Preconfigure Git Credential Manager as instance-wide OAuth application

[shyim]

Feature Description

It would be really nice if there would be a instance-wide OAuth application only for the purpose of using it with the Git Credential Manager or git-credential-oauth. This would allow Git authentication just work without passwords, personal access tokens or SSH keys.

The OAuth client details for both helpers are redirect URI http://127.0.0.1/, only the client-id needs to be same between all instances.

There is also a similar request to Gitlab: https://gitlab.com/gitlab-org/gitlab/-/issues/374172

Screenshots

No response

[denyskon]

@hickford You seem to be the author of git-credential-oauth. If we tried to integrate it into Gitea, would a pre-registered OAuth application be enough for it to work? Would we need to implement something else?

[hickford]

@denyskon Two changes are necessary:

1. In a migration (pseudocode), insert an OAuth2Application record for git-credential-oauth. The client id must be the same on all instances.
2. So that git-credential-oauth can identify Gitea instances and select the appropriate configuration, change the 401 Unauthorized http header from Www-Authenticate: Basic realm="." to something like Www-Authenticate: Basic realm="Gitea"

[hickford]

@shyim @denyskon I sketched an implementation in #25653 but it has a problem: the OAuth2Application isn't created on first time install. Maybe there's a better alternative to using a migration. If you have any ideas how to fix, please have a go.

[denyskon]

Thanks, I'll take a look tomorrow.

[hickford]

An alternative approach could be to hard code the application in GetOAuth2ApplicationByClientID without database records. #25774

[hickford]

@shyim @denyskon #25653 working, ready for review

[hickford]

Security wise, it would be prudent to fix #25061 and #25813 , because these would protect the preconfigured OAuth client from client impersonation, and limit its scope.