fix github migration error when using multiple tokens

[TheFox0x7]

Git authorization was not taking into account multiple token feature, leading to auth failures

Closes: #34141

---

I made it default to first token. I'm honestly not sure if it wouldn't be better to scrap the multi token feature instead. The UI hides the tokens so it's hard to tell if no mistake was made in the input and it's the only provider "supporting" this.
I guess the intention was to somewhat speed up migration from github for a single repository which is nice too.

[TheFox0x7]

Is the basicAuth setup in client creation even working?

[wxiaoguang]

IIRC "multiple tokens" are used to benefit more "access rate limit quota"? If only the first token is used, would it be more likely reach the rate limit?

[TheFox0x7]

Honestly, I'm not sure if git clones count for rate limits. That's not rest api.

Thread I found on this suggests they don't: https://github.com/orgs/community/discussions/44515

[TheFox0x7]

I'm fairly sure that basic auth can be removed but gitbucket might depend on it, which I know nothing about.

[wxiaoguang]

@TheFox0x7

#34141 (comment)

the entire GitHub migration was failing after this fix

[TheFox0x7]

I'll send a followup when I'll find the cause. I have no clues currently. Since CI passed it I doubt it's a single token issue (unless for some reason that test doesn't run in CI) so shouldn't be a regression at the very least.

Without the fix the test passes on single token input.

[wxiaoguang]

CI passes, but does it really work with GitHub oauth2?

By reading the "oauth2" code, it does token.SetAuthHeader(req2), then:

Is it the same as your new code u.User = url.UserPassword(...) ?

[TheFox0x7]

It worked before and the single test outcome is the same with and without the fix - both pass. So unless the token workflow stopped working there's no changes there.

Logic is taken from NullDownloader just without support for user/pass system.
https://github.com/TheFox0x7/gitea/blob/164a382bcdcf70b67983bb5e5ff8ef310606d340/modules/migration/null_downloader.go#L67-L80

Let's wait for more details from the reporter.

[wxiaoguang]

If I understand correctly, the "oauth2:token" works with GitHub migration on your side, and at the moment it's unclear about how to reproduce the user's problem, right?

[TheFox0x7]

oauth2:token is the default system in general when token is passed (from NullDownloader), it's just our Github migration supports multiple tokens which encoded oauth2:token1,token2 and ended up treating it as basic auth.
The single token case has not changed and still is oauth2:token - it worked before and I don't see why it should stop now.

Yes, at the moment is unclear what is the users issue after the patch. It could be any of:

• a regression in single token system
• the fix was not sufficient to make multitoken work
• the issue is unrelated
• version tested does not have the patch and it's a false positive

Currently I suspect the last case, but I can manually test it later to be extra sure.