At least t̶w̶o̶ three API calls don't work

[HoffmannP]

• Gitea version (or commit ref): bae2642
• Git version: 2.15.0
• Operating system: Alpine Linux 3.7
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL) see https://try.gitea.io/api/swagger
  • No
  • Not relevant
• Log gist: https://gist.github.com/HoffmannP/9f6ff51fe0168e1ad1195c3d1f89a431

Description

At least two API calls don't work:

• Getting a special commit (in my example the latest commit in a branch) via /repos/{owner}/{repo}/commits/{ref}/statuses

• Creating a release via /repos/{owner}/{repo}/releases

• Tested with newest Docker version

• Test with swagger command interface and from outside (using AuthToken)

[HoffmannP]

Seeme to me the log shows two completely different problems:

1. either the query is wrong or only searching for a SHA is supported
2. the POST is nevertheless seen as a GET-request

Can s/o confirm &&/|| fix this?

[HoffmannP]

Little code to test against try.gitea.io

read TOKEN
curl -s "https://try.gitea.io/api/v1/repos/gitea/gitea/branches" -H "Authorization: token $TOKEN" | jq ".[].name"
> … all branches …
curl -s "https://try.gitea.io/api/v1/repos/gitea/gitea/commits/HEAD/statuses" -H "Authorization: token $TOKEN"
> []
curl -s "https://try.gitea.io/api/v1/repos/gitea/gitea/commits/fa3ceb610d/statuses" -H "Authorization: token $TOKEN"
> []
curl -s "https://try.gitea.io/api/v1/repos/gitea/gitea/commits/fa3ceb610d579c64142321ad4c82398a9d0bfde0/statuses" -H "Authorization: token $TOKEN"
> []

[markuman]

Does GET /users/{username}/tokens and POST /users/{username}/tokens works for you? I got an empty response here on my own installation.

[HoffmannP]

I tried it and voilà

curl -s "$SERVER/api/v1/users/$USER/repos" -H "Authorization: token $TOKEN"
> … all repos …
curl -s "$SERVER/api/v1/users/$USER/tokens" -H "Authorization: token $TOKEN"
>    (empty)
curl -D - -s "$SERVER/api/v1/users/$USER/tokens" -H "Authorization: token $TOKEN"
> HTTP/1.1 401 Unauthorized
> …
> Content-Length: 0

So I also don't get a response (same for the POST request)

[markuman]

I like to reference to #4234 also

[markuman]

@stevegt as you've mentioned in #4243 it must be used token in the auth header

-H "Authorization: token 65eaa9c8ef52460d22a93307fe0aee76289dc675"

the result for listing tokens is the same, an empty array.

curl --request GET --url https://git.osuv.de/api/v1/users/m/tokens -H "accepts: application/json" -H 'Authorization: token acb123...'

[HoffmannP]

I'm confused, what do you guys think, is "Unauthorized" it a Gitea bug (a bug in the API) or just a missuse? I think the first b/c

1. I'm using the correct auth-tokken
2. I'm an admin user
   so -> I shouldn't be "Unauthorized"

[bkcsoft]

/users/:name/tokens is special and requires you to Authenticate using BasicAuth

gitea/routers/api/v1/api.go

Lines 302 to 306 in 85414d8

	m.Group("/tokens", func() {
	m.Combo("").Get(user.ListAccessTokens).
	Post(bind(api.CreateAccessTokenOption{}), user.CreateAccessToken)
	}, reqBasicAuth())
	})

Which is set here

gitea/modules/auth/auth.go

Lines 125 to 143 in 85414d8

	// Check with basic auth.
	baHead := ctx.Req.Header.Get("Authorization")
	if len(baHead) > 0 {
	auths := strings.Fields(baHead)
	if len(auths) == 2 && auths[0] == "Basic" {
	uname, passwd, _ := base.BasicAuthDecode(auths[1])
	u, err := models.UserSignIn(uname, passwd)
	if err != nil {
	if !models.IsErrUserNotExist(err) {
	log.Error(4, "UserSignIn: %v", err)
	}
	return nil, false
	}
	return u, true
	}
	}
	return nil, false

Also interested in knowing what status-code you get for /statuses 🙂

[markuman]

@bkcsoft hmm interesting. Indeed, listing only with basic auth work - even if this account is secured by 2FA.

$ curl --request GET --url https://m:mypassword@git.osuv.de/api/v1/users/m/tokens
[{"name":"test","sha1":"..."},{"name":"dev","sha1":"..."}]

I also noticed that the {username} in the url specification /users/{username}/tokens is completely irrelevant.

$ curl --request GET --url https://m:mypassword@git.osuv.de/api/v1/users/fasgdjfhgdsf/tokens
[{"name":"test","sha1":"..."},{"name":"dev","sha1":"..."}]
$

[kainz]

So I'm running gitea in a setup doing SSL client certificate authentication in a reverse proxy, and injecting that as a header for gitea to use. Needless to say, that breaks the tokens api totally.

I have a patch which hacks in detection for client cert auth as well as basic auth in this path, but the whole logic here seems not great. Any thoughts from gitea maintainers on seeing a rework for this? It seems there are some (expected?) differences to the regular authentication rules, but they aren't well codified. What should they be?