mirror of
https://gitea.com/gitea/tea.git
synced 2026-03-13 17:33:31 +01:00
## Summary - Introduce `github.com/go-authgate/sdk-go/credstore` to store OAuth tokens securely in the OS keyring (macOS Keychain / Linux Secret Service / Windows Credential Manager), with automatic fallback to an encrypted JSON file - Add `AuthMethod` field to `Login` struct; new OAuth logins are marked `auth_method: oauth` and no longer write `token`/`refresh_token`/`token_expiry` to `config.yml` - Add `GetAccessToken()` / `GetRefreshToken()` / `GetTokenExpiry()` accessors that transparently read from credstore for OAuth logins, with fallback to YAML fields for legacy logins - Update all token reference sites across the codebase to use the new accessors - Non-OAuth logins (token, SSH) are completely unaffected; no migration of existing tokens ## Key files | File | Role | |------|------| | `modules/config/credstore.go` | **New** — credstore wrapper (Load/Save/Delete) | | `modules/config/login.go` | Login struct, token accessors, refresh logic | | `modules/auth/oauth.go` | OAuth flow, token creation / re-authentication | | `modules/api/client.go`, `cmd/login/helper.go`, `cmd/login/oauth_refresh.go` | Token reference updates | | `modules/task/pull_*.go`, `modules/task/repo_clone.go` | Git operation token reference updates | ## Test plan - [x] `go build ./...` compiles successfully - [x] `go test ./...` all tests pass - [x] `tea login add --oauth` completes OAuth flow; verify config.yml has `auth_method: oauth` but no token/refresh_token/token_expiry - [x] `tea repos ls` API calls work (token read from credstore) - [x] `tea login delete <name>` credstore token is also removed - [x] Existing non-OAuth logins continue to work unchanged 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://gitea.com/gitea/tea/pulls/926 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-committed-by: Bo-Yi Wu <appleboy.tw@gmail.com>
96 lines
2.2 KiB
Go
96 lines
2.2 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package task
|
|
|
|
import (
|
|
"fmt"
|
|
"net/url"
|
|
|
|
"code.gitea.io/sdk/gitea"
|
|
"code.gitea.io/tea/modules/config"
|
|
local_git "code.gitea.io/tea/modules/git"
|
|
|
|
"github.com/go-git/go-git/v5"
|
|
git_config "github.com/go-git/go-git/v5/config"
|
|
"github.com/go-git/go-git/v5/plumbing"
|
|
)
|
|
|
|
// RepoClone creates a local git clone in the given path, and sets up upstream remote
|
|
// for fork repos, for good usability with tea.
|
|
func RepoClone(
|
|
path string,
|
|
login *config.Login,
|
|
repoOwner, repoName string,
|
|
callback func(string) (string, error),
|
|
depth int,
|
|
) (*local_git.TeaRepo, error) {
|
|
repoMeta, _, err := login.Client().GetRepo(repoOwner, repoName)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
originURL, err := cloneURL(repoMeta, login)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
auth, err := local_git.GetAuthForURL(originURL, login.GetAccessToken(), login.SSHKey, callback)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// default path behavior as native git
|
|
if path == "" {
|
|
path = repoName
|
|
}
|
|
|
|
repo, err := git.PlainClone(path, false, &git.CloneOptions{
|
|
URL: originURL.String(),
|
|
Auth: auth,
|
|
Depth: depth,
|
|
InsecureSkipTLS: login.Insecure,
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// set up upstream remote for forks
|
|
if repoMeta.Fork && repoMeta.Parent != nil {
|
|
upstreamURL, err := cloneURL(repoMeta.Parent, login)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
upstreamBranch := repoMeta.Parent.DefaultBranch
|
|
_, err = repo.CreateRemote(&git_config.RemoteConfig{
|
|
Name: "upstream",
|
|
URLs: []string{upstreamURL.String()},
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
repoConf, err := repo.Config()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if b, ok := repoConf.Branches[upstreamBranch]; ok {
|
|
b.Remote = "upstream"
|
|
b.Merge = plumbing.ReferenceName(fmt.Sprintf("refs/heads/%s", upstreamBranch))
|
|
}
|
|
if err = repo.SetConfig(repoConf); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
return &local_git.TeaRepo{Repository: repo}, nil
|
|
}
|
|
|
|
func cloneURL(repo *gitea.Repository, login *config.Login) (*url.URL, error) {
|
|
urlStr := repo.CloneURL
|
|
if login.SSHKey != "" {
|
|
urlStr = repo.SSHURL
|
|
}
|
|
return local_git.ParseURL(urlStr)
|
|
}
|