Skip to content

fix(git): Fix smart http request scope bug#37583

Merged
silverwind merged 7 commits into
go-gitea:mainfrom
lunny:lunny/fix_smart_http_scope
May 8, 2026
Merged

fix(git): Fix smart http request scope bug#37583
silverwind merged 7 commits into
go-gitea:mainfrom
lunny:lunny/fix_smart_http_scope

Conversation

@lunny
Copy link
Copy Markdown
Member

@lunny lunny commented May 7, 2026

No description provided.

@lunny lunny added type/bug backport/v1.26 This PR should be backported to Gitea 1.26 labels May 7, 2026
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label May 7, 2026
@lunny lunny changed the title Fix smart http request scope bug fix(git): Fix smart http request scope bug May 7, 2026
@silverwind silverwind requested a review from Copilot May 7, 2026 11:51
Copilot AI reviewed May 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes smart-HTTP auth scope enforcement so repository-scoped token checks apply to authenticated API tokens regardless of auth mechanism (e.g. Bearer/OAuth2), and adds integration coverage for expected scope requirements on Git smart-HTTP endpoints.

Changes:

  • Update CheckRepoScopedToken to run whenever IsApiToken is set (not only for Basic auth).
  • Add integration tests asserting read/write repository token scopes are required for git-upload-pack / git-receive-pack info/refs requests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
tests/integration/git_smart_http_test.go Adds integration tests validating smart-HTTP endpoints enforce repository token scopes.
services/context/permission.go Broadens repo-scope enforcement to all API-token-authenticated requests (including Bearer tokens).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread services/context/permission.go
@bircni @claude
fix: guard nil repo in CheckRepoScopedToken
8625003 
Smart-HTTP routes call CheckRepoScopedToken before confirming the
repository exists, so repo can be nil. Without the guard, a token
with the public-only scope would panic on repo.IsPrivate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 7, 2026
lunny and others added 3 commits May 7, 2026 14:16
@lunny
Merge branch 'main' into lunny/fix_smart_http_scope
6423c26
@lunny
Merge branch 'main' into lunny/fix_smart_http_scope
5e49055
@silverwind @claude
test: tighten testGitSmartHTTPTokenScopes
cb34546 
- assert.True -> require.True for the IsPrivate precondition
- rename url to path to avoid shadowing net/url
- mirror basic-auth coverage on receive-pack
- add subtest for public-only scope rejecting a private repo

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
silverwind
silverwind approved these changes May 8, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@silverwind silverwind left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some cleanups done in cb34546.

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 8, 2026
@silverwind silverwind merged commit 7dc3087 into go-gitea:main May 8, 2026
23 checks passed
@GiteaBot GiteaBot added this to the 1.27.0 milestone May 8, 2026
@wxiaoguang wxiaoguang deleted the lunny/fix_smart_http_scope branch May 8, 2026 11:35
@GiteaBot GiteaBot mentioned this pull request May 8, 2026
Merged
@GiteaBot GiteaBot added the backport/done All backports for this PR have been created label May 8, 2026
lunny added a commit that referenced this pull request May 8, 2026
@GiteaBot @lunny
@bircni @claude @silverwind
fix(git): Fix smart http request scope bug (#37583) (#37605)
677ab98 
Backport #37583 by @lunny

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
silverwind added a commit to mohammad-rj/gitea that referenced this pull request May 8, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into feat/websocket-migration
23e1406 
* origin/main: (82 commits)
  build(deps): bump fast-uri from 3.1.0 to 3.1.2 (go-gitea#37616)
  fix: make clone URL respect public URL detection setting (go-gitea#37615)
  chore(deps): bump go-git/go-git/v5 to 5.19.0 (go-gitea#37608)
  chore(deps): update action dependencies (go-gitea#37603)
  fix(actions): fix blank lines after `::endgroup::` (go-gitea#37597)
  fix: treat email addresses case-insensitively (go-gitea#37600)
  fix(git): Fix smart http request scope bug (go-gitea#37583)
  chore(deps): update dependency go to v1.26.3 (go-gitea#37601)
  chore(deps): bump tool deps and pin, update `golangci-lint` (go-gitea#37574)
  build: update pnpm to v11 (go-gitea#37591)
  chore(renovate): detect Makefile tools, enable `go` bumps (go-gitea#37595)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  ...

