Select("org_user.*") + if opts.applyKeywordFilter(sess) { + sess = sess.Select("org_user.*") } sess = sess.OrderBy("org_user.uid ASC") diff --git a/models/organization/org_test.go b/models/organization/org_test.go index 8fe4b79297..e24de5b054 100644 --- a/models/organization/org_test.go +++ b/models/organization/org_test.go @@ -302,43 +302,39 @@ func TestOrgMembersSearch(t *testing.T) { { name: "match by username", opts: &organization.FindOrgMembersOpts{ - OrgID: 3, - Doer: member, - IsDoerMember: true, - Keyword: "user4", - SearchByEmail: true, + OrgID: 3, + Doer: member, + IsDoerMember: true, + Keyword: "user4", }, expectedUIDs: []int64{4}, }, { name: "match by full name", opts: &organization.FindOrgMembersOpts{ - OrgID: 3, - Doer: member, - IsDoerMember: true, - Keyword: "user27", - SearchByEmail: true, + OrgID: 3, + Doer: member, + IsDoerMember: true, + Keyword: "user27", }, expectedUIDs: []int64{28}, }, { name: "private email hidden", opts: &organization.FindOrgMembersOpts{ - OrgID: 3, - Doer: member, - IsDoerMember: true, - Keyword: "user2@example.com", - SearchByEmail: true, + OrgID: 3, + Doer: member, + IsDoerMember: true, + Keyword: "user2@example.com", }, expectedUIDs: []int64{}, }, { name: "admin can search private email", opts: &organization.FindOrgMembersOpts{ - OrgID: 3, - Doer: admin, - Keyword: "user2@example.com", - SearchByEmail: true, + OrgID: 3, + Doer: admin, + Keyword: "user2@example.com", }, expectedUIDs: []int64{2}, }, diff --git a/routers/web/org/members.go b/routers/web/org/members.go index 4a7799a6e2..2f7df4b14e 100644 --- a/routers/web/org/members.go +++ b/routers/web/org/members.go @@ -35,16 +35,15 @@ func Members(ctx *context.Context) { ctx.Data["Keyword"] = keyword opts := &organization.FindOrgMembersOpts{ - Doer: ctx.Doer, - OrgID: org.ID, - Keyword: keyword, - SearchByEmail: true, + Doer: ctx.Doer, + OrgID: org.ID, + Keyword: keyword, } if ctx.Doer != nil { isMember, err := ctx.Org.Organization.IsOrgMember(ctx, ctx.Doer.ID) if err != nil { - ctx.HTTPError(http.StatusInternalServerError, "IsOrgMember") + ctx.ServerError("IsOrgMember", err) return } opts.IsDoerMember = isMember @@ -53,7 +52,7 @@ func Members(ctx *context.Context) { total, err := organization.CountOrgMembers(ctx, opts) if err != nil { - ctx.HTTPError(http.StatusInternalServerError, "CountOrgMembers") + ctx.ServerError("CountOrgMembers", err) return } @@ -74,8 +73,6 @@ func Members(ctx *context.Context) { } ctx.Data["Page"] = pager ctx.Data["Members"] = members - ctx.Data["MembersShown"] = len(members) - ctx.Data["MembersTotal"] = total ctx.Data["MembersIsPublicMember"] = membersIsPublic ctx.Data["MembersIsUserOrgOwner"] = organization.IsUserOrgOwner(ctx, members, org.ID) ctx.Data["MembersTwoFaStatus"] = members.GetTwoFaStatus(ctx) diff --git a/templates/org/member/members.tmpl b/templates/org/member/members.tmpl index ea637e76fb..7c6b097765 100644 --- a/templates/org/member/members.tmpl +++ b/templates/org/member/members.tmpl @@ -11,16 +11,13 @@
{{end}} -
-
+
+
{{template "shared/search/input" dict "Value" .Keyword "Placeholder" (ctx.Locale.Tr "search.user_kind")}} {{template "shared/search/button"}}
-
- {{ctx.Locale.Tr "org.members"}}: {{CountFmt .MembersShown}} / {{CountFmt .MembersTotal}} -
{{range .Members}} @@ -79,8 +76,8 @@
{{else}} -
-
+
+
{{ctx.Locale.Tr "search.no_results"}}
From 49a0d19fa3273e78ee51b781d8eb8719220b2159 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Mon, 8 Jun 2026 23:12:09 -0700 Subject: [PATCH 2/7] feat(api): Add assignees APIs (#37330) Follow https://docs.github.com/en/enterprise-server@3.20/rest/issues/assignees?apiVersion=2022-11-28 Fix #33576 And it also fixed some possible dead-lock problem. --------- Signed-off-by: Lunny Xiao Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Nicolas Co-authored-by: Zettat123 --- models/issues/assignees.go | 10 +- models/issues/assignees_test.go | 6 +- models/perm/access/repo_permission.go | 4 +- modules/structs/issue.go | 5 + routers/api/v1/api.go | 5 + routers/api/v1/repo/collaborators.go | 37 ++++ routers/api/v1/repo/issue.go | 2 +- routers/api/v1/repo/issue_assignee.go | 238 ++++++++++++++++++++++ routers/api/v1/repo/pull.go | 2 +- routers/api/v1/swagger/options.go | 2 + routers/web/repo/issue.go | 2 +- services/context/repo.go | 2 +- services/issue/assignee.go | 222 +++++++++++++++++---- services/issue/assignee_test.go | 55 +++++- services/issue/issue.go | 18 +- services/pull/pull.go | 18 +- services/repository/collaboration.go | 2 +- templates/swagger/v1_json.tmpl | 237 ++++++++++++++++++++++ templates/swagger/v1_openapi3_json.tmpl | 251 ++++++++++++++++++++++++ tests/integration/api_issue_test.go | 87 ++++++++ tests/integration/api_repo_test.go | 18 +- 21 files changed, 1155 insertions(+), 68 deletions(-) create mode 100644 routers/api/v1/repo/issue_assignee.go diff --git a/models/issues/assignees.go b/models/issues/assignees.go index a45ab468eb..91823b4ec4 100644 --- a/models/issues/assignees.go +++ b/models/issues/assignees.go @@ -64,8 +64,8 @@ func GetAssigneeIDsByIssue(ctx context.Context, issueID int64) ([]int64, error) } // IsUserAssignedToIssue returns true when the user is assigned to the issue -func IsUserAssignedToIssue(ctx context.Context, issue *Issue, user *user_model.User) (isAssigned bool, err error) { - return db.Exist[IssueAssignees](ctx, builder.Eq{"assignee_id": user.ID, "issue_id": issue.ID}) +func IsUserAssignedToIssue(ctx context.Context, issue *Issue, userID int64) (isAssigned bool, err error) { + return db.Exist[IssueAssignees](ctx, builder.Eq{"assignee_id": userID, "issue_id": issue.ID}) } type AssignedIssuesOptions struct { @@ -170,7 +170,7 @@ func toggleUserAssignee(ctx context.Context, issue *Issue, assigneeID int64) (re } // MakeIDsFromAPIAssigneesToAdd returns an array with all assignee IDs -func MakeIDsFromAPIAssigneesToAdd(ctx context.Context, oneAssignee string, multipleAssignees []string) (assigneeIDs []int64, err error) { +func MakeIDsFromAPIAssigneesToAdd(ctx context.Context, oneAssignee string, multipleAssignees []string) ([]int64, error) { var requestAssignees []string // Keeping the old assigning method for compatibility reasons @@ -184,7 +184,5 @@ func MakeIDsFromAPIAssigneesToAdd(ctx context.Context, oneAssignee string, multi } // Get the IDs of all assignees - assigneeIDs, err = user_model.GetUserIDsByNames(ctx, requestAssignees, false) - - return assigneeIDs, err + return user_model.GetUserIDsByNames(ctx, requestAssignees, false) } diff --git a/models/issues/assignees_test.go b/models/issues/assignees_test.go index 58a1edc02b..57c5262607 100644 --- a/models/issues/assignees_test.go +++ b/models/issues/assignees_test.go @@ -40,7 +40,7 @@ func TestUpdateAssignee(t *testing.T) { assert.NoError(t, err) // Check if he got removed - isAssigned, err := issues_model.IsUserAssignedToIssue(t.Context(), issue, user1) + isAssigned, err := issues_model.IsUserAssignedToIssue(t.Context(), issue, user1.ID) assert.NoError(t, err) assert.False(t, isAssigned) @@ -56,12 +56,12 @@ func TestUpdateAssignee(t *testing.T) { } // Check if the user is assigned - isAssigned, err = issues_model.IsUserAssignedToIssue(t.Context(), issue, user2) + isAssigned, err = issues_model.IsUserAssignedToIssue(t.Context(), issue, user2.ID) assert.NoError(t, err) assert.True(t, isAssigned) // This user should not be assigned - isAssigned, err = issues_model.IsUserAssignedToIssue(t.Context(), issue, &user_model.User{ID: 4}) + isAssigned, err = issues_model.IsUserAssignedToIssue(t.Context(), issue, 4) assert.NoError(t, err) assert.False(t, isAssigned) } diff --git a/models/perm/access/repo_permission.go b/models/perm/access/repo_permission.go index 6e52177f0a..2d53b0699f 100644 --- a/models/perm/access/repo_permission.go +++ b/models/perm/access/repo_permission.go @@ -567,9 +567,9 @@ func HasAccessUnit(ctx context.Context, user *user_model.User, repo *repo_model. // CanBeAssigned return true if user can be assigned to issue or pull requests in repo // Currently any write access (code, issues or pr's) is assignable, to match assignee list in user interface. -func CanBeAssigned(ctx context.Context, user *user_model.User, repo *repo_model.Repository, _ bool) (bool, error) { +func CanBeAssigned(ctx context.Context, user *user_model.User, repo *repo_model.Repository) (bool, error) { if user.IsOrganization() { - return false, fmt.Errorf("organization can't be added as assignee [user_id: %d, repo_id: %d]", user.ID, repo.ID) + return false, util.NewInvalidArgumentErrorf("organization can't be added as assignee [user_id: %d, repo_id: %d]", user.ID, repo.ID) } perm, err := GetIndividualUserRepoPermission(ctx, repo, user) if err != nil { diff --git a/modules/structs/issue.go b/modules/structs/issue.go index 68618a3191..54e62ad2bb 100644 --- a/modules/structs/issue.go +++ b/modules/structs/issue.go @@ -125,6 +125,11 @@ type EditIssueOption struct { ContentVersion *int `json:"content_version"` } +// IssueAssigneesOption options for adding/removing issue assignees +type IssueAssigneesOption struct { + Assignees []string `json:"assignees"` +} + // EditDeadlineOption options for creating a deadline type EditDeadlineOption struct { // required:true diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index 618181eb1c..e44c0cb43e 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -1226,6 +1226,7 @@ func Routes() *web.Router { }) }, reqToken()) m.Get("/assignees", reqToken(), reqAnyRepoReader(), repo.GetAssignees) + m.Get("/assignees/{assignee}", reqToken(), reqAnyRepoReader(), repo.CheckRepoIssueAssignee) m.Get("/reviewers", reqToken(), reqAnyRepoReader(), repo.GetReviewers) m.Group("/teams", func() { m.Get("", reqAnyRepoReader(), repo.ListTeams) @@ -1517,6 +1518,10 @@ func Routes() *web.Router { m.Combo("").Get(repo.GetIssue). Patch(reqToken(), bind(api.EditIssueOption{}), repo.EditIssue). Delete(reqToken(), reqAdmin(), context.ReferencesGitRepo(), repo.DeleteIssue) + m.Combo("/assignees"). + Post(reqToken(), mustNotBeArchived, bind(api.IssueAssigneesOption{}), repo.AddIssueAssignees). + Delete(reqToken(), mustNotBeArchived, bind(api.IssueAssigneesOption{}), repo.DeleteIssueAssignees) + m.Get("/assignees/{assignee}", repo.CheckIssueAssignee) m.Group("/comments", func() { m.Combo("").Get(repo.ListIssueComments). Post(reqToken(), mustNotBeArchived, bind(api.CreateIssueCommentOption{}), repo.CreateIssueComment) diff --git a/routers/api/v1/repo/collaborators.go b/routers/api/v1/repo/collaborators.go index e254d5e128..07c0b95e09 100644 --- a/routers/api/v1/repo/collaborators.go +++ b/routers/api/v1/repo/collaborators.go @@ -367,5 +367,42 @@ func GetAssignees(ctx *context.APIContext) { ctx.APIErrorInternal(err) return } + ctx.JSON(http.StatusOK, convert.ToUsers(ctx, ctx.Doer, assignees)) } + +// CheckRepoIssueAssignee check if a user can be assigned to issues in a repository +func CheckRepoIssueAssignee(ctx *context.APIContext) { + // swagger:operation GET /repos/{owner}/{repo}/assignees/{assignee} repository repoCheckAssignee + // --- + // summary: Check if a user can be assigned to issues in a repository + // produces: + // - application/json + // parameters: + // - name: owner + // in: path + // description: owner of the repo + // type: string + // required: true + // - name: repo + // in: path + // description: name of the repo + // type: string + // required: true + // - name: assignee + // in: path + // description: username of the user to check for being an assignee + // type: string + // required: true + // responses: + // "204": + // "$ref": "#/responses/empty" + // "400": + // "$ref": "#/responses/error" + // "404": + // "$ref": "#/responses/notFound" + + if checkAssignableUser(ctx, ctx.PathParam("assignee"), ctx.Repo.Repository) { + ctx.Status(http.StatusNoContent) + } +} diff --git a/routers/api/v1/repo/issue.go b/routers/api/v1/repo/issue.go index 9946afc8b7..fe5772fa46 100644 --- a/routers/api/v1/repo/issue.go +++ b/routers/api/v1/repo/issue.go @@ -670,7 +670,7 @@ func CreateIssue(ctx *context.APIContext) { return } - valid, err := access_model.CanBeAssigned(ctx, assignee, ctx.Repo.Repository, false) + valid, err := access_model.CanBeAssigned(ctx, assignee, ctx.Repo.Repository) if err != nil { ctx.APIErrorInternal(err) return diff --git a/routers/api/v1/repo/issue_assignee.go b/routers/api/v1/repo/issue_assignee.go new file mode 100644 index 0000000000..d045102930 --- /dev/null +++ b/routers/api/v1/repo/issue_assignee.go @@ -0,0 +1,238 @@ +// Copyright 2026 The Gitea Authors. All rights reserved. +// SPDX-License-Identifier: MIT + +package repo + +import ( + "net/http" + + issues_model "gitea.dev/models/issues" + access_model "gitea.dev/models/perm/access" + repo_model "gitea.dev/models/repo" + user_model "gitea.dev/models/user" + api "gitea.dev/modules/structs" + "gitea.dev/modules/web" + "gitea.dev/services/context" + "gitea.dev/services/convert" + issue_service "gitea.dev/services/issue" +) + +// AddIssueAssignees add assignees to an issue +func AddIssueAssignees(ctx *context.APIContext) { + // swagger:operation POST /repos/{owner}/{repo}/issues/{index}/assignees issue issueAddAssignees + // --- + // summary: Add assignees to an issue + // consumes: + // - application/json + // produces: + // - application/json + // parameters: + // - name: owner + // in: path + // description: owner of the repo + // type: string + // required: true + // - name: repo + // in: path + // description: name of the repo + // type: string + // required: true + // - name: index + // in: path + // description: index of the issue + // type: integer + // format: int64 + // required: true + // - name: body + // in: body + // required: true + // schema: + // "$ref": "#/definitions/IssueAssigneesOption" + // responses: + // "201": + // "$ref": "#/responses/Issue" + // "400": + // "$ref": "#/responses/error" + // "403": + // "$ref": "#/responses/forbidden" + // "404": + // "$ref": "#/responses/notFound" + // "422": + // "$ref": "#/responses/validationError" + + opts := web.GetForm(ctx).(*api.IssueAssigneesOption) + updateIssueAssignees(ctx, *opts, true) +} + +// DeleteIssueAssignees remove assignees from an issue +func DeleteIssueAssignees(ctx *context.APIContext) { + // swagger:operation DELETE /repos/{owner}/{repo}/issues/{index}/assignees issue issueRemoveAssignees + // --- + // summary: Remove assignees from an issue + // consumes: + // - application/json + // produces: + // - application/json + // parameters: + // - name: owner + // in: path + // description: owner of the repo + // type: string + // required: true + // - name: repo + // in: path + // description: name of the repo + // type: string + // required: true + // - name: index + // in: path + // description: index of the issue + // type: integer + // format: int64 + // required: true + // - name: body + // in: body + // required: true + // schema: + // "$ref": "#/definitions/IssueAssigneesOption" + // responses: + // "200": + // "$ref": "#/responses/Issue" + // "403": + // "$ref": "#/responses/forbidden" + // "404": + // "$ref": "#/responses/notFound" + // "422": + // "$ref": "#/responses/validationError" + + opts := web.GetForm(ctx).(*api.IssueAssigneesOption) + updateIssueAssignees(ctx, *opts, false) +} + +// CheckIssueAssignee check if a user can be assigned to an issue +func CheckIssueAssignee(ctx *context.APIContext) { + // swagger:operation GET /repos/{owner}/{repo}/issues/{index}/assignees/{assignee} issue issueCheckAssignee + // --- + // summary: Check if a user can be assigned to an issue + // produces: + // - application/json + // parameters: + // - name: owner + // in: path + // description: owner of the repo + // type: string + // required: true + // - name: repo + // in: path + // description: name of the repo + // type: string + // required: true + // - name: index + // in: path + // description: index of the issue + // type: integer + // format: int64 + // required: true + // - name: assignee + // in: path + // description: username of the user to check for being an assignee + // type: string + // required: true + // responses: + // "204": + // "$ref": "#/responses/empty" + // "400": + // "$ref": "#/responses/error" + // "404": + // "$ref": "#/responses/notFound" + + issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index")) + if err != nil { + ctx.APIErrorAuto(err) + return + } + + if !ctx.Repo.Permission.CanReadIssuesOrPulls(issue.IsPull) { + ctx.APIErrorNotFound() + return + } + + if checkAssignableUser(ctx, ctx.PathParam("assignee"), ctx.Repo.Repository) { + ctx.Status(http.StatusNoContent) + } +} + +// checkAssignableUser resolves assigneeName and verifies the user can be assigned to issues in repo. +// Returns true only when the user resolves AND is assignable; the caller is responsible for writing the 204. +// On any failure it writes the appropriate API response and returns false. +func checkAssignableUser(ctx *context.APIContext, assigneeName string, repo *repo_model.Repository) bool { + assignee, err := user_model.GetUserByName(ctx, assigneeName) + if err != nil { + ctx.APIErrorAuto(err) + return false + } + + canAssign, err := access_model.CanBeAssigned(ctx, assignee, repo) + if err != nil { + ctx.APIErrorAuto(err) + return false + } + + if !canAssign { + ctx.APIErrorNotFound() + return false + } + + return true +} + +func updateIssueAssignees(ctx *context.APIContext, opts api.IssueAssigneesOption, isAdd bool) { + issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index")) + if err != nil { + ctx.APIErrorAuto(err) + return + } + + if !ctx.Repo.Permission.CanWriteIssuesOrPulls(issue.IsPull) { + ctx.Status(http.StatusForbidden) + return + } + + if err := issue.LoadAttributes(ctx); err != nil { + ctx.APIErrorInternal(err) + return + } + + assigneeIDs, err := user_model.GetUserIDsByNames(ctx, opts.Assignees, false) + if err != nil { + if user_model.IsErrUserNotExist(err) { + ctx.APIError(http.StatusUnprocessableEntity, err.Error()) + return + } + ctx.APIErrorAuto(err) + return + } + + if isAdd { + err = issue_service.AddAssignees(ctx, issue, ctx.Doer, assigneeIDs) + } else { + err = issue_service.RemoveAssignees(ctx, issue, ctx.Doer, assigneeIDs) + } + + if err != nil { + ctx.APIErrorAuto(err) + return + } + + issue, err = issues_model.GetIssueByID(ctx, issue.ID) + if err != nil { + ctx.APIErrorInternal(err) + return + } + + status := http.StatusOK + if isAdd { + status = http.StatusCreated + } + ctx.JSON(status, convert.ToAPIIssue(ctx, ctx.Doer, issue)) +} diff --git a/routers/api/v1/repo/pull.go b/routers/api/v1/repo/pull.go index dcfaa3d3ac..d5c912d243 100644 --- a/routers/api/v1/repo/pull.go +++ b/routers/api/v1/repo/pull.go @@ -545,7 +545,7 @@ func CreatePullRequest(ctx *context.APIContext) { return } - valid, err := access_model.CanBeAssigned(ctx, assignee, repo, true) + valid, err := access_model.CanBeAssigned(ctx, assignee, repo) if err != nil { ctx.APIErrorInternal(err) return diff --git a/routers/api/v1/swagger/options.go b/routers/api/v1/swagger/options.go index e59857682e..c234b8ec84 100644 --- a/routers/api/v1/swagger/options.go +++ b/routers/api/v1/swagger/options.go @@ -36,6 +36,8 @@ type swaggerParameterBodies struct { EditIssueOption api.EditIssueOption // in:body EditDeadlineOption api.EditDeadlineOption + // in:body + IssueAssigneesOption api.IssueAssigneesOption // in:body CreateIssueCommentOption api.CreateIssueCommentOption diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go index e37484e2ad..10c9d7d726 100644 --- a/routers/web/repo/issue.go +++ b/routers/web/repo/issue.go @@ -458,7 +458,7 @@ func UpdateIssueAssignee(ctx *context.Context) { return } - valid, err := access_model.CanBeAssigned(ctx, assignee, issue.Repo, issue.IsPull) + valid, err := access_model.CanBeAssigned(ctx, assignee, issue.Repo) if err != nil { ctx.ServerError("canBeAssigned", err) return diff --git a/services/context/repo.go b/services/context/repo.go index 9c7f20aadd..fa816ba6ad 100644 --- a/services/context/repo.go +++ b/services/context/repo.go @@ -242,7 +242,7 @@ func (r *Repository) CanUseTimetracker(ctx context.Context, issue *issues_model. // Checking for following: // 1. Is timetracker enabled // 2. Is the user a contributor, admin, poster or assignee and do the repository policies require this? - isAssigned, _ := issues_model.IsUserAssignedToIssue(ctx, issue, user) + isAssigned, _ := issues_model.IsUserAssignedToIssue(ctx, issue, user.ID) return r.Repository.IsTimetrackerEnabled(ctx) && (!r.Repository.AllowOnlyContributorsToTrackTime(ctx) || r.Permission.CanWriteIssuesOrPulls(issue.IsPull) || issue.IsPoster(user.ID) || isAssigned) } diff --git a/services/issue/assignee.go b/services/issue/assignee.go index a3d1879d85..4b24115507 100644 --- a/services/issue/assignee.go +++ b/services/issue/assignee.go @@ -6,6 +6,7 @@ package issue import ( "context" + "gitea.dev/models/db" issues_model "gitea.dev/models/issues" access_model "gitea.dev/models/perm/access" repo_model "gitea.dev/models/repo" @@ -14,8 +15,7 @@ import ( notify_service "gitea.dev/services/notify" ) -// DeleteNotPassedAssignee deletes all assignees who aren't passed via the "assignees" array -func DeleteNotPassedAssignee(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, assignees []*user_model.User) (err error) { +func toBeRemovedAssignees(issue *issues_model.Issue, assignees []*user_model.User) (toBeRemovedAssignees []*user_model.User) { var found bool oriAssignees := make([]*user_model.User, len(issue.Assignees)) _ = copy(oriAssignees, issue.Assignees) @@ -31,28 +31,54 @@ func DeleteNotPassedAssignee(ctx context.Context, issue *issues_model.Issue, doe if !found { // This function also does comments and hooks, which is why we call it separately instead of directly removing the assignees here - if _, _, err := ToggleAssigneeWithNotify(ctx, issue, doer, assignee.ID); err != nil { - return err - } + toBeRemovedAssignees = append(toBeRemovedAssignees, assignee) + } + } + return toBeRemovedAssignees +} + +// DeleteNotPassedAssignee deletes all assignees who aren't passed via the "assignees" array +func DeleteNotPassedAssignee(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, assignees []*user_model.User) (err error) { + toBeRemoved := toBeRemovedAssignees(issue, assignees) + + for _, assignee := range toBeRemoved { + // This function also does comments and hooks, which is why we call it separately instead of directly removing the assignees here + removed, comment, err := ToggleAssignee(ctx, issue, doer, assignee) + if err != nil { + return err + } + if removed { + notify_service.IssueChangeAssignee(ctx, doer, issue, assignee, true, comment) } } return nil } -// ToggleAssigneeWithNoNotify changes a user between assigned and not assigned for this issue, and make issue comment for it. -func ToggleAssigneeWithNotify(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, assigneeID int64) (removed bool, comment *issues_model.Comment, err error) { - removed, comment, err = issues_model.ToggleIssueAssignee(ctx, issue, doer, assigneeID) +// ToggleAssignee changes a user between assigned and not assigned for this issue, and make issue comment for it. +func ToggleAssignee(ctx context.Context, issue *issues_model.Issue, doer, assignee *user_model.User) (removed bool, comment *issues_model.Comment, err error) { + removed, comment, err = issues_model.ToggleIssueAssignee(ctx, issue, doer, assignee.ID) if err != nil { return false, nil, err } + issue.AssigneeID = assignee.ID + issue.Assignee = assignee + + return removed, comment, nil +} + +// ToggleAssignee changes a user between assigned and not assigned for this issue, and make issue comment for it. +func ToggleAssigneeWithNotify(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, assigneeID int64) (removed bool, comment *issues_model.Comment, err error) { assignee, err := user_model.GetUserByID(ctx, assigneeID) if err != nil { return false, nil, err } - issue.AssigneeID = assigneeID - issue.Assignee = assignee + + removed, comment, err = ToggleAssignee(ctx, issue, doer, assignee) + if err != nil { + return false, nil, err + } notify_service.IssueChangeAssignee(ctx, doer, issue, assignee, removed, comment) @@ -81,43 +107,85 @@ func UpdateAssignees(ctx context.Context, issue *issues_model.Issue, oneAssignee return err } - if user_model.IsUserBlockedBy(ctx, doer, assignee.ID) { - return user_model.ErrBlockedUser + if err := validateAssignee(ctx, issue, doer, assignee); err != nil { + return err } allNewAssignees = append(allNewAssignees, assignee) } - // Delete all old assignees not passed - if err = DeleteNotPassedAssignee(ctx, issue, doer, allNewAssignees); err != nil { + assigneeCommentMap := make(map[int64]*issues_model.Comment) + assigneeRemovedCommentMap := make(map[int64]*issues_model.Comment) + assigneeRemoved := make(map[int64]*user_model.User) + if err := db.WithTx(ctx, func(ctx context.Context) error { + // Delete all old assignees not passed. + toBeRemoved := toBeRemovedAssignees(issue, allNewAssignees) + + for _, assignee := range toBeRemoved { + // This function also does comments and hooks, which is why we call it separately instead of directly removing the assignees here + removed, comment, err := ToggleAssignee(ctx, issue, doer, assignee) + if err != nil { + return err + } + if removed { + assigneeRemoved[assignee.ID] = assignee + assigneeRemovedCommentMap[assignee.ID] = comment + } + } + + // Add all new assignees. + // Update the assignee. The function will check if the user exists, is already + // assigned (which he shouldn't as we deleted all assignees before) and + // has access to the repo. + for _, assignee := range allNewAssignees { + // Extra method to prevent double adding (which would result in removing). + comment, err := AddAssigneeIfNotAssigned(ctx, issue, doer, assignee) + if err != nil { + return err + } + assigneeCommentMap[assignee.ID] = comment + } + + return nil + }); err != nil { return err } - // Add all new assignees - // Update the assignee. The function will check if the user exists, is already - // assigned (which he shouldn't as we deleted all assignees before) and - // has access to the repo. + for _, assignee := range assigneeRemoved { + notify_service.IssueChangeAssignee(ctx, doer, issue, assignee, true, assigneeRemovedCommentMap[assignee.ID]) + } + for _, assignee := range allNewAssignees { - // Extra method to prevent double adding (which would result in removing) - _, err = AddAssigneeIfNotAssigned(ctx, issue, doer, assignee.ID, true) - if err != nil { - return err + comment := assigneeCommentMap[assignee.ID] + if comment != nil { + notify_service.IssueChangeAssignee(ctx, doer, issue, assignee, false, comment) } } - return err + return nil +} + +func validateAssignee(ctx context.Context, issue *issues_model.Issue, doer, assignee *user_model.User) error { + if user_model.IsUserBlockedBy(ctx, doer, assignee.ID) { + return user_model.ErrBlockedUser + } + + valid, err := access_model.CanBeAssigned(ctx, assignee, issue.Repo) + if err != nil { + return err + } + if !valid { + return repo_model.ErrUserDoesNotHaveAccessToRepo{UserID: assignee.ID, RepoName: issue.Repo.Name} + } + + return nil } // AddAssigneeIfNotAssigned adds an assignee only if he isn't already assigned to the issue. // Also checks for access of assigned user -func AddAssigneeIfNotAssigned(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, assigneeID int64, notify bool) (comment *issues_model.Comment, err error) { - assignee, err := user_model.GetUserByID(ctx, assigneeID) - if err != nil { - return nil, err - } - +func AddAssigneeIfNotAssigned(ctx context.Context, issue *issues_model.Issue, doer, assignee *user_model.User) (comment *issues_model.Comment, err error) { // Check if the user is already assigned - isAssigned, err := issues_model.IsUserAssignedToIssue(ctx, issue, assignee) + isAssigned, err := issues_model.IsUserAssignedToIssue(ctx, issue, assignee.ID) if err != nil { return nil, err } @@ -126,18 +194,92 @@ func AddAssigneeIfNotAssigned(ctx context.Context, issue *issues_model.Issue, do return nil, nil //nolint:nilnil // return nil because the user is already assigned } - valid, err := access_model.CanBeAssigned(ctx, assignee, issue.Repo, issue.IsPull) - if err != nil { + if err := validateAssignee(ctx, issue, doer, assignee); err != nil { return nil, err } - if !valid { - return nil, repo_model.ErrUserDoesNotHaveAccessToRepo{UserID: assigneeID, RepoName: issue.Repo.Name} - } - if notify { - _, comment, err = ToggleAssigneeWithNotify(ctx, issue, doer, assigneeID) - return comment, err - } - _, comment, err = issues_model.ToggleIssueAssignee(ctx, issue, doer, assigneeID) + _, comment, err = issues_model.ToggleIssueAssignee(ctx, issue, doer, assignee.ID) return comment, err } + +// AddAssignees adds multiple assignees to an issue atomically. +func AddAssignees(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, assigneeIDs []int64) error { + assigneeCommentMap := make(map[int64]*issues_model.Comment) + assignees := make(map[int64]*user_model.User) + if err := db.WithTx(ctx, func(ctx context.Context) error { + for _, assigneeID := range assigneeIDs { + isAssigned, err := issues_model.IsUserAssignedToIssue(ctx, issue, assigneeID) + if err != nil { + return err + } + if isAssigned { + continue + } + + assignee, err := user_model.GetUserByID(ctx, assigneeID) + if err != nil { + return err + } + if err := validateAssignee(ctx, issue, doer, assignee); err != nil { + return err + } + + comment, err := AddAssigneeIfNotAssigned(ctx, issue, doer, assignee) + if err != nil { + return err + } + assignees[assigneeID] = assignee + assigneeCommentMap[assigneeID] = comment + } + + return nil + }); err != nil { + return err + } + + if len(assignees) > 0 { + for assigneeID, assignee := range assignees { + notify_service.IssueChangeAssignee(ctx, doer, issue, assignee, false, assigneeCommentMap[assigneeID]) + } + } + return nil +} + +// RemoveAssignees removes multiple assignees from an issue atomically. +func RemoveAssignees(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, assigneeIDs []int64) error { + assigneeCommentMap := make(map[int64]*issues_model.Comment) + assignees := make(map[int64]*user_model.User) + if err := db.WithTx(ctx, func(ctx context.Context) error { + for _, assigneeID := range assigneeIDs { + isAssigned, err := issues_model.IsUserAssignedToIssue(ctx, issue, assigneeID) + if err != nil { + return err + } + if !isAssigned { + continue + } + removed, comment, err := issues_model.ToggleIssueAssignee(ctx, issue, doer, assigneeID) + if err != nil { + return err + } + if removed { + assignee, err := user_model.GetUserByID(ctx, assigneeID) + if err != nil { + return err + } + assignees[assigneeID] = assignee + assigneeCommentMap[assigneeID] = comment + } + } + return nil + }); err != nil { + return err + } + + if len(assignees) > 0 { + for assigneeID, assignee := range assignees { + notify_service.IssueChangeAssignee(ctx, doer, issue, assignee, true, assigneeCommentMap[assigneeID]) + } + } + return nil +} diff --git a/services/issue/assignee_test.go b/services/issue/assignee_test.go index d020df717d..4c427a2849 100644 --- a/services/issue/assignee_test.go +++ b/services/issue/assignee_test.go @@ -6,6 +6,7 @@ package issue import ( "testing" + "gitea.dev/models/db" issues_model "gitea.dev/models/issues" "gitea.dev/models/unittest" user_model "gitea.dev/models/user" @@ -29,7 +30,7 @@ func TestDeleteNotPassedAssignee(t *testing.T) { assert.NoError(t, err) // Check if he got removed - isAssigned, err := issues_model.IsUserAssignedToIssue(t.Context(), issue, user1) + isAssigned, err := issues_model.IsUserAssignedToIssue(t.Context(), issue, user1.ID) assert.NoError(t, err) assert.True(t, isAssigned) @@ -44,3 +45,55 @@ func TestDeleteNotPassedAssignee(t *testing.T) { assert.Empty(t, issue.Assignees) assert.Empty(t, issue.Assignee) } + +func TestAddAssigneeIfNotAssignedBlocked(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + issue, err := issues_model.GetIssueByID(t.Context(), 1) + assert.NoError(t, err) + assert.NoError(t, issue.LoadRepo(t.Context())) + + doer, err := user_model.GetUserByID(t.Context(), 4) + assert.NoError(t, err) + + assignee, err := user_model.GetUserByID(t.Context(), 2) + assert.NoError(t, err) + + assert.NoError(t, db.Insert(t.Context(), &user_model.Blocking{ + BlockerID: assignee.ID, + BlockeeID: doer.ID, + })) + + _, err = AddAssigneeIfNotAssigned(t.Context(), issue, doer, assignee) + assert.ErrorIs(t, err, user_model.ErrBlockedUser) + + isAssigned, err := issues_model.IsUserAssignedToIssue(t.Context(), issue, assignee.ID) + assert.NoError(t, err) + assert.False(t, isAssigned) +} + +func TestAddAssigneesBlockedIsAtomic(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + issue, err := issues_model.GetIssueByID(t.Context(), 1) + assert.NoError(t, err) + assert.NoError(t, issue.LoadAttributes(t.Context())) + + doer, err := user_model.GetUserByID(t.Context(), 2) + assert.NoError(t, err) + + blockedAssignee, err := user_model.GetUserByID(t.Context(), 40) + assert.NoError(t, err) + + assert.NoError(t, db.Insert(t.Context(), &user_model.Blocking{ + BlockerID: blockedAssignee.ID, + BlockeeID: doer.ID, + })) + + err = AddAssignees(t.Context(), issue, doer, []int64{doer.ID, blockedAssignee.ID}) + assert.ErrorIs(t, err, user_model.ErrBlockedUser) + + assigneeIDs, err := issues_model.GetAssigneeIDsByIssue(t.Context(), issue.ID) + assert.NoError(t, err) + assert.ElementsMatch(t, []int64{1}, assigneeIDs) +} diff --git a/services/issue/issue.go b/services/issue/issue.go index 1c7fb7761e..511357372f 100644 --- a/services/issue/issue.go +++ b/services/issue/issue.go @@ -32,14 +32,24 @@ func NewIssue(ctx context.Context, repo *repo_model.Repository, issue *issues_mo return user_model.ErrBlockedUser } + assigneeCommentMap := make(map[int64]*issues_model.Comment) + assignees := make(map[int64]*user_model.User) if err := db.WithTx(ctx, func(ctx context.Context) error { if err := issues_model.NewIssue(ctx, repo, issue, labelIDs, uuids); err != nil { return err } for _, assigneeID := range assigneeIDs { - if _, err := AddAssigneeIfNotAssigned(ctx, issue, issue.Poster, assigneeID, true); err != nil { + assignee, err := user_model.GetUserByID(ctx, assigneeID) + if err != nil { + log.Error("GetUserByID: %v", err) + continue + } + assignees[assigneeID] = assignee + comment, err := AddAssigneeIfNotAssigned(ctx, issue, issue.Poster, assignee) + if err != nil { return err } + assigneeCommentMap[assigneeID] = comment } if len(projectIDs) > 0 { err := issues_model.IssueAssignOrRemoveProject(ctx, issue, issue.Poster, projectIDs) @@ -65,6 +75,12 @@ func NewIssue(ctx context.Context, repo *repo_model.Repository, issue *issues_mo notify_service.IssueChangeMilestone(ctx, issue.Poster, issue, 0) } + if len(assigneeIDs) > 0 { + for _, assignee := range assignees { + notify_service.IssueChangeAssignee(ctx, issue.Poster, issue, assignee, false, assigneeCommentMap[assignee.ID]) + } + } + return nil } diff --git a/services/pull/pull.go b/services/pull/pull.go index a601450ff2..a12adab99d 100644 --- a/services/pull/pull.go +++ b/services/pull/pull.go @@ -96,7 +96,7 @@ func NewPullRequest(ctx context.Context, opts *NewPullRequestOptions) error { } assigneeCommentMap := make(map[int64]*issues_model.Comment) - + assignees := make(map[int64]*user_model.User) var reviewNotifiers []*issue_service.ReviewRequestNotifier if err := db.WithTx(ctx, func(ctx context.Context) error { if err := issues_model.NewPullRequest(ctx, repo, issue, labelIDs, uuids, pr); err != nil { @@ -104,10 +104,16 @@ func NewPullRequest(ctx context.Context, opts *NewPullRequestOptions) error { } for _, assigneeID := range assigneeIDs { - comment, err := issue_service.AddAssigneeIfNotAssigned(ctx, issue, issue.Poster, assigneeID, false) + assignee, err := user_model.GetUserByID(ctx, assigneeID) + if err != nil { + log.Error("GetUserByID: %v", err) + continue + } + comment, err := issue_service.AddAssigneeIfNotAssigned(ctx, issue, issue.Poster, assignee) if err != nil { return err } + assignees[assigneeID] = assignee assigneeCommentMap[assigneeID] = comment } @@ -186,12 +192,8 @@ func NewPullRequest(ctx context.Context, opts *NewPullRequestOptions) error { if issue.Milestone != nil { notify_service.IssueChangeMilestone(ctx, issue.Poster, issue, 0) } - for _, assigneeID := range assigneeIDs { - assignee, err := user_model.GetUserByID(ctx, assigneeID) - if err != nil { - return ErrDependenciesLeft - } - notify_service.IssueChangeAssignee(ctx, issue.Poster, issue, assignee, false, assigneeCommentMap[assigneeID]) + for _, assignee := range assignees { + notify_service.IssueChangeAssignee(ctx, issue.Poster, issue, assignee, false, assigneeCommentMap[assignee.ID]) } return nil diff --git a/services/repository/collaboration.go b/services/repository/collaboration.go index 9bbafb5c0c..68bb88cf87 100644 --- a/services/repository/collaboration.go +++ b/services/repository/collaboration.go @@ -100,7 +100,7 @@ func DeleteCollaboration(ctx context.Context, repo *repo_model.Repository, colla } func ReconsiderRepoIssuesAssignee(ctx context.Context, repo *repo_model.Repository, user *user_model.User) error { - if canAssigned, err := access_model.CanBeAssigned(ctx, user, repo, true); err != nil || canAssigned { + if canAssigned, err := access_model.CanBeAssigned(ctx, user, repo); err != nil || canAssigned { return err } diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl index 0463c31d2a..13347e0fce 100644 --- a/templates/swagger/v1_json.tmpl +++ b/templates/swagger/v1_json.tmpl @@ -6766,6 +6766,52 @@ } } }, + "/repos/{owner}/{repo}/assignees/{assignee}": { + "get": { + "produces": [ + "application/json" + ], + "tags": [ + "repository" + ], + "summary": "Check if a user can be assigned to issues in a repository", + "operationId": "repoCheckAssignee", + "parameters": [ + { + "type": "string", + "description": "owner of the repo", + "name": "owner", + "in": "path", + "required": true + }, + { + "type": "string", + "description": "name of the repo", + "name": "repo", + "in": "path", + "required": true + }, + { + "type": "string", + "description": "username of the user to check for being an assignee", + "name": "assignee", + "in": "path", + "required": true + } + ], + "responses": { + "204": { + "$ref": "#/responses/empty" + }, + "400": { + "$ref": "#/responses/error" + }, + "404": { + "$ref": "#/responses/notFound" + } + } + } + }, "/repos/{owner}/{repo}/avatar": { "post": { "produces": [ @@ -10962,6 +11008,183 @@ } } }, + "/repos/{owner}/{repo}/issues/{index}/assignees": { + "post": { + "consumes": [ + "application/json" + ], + "produces": [ + "application/json" + ], + "tags": [ + "issue" + ], + "summary": "Add assignees to an issue", + "operationId": "issueAddAssignees", + "parameters": [ + { + "type": "string", + "description": "owner of the repo", + "name": "owner", + "in": "path", + "required": true + }, + { + "type": "string", + "description": "name of the repo", + "name": "repo", + "in": "path", + "required": true + }, + { + "type": "integer", + "format": "int64", + "description": "index of the issue", + "name": "index", + "in": "path", + "required": true + }, + { + "name": "body", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/IssueAssigneesOption" + } + } + ], + "responses": { + "201": { + "$ref": "#/responses/Issue" + }, + "400": { + "$ref": "#/responses/error" + }, + "403": { + "$ref": "#/responses/forbidden" + }, + "404": { + "$ref": "#/responses/notFound" + }, + "422": { + "$ref": "#/responses/validationError" + } + } + }, + "delete": { + "consumes": [ + "application/json" + ], + "produces": [ + "application/json" + ], + "tags": [ + "issue" + ], + "summary": "Remove assignees from an issue", + "operationId": "issueRemoveAssignees", + "parameters": [ + { + "type": "string", + "description": "owner of the repo", + "name": "owner", + "in": "path", + "required": true + }, + { + "type": "string", + "description": "name of the repo", + "name": "repo", + "in": "path", + "required": true + }, + { + "type": "integer", + "format": "int64", + "description": "index of the issue", + "name": "index", + "in": "path", + "required": true + }, + { + "name": "body", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/IssueAssigneesOption" + } + } + ], + "responses": { + "200": { + "$ref": "#/responses/Issue" + }, + "403": { + "$ref": "#/responses/forbidden" + }, + "404": { + "$ref": "#/responses/notFound" + }, + "422": { + "$ref": "#/responses/validationError" + } + } + } + }, + "/repos/{owner}/{repo}/issues/{index}/assignees/{assignee}": { + "get": { + "produces": [ + "application/json" + ], + "tags": [ + "issue" + ], + "summary": "Check if a user can be assigned to an issue", + "operationId": "issueCheckAssignee", + "parameters": [ + { + "type": "string", + "description": "owner of the repo", + "name": "owner", + "in": "path", + "required": true + }, + { + "type": "string", + "description": "name of the repo", + "name": "repo", + "in": "path", + "required": true + }, + { + "type": "integer", + "format": "int64", + "description": "index of the issue", + "name": "index", + "in": "path", + "required": true + }, + { + "type": "string", + "description": "username of the user to check for being an assignee", + "name": "assignee", + "in": "path", + "required": true + } + ], + "responses": { + "204": { + "$ref": "#/responses/empty" + }, + "400": { + "$ref": "#/responses/error" + }, + "404": { + "$ref": "#/responses/notFound" + } + } + } + }, "/repos/{owner}/{repo}/issues/{index}/blocks": { "get": { "produces": [ @@ -26838,6 +27061,20 @@ }, "x-go-package": "gitea.dev/modules/structs" }, + "IssueAssigneesOption": { + "description": "IssueAssigneesOption options for adding/removing issue assignees", + "type": "object", + "properties": { + "assignees": { + "type": "array", + "items": { + "type": "string" + }, + "x-go-name": "Assignees" + } + }, + "x-go-package": "gitea.dev/modules/structs" + }, "IssueConfig": { "type": "object", "properties": { diff --git a/templates/swagger/v1_openapi3_json.tmpl b/templates/swagger/v1_openapi3_json.tmpl index fcc1603ce1..b4ea4187fe 100644 --- a/templates/swagger/v1_openapi3_json.tmpl +++ b/templates/swagger/v1_openapi3_json.tmpl @@ -6992,6 +6992,20 @@ "type": "object", "x-go-package": "gitea.dev/modules/structs" }, + "IssueAssigneesOption": { + "description": "IssueAssigneesOption options for adding/removing issue assignees", + "properties": { + "assignees": { + "items": { + "type": "string" + }, + "type": "array", + "x-go-name": "Assignees" + } + }, + "type": "object", + "x-go-package": "gitea.dev/modules/structs" + }, "IssueConfig": { "properties": { "blank_issues_enabled": { @@ -17814,6 +17828,55 @@ ] } }, + "/repos/{owner}/{repo}/assignees/{assignee}": { + "get": { + "operationId": "repoCheckAssignee", + "parameters": [ + { + "description": "owner of the repo", + "in": "path", + "name": "owner", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "name of the repo", + "in": "path", + "name": "repo", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "username of the user to check for being an assignee", + "in": "path", + "name": "assignee", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "204": { + "$ref": "#/components/responses/empty" + }, + "400": { + "$ref": "#/components/responses/error" + }, + "404": { + "$ref": "#/components/responses/notFound" + } + }, + "summary": "Check if a user can be assigned to issues in a repository", + "tags": [ + "repository" + ] + } + }, "/repos/{owner}/{repo}/avatar": { "delete": { "operationId": "repoDeleteAvatar", @@ -22371,6 +22434,194 @@ ] } }, + "/repos/{owner}/{repo}/issues/{index}/assignees": { + "delete": { + "operationId": "issueRemoveAssignees", + "parameters": [ + { + "description": "owner of the repo", + "in": "path", + "name": "owner", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "name of the repo", + "in": "path", + "name": "repo", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "index of the issue", + "in": "path", + "name": "index", + "required": true, + "schema": { + "format": "int64", + "type": "integer" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/IssueAssigneesOption" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "200": { + "$ref": "#/components/responses/Issue" + }, + "403": { + "$ref": "#/components/responses/forbidden" + }, + "404": { + "$ref": "#/components/responses/notFound" + }, + "422": { + "$ref": "#/components/responses/validationError" + } + }, + "summary": "Remove assignees from an issue", + "tags": [ + "issue" + ] + }, + "post": { + "operationId": "issueAddAssignees", + "parameters": [ + { + "description": "owner of the repo", + "in": "path", + "name": "owner", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "name of the repo", + "in": "path", + "name": "repo", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "index of the issue", + "in": "path", + "name": "index", + "required": true, + "schema": { + "format": "int64", + "type": "integer" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/IssueAssigneesOption" + } + } + }, + "required": true, + "x-originalParamName": "body" + }, + "responses": { + "201": { + "$ref": "#/components/responses/Issue" + }, + "400": { + "$ref": "#/components/responses/error" + }, + "403": { + "$ref": "#/components/responses/forbidden" + }, + "404": { + "$ref": "#/components/responses/notFound" + }, + "422": { + "$ref": "#/components/responses/validationError" + } + }, + "summary": "Add assignees to an issue", + "tags": [ + "issue" + ] + } + }, + "/repos/{owner}/{repo}/issues/{index}/assignees/{assignee}": { + "get": { + "operationId": "issueCheckAssignee", + "parameters": [ + { + "description": "owner of the repo", + "in": "path", + "name": "owner", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "name of the repo", + "in": "path", + "name": "repo", + "required": true, + "schema": { + "type": "string" + } + }, + { + "description": "index of the issue", + "in": "path", + "name": "index", + "required": true, + "schema": { + "format": "int64", + "type": "integer" + } + }, + { + "description": "username of the user to check for being an assignee", + "in": "path", + "name": "assignee", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "204": { + "$ref": "#/components/responses/empty" + }, + "400": { + "$ref": "#/components/responses/error" + }, + "404": { + "$ref": "#/components/responses/notFound" + } + }, + "summary": "Check if a user can be assigned to an issue", + "tags": [ + "issue" + ] + } + }, "/repos/{owner}/{repo}/issues/{index}/blocks": { "delete": { "operationId": "issueRemoveIssueBlocking", diff --git a/tests/integration/api_issue_test.go b/tests/integration/api_issue_test.go index 67a7e2b590..b77775d173 100644 --- a/tests/integration/api_issue_test.go +++ b/tests/integration/api_issue_test.go @@ -13,6 +13,7 @@ import ( "time" auth_model "gitea.dev/models/auth" + "gitea.dev/models/db" issues_model "gitea.dev/models/issues" repo_model "gitea.dev/models/repo" "gitea.dev/models/unittest" @@ -35,6 +36,7 @@ func TestAPIIssue(t *testing.T) { t.Run("IssueContentVersion", testAPIIssueContentVersion) t.Run("CreateIssue", testAPICreateIssue) t.Run("CreateIssueParallel", testAPICreateIssueParallel) + t.Run("IssueAssignees", testAPIIssueAssignees) t.Run("IssueProjects", testAPIIssueProjects) } @@ -495,6 +497,91 @@ func testAPIIssueContentVersion(t *testing.T) { }) } +func testAPIIssueAssignees(t *testing.T) { + issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1}) + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: issue.RepoID}) + owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID}) + + session := loginUser(t, owner.Name) + token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue) + + urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/assignees", owner.Name, repo.Name, issue.Index) + getAssigneeIDs := func(issueID int64) []int64 { + assigneeIDs, err := issues_model.GetAssigneeIDsByIssue(t.Context(), issueID) + assert.NoError(t, err) + return assigneeIDs + } + + t.Run("NonWriter", func(t *testing.T) { + req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"user40"}}). + AddTokenAuth(getUserToken(t, "user5", auth_model.AccessTokenScopeWriteIssue)) + MakeRequest(t, req, http.StatusForbidden) + }) + + t.Run("MissingIssue", func(t *testing.T) { + req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/issues/99999/assignees", owner.Name, repo.Name), &api.IssueAssigneesOption{Assignees: []string{"user40"}}). + AddTokenAuth(token) + MakeRequest(t, req, http.StatusNotFound) + }) + + t.Run("UnknownAssignee", func(t *testing.T) { + req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"does-not-exist"}}). + AddTokenAuth(token) + resp := MakeRequest(t, req, http.StatusUnprocessableEntity) + apiErr := DecodeJSON(t, resp, &api.APIError{}) + assert.Equal(t, "user does not exist [uid: 0, name: does-not-exist]", apiErr.Message) + }) + + t.Run("OrganizationAssignee", func(t *testing.T) { + req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"org3"}}). + AddTokenAuth(token) + MakeRequest(t, req, http.StatusBadRequest) + + checkReq := NewRequest(t, "GET", fmt.Sprintf("%s/%s", urlStr, "org3")).AddTokenAuth(token) + MakeRequest(t, checkReq, http.StatusBadRequest) + }) + + t.Run("BlockedAssigneeIsAtomic", func(t *testing.T) { + blockedIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 5}) + blockedURL := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/assignees", owner.Name, repo.Name, blockedIssue.Index) + blockedToken := getUserToken(t, "user40", auth_model.AccessTokenScopeWriteIssue) + + assert.Empty(t, getAssigneeIDs(blockedIssue.ID)) + assert.NoError(t, db.Insert(t.Context(), &user_model.Blocking{ + BlockerID: owner.ID, + BlockeeID: 40, + })) + + req := NewRequestWithJSON(t, "POST", blockedURL, &api.IssueAssigneesOption{Assignees: []string{"user1", "user2"}}). + AddTokenAuth(blockedToken) + MakeRequest(t, req, http.StatusForbidden) + assert.Empty(t, getAssigneeIDs(blockedIssue.ID)) + }) + + t.Run("HappyPath", func(t *testing.T) { + req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"user40"}}). + AddTokenAuth(token) + resp := MakeRequest(t, req, http.StatusCreated) + apiIssue := DecodeJSON(t, resp, &api.Issue{}) + assert.Len(t, apiIssue.Assignees, 2) + assert.ElementsMatch(t, []int64{1, 40}, []int64{apiIssue.Assignees[0].ID, apiIssue.Assignees[1].ID}) + + checkReq := NewRequest(t, "GET", fmt.Sprintf("%s/%s", urlStr, "user40")).AddTokenAuth(token) + MakeRequest(t, checkReq, http.StatusNoContent) + + // This endpoint checks assignability, not current assignment membership. + checkReq = NewRequest(t, "GET", fmt.Sprintf("%s/%s", urlStr, "user5")).AddTokenAuth(token) + MakeRequest(t, checkReq, http.StatusNoContent) + + req = NewRequestWithJSON(t, "DELETE", urlStr, &api.IssueAssigneesOption{Assignees: []string{"user1"}}). + AddTokenAuth(token) + resp = MakeRequest(t, req, http.StatusOK) + apiIssue = DecodeJSON(t, resp, &api.Issue{}) + assert.Len(t, apiIssue.Assignees, 1) + assert.Equal(t, int64(40), apiIssue.Assignees[0].ID) + }) +} + func testAPIIssueProjects(t *testing.T) { repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1}) owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID}) diff --git a/tests/integration/api_repo_test.go b/tests/integration/api_repo_test.go index 45d904c261..47d8effaab 100644 --- a/tests/integration/api_repo_test.go +++ b/tests/integration/api_repo_test.go @@ -721,11 +721,25 @@ func TestAPIRepoGetAssignees(t *testing.T) { user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}) session := loginUser(t, user.Name) token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository) - repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1}) + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2}) req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/assignees", user.Name, repo.Name). AddTokenAuth(token) resp := MakeRequest(t, req, http.StatusOK) assignees := DecodeJSON(t, resp, []*api.User{}) - assert.Len(t, assignees, 2) + assert.Len(t, assignees, 1) + + assignee := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}) + req = NewRequestf(t, "GET", "/api/v1/repos/%s/%s/assignees/%s", user.Name, repo.Name, assignee.Name). + AddTokenAuth(token) + MakeRequest(t, req, http.StatusNoContent) + + nonAssignee := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5}) + req = NewRequestf(t, "GET", "/api/v1/repos/%s/%s/assignees/%s", user.Name, repo.Name, nonAssignee.Name). + AddTokenAuth(token) + MakeRequest(t, req, http.StatusNotFound) + + req = NewRequestf(t, "GET", "/api/v1/repos/%s/%s/assignees/%s", user.Name, repo.Name, "org3"). + AddTokenAuth(token) + MakeRequest(t, req, http.StatusBadRequest) } From a91c88428b1cc23e4b9769a9df826e6611d0f9ad Mon Sep 17 00:00:00 2001 From: Giteabot Date: Tue, 9 Jun 2026 02:57:31 -0700 Subject: [PATCH 3/7] chore(deps): update dependency happy-dom to v20.10.1 (#38043) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [happy-dom](https://redirect.github.com/capricorn86/happy-dom) | [`20.9.0` β†’ `20.10.1`](https://renovatebot.com/diffs/npm/happy-dom/20.9.0/20.10.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/happy-dom/20.10.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/happy-dom/20.9.0/20.10.1?slim=true) | --- ### Release Notes
capricorn86/happy-dom (happy-dom) ### [`v20.10.1`](https://redirect.github.com/capricorn86/happy-dom/compare/v20.10.0...v20.10.1) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.10.0...v20.10.1) ### [`v20.10.0`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v20.10.0) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v20.9.0...v20.10.0) ##### :art: Features - Adds support for setting a canvas adapter for handling the canvas rendering using the browser setting [canvasAdapter](https://redirect.github.com/capricorn86/happy-dom/wiki/IOptionalBrowserSettings) - By **[@​RAprogramm](https://redirect.github.com/RAprogramm)** and **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​241](https://redirect.github.com/capricorn86/happy-dom/issues/241) - Adds new package [@​happy-dom/node-canvas-adapter](https://redirect.github.com/capricorn86/happy-dom/tree/master/packages/%40happy-dom/node-canvas-adapter) - By **[@​RAprogramm](https://redirect.github.com/RAprogramm)** and **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​241](https://redirect.github.com/capricorn86/happy-dom/issues/241) - [@​happy-dom/node-canvas-adapter](https://redirect.github.com/capricorn86/happy-dom/tree/master/packages/%40happy-dom/node-canvas-adapter) is a pluggable canvas adapter for Happy DOM using [node-canvas](https://redirect.github.com/Automattic/node-canvas). - Adds support for loading image files when enabling the browser setting [enableImageFileLoading](https://redirect.github.com/capricorn86/happy-dom/wiki/IOptionalBrowserSettings) - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​241](https://redirect.github.com/capricorn86/happy-dom/issues/241) - Adds support for loading image data URLs - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​241](https://redirect.github.com/capricorn86/happy-dom/issues/241) - Adds support for [ImageData](https://developer.mozilla.org/en-US/docs/Web/API/ImageData) - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​241](https://redirect.github.com/capricorn86/happy-dom/issues/241) - Adds support for [ImageBitmap](https://developer.mozilla.org/en-US/docs/Web/API/ImageBitmap) - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​241](https://redirect.github.com/capricorn86/happy-dom/issues/241) - Adds support for [Window.createImageBitmap()](https://developer.mozilla.org/en-US/docs/Web/API/Window/createImageBitmap) - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​241](https://redirect.github.com/capricorn86/happy-dom/issues/241)
--- ### Configuration πŸ“… **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). --- package.json | 2 +- pnpm-lock.yaml | 93 ++++++++++++++++++++++++++++++++++---------------- 2 files changed, 65 insertions(+), 30 deletions(-) diff --git a/package.json b/package.json index cbd944222b..c35457e167 100644 --- a/package.json +++ b/package.json @@ -106,7 +106,7 @@ "eslint-plugin-vue-scoped-css": "3.1.1", "eslint-plugin-wc": "3.1.0", "globals": "17.6.0", - "happy-dom": "20.9.0", + "happy-dom": "20.10.1", "jiti": "2.7.0", "markdownlint-cli": "0.48.0", "material-icon-theme": "5.35.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 948bb2ba5c..ee94cec7f2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -257,7 +257,7 @@ importers: version: 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3) '@vitest/eslint-plugin': specifier: 1.6.19 - version: 1.6.19(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))) + version: 1.6.19(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.10.1)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))) eslint: specifier: 10.4.1 version: 10.4.1(jiti@2.7.0) @@ -301,8 +301,8 @@ importers: specifier: 17.6.0 version: 17.6.0 happy-dom: - specifier: 20.9.0 - version: 20.9.0 + specifier: 20.10.1 + version: 20.10.1 jiti: specifier: 2.7.0 version: 2.7.0 @@ -347,7 +347,7 @@ importers: version: 17.17.3 vitest: specifier: 4.1.8 - version: 4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)) + version: 4.1.8(@types/node@25.9.1)(happy-dom@20.10.1)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)) vue-tsc: specifier: 3.3.3 version: 3.3.3(typescript@6.0.3) @@ -1879,6 +1879,10 @@ packages: engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true + buffer-image-size@0.6.4: + resolution: {integrity: sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ==} + engines: {node: '>=4.0'} + buffer@5.7.1: resolution: {integrity: sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==} @@ -3006,8 +3010,8 @@ packages: resolution: {integrity: sha512-tSQXBXS/MWQOn/RKckawJ61vvsDpCom87JgxiYdGwHdOa0ht0vzUWDlfioofFCRU0L+6NGDt6XzbgoJvZkMeRQ==} engines: {node: '>=0.8.0'} - happy-dom@20.9.0: - resolution: {integrity: sha512-GZZ9mKe8r646NUAf/zemnGbjYh4Bt8/MqASJY+pSm5ZDtc3YQox+4gsLI7yi1hba6o+eCsGxpHn5+iEVn31/FQ==} + happy-dom@20.10.1: + resolution: {integrity: sha512-awPoqPjx8CgjapJllyDlgzgVHjBExcitKK5ZJkxwhQJyQpHFkyS2bEcqCm7IeW20cQvuCI0cz2Ifq79CJKqtiw==} engines: {node: '>=20.0.0'} har-schema@2.0.0: @@ -6125,22 +6129,6 @@ snapshots: transitivePeerDependencies: - supports-color - '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3)': - dependencies: - '@eslint-community/regexpp': 4.12.2 - '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3) - '@typescript-eslint/scope-manager': 8.60.1 - '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3) - '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3) - '@typescript-eslint/visitor-keys': 8.60.1 - eslint: 10.4.1(jiti@2.7.0) - ignore: 7.0.5 - natural-compare: 1.4.0 - ts-api-utils: 2.5.0(typescript@5.9.3) - typescript: 5.9.3 - transitivePeerDependencies: - - supports-color - '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)': dependencies: '@eslint-community/regexpp': 4.12.2 @@ -6376,7 +6364,7 @@ snapshots: vite: 8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0) vue: 3.5.35(typescript@6.0.3) - '@vitest/eslint-plugin@1.6.19(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))': + '@vitest/eslint-plugin@1.6.19(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.10.1)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))': dependencies: '@typescript-eslint/scope-manager': 8.60.1 '@typescript-eslint/utils': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3) @@ -6384,7 +6372,7 @@ snapshots: optionalDependencies: '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3) typescript: 6.0.3 - vitest: 4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)) + vitest: 4.1.8(@types/node@25.9.1)(happy-dom@20.10.1)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)) transitivePeerDependencies: - supports-color @@ -6710,6 +6698,10 @@ snapshots: node-releases: 2.0.46 update-browserslist-db: 1.2.3(browserslist@4.28.2) + buffer-image-size@0.6.4: + dependencies: + '@types/node': 25.9.1 + buffer@5.7.1: dependencies: base64-js: 1.5.1 @@ -7459,6 +7451,17 @@ snapshots: transitivePeerDependencies: - supports-color + eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)): + dependencies: + debug: 3.2.7 + optionalDependencies: + '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3) + eslint: 10.4.1(jiti@2.7.0) + eslint-import-resolver-node: 0.3.10 + eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0)) + transitivePeerDependencies: + - supports-color + eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)): dependencies: debug: 3.2.7 @@ -7469,6 +7472,7 @@ snapshots: eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.1(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.1(jiti@2.7.0)) transitivePeerDependencies: - supports-color + optional: true eslint-plugin-array-func@5.1.1(eslint@10.4.1(jiti@2.7.0)): dependencies: @@ -7503,7 +7507,7 @@ snapshots: '@eslint/eslintrc': 3.3.5 '@eslint/js': 9.39.4 '@github/browserslist-config': 1.0.0 - '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3) + '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3) '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3) aria-query: 5.3.2 eslint: 10.4.1(jiti@2.7.0) @@ -7512,7 +7516,7 @@ snapshots: eslint-plugin-eslint-comments: 3.2.0(eslint@10.4.1(jiti@2.7.0)) eslint-plugin-filenames: 1.3.2(eslint@10.4.1(jiti@2.7.0)) eslint-plugin-i18n-text: 1.0.1(eslint@10.4.1(jiti@2.7.0)) - eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)) + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)) eslint-plugin-jsx-a11y: 6.10.2(eslint@10.4.1(jiti@2.7.0)) eslint-plugin-no-only-tests: 3.4.0 eslint-plugin-prettier: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.1(jiti@2.7.0)))(eslint@10.4.1(jiti@2.7.0))(prettier@3.8.3) @@ -7552,6 +7556,35 @@ snapshots: transitivePeerDependencies: - supports-color + eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)): + dependencies: + '@rtsao/scc': 1.1.0 + array-includes: 3.1.9 + array.prototype.findlastindex: 1.2.6 + array.prototype.flat: 1.3.3 + array.prototype.flatmap: 1.3.3 + debug: 3.2.7 + doctrine: 2.1.0 + eslint: 10.4.1(jiti@2.7.0) + eslint-import-resolver-node: 0.3.10 + eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)) + hasown: 2.0.4 + is-core-module: 2.16.2 + is-glob: 4.0.3 + minimatch: 3.1.5 + object.fromentries: 2.0.8 + object.groupby: 1.0.3 + object.values: 1.2.1 + semver: 6.3.1 + string.prototype.trimend: 1.0.9 + tsconfig-paths: 3.15.0 + optionalDependencies: + '@typescript-eslint/parser': 8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@5.9.3) + transitivePeerDependencies: + - eslint-import-resolver-typescript + - eslint-import-resolver-webpack + - supports-color + eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@10.4.