Pre-register OAuth2 applications for git credential helpers

[denyskon]

This PR is an extended implementation of #25189 and builds upon the proposal by @hickford in #25653, utilizing some ideas proposed internally by @wxiaoguang.

Mainly, this PR consists of a mechanism to pre-register OAuth2 applications on startup, which can be enabled or disabled by modifying the [oauth2].DEFAULT_APPLICATIONS parameter in app.ini. The OAuth2 applications registered this way are being marked as "locked" and neither be deleted nor edited over UI to prevent confusing/unexpected behavior. Instead, they're being removed if no longer enabled in config.

The implemented mechanism can also be used to pre-register other OAuth2 applications in the future, if wanted.

Co-authored-by: hickford mirth.hickford@gmail.com
Co-authored-by: wxiaoguang wxiaoguang@gmail.com

[hickford]

LGTM. Nice solution, great work.

[lunny]

Maybe we need to check the delete functions to don't allow delete OAuth2 Applications from both UI and API.

[denyskon]

@lunny done

[wxiaoguang]

Actually, the "ClientID" can be any string if I understand correctly. If so, maybe it's even better to use "builtin-git-cred-oauth" / "builtin-git-cred-manager", it brings consistent user experience for the config too:

DEFAULT_APPLICATIONS = builtin-git-cred-oauth, builtin-git-cred-manager

And the pre-defined ClientIDs could avoid the database migration (no need to add the Locked field, just check the ClientID)

		{
			Name:         "Git Credential Manager",
			ClientID:     "builtin-git-cred-manager",
			RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
		},

[wxiaoguang]

If you don't mind, could I push some changes for idea #26291 (comment) ?

[denyskon]

@wxiaoguang Feel free to make any changes if you want

[wxiaoguang]

@wxiaoguang Do you want any more changes to be made?

Nope. But I am not sure whether allowing site admin editing the name/URL/confidential is good ... Personally I would agree more with hickford: allowing editing would confuse users.

[denyskon]

Even though I think there could be use cases for it, I'm fine with disallowing edits as the concerns are valid and changes to confidential/redirect URIs could break the whole functionality

[wxiaoguang]

I think the client IDs could be written into the document, to make them could be found easily.

[denyskon]

I changed the behavior to disallow editing and also changed the UI, as now we don't need any buttons (and as there is no proper way to disable link buttons 😆)

[denyskon]

I think the client IDs could be written into the document, to make them could be found easily.

Done

[GiteaBot]

@denyskon please fix the merge conflicts. 🍵

[wxiaoguang]

-> Avoid GCM OAuth2 attempt when OAuth2 is disabled #36000