# Conflicts:
#	tests/e2e/events.test.ts
#	tests/integration/eventsource_test.go
zjjhot added a commit to zjjhot/gitea that referenced this pull request May 9, 2026
@zjjhot
Merge branch 'main' into mainzjj
091fb15 
* main:
  perf: replace `goheader` linter with custom check (go-gitea#37599)
  build(deps): bump fast-uri from 3.1.0 to 3.1.2 (go-gitea#37616)
  fix: make clone URL respect public URL detection setting (go-gitea#37615)
  chore(deps): bump go-git/go-git/v5 to 5.19.0 (go-gitea#37608)
  chore(deps): update action dependencies (go-gitea#37603)
  fix(actions): fix blank lines after `::endgroup::` (go-gitea#37597)
  fix: treat email addresses case-insensitively (go-gitea#37600)
  fix(git): Fix smart http request scope bug (go-gitea#37583)
  chore(deps): update dependency go to v1.26.3 (go-gitea#37601)
eleboucher pushed a commit to eleboucher/apoci that referenced this pull request May 20, 2026
@eleboucher
fix(deps): update module code.gitea.io/gitea (v1.26.1 → v1.26.2) (#47)
ce5a949 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [code.gitea.io/gitea](https://github.com/go-gitea/gitea) | `v1.26.1` → `v1.26.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/code.gitea.io%2fgitea/v1.26.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.gitea.io%2fgitea/v1.26.1/v1.26.2?slim=true) |

---

### Release Notes

<details>
<summary>go-gitea/gitea (code.gitea.io/gitea)</summary>

### [`v1.26.2`](https://github.com/go-gitea/gitea/releases/tag/v1.26.2)

[Compare Source](go-gitea/gitea@v1.26.1...v1.26.2)

- SECURITY
  - fix(permissions): Fix reading permission ([#&#8203;37769](go-gitea/gitea#37769))
  - fix(actions): make artifact signature payloads unambiguous ([#&#8203;37707](go-gitea/gitea#37707))
  - fix: Unify public-only token filtering in API queries and repo access checks ([#&#8203;37118](go-gitea/gitea#37118))
  - fix: Add missed token scope checking ([#&#8203;37735](go-gitea/gitea#37735))
  - fix(oauth): bind token exchanges to the original client request ([#&#8203;37704](go-gitea/gitea#37704))
  - fix(oauth): strengthen PKCE validation and refresh token replay protection ([#&#8203;37706](go-gitea/gitea#37706))
  - fix(web): enforce token scopes on raw, media, and attachment downloads ([#&#8203;37698](go-gitea/gitea#37698))
  - fix(security): enforce wiki git writes and LFS token access at request time ([#&#8203;37695](go-gitea/gitea#37695))
  - feat(api): encrypt AWS creds ([#&#8203;37679](go-gitea/gitea#37679))
  - fix(deps): update dependency mermaid to v11.15.0 \[security], add e2e test
  - fix(packages): Add label for private and internal package and fix composor package source permission check ([#&#8203;37610](go-gitea/gitea#37610))
  - fix(git): Fix smart http request scope bug ([#&#8203;37583](go-gitea/gitea#37583))
  - Fix basic auth bug ([#&#8203;37503](go-gitea/gitea#37503))
  - Fix allow maintainer edit permission check ([#&#8203;37479](go-gitea/gitea#37479)) ([#&#8203;37484](go-gitea/gitea#37484))
  - Fix URL sanitization to handle schemeless credentials ([#&#8203;37440](go-gitea/gitea#37440)) ([#&#8203;37471](go-gitea/gitea#37471))
  - Fix attachment Content-Security-Policy ([#&#8203;37455](go-gitea/gitea#37455)) ([#&#8203;37464](go-gitea/gitea#37464))
  - chore(deps): bump go-git/go-git/v5 to 5.19.0 ([#&#8203;37608](go-gitea/gitea#37608))

- BUGFIXES
  - fix(pull): handle empty pull request files view to allow reviews ([#&#8203;37783](go-gitea/gitea#37783))
  - fix(markup): make RenderString never fail ([#&#8203;37779](go-gitea/gitea#37779))
  - fix: add natural sort to sortTreeViewNodes ([#&#8203;37772](go-gitea/gitea#37772))
  - fix: package creation unique conflict ([#&#8203;37774](go-gitea/gitea#37774))
  - fix!: add DEFAULT\_TITLE\_SOURCE setting for pull request title default behavior ([#&#8203;37465](go-gitea/gitea#37465))
  - fix: Allow direct commits for unprotected files with push restrictions ([#&#8203;37657](go-gitea/gitea#37657))
  - fix(actions): wrong assumption that run id always >= job id ([#&#8203;37737](go-gitea/gitea#37737))
  - fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register ([#&#8203;37564](go-gitea/gitea#37564)) ([#&#8203;37588](go-gitea/gitea#37588))
  - fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState ([#&#8203;37692](go-gitea/gitea#37692))
  - fix(repo): /generate must sync the branch table for the new repo ([#&#8203;37693](go-gitea/gitea#37693))
  - build: Fix snap build (1.26)
  - fix(actions): run TransferLogs on UpdateLog{Rows:\[], NoMore:true} ([#&#8203;37631](go-gitea/gitea#37631))
  - fix show correct mergebase
  - fix: make clone URL respect public URL detection setting ([#&#8203;37615](go-gitea/gitea#37615))
  - fix: "run as root" check ([#&#8203;37622](go-gitea/gitea#37622))
  - chore(deps): update dependency go to v1.26.3 ([#&#8203;37601](go-gitea/gitea#37601))
  - Compare dropdown fails when selecting branch with no common merge-base ([#&#8203;37470](go-gitea/gitea#37470))
  - fix: treat email addresses case-insensitively ([#&#8203;37600](go-gitea/gitea#37600))
  - fix(actions): fix blank lines after ::endgroup:: ([#&#8203;37597](go-gitea/gitea#37597))
  - fix(actions): report individual step status in workflow job API response ([#&#8203;37592](go-gitea/gitea#37592))
  - fix: Invalid UTF-8 commit messages in JSON API responses ([#&#8203;37542](go-gitea/gitea#37542))
  - fix: use consistent GetUser family functions ([#&#8203;37553](go-gitea/gitea#37553))
  - fix(api): return 409 message instead of empty JSON for wrong commit id ([#&#8203;37572](go-gitea/gitea#37572))
  - fix(actions): prevent panic when workflow contains null jobs ([#&#8203;37570](go-gitea/gitea#37570))
  - Make ServeSetHeaders default to download attachment if filename exists ([#&#8203;37552](go-gitea/gitea#37552)) ([#&#8203;37555](go-gitea/gitea#37555))
  - Fix(actions): validate workflow param to prevent 500 error ([#&#8203;37546](go-gitea/gitea#37546)) ([#&#8203;37554](go-gitea/gitea#37554))
  - Don't unblock run-level-concurrency-blocked runs in the resolver ([#&#8203;37461](go-gitea/gitea#37461)) ([#&#8203;37538](go-gitea/gitea#37538))
  - Fix(packages): use file names for generic web downloads ([#&#8203;37514](go-gitea/gitea#37514)) ([#&#8203;37520](go-gitea/gitea#37520))
  - Fix merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once ([#&#8203;37512](go-gitea/gitea#37512)) ([#&#8203;37516](go-gitea/gitea#37516))
  - Fix update branch protection order ([#&#8203;37508](go-gitea/gitea#37508)) ([#&#8203;37513](go-gitea/gitea#37513))
  - Fix mCaptcha broken after Vite migration ([#&#8203;37492](go-gitea/gitea#37492)) ([#&#8203;37509](go-gitea/gitea#37509))
  - Fix review submission from single-commit PR view ([#&#8203;37475](go-gitea/gitea#37475)) ([#&#8203;37485](go-gitea/gitea#37485))
  - Fix scheduled action panic with null event payload ([#&#8203;37459](go-gitea/gitea#37459)) ([#&#8203;37466](go-gitea/gitea#37466))
  - Make GetPossibleUserByID can handle deleted user ([#&#8203;37430](go-gitea/gitea#37430)) ([#&#8203;37431](go-gitea/gitea#37431))
  - Remove excessive quote from terraform instructions ([#&#8203;37424](go-gitea/gitea#37424)) ([#&#8203;37426](go-gitea/gitea#37426))
  - Fix color regressions, add `priority` color ([#&#8203;37417](go-gitea/gitea#37417)) ([#&#8203;37421](go-gitea/gitea#37421))

- MISC
  - Add CurrentURL template variable back ([#&#8203;37444](go-gitea/gitea#37444)) ([#&#8203;37449](go-gitea/gitea#37449))

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/apoci/pulls/47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@silverwind silverwind silverwind approved these changes

@bircni bircni bircni approved these changes

Assignees

No one assigned

Labels

backport/done All backports for this PR have been created backport/v1.26 This PR should be backported to Gitea 1.26 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/bug

Projects

None yet

Milestone

1.27.0

Development

Successfully merging this pull request may close these issues.

5 participants

@lunny @silverwind @bircni @GiteaBot