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.4.1(jiti@2.7.0)): dependencies: '@rtsao/scc': 1.1.0 @@ -7580,6 +7613,7 @@ snapshots: - eslint-import-resolver-typescript - eslint-import-resolver-webpack - supports-color + optional: true eslint-plugin-jsx-a11y@6.10.2(eslint@10.4.1(jiti@2.7.0)): dependencies: @@ -8013,11 +8047,12 @@ snapshots: hammerjs@2.0.8: {} - happy-dom@20.9.0: + happy-dom@20.10.1: dependencies: '@types/node': 25.9.1 '@types/whatwg-mimetype': 3.0.2 '@types/ws': 8.18.1 + buffer-image-size: 0.6.4 entities: 7.0.1 whatwg-mimetype: 3.0.0 ws: 8.21.0 @@ -10001,7 +10036,7 @@ snapshots: fsevents: 2.3.3 jiti: 2.7.0 - vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)): + vitest@4.1.8(@types/node@25.9.1)(happy-dom@20.10.1)(jsdom@20.0.3)(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)): dependencies: '@vitest/expect': 4.1.8 '@vitest/mocker': 4.1.8(vite@8.0.16(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)) @@ -10025,7 +10060,7 @@ snapshots: why-is-node-running: 2.3.0 optionalDependencies: '@types/node': 25.9.1 - happy-dom: 20.9.0 + happy-dom: 20.10.1 jsdom: 20.0.3 transitivePeerDependencies: - msw From 5fe77ad3095b6ca4e3efe042951cf825373fd859 Mon Sep 17 00:00:00 2001 From: Giteabot Date: Tue, 9 Jun 2026 03:41:54 -0700 Subject: [PATCH 4/7] fix(deps): update go dependencies (#37967) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [gitea.com/gitea/runner](https://gitea.com/gitea/runner) | `v1.0.5` β†’ `v1.0.6` | ![age](https://developer.mend.io/api/mc/badges/age/go/gitea.com%2fgitea%2frunner/v1.0.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/gitea.com%2fgitea%2frunner/v1.0.5/v1.0.6?slim=true) | | [github.com/aws/aws-sdk-go-v2/credentials](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.19.16` β†’ `v1.19.17` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fcredentials/v1.19.17?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fcredentials/v1.19.16/v1.19.17?slim=true) | | [github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi) | `v0.138.0` β†’ `v0.139.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgetkin%2fkin-openapi/v0.139.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgetkin%2fkin-openapi/v0.138.0/v0.139.0?slim=true) | | [github.com/go-chi/chi/v5](https://redirect.github.com/go-chi/chi) | `v5.2.5` β†’ `v5.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-chi%2fchi%2fv5/v5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-chi%2fchi%2fv5/v5.2.5/v5.3.0?slim=true) | | [github.com/go-webauthn/webauthn](https://redirect.github.com/go-webauthn/webauthn) | `v0.17.3` β†’ `v0.17.4` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-webauthn%2fwebauthn/v0.17.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-webauthn%2fwebauthn/v0.17.3/v0.17.4?slim=true) | | [github.com/minio/minio-go/v7](https://redirect.github.com/minio/minio-go) | `v7.1.0` β†’ `v7.2.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fminio%2fminio-go%2fv7/v7.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fminio%2fminio-go%2fv7/v7.1.0/v7.2.0?slim=true) | | [gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go) | `v2.30.0` β†’ `v2.34.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/gitlab.com%2fgitlab-org%2fapi%2fclient-go%2fv2/v2.34.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/gitlab.com%2fgitlab-org%2fapi%2fclient-go%2fv2/v2.30.0/v2.34.0?slim=true) | --- ### Release Notes
gitea/runner (gitea.com/gitea/runner) ### [`v1.0.6`](https://gitea.com/gitea/runner/releases/tag/v1.0.6) [Compare Source](https://gitea.com/gitea/runner/compare/v1.0.5...v1.0.6) #### Changelog - fix(deps): update module github.com/opencontainers/selinux to v1.15.0 ([#​990](https://redirect.github.com/gitea/runner/issues/990)) - chore: pin Docker base images to explicit versions ([#​992](https://redirect.github.com/gitea/runner/issues/992)) - chore(deps): update actions/setup-node action to v6 ([#​991](https://redirect.github.com/gitea/runner/issues/991)) - test: make TestRunEvent integration suite runnable locally ([#​987](https://redirect.github.com/gitea/runner/issues/987)) - ci: add PR title linting against Conventional Commits ([#​988](https://redirect.github.com/gitea/runner/issues/988)) - fix: clean up job network and container when container start fails ([#​986](https://redirect.github.com/gitea/runner/issues/986))
getkin/kin-openapi (github.com/getkin/kin-openapi) ### [`v0.139.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.139.0) [Compare Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.138.0...v0.139.0) #### What's Changed - feat(openapi3): batch-convert long-tail RequiredFieldError sites by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1170](https://redirect.github.com/getkin/kin-openapi/pull/1170) - feat(openapi3): typed validation error clusters (combined: [#​1171](https://redirect.github.com/getkin/kin-openapi/issues/1171)-[#​1179](https://redirect.github.com/getkin/kin-openapi/issues/1179)) by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1180](https://redirect.github.com/getkin/kin-openapi/pull/1180) - openapi3gen: skip component export for anonymous types by [@​0-don](https://redirect.github.com/0-don) in [#​1163](https://redirect.github.com/getkin/kin-openapi/pull/1163) - feat: migrate to oasdiff/yaml v0.1.0 single Unmarshal API + enable DisableTimestamps by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1181](https://redirect.github.com/getkin/kin-openapi/pull/1181) - openapi3: typed context errors for Validate() wrapper chain by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1183](https://redirect.github.com/getkin/kin-openapi/pull/1183) - openapi3: track Origin on the document root (T) by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1184](https://redirect.github.com/getkin/kin-openapi/pull/1184) - openapi3: tests flakiness corrected by [@​fenollp](https://redirect.github.com/fenollp) in [#​1159](https://redirect.github.com/getkin/kin-openapi/pull/1159) - openapi3: aggregate independent validation errors via EnableMultiError by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1185](https://redirect.github.com/getkin/kin-openapi/pull/1185) - openapi3: fix validation of duplicated path templates by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1189](https://redirect.github.com/getkin/kin-openapi/pull/1189) - openapi3: type the remaining bare-error validation sites by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1187](https://redirect.github.com/getkin/kin-openapi/pull/1187) **Full Changelog**:
go-chi/chi (github.com/go-chi/chi/v5) ### [`v5.3.0`](https://redirect.github.com/go-chi/chi/releases/tag/v5.3.0) [Compare Source](https://redirect.github.com/go-chi/chi/compare/v5.2.5...v5.3.0) #### What's Changed - Use strings.ReplaceAll where applicable by [@​JRaspass](https://redirect.github.com/JRaspass) in [#​1046](https://redirect.github.com/go-chi/chi/pull/1046) - Propagate inline middlewares across mounted subrouters by [@​LukasJenicek](https://redirect.github.com/LukasJenicek) in [#​1049](https://redirect.github.com/go-chi/chi/pull/1049) - add go 1.26 to ci by [@​pkieltyka](https://redirect.github.com/pkieltyka) in [#​1052](https://redirect.github.com/go-chi/chi/pull/1052) - Remove last uses of io/ioutil by [@​JRaspass](https://redirect.github.com/JRaspass) in [#​1054](https://redirect.github.com/go-chi/chi/pull/1054) - Simplify chi.walk with slices.Concat by [@​JRaspass](https://redirect.github.com/JRaspass) in [#​1053](https://redirect.github.com/go-chi/chi/pull/1053) - Apply the stringscutprefix modernizer by [@​JRaspass](https://redirect.github.com/JRaspass) in [#​1051](https://redirect.github.com/go-chi/chi/pull/1051) - Bump minimum Go to 1.23, always use request.Pattern by [@​JRaspass](https://redirect.github.com/JRaspass) in [#​1048](https://redirect.github.com/go-chi/chi/pull/1048) - middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by [@​alliasgher](https://redirect.github.com/alliasgher) in [#​1085](https://redirect.github.com/go-chi/chi/pull/1085) - Fix typo in Route doc comment by [@​gouwazi](https://redirect.github.com/gouwazi) in [#​1073](https://redirect.github.com/go-chi/chi/pull/1073) - fix: set Request.Pattern from RoutePattern() by [@​leno23](https://redirect.github.com/leno23) in [#​1097](https://redirect.github.com/go-chi/chi/pull/1097) - feat: middleware.ClientIP, a replacement for middleware.RealIP by [@​VojtechVitek](https://redirect.github.com/VojtechVitek) in [#​967](https://redirect.github.com/go-chi/chi/pull/967) #### New Contributors - [@​LukasJenicek](https://redirect.github.com/LukasJenicek) made their first contribution in [#​1049](https://redirect.github.com/go-chi/chi/pull/1049) - [@​alliasgher](https://redirect.github.com/alliasgher) made their first contribution in [#​1085](https://redirect.github.com/go-chi/chi/pull/1085) - [@​gouwazi](https://redirect.github.com/gouwazi) made their first contribution in [#​1073](https://redirect.github.com/go-chi/chi/pull/1073) - [@​leno23](https://redirect.github.com/leno23) made their first contribution in [#​1097](https://redirect.github.com/go-chi/chi/pull/1097) #### SECURITY: middleware.ClientIP, a replacement for middleware.RealIP [@​VojtechVitek](https://redirect.github.com/VojtechVitek) submitted PR [#​967](https://redirect.github.com/go-chi/chi/issues/967), which introduces middleware.ClientIP β€” a replacement for middleware.RealIP that closes the three open spoofing advisories: - [GHSA-9g5q-2w5x-hmxf](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf) β€” IP spoofing via XFF in `RemoteAddr` resolution (convto) - [GHSA-rjr7-jggh-pgcp](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp) β€” RealIP allows IP spoofing via unvalidated XFF (rezmoss) - [GHSA-3fxj-6jh8-hvhx](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx) β€” IP spoofing in `middleware.RealIP` (Saku0512, Critical / 9.3) It also addresses issues outlined at: - [#​708](https://redirect.github.com/go-chi/chi/issues/708) - - [#​711](https://redirect.github.com/go-chi/chi/issues/711) - [#​453](https://redirect.github.com/go-chi/chi/issues/453) - [#​908](https://redirect.github.com/go-chi/chi/pull/908) `middleware.RealIP` is deprecated in this PR with pointers to the new API. The deprecation only adds a `// Deprecated:` doc comment; the function keeps working for backward compatibility. ##### Why a new middleware (not "fix RealIP in place") `RealIP` has two unfixable design choices: it mutates `r.RemoteAddr`, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per [adam-p's "The perils of the 'real' client IP"](https://adam-p.ca/blog/2022/03/x-forwarded-for/) (which calls chi out by name on this), there is no safe default β€” the user must pick their trust source explicitly. ##### The new API Four middlewares, two accessors. Pick exactly one middleware based on your infrastructure, read the result with one of the two accessors: ```go // One of the four. There is no safe default β€” pick exactly one. func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler func ClientIPFromRemoteAddr(h http.Handler) http.Handler // Read the result. func GetClientIP(ctx context.Context) string // for logs, rate-limit keys func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work ``` #### Example usage: ```go // Pick a single ClientIP middleware based on your deployment // Cloudflare. r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP")) // Nginx with ngx_http_realip_module. r.Use(middleware.ClientIPFromHeader("X-Real-IP")) // Apache with mod_remoteip. r.Use(middleware.ClientIPFromHeader("X-Client-IP")) // AWS CloudFront, or any proxy fleet with known CIDRs. r.Use(middleware.ClientIPFromXFF( "13.32.0.0/15", // CloudFront IPv4 "52.46.0.0/18", // CloudFront IPv4 "2600:9000::/28", // CloudFront IPv6 )) // Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools, // ephemeral containers, dynamic CDN edges). r.Use(middleware.ClientIPFromXFFTrustedProxies(2)) // Server directly on the public internet, no proxy in front. r.Use(middleware.ClientIPFromRemoteAddr) ``` And in your handler or downstream middleware: ```go clientIP := middleware.GetClientIP(r.Context()) // log it, use it as a rate-limit key, etc. ``` *** Thanks to [@​adam-p](https://redirect.github.com/adam-p), [@​c2h5oh](https://redirect.github.com/c2h5oh), [@​rezmoss](https://redirect.github.com/rezmoss), [@​Saku0512](https://redirect.github.com/Saku0512), [@​convto](https://redirect.github.com/convto), [@​Dirbaio](https://redirect.github.com/Dirbaio), [@​jawnsy](https://redirect.github.com/jawnsy), [@​lrstanley](https://redirect.github.com/lrstanley), [@​mfridman](https://redirect.github.com/mfridman), [@​n33pm](https://redirect.github.com/n33pm), [@​pkieltyka](https://redirect.github.com/pkieltyka) for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR. **Full Changelog**:
go-webauthn/webauthn (github.com/go-webauthn/webauthn) ### [`v0.17.4`](https://redirect.github.com/go-webauthn/webauthn/blob/HEAD/CHANGELOG.md#v0174-2026-05-22) [Compare Source](https://redirect.github.com/go-webauthn/webauthn/compare/v0.17.3...v0.17.4) ##### Dependency Updates This release just contains updates to dependencies.
minio/minio-go (github.com/minio/minio-go/v7) ### [`v7.2.0`](https://redirect.github.com/minio/minio-go/releases/tag/v7.2.0) [Compare Source](https://redirect.github.com/minio/minio-go/compare/v7.1.0...v7.2.0) #### What's Changed - Use go tool for ci-lint check by [@​klauspost](https://redirect.github.com/klauspost) in [#​2229](https://redirect.github.com/minio/minio-go/pull/2229) - Rename github.com/go-ini/ini to gopkg.in/ini.v1 by [@​ramondeklein](https://redirect.github.com/ramondeklein) in [#​2232](https://redirect.github.com/minio/minio-go/pull/2232) - Add RDMA / NVIDIA GPU Direct Storage support by [@​harshavardhana](https://redirect.github.com/harshavardhana) in [#​2233](https://redirect.github.com/minio/minio-go/pull/2233) **Full Changelog**:
gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2) ### [`v2.34.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.34.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.33.0...v2.34.0) #### 2.34.0 ##### πŸš€ Features - Extend DeploymentDeployablePipeline with web_url ([!2902](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2902)) by [Jan Berge Sommerdahl](https://gitlab.com/sommerdahl) ##### πŸ”„ Other Changes - chore(deps): update docker docker tag to v29.5.1 ([!2903](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2903)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.34.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.33.0...v2.34.0) (2026-05-27) ### [`v2.33.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.33.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.32.0...v2.33.0) #### 2.33.0 ##### πŸš€ Features - feat(work-items): add ListWorkItemTypes to WorkItemsService ([!2864](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2864)) by [Emmanuel 326](https://gitlab.com/Emmanuel326) ##### πŸ”„ Other Changes - chore(deps): update module cel.dev/expr to v0.25.2 ([!2881](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2881)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.33.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.32.0...v2.33.0) (2026-05-27) ##### Features * **work-items:** add ListWorkItemTypes to WorkItemsService ([e71cb99](https://gitlab.com/gitlab-org/api/client-go/commit/e71cb994482aa882eb8eb9fc4140ca1e4aac25ab)) ### [`v2.32.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.32.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.31.0...v2.32.0) #### 2.32.0 ##### πŸš€ Features - feat(ci-job-cancel): force cancel ([!2872](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2872)) by [Filip Aleksic](https://gitlab.com/faleksic) ### [2.32.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.31.0...v2.32.0) (2026-05-23) ##### Features * **ci-job-cancel:** force cancel ([aa46bd1](https://gitlab.com/gitlab-org/api/client-go/commit/aa46bd18428834eebdb42622f2523c64686021e8)) ### [`v2.31.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.31.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.30.0...v2.31.0) #### 2.31.0 ##### πŸš€ Features - Adds project service accounts API ([!2899](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2899)) by [Jimmy Spagnola](https://gitlab.com/jspagnola) - feat(gitlaboauth2): support ephemeral ports in CallbackServer ([!2877](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2877)) by [Raphael RΓΆsch](https://gitlab.com/raphael.roesch) ### [2.31.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.30.0...v2.31.0) (2026-05-22) ##### Features * **gitlaboauth2:** support ephemeral ports in CallbackServer ([c8c388d](https://gitlab.com/gitlab-org/api/client-go/commit/c8c388d56663a8f2e27b4c74f1323d3671a6bbaf))
--- ### Configuration πŸ“… **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β™» **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. πŸ‘» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). --------- Co-authored-by: Lunny Xiao Co-authored-by: silverwind --- assets/go-licenses.json | 5 ----- go.mod | 22 +++++++++---------- go.sum | 42 ++++++++++++++++++------------------- routers/private/internal.go | 16 ++++++++++++-- 4 files changed, 44 insertions(+), 41 deletions(-) diff --git a/assets/go-licenses.json b/assets/go-licenses.json index 506ab3c9ee..cfb195ebcc 100644 --- a/assets/go-licenses.json +++ b/assets/go-licenses.json @@ -559,11 +559,6 @@ "path": "github.com/go-git/go-git/v5/LICENSE", "licenseText": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2018 Sourced Technologies, S.L.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" }, - { - "name": "github.com/go-ini/ini", - "path": "github.com/go-ini/ini/LICENSE", - "licenseText": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that You\nchanged the files; and\nYou must retain, in the Source form of any Derivative Works that You distribute,\nall copyright, patent, trademark, and attribution notices from the Source form\nof the Work, excluding those notices that do not pertain to any part of the\nDerivative Works; and\nIf the Work includes a \"NOTICE\" text file as part of its distribution, then any\nDerivative Works that You distribute must include a readable copy of the\nattribution notices contained within such NOTICE file, excluding those notices\nthat do not pertain to any part of the Derivative Works, in at least one of the\nfollowing places: within a NOTICE text file distributed as part of the\nDerivative Works; within the Source form or documentation, if provided along\nwith the Derivative Works; or, within a display generated by the Derivative\nWorks, if and wherever such third-party notices normally appear. The contents of\nthe NOTICE file are for informational purposes only and do not modify the\nLicense. You may add Your own attribution notices within Derivative Works that\nYou distribute, alongside or as an addendum to the NOTICE text from the Work,\nprovided that such additional attribution notices cannot be construed as\nmodifying the License.\nYou may add Your own copyright statement to Your modifications and may provide\nadditional or different license terms and conditions for use, reproduction, or\ndistribution of Your modifications, or for any such Derivative Works as a whole,\nprovided Your use, reproduction, and distribution of the Work otherwise complies\nwith the conditions stated in this License.\n\n5. Submission of Contributions.\n\nUnless You explicitly state otherwise, any Contribution intentionally submitted\nfor inclusion in the Work by You to the Licensor shall be under the terms and\nconditions of this License, without any additional terms or conditions.\nNotwithstanding the above, nothing herein shall supersede or modify the terms of\nany separate license agreement you may have executed with Licensor regarding\nsuch Contributions.\n\n6. Trademarks.\n\nThis License does not grant permission to use the trade names, trademarks,\nservice marks, or product names of the Licensor, except as required for\nreasonable and customary use in describing the origin of the Work and\nreproducing the content of the NOTICE file.\n\n7. Disclaimer of Warranty.\n\nUnless required by applicable law or agreed to in writing, Licensor provides the\nWork (and each Contributor provides its Contributions) on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,\nincluding, without limitation, any warranties or conditions of TITLE,\nNON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are\nsolely responsible for determining the appropriateness of using or\nredistributing the Work and assume any risks associated with Your exercise of\npermissions under this License.\n\n8. Limitation of Liability.\n\nIn no event and under no legal theory, whether in tort (including negligence),\ncontract, or otherwise, unless required by applicable law (such as deliberate\nand grossly negligent acts) or agreed to in writing, shall any Contributor be\nliable to You for damages, including any direct, indirect, special, incidental,\nor consequential damages of any character arising as a result of this License or\nout of the use or inability to use the Work (including but not limited to\ndamages for loss of goodwill, work stoppage, computer failure or malfunction, or\nany and all other commercial damages or losses), even if such Contributor has\nbeen advised of the possibility of such damages.\n\n9. Accepting Warranty or Additional Liability.\n\nWhile redistributing the Work or Derivative Works thereof, You may choose to\noffer, and charge a fee for, acceptance of support, warranty, indemnity, or\nother liability obligations and/or rights consistent with this License. However,\nin accepting such obligations, You may act only on Your own behalf and on Your\nsole responsibility, not on behalf of any other Contributor, and only if You\nagree to indemnify, defend, and hold each Contributor harmless for any liability\nincurred by, or claims asserted against, such Contributor by reason of your\naccepting any such warranty or additional liability.\n\nEND OF TERMS AND CONDITIONS\n\nAPPENDIX: How to apply the Apache License to your work\n\nTo apply the Apache License to your work, attach the following boilerplate\nnotice, with the fields enclosed by brackets \"[]\" replaced with your own\nidentifying information. (Don't include the brackets!) The text should be\nenclosed in the appropriate comment syntax for the file format. We also\nrecommend that a file or class name and description of purpose be included on\nthe same \"printed page\" as the copyright notice for easier identification within\nthird-party archives.\n\n Copyright 2014 Unknwon\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" - }, { "name": "github.com/go-ldap/ldap/v3", "path": "github.com/go-ldap/ldap/v3/LICENSE", diff --git a/go.mod b/go.mod index e1b54b8aac..25e319aefe 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.26.3 require ( codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570 connectrpc.com/connect v1.20.0 - gitea.com/gitea/runner v1.0.5 + gitea.com/gitea/runner v1.0.6 gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a gitea.com/go-chi/cache v0.2.1 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098 @@ -24,7 +24,7 @@ require ( github.com/PuerkitoBio/goquery v1.12.0 github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0 github.com/alecthomas/chroma/v2 v2.25.0 - github.com/aws/aws-sdk-go-v2/credentials v1.19.16 + github.com/aws/aws-sdk-go-v2/credentials v1.19.17 github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.14 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb github.com/blevesearch/bleve/v2 v2.6.0 @@ -42,9 +42,9 @@ require ( github.com/ethantkoenig/rupture v1.0.1 github.com/felixge/fgprof v0.9.5 github.com/fsnotify/fsnotify v1.10.1 - github.com/getkin/kin-openapi v0.138.0 + github.com/getkin/kin-openapi v0.139.0 github.com/gliderlabs/ssh v0.3.8 - github.com/go-chi/chi/v5 v5.2.5 + github.com/go-chi/chi/v5 v5.3.0 github.com/go-chi/cors v1.2.2 github.com/go-co-op/gocron/v2 v2.21.2 github.com/go-enry/go-enry/v2 v2.9.6 @@ -53,7 +53,7 @@ require ( github.com/go-ldap/ldap/v3 v3.4.13 github.com/go-redsync/redsync/v4 v4.16.0 github.com/go-sql-driver/mysql v1.10.0 - github.com/go-webauthn/webauthn v0.17.3 + github.com/go-webauthn/webauthn v0.17.4 github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85 github.com/golang-jwt/jwt/v5 v5.3.1 @@ -78,7 +78,7 @@ require ( github.com/mholt/archives v0.1.5 github.com/microcosm-cc/bluemonday v1.0.27 github.com/microsoft/go-mssqldb v1.9.7 - github.com/minio/minio-go/v7 v7.1.0 + github.com/minio/minio-go/v7 v7.2.0 github.com/msteinert/pam/v2 v2.1.0 github.com/niklasfasching/go-org v1.9.1 github.com/opencontainers/go-digest v1.0.0 @@ -101,7 +101,7 @@ require ( github.com/yohcop/openid-go v1.0.1 github.com/yuin/goldmark v1.8.2 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc - gitlab.com/gitlab-org/api/client-go/v2 v2.30.0 + gitlab.com/gitlab-org/api/client-go/v2 v2.34.0 go.yaml.in/yaml/v4 v4.0.0-rc.3 golang.org/x/crypto v0.52.0 golang.org/x/image v0.41.0 @@ -176,7 +176,6 @@ require ( github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/davidmz/go-pageant v1.0.2 // indirect - github.com/dlclark/regexp2 v1.12.0 // indirect github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect github.com/fatih/color v1.19.0 // indirect github.com/fxamacker/cbor/v2 v2.9.2 // indirect @@ -185,11 +184,10 @@ require ( github.com/go-enry/go-oniguruma v1.2.1 // indirect github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect - github.com/go-ini/ini v1.67.0 // indirect github.com/go-openapi/jsonpointer v0.21.0 // indirect github.com/go-openapi/swag v0.23.0 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect - github.com/go-webauthn/x v0.2.5 // indirect + github.com/go-webauthn/x v0.2.6 // indirect github.com/goccy/go-json v0.10.6 // indirect github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect github.com/golang-sql/sqlexp v0.1.0 // indirect @@ -233,8 +231,8 @@ require ( github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/ncruces/go-strftime v1.0.0 // indirect github.com/nwaples/rardecode/v2 v2.2.2 // indirect - github.com/oasdiff/yaml v0.0.9 // indirect - github.com/oasdiff/yaml3 v0.0.12 // indirect + github.com/oasdiff/yaml v0.1.0 // indirect + github.com/oasdiff/yaml3 v0.0.13 // indirect github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect github.com/olekukonko/errors v1.3.0 // indirect github.com/olekukonko/ll v0.1.8 // indirect diff --git a/go.sum b/go.sum index 6a97d37ced..687b245881 100644 --- a/go.sum +++ b/go.sum @@ -10,8 +10,8 @@ dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= -gitea.com/gitea/runner v1.0.5 h1:9Idm8XXxXp4aHoLp0Ba0AEwv87YUblp9gk4qbih+DlE= -gitea.com/gitea/runner v1.0.5/go.mod h1:ff8SKVat/6FywBGpN4dKi2x3AlHZUfLOA/vVWHf7+Cw= +gitea.com/gitea/runner v1.0.6 h1:QG0YB97z1S7bu3q5VX5sOEs5gyER6AG/oSGFS1dJ1Hg= +gitea.com/gitea/runner v1.0.6/go.mod