Add commitstatus token scope #35383
Add commitstatus token scope #35383
Conversation
now what?
|
I'm unsure about the use of permission units. I may want to reduce scope to access tokens only. And it seems that |
|
@lafriks, I want to implement this in a way, that |
This reverts commit 7c5cc63.
|
So commitstatus is shown in the UI. I can create tokens with |
routers/api/v1/api.go
Outdated
| @@ -1399,8 +1399,8 @@ func Routes() *web.Router { | |||
| }, mustAllowPulls, reqRepoReader(unit.TypeCode), context.ReferencesGitRepo()) | |||
| m.Group("/statuses", func() { | |||
| m.Combo("/{sha}").Get(repo.GetCommitStatuses). | |||
| Post(reqToken(), reqRepoWriter(unit.TypeCode), bind(api.CreateStatusOption{}), repo.NewCommitStatus) | |||
| }, reqRepoReader(unit.TypeCode)) | |||
| Post(reqToken(), tokenRequiresScopes(auth_model.AccessTokenScopeCategoryCommitStatus, auth_model.AccessTokenScopeCategoryRepository), bind(api.CreateStatusOption{}), repo.NewCommitStatus) | |||
There was a problem hiding this comment.
This still does not look right as Get method (Combo) should test read rights and Post - write rights
There was a problem hiding this comment.
This should be fixed. I re-introduced reqRepoWriter and Reader middlewares. I'm getting an error that repository permissions are required. So there is something I don't understand in how these middlewares work.
Is there a way to write tests for routing?
There was a problem hiding this comment.
Also what is the difference between unit and token permission?
Adds
commitstatuspermission unit to enable more granular permissions for applications with stricter security policies.Resolves #32625
TODO: