refactor: migrate protected branch fields into one json column and support system users (#39735)

1. migrate protected branch fields into one json column
2. use the dropdown list for push/force-push user selection, and Actions
user can be added into the list now.

tests/integration/api_branch_test.go

@@ -18,6 +18,7 @@ import (
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func testAPIGetBranch(t *testing.T, branchName string, exists bool) {
@@ -472,3 +473,78 @@ func TestAPICreateBranchWithSyncBranches(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Len(t, branches, 1)
 }
+
+func TestAPIBranchProtectionDeployKeyAllowlists(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeWriteRepository)
+	path := "/api/v1/repos/user2/repo1/branch_protections"
+	createProtection := func(t *testing.T, ruleName string, deployKeys bool) *api.BranchProtection {
+		t.Helper()
+		resp := MakeRequest(t, NewRequestWithJSON(t, "POST", path, &api.CreateBranchProtectionOption{
+			RuleName: ruleName, EnablePush: true, EnablePushWhitelist: true, PushWhitelistDeployKeys: deployKeys,
+			EnableForcePush: true, EnableForcePushAllowlist: true, ForcePushAllowlistDeployKeys: deployKeys,
+		}).AddTokenAuth(token), http.StatusCreated)
+		return DecodeJSON(t, resp, &api.BranchProtection{})
+	}
+
+	t.Run("CreateWithLegacyFlags", func(t *testing.T) {
+		bp := createProtection(t, "legacy-flags", true)
+		assert.True(t, bp.PushWhitelistDeployKeys)
+		assert.True(t, bp.ForcePushAllowlistDeployKeys)
+	})
+
+	t.Run("PreserveDeployKeysWhenUpdatingUsernames", func(t *testing.T) {
+		createProtection(t, "update-usernames", true)
+		resp := MakeRequest(t, NewRequestWithJSON(t, "PATCH", path+"/update-usernames", map[string]any{
+			"push_whitelist_usernames": []string{"user2"}, "force_push_allowlist_usernames": []string{},
+		}).AddTokenAuth(token), http.StatusOK)
+		bp := DecodeJSON(t, resp, &api.BranchProtection{})
+		assert.True(t, bp.PushWhitelistDeployKeys)
+		assert.True(t, bp.ForcePushAllowlistDeployKeys)
+		assert.Equal(t, []string{"user2", "gitea:deploy-key"}, bp.PushWhitelistUsernames)
+	})
+
+	t.Run("LegacyFlagsDisableDeployKeys", func(t *testing.T) {
+		createProtection(t, "disable-deploy-keys", true)
+		resp := MakeRequest(t, NewRequestWithJSON(t, "PATCH", path+"/disable-deploy-keys", map[string]any{
+			"enable_push": true, "enable_push_whitelist": true, "push_whitelist_deploy_keys": false,
+			"enable_force_push": true, "enable_force_push_allowlist": true, "force_push_allowlist_deploy_keys": false,
+			"push_whitelist_usernames": []string{"user2", "gitea:deploy-key"}, "force_push_allowlist_usernames": []string{"gitea:deploy-key"},
+		}).AddTokenAuth(token), http.StatusOK)
+		bp := DecodeJSON(t, resp, &api.BranchProtection{})
+		assert.False(t, bp.PushWhitelistDeployKeys)
+		assert.False(t, bp.ForcePushAllowlistDeployKeys)
+		assert.Equal(t, []string{"user2"}, bp.PushWhitelistUsernames)
+		rule, err := git_model.GetProtectedBranchRuleByName(t.Context(), 1, "disable-deploy-keys")
+		require.NoError(t, err)
+		require.NotNil(t, rule)
+		assert.Equal(t, []int64{2}, rule.WhitelistUserIDs)
+		assert.Empty(t, rule.ForcePushAllowlistUserIDs)
+	})
+
+	t.Run("AddDeployKeysByUsername", func(t *testing.T) {
+		createProtection(t, "add-deploy-keys", false)
+		resp := MakeRequest(t, NewRequestWithJSON(t, "PATCH", path+"/add-deploy-keys", map[string]any{
+			"push_whitelist_usernames": []string{"user2", "gitea:deploy-key"}, "force_push_allowlist_usernames": []string{"gitea:deploy-key"},
+		}).AddTokenAuth(token), http.StatusOK)
+		bp := DecodeJSON(t, resp, &api.BranchProtection{})
+		assert.True(t, bp.PushWhitelistDeployKeys)
+		assert.True(t, bp.ForcePushAllowlistDeployKeys)
+		assert.Equal(t, []string{"user2", "gitea:deploy-key"}, bp.PushWhitelistUsernames)
+		assert.Equal(t, []string{"gitea:deploy-key"}, bp.ForcePushAllowlistUsernames)
+	})
+
+	t.Run("CreateWithDeployKeyUsernames", func(t *testing.T) {
+		resp := MakeRequest(t, NewRequestWithJSON(t, "POST", path, &api.CreateBranchProtectionOption{
+			RuleName: "deploy-key-usernames", EnablePush: true, EnablePushWhitelist: true,
+			PushWhitelistUsernames: []string{"gitea:deploy-key"}, EnableForcePush: true, EnableForcePushAllowlist: true,
+			ForcePushAllowlistUsernames: []string{"gitea:deploy-key"},
+		}).AddTokenAuth(token), http.StatusCreated)
+		bp := DecodeJSON(t, resp, &api.BranchProtection{})
+		assert.True(t, bp.PushWhitelistDeployKeys)
+		assert.True(t, bp.ForcePushAllowlistDeployKeys)
+		assert.Equal(t, []string{"gitea:deploy-key"}, bp.PushWhitelistUsernames)
+		assert.Equal(t, []string{"gitea:deploy-key"}, bp.ForcePushAllowlistUsernames)
+	})
+}

tests/integration/api_issue_test.go

@@ -537,7 +537,7 @@ func testAPIIssueAssignees(t *testing.T) {
 	t.Run("OrganizationAssignee", func(t *testing.T) {
 		req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"org3"}}).
 			AddTokenAuth(token)
-		MakeRequest(t, req, http.StatusBadRequest)
+		MakeRequest(t, req, http.StatusUnprocessableEntity)
 
 		checkReq := NewRequest(t, "GET", fmt.Sprintf("%s/%s", urlStr, "org3")).AddTokenAuth(token)
 		MakeRequest(t, checkReq, http.StatusBadRequest)