h1:q+WGNAMeOZL4fRqvBTbAFgR2tupWtzLOrzoyKcky3QQ= gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a h1:JHoBrfuTSF9Ke9aNfSYj1XRPBHjKPgCApVprnt2Am0M= gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a/go.mod h1:FOsLJIMdpiHzBp3Vby6Wfkdw2ppGscrjgU1IC7E4/zQ= gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g= @@ -94,8 +94,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8= github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc= -github.com/aws/aws-sdk-go-v2/credentials v1.19.16 h1:r3RJBuU7X9ibt8RHbMjWE6y60QbKBiII6wSrXnapxSU= -github.com/aws/aws-sdk-go-v2/credentials v1.19.16/go.mod h1:6cx7zqDENJDbBIIWX6P8s0h6hqHC8Avbjh9Dseo27ug= +github.com/aws/aws-sdk-go-v2/credentials v1.19.17 h1:gP2nkGsS+KMvF/jfFz2Vv2qiiOqWKyPACSzPsqHgoW8= +github.com/aws/aws-sdk-go-v2/credentials v1.19.17/go.mod h1:Bsew3S/moG5iT77giPj1q8wb/s0RE5/QfH+ASjYtuQc= github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0= github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA= github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo= @@ -274,8 +274,8 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78= github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= -github.com/getkin/kin-openapi v0.138.0 h1:ebfE0JAmF6AqHrNBy1KO3Fs68K9tPs48HalvLPo7Rv4= -github.com/getkin/kin-openapi v0.138.0/go.mod h1:vUYWaKyMqj7PfTybelXtLuLN9tReS12vxnzMRK+z2GY= +github.com/getkin/kin-openapi v0.139.0 h1:pBFXcZJFwz9J1X64jzxlOoNgFm+TF7kNrs9+HJVN6Ic= +github.com/getkin/kin-openapi v0.139.0/go.mod h1:NGxPfE4PwS/TRXEbyx2RrxDFPZvxcWw31Tw8XXjPZLs= github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 h1:mtDjlmloH7ytdblogrMz1/8Hqua1y8B4ID+bh3rvod0= github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1/go.mod h1:fenKRzpXDjNpsIBhuhUzvjCKlDjKam0boRAenTE0Q6A= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= @@ -285,8 +285,8 @@ github.com/glycerine/goconvey v0.0.0-20190410193231-58a59202ab31/go.mod h1:Ogl1T github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo= github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-chi/chi/v5 v5.0.1/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8= -github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug= -github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0= +github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM= +github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE= github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58= github.com/go-co-op/gocron/v2 v2.21.2 h1:bD8/YwkojYHgXFr3iEulL148KBdTbKVxUZzFKpXcdbY= @@ -305,8 +305,6 @@ github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMj github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00= github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= -github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A= -github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ= @@ -330,10 +328,10 @@ github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U= github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= -github.com/go-webauthn/webauthn v0.17.3 h1:XHZ0TXV7k8vChcE4TFgPitOPJ5cb7h1dpAeFDS0cjCo= -github.com/go-webauthn/webauthn v0.17.3/go.mod h1:PlkMgmuL9McCT7dvgBj/Sz/fgs3V6ZID6/KnFkEcPvQ= -github.com/go-webauthn/x v0.2.5 h1:wEVTfU04XFyPTXGQbKOQwMKhcDWfDAkdsDDBsDaG9yY= -github.com/go-webauthn/x v0.2.5/go.mod h1:Qna/yJz9rV6lRzwl5BfYbmTJpVGxcBIds3gJtw2tlGg= +github.com/go-webauthn/webauthn v0.17.4 h1:KFTSz3R2RYDiUn/0cDi3XTJgFenSG74eKTTHlqWhlxk= +github.com/go-webauthn/webauthn v0.17.4/go.mod h1:pZk63EE/BdztlmyS4Yc+9H5g4a8blNlbtGmdHQHbZX8= +github.com/go-webauthn/x v0.2.6 h1:TEyDuQAIiEgYpx60nKiBJIX/5nSUC8LxNbH+uf5U9uk= +github.com/go-webauthn/x v0.2.6/go.mod h1:45bA7YEqyQhRcQJ/TiBb46Ww8yqHBGvgEhQ3WWF0aDo= github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM= github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw= github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY= @@ -538,8 +536,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg= github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34= github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM= -github.com/minio/minio-go/v7 v7.1.0 h1:QEt5IStDpxgGjEdtOgpiZ5QhmSl3ax7qy61vi2SwHO8= -github.com/minio/minio-go/v7 v7.1.0/go.mod h1:Dm7WS1AgLmBa0NcQD6SeJnJf+K/EUW3GR7Ks6olB3OA= +github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs= +github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0= github.com/minio/minlz v1.1.0 h1:rUOGu3EP4EqJC5k3qCsIwEnZiJULKqtRyDdqbhlvMmQ= github.com/minio/minlz v1.1.0/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= @@ -569,10 +567,10 @@ github.com/nwaples/rardecode/v2 v2.2.2/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsR github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= -github.com/oasdiff/yaml v0.0.9 h1:zQOvd2UKoozsSsAknnWoDJlSK4lC0mpmjfDsfqNwX48= -github.com/oasdiff/yaml v0.0.9/go.mod h1:8lvhgJG4xiKPj3HN5lDow4jZHPlx1i7dIwzkdAo6oAM= -github.com/oasdiff/yaml3 v0.0.12 h1:75urAtPeDg2/iDEWwzNrLOWxI9N/dCh81nTTJtokt2M= -github.com/oasdiff/yaml3 v0.0.12/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o= +github.com/oasdiff/yaml v0.1.0 h1:0bqZjfKc/8S9urj4JuwepX41WX9EoA6ifhU3SV06cXg= +github.com/oasdiff/yaml v0.1.0/go.mod h1:kOlRmMdL2X3vucLCEQO5u61SU22RysnfXvcttrZA1O0= +github.com/oasdiff/yaml3 v0.0.13 h1:06svmvOHOVBqF81+sY2EUScvUI/iS/vl2VIeUUxZQwg= +github.com/oasdiff/yaml3 v0.0.13/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o= github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc= github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0= github.com/olekukonko/errors v1.3.0 h1:teJvgLGUEqMzBUms+Dj3/3szNqCG/Jdw9iDbum8fR6U= @@ -750,8 +748,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo= github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4= github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs= github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s= -gitlab.com/gitlab-org/api/client-go/v2 v2.30.0 h1:guXC+uOA325P1FIwUVesPoDcnogHnbPrhV8c+wMHZPE= -gitlab.com/gitlab-org/api/client-go/v2 v2.30.0/go.mod h1:0upZTKi9YMMvhavTlKJ3YgQUZE/GJkcLmXT/+6knTXU= +gitlab.com/gitlab-org/api/client-go/v2 v2.34.0 h1:3Gv+41azLlj97fUkhkaTCnIOm45mHDwLlAcTDEwHE2s= +gitlab.com/gitlab-org/api/client-go/v2 v2.34.0/go.mod h1:T+hA9p13Fxyh4FkVbcEy36HlAGs37QBCifhh7Zt4+dg= go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ= go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo= go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E= diff --git a/routers/private/internal.go b/routers/private/internal.go index 36cd442956..114f9e7528 100644 --- a/routers/private/internal.go +++ b/routers/private/internal.go @@ -6,6 +6,7 @@ package private import ( "crypto/subtle" + "net" "net/http" "strings" @@ -18,7 +19,6 @@ import ( "gitea.dev/services/context" "gitea.com/go-chi/binding" - chi_middleware "github.com/go-chi/chi/v5/middleware" ) func authInternal(next http.Handler) http.Handler { @@ -50,6 +50,18 @@ func bind[T any](_ T) any { } } +// setRealIP sets RemoteAddr from the trusted X-Real-IP header set by the internal API +// client (see modules/private.NewInternalRequest); the internal API is gated by InternalToken. +// It replaces chi's deprecated middleware.RealIP, which is unsafe on public-facing endpoints. +func setRealIP(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { + if ip := req.Header.Get("X-Real-IP"); net.ParseIP(ip) != nil { + req.RemoteAddr = ip + } + next.ServeHTTP(w, req) + }) +} + // Routes registers all internal APIs routes to web application. // These APIs will be invoked by internal commands for example `gitea serv` and etc. func Routes() *web.Router { @@ -58,7 +70,7 @@ func Routes() *web.Router { r.AfterRouting(authInternal) // Log the real ip address of the request from SSH is really helpful for diagnosing sometimes. // Since internal API will be sent only from Gitea sub commands and it's under control (checked by InternalToken), we can trust the headers. - r.AfterRouting(chi_middleware.RealIP) + r.AfterRouting(setRealIP) r.Get("/dummy", misc.DummyOK) r.Post("/ssh/authorized_keys", AuthorizedPublicKeyByContent) From 63df886ba809c25789067f18ab8fe675ca2597df Mon Sep 17 00:00:00 2001 From: bircni Date: Tue, 9 Jun 2026 14:59:58 +0200 Subject: [PATCH 5/7] fix(actions): keep distinct commit statuses for workflows sharing a name (#37834) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Two Gitea Actions workflow files that share the same `name:` and same job name produced identical commit-status `Context` strings. Because `GetLatestCommitStatus` groups by `context_hash` (derived from `Context`), only one row was shown on the PR page β€” see #35699. GitHub displays both rows even though they look identical. This change does the same: the displayed `Context` is unchanged, but `ContextHash` now mixes in the workflow file path so the two statuses remain distinct in the dedupe query. ## Notes - Workflows that omit `name:` now use the workflow file name in the `Context` (e.g. `ci.yaml / build (push)`) instead of an empty `/ build (push)`. This changes the `Context` string for unnamed workflows, so any required-status-check rule that referenced the old string must be updated after upgrade. - For statuses created before this change (hashed from `Context` alone), `createCommitStatus` reuses that legacy hash when a matching row is still present, so in-flight pending statuses are superseded rather than orphaned on upgrade. Fixes #35699 --------- Co-authored-by: Claude Opus 4.7 Co-authored-by: silverwind --- models/git/commit_status.go | 15 ++- services/actions/commit_status.go | 25 +++- services/actions/commit_status_test.go | 154 ++++++++++++++++++++++ tests/integration/actions_trigger_test.go | 18 ++- 4 files changed, 200 insertions(+), 12 deletions(-) diff --git a/models/git/commit_status.go b/models/git/commit_status.go index 918e45c207..fa98cba7ba 100644 --- a/models/git/commit_status.go +++ b/models/git/commit_status.go @@ -505,13 +505,19 @@ func NewCommitStatus(ctx context.Context, opts NewCommitStatusOptions) error { opts.CommitStatus.Description = strings.TrimSpace(opts.CommitStatus.Description) opts.CommitStatus.Context = strings.TrimSpace(opts.CommitStatus.Context) opts.CommitStatus.TargetURL = strings.TrimSpace(opts.CommitStatus.TargetURL) + opts.CommitStatus.ContextHash = strings.TrimSpace(opts.CommitStatus.ContextHash) opts.CommitStatus.SHA = opts.SHA.String() opts.CommitStatus.CreatorID = opts.Creator.ID opts.CommitStatus.RepoID = opts.Repo.ID opts.CommitStatus.Index = idx log.Debug("NewCommitStatus[%s, %s]: %d", opts.Repo.FullName(), opts.SHA, opts.CommitStatus.Index) - opts.CommitStatus.ContextHash = hashCommitStatusContext(opts.CommitStatus.Context) + // Callers may pre-compute a ContextHash to keep entries that share a + // human-readable Context separated (e.g. two workflow files with the + // same `name:` β€” issue #35699). Only derive from Context when unset. + if opts.CommitStatus.ContextHash == "" { + opts.CommitStatus.ContextHash = HashCommitStatusContext(opts.CommitStatus.Context) + } // Insert new CommitStatus if err = db.Insert(ctx, opts.CommitStatus); err != nil { @@ -529,8 +535,11 @@ type SignCommitWithStatuses struct { *asymkey_model.SignCommit } -// hashCommitStatusContext hash context -func hashCommitStatusContext(context string) string { +// HashCommitStatusContext returns the sha1 hash used to dedupe commit statuses +// by Context. Callers that need to keep statuses with the same display Context +// separated (e.g. distinct workflow files sharing a `name:`) can mix extra +// disambiguating data into the input. +func HashCommitStatusContext(context string) string { return fmt.Sprintf("%x", sha1.Sum([]byte(context))) } diff --git a/services/actions/commit_status.go b/services/actions/commit_status.go index 1e60b5506a..2b8ed19f92 100644 --- a/services/actions/commit_status.go +++ b/services/actions/commit_status.go @@ -139,10 +139,24 @@ func getCommitStatusEventNameAndCommitID(run *actions_model.ActionRun) (event, c func createCommitStatus(ctx context.Context, repo *repo_model.Repository, event, commitID string, run *actions_model.ActionRun, job *actions_model.ActionRunJob) error { // TODO: store workflow name as a field in ActionRun to avoid parsing runName := path.Base(run.WorkflowID) + // fall back to the file name when the workflow has no non-blank `name:` if wfs, err := jobparser.Parse(job.WorkflowPayload); err == nil && len(wfs) > 0 { - runName = wfs[0].Name + if name := strings.TrimSpace(wfs[0].Name); name != "" { + runName = name + } } ctxName := strings.TrimSpace(fmt.Sprintf("%s / %s (%s)", runName, job.Name, event)) // git_model.NewCommitStatus also trims spaces + // Mix the workflow file path into the hash so two workflow files that + // share the same `name:` and job name produce distinct commit statuses + // even though they render identically β€” matching GitHub's behavior + // (issue #35699). + ctxHash := git_model.HashCommitStatusContext(ctxName + "\x00" + run.WorkflowID) + // Pre-fix rows were hashed from Context alone. If a pre-existing row with + // the legacy hash is still the "latest" for this SHA, reuse that hash so + // the new row supersedes it; otherwise the old pending status would stay + // stuck forever (it lives in its own dedupe group). Only relevant for + // in-flight workflows at upgrade time. + legacyHash := git_model.HashCommitStatusContext(ctxName) state := toCommitStatus(job.Status) targetURL := fmt.Sprintf("%s/jobs/%d", run.Link(), job.ID) description := toCommitStatusDescription(job) @@ -152,7 +166,13 @@ func createCommitStatus(ctx context.Context, repo *repo_model.Repository, event, return fmt.Errorf("GetLatestCommitStatus: %w", err) } for _, v := range statuses { - if v.Context == ctxName { + if v.ContextHash == legacyHash && v.Context == ctxName { + ctxHash = legacyHash + break + } + } + for _, v := range statuses { + if v.ContextHash == ctxHash { if v.State == state && v.TargetURL == targetURL && v.Description == description { return nil } @@ -166,6 +186,7 @@ func createCommitStatus(ctx context.Context, repo *repo_model.Repository, event, TargetURL: targetURL, Description: description, Context: ctxName, + ContextHash: ctxHash, State: state, CreatorID: creator.ID, } diff --git a/services/actions/commit_status_test.go b/services/actions/commit_status_test.go index c6bcfddf18..e20dcf8511 100644 --- a/services/actions/commit_status_test.go +++ b/services/actions/commit_status_test.go @@ -11,8 +11,10 @@ import ( git_model "gitea.dev/models/git" repo_model "gitea.dev/models/repo" "gitea.dev/models/unittest" + user_model "gitea.dev/models/user" actions_module "gitea.dev/modules/actions" "gitea.dev/modules/commitstatus" + "gitea.dev/modules/git" "gitea.dev/modules/gitrepo" "gitea.dev/modules/timeutil" @@ -146,6 +148,158 @@ func TestGetCommitActionsStatusMap(t *testing.T) { assert.Empty(t, nilInfo.IconStatus(statuses[0])) } +// TestCreateCommitStatus_DistinctWorkflowFilesSameName covers issue #35699: +// two workflow files with the same `name:` and same job name must produce +// two distinct commit statuses, not be deduplicated into one. +func TestCreateCommitStatus_DistinctWorkflowFilesSameName(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4}) + branch := unittest.AssertExistsAndLoadBean(t, &git_model.Branch{RepoID: repo.ID, Name: repo.DefaultBranch}) + + payload := []byte(` +name: test-run +on: pull_request +jobs: + my-test: + runs-on: ubuntu-latest + steps: + - run: echo hi +`) + + for _, spec := range []struct { + workflowID string + runID, jobID int64 + }{ + {"workflow1.yaml", 99101, 99201}, + {"workflow2.yaml", 99102, 99202}, + } { + run := &actions_model.ActionRun{ + ID: spec.runID, Index: spec.runID, RepoID: repo.ID, Repo: repo, OwnerID: repo.OwnerID, TriggerUserID: repo.OwnerID, + WorkflowID: spec.workflowID, CommitSHA: branch.CommitID, + } + require.NoError(t, db.Insert(t.Context(), run)) + job := &actions_model.ActionRunJob{ + ID: spec.jobID, RunID: run.ID, RepoID: repo.ID, OwnerID: repo.OwnerID, + Name: "my-test", Status: actions_model.StatusWaiting, + WorkflowPayload: payload, + } + require.NoError(t, db.Insert(t.Context(), job)) + require.NoError(t, createCommitStatus(t.Context(), repo, "pull_request", branch.CommitID, run, job)) + } + + statuses, err := git_model.GetLatestCommitStatus(t.Context(), repo.ID, branch.CommitID, db.ListOptionsAll) + require.NoError(t, err) + + // Both workflow files should produce a row even though the display + // Context is identical β€” matching GitHub's behavior. + hashes := map[string]struct{}{} + targets := map[string]struct{}{} + for _, st := range statuses { + hashes[st.ContextHash] = struct{}{} + targets[st.TargetURL] = struct{}{} + assert.Equal(t, "test-run / my-test (pull_request)", st.Context) + } + assert.Len(t, hashes, 2, "expected distinct ContextHash per workflow file") + assert.Len(t, targets, 2, "expected distinct TargetURL per workflow file") +} + +// TestCreateCommitStatus_LegacyHashRecovery covers the upgrade path: a pending +// status created before the fix (hashed from Context alone) must still be +// superseded by a follow-up event, instead of being orphaned in its own dedupe +// group while a new row accumulates under the new hash. +func TestCreateCommitStatus_LegacyHashRecovery(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4}) + branch := unittest.AssertExistsAndLoadBean(t, &git_model.Branch{RepoID: repo.ID, Name: repo.DefaultBranch}) + + ctxName := "legacy.yaml / my-job (push)" + legacyHash := git_model.HashCommitStatusContext(ctxName) + sha, err := git.NewIDFromString(branch.CommitID) + require.NoError(t, err) + creator := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID}) + require.NoError(t, git_model.NewCommitStatus(t.Context(), git_model.NewCommitStatusOptions{ + Repo: repo, + Creator: creator, + SHA: sha, + CommitStatus: &git_model.CommitStatus{ + State: commitstatus.CommitStatusPending, + Context: ctxName, + ContextHash: legacyHash, + TargetURL: "https://example.invalid/legacy", + Description: "Waiting to run", + }, + })) + + run := &actions_model.ActionRun{ + ID: 99301, Index: 99301, RepoID: repo.ID, Repo: repo, OwnerID: repo.OwnerID, TriggerUserID: repo.OwnerID, + WorkflowID: "legacy.yaml", CommitSHA: branch.CommitID, + } + require.NoError(t, db.Insert(t.Context(), run)) + job := &actions_model.ActionRunJob{ + ID: 99302, RunID: run.ID, RepoID: repo.ID, OwnerID: repo.OwnerID, + Name: "my-job", Status: actions_model.StatusSuccess, + } + require.NoError(t, db.Insert(t.Context(), job)) + require.NoError(t, createCommitStatus(t.Context(), repo, "push", branch.CommitID, run, job)) + + latest, err := git_model.GetLatestCommitStatus(t.Context(), repo.ID, branch.CommitID, db.ListOptionsAll) + require.NoError(t, err) + // The new row must reuse the legacy hash so GetLatestCommitStatus returns + // only one entry for this Context β€” the success, not the orphaned pending. + matches := 0 + for _, s := range latest { + if s.Context == ctxName { + matches++ + assert.Equal(t, legacyHash, s.ContextHash) + assert.Equal(t, commitstatus.CommitStatusSuccess, s.State) + } + } + assert.Equal(t, 1, matches) +} + +// TestCreateCommitStatus_UnnamedWorkflowUsesFileName: a workflow with no +// non-blank `name:` uses the file name in the Context, not an empty +// "/ job (event)" β€” covers both an omitted and a whitespace-only name. +func TestCreateCommitStatus_UnnamedWorkflowUsesFileName(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4}) + branch := unittest.AssertExistsAndLoadBean(t, &git_model.Branch{RepoID: repo.ID, Name: repo.DefaultBranch}) + + for _, tc := range []struct { + workflowID string + runID, jobID int64 + payload string + }{ + {"unnamed.yaml", 99401, 99411, "on: push\n"}, + {"blank.yaml", 99402, 99412, "name: \" \"\non: push\n"}, + } { + run := &actions_model.ActionRun{ + ID: tc.runID, Index: tc.runID, RepoID: repo.ID, Repo: repo, OwnerID: repo.OwnerID, TriggerUserID: repo.OwnerID, + WorkflowID: tc.workflowID, CommitSHA: branch.CommitID, + } + require.NoError(t, db.Insert(t.Context(), run)) + job := &actions_model.ActionRunJob{ + ID: tc.jobID, RunID: run.ID, RepoID: repo.ID, OwnerID: repo.OwnerID, + Name: "my-test", Status: actions_model.StatusWaiting, + WorkflowPayload: []byte(tc.payload + `jobs: + my-test: + runs-on: ubuntu-latest + steps: + - run: echo hi +`), + } + require.NoError(t, db.Insert(t.Context(), job)) + require.NoError(t, createCommitStatus(t.Context(), repo, "push", branch.CommitID, run, job)) + + statuses := findCommitStatusesForContext(t, repo.ID, branch.CommitID, tc.workflowID+" / my-test (push)") + require.Len(t, statuses, 1) + assert.Equal(t, commitstatus.CommitStatusPending, statuses[0].State) + } +} + func findCommitStatusesForContext(t *testing.T, repoID int64, sha, context string) []*git_model.CommitStatus { t.Helper() diff --git a/tests/integration/actions_trigger_test.go b/tests/integration/actions_trigger_test.go index cd87bc8b1a..d222aac362 100644 --- a/tests/integration/actions_trigger_test.go +++ b/tests/integration/actions_trigger_test.go @@ -638,7 +638,7 @@ jobs: return false } if latestCommitStatuses[0].State == commitstatus.CommitStatusPending { - insertFakeStatus(t, repo, sha, latestCommitStatuses[0].TargetURL, latestCommitStatuses[0].Context) + insertFakeStatus(t, repo, sha, latestCommitStatuses[0]) return true } return false @@ -680,14 +680,18 @@ func checkCommitStatusAndInsertFakeStatus(t *testing.T, repo *repo_model.Reposit assert.Len(t, latestCommitStatuses, 1) assert.Equal(t, commitstatus.CommitStatusPending, latestCommitStatuses[0].State) - insertFakeStatus(t, repo, sha, latestCommitStatuses[0].TargetURL, latestCommitStatuses[0].Context) + insertFakeStatus(t, repo, sha, latestCommitStatuses[0]) } -func insertFakeStatus(t *testing.T, repo *repo_model.Repository, sha, targetURL, context string) { +// insertFakeStatus inserts a success status that lands in the same dedupe +// group as `prev` β€” the actions runner mixes the workflow file path into +// ContextHash, so we must reuse it (rather than recomputing from Context). +func insertFakeStatus(t *testing.T, repo *repo_model.Repository, sha string, prev *git_model.CommitStatus) { err := commitstatus_service.CreateCommitStatus(t.Context(), repo, user_model.NewActionsUser(), sha, &git_model.CommitStatus{ - State: commitstatus.CommitStatusSuccess, - TargetURL: targetURL, - Context: context, + State: commitstatus.CommitStatusSuccess, + TargetURL: prev.TargetURL, + Context: prev.Context, + ContextHash: prev.ContextHash, }) assert.NoError(t, err) } @@ -822,7 +826,7 @@ jobs: return false } if latestCommitStatuses[0].State == commitstatus.CommitStatusPending { - insertFakeStatus(t, repo, sha, latestCommitStatuses[0].TargetURL, latestCommitStatuses[0].Context) + insertFakeStatus(t, repo, sha, latestCommitStatuses[0]) return true } return false From 7b4a1a1a118501b9d0260301dfed7f52dfc36ee9 Mon Sep 17 00:00:00 2001 From: bircni Date: Tue, 9 Jun 2026 19:34:37 +0200 Subject: [PATCH 6/7] fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) --- models/git/lfs.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/models/git/lfs.go b/models/git/lfs.go index 1cfb933100..75abb89f1f 100644 --- a/models/git/lfs.go +++ b/models/git/lfs.go @@ -196,7 +196,10 @@ func LFSObjectAccessible(ctx context.Context, user *user_model.User, oid string) count, err := db.GetEngine(ctx).Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}}) return count > 0, err } - cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid) + // LFS objects are repository code content, so authorization must require + // Code-unit access; other unit accesses (e.g. Issues) must not authorize + // reuse of an existing LFS object across repositories. + cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeCode) count, err := db.GetEngine(ctx).Where(cond).Join("INNER", "repository", "`lfs_meta_object`.repository_id = `repository`.id").Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}}) return count > 0, err } @@ -220,7 +223,7 @@ func LFSAutoAssociate(ctx context.Context, metas []*LFSMetaObject, user *user_mo newMetas := make([]*LFSMetaObject, 0, len(metas)) cond := builder.In( "`lfs_meta_object`.repository_id", - builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)), + builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeCode)), ) if err := db.GetEngine(ctx).Cols("oid").Where(cond).In("oid", oids...).GroupBy("oid").Find(&newMetas); err != nil { return err From 7134c1f845f8167afe19d8abd3b9144c6b7393de Mon Sep 17 00:00:00 2001 From: metsw24-max Date: Wed, 10 Jun 2026 08:57:57 +0530 Subject: [PATCH 7/7] fix: bound debian ParseControlFile to a single control stanza (#38044) **Packages-index stanza injection via Debian control file** A `.deb` whose `control` file appends extra paragraphs after a blank line was still accepted, and `ParseControlFile` stored the whole multi-stanza blob in `p.Control`. That blob is re-emitted verbatim into the generated `Packages` index, so the embedded blank line splits it into separate stanzas and an uploader can smuggle a package entry with an attacker-chosen `Filename` into the shared index. A binary control file only holds one stanza, so parsing now stops at the blank line that terminates it; well-formed packages are unaffected and the new subtest covers the trailing-stanza case. --------- Signed-off-by: wxiaoguang Co-authored-by: wxiaoguang --- modules/packages/debian/metadata.go | 15 +++++++++++++-- modules/packages/debian/metadata_test.go | 15 +++++++++++++++ 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/modules/packages/debian/metadata.go b/modules/packages/debian/metadata.go index ba12424e74..8d8b03147f 100644 --- a/modules/packages/debian/metadata.go +++ b/modules/packages/debian/metadata.go @@ -146,15 +146,26 @@ func ParseControlFile(r io.Reader) (*Package, error) { var depends strings.Builder var control strings.Builder - s := bufio.NewScanner(io.TeeReader(r, &control)) + // https://www.debian.org/doc/debian-policy/ch-controlfields.html#syntax-of-control-files + s := bufio.NewScanner(r) for s.Scan() { line := s.Text() trimmed := strings.TrimSpace(line) if trimmed == "" { - continue + // A binary package control file holds exactly one stanza. Stop at the + // blank line that terminates it, otherwise a crafted control file could + // smuggle additional stanzas (with attacker-chosen Filename/Package + // fields) into the generated repository "Packages" index. + if control.Len() == 0 { + continue + } + break } + control.WriteString(line) + control.WriteByte('\n') + if line[0] == ' ' || line[0] == '\t' { switch key { case "Description": diff --git a/modules/packages/debian/metadata_test.go b/modules/packages/debian/metadata_test.go index 9598c6cac8..6ff10a7f21 100644 --- a/modules/packages/debian/metadata_test.go +++ b/modules/packages/debian/metadata_test.go @@ -184,4 +184,19 @@ func TestParseControlFile(t *testing.T) { assert.NotNil(t, p) } }) + + t.Run("SingleStanzaOnly", func(t *testing.T) { + // A control file with a trailing stanza must not leak the extra fields into + // p.Control, otherwise buildPackagesIndices would emit a second package entry + // with an attacker-chosen Filename into the repository "Packages" index. + content := bytes.NewBufferString("Package: realpkg\nVersion: 1.0.0\nArchitecture: amd64\nMaintainer: a \nDescription: real\n\nPackage: openssl\nVersion: 99.0\nArchitecture: amd64\nFilename: pool/main/o/openssl/evil.deb\nDescription: spoofed\n") + + p, err := ParseControlFile(content) + assert.NoError(t, err) + assert.NotNil(t, p) + assert.Equal(t, "realpkg", p.Name) + assert.Equal(t, "1.0.0", p.Version) + assert.NotContains(t, p.Control, "openssl") + assert.NotContains(t, p.Control, "evil.deb") + }) }