api.go 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413
  1. // Copyright 2015 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package v1
  5. import (
  6. "net/http"
  7. "strings"
  8. "github.com/go-macaron/binding"
  9. "gopkg.in/macaron.v1"
  10. api "github.com/gogs/go-gogs-client"
  11. "gogs.io/gogs/internal/context"
  12. "gogs.io/gogs/internal/db"
  13. "gogs.io/gogs/internal/form"
  14. "gogs.io/gogs/internal/route/api/v1/admin"
  15. "gogs.io/gogs/internal/route/api/v1/misc"
  16. "gogs.io/gogs/internal/route/api/v1/org"
  17. "gogs.io/gogs/internal/route/api/v1/repo"
  18. "gogs.io/gogs/internal/route/api/v1/user"
  19. )
  20. // repoAssignment extracts information from URL parameters to retrieve the repository,
  21. // and makes sure the context user has at least the read access to the repository.
  22. func repoAssignment() macaron.Handler {
  23. return func(c *context.APIContext) {
  24. username := c.Params(":username")
  25. reponame := c.Params(":reponame")
  26. var err error
  27. var owner *db.User
  28. // Check if the context user is the repository owner.
  29. if c.IsLogged && c.User.LowerName == strings.ToLower(username) {
  30. owner = c.User
  31. } else {
  32. owner, err = db.GetUserByName(username)
  33. if err != nil {
  34. c.NotFoundOrError(err, "get user by name")
  35. return
  36. }
  37. }
  38. c.Repo.Owner = owner
  39. r, err := db.GetRepositoryByName(owner.ID, reponame)
  40. if err != nil {
  41. c.NotFoundOrError(err, "get repository by name")
  42. return
  43. } else if err = r.GetOwner(); err != nil {
  44. c.Error(err, "get owner")
  45. return
  46. }
  47. if c.IsTokenAuth && c.User.IsAdmin {
  48. c.Repo.AccessMode = db.ACCESS_MODE_OWNER
  49. } else {
  50. mode, err := db.UserAccessMode(c.UserID(), r)
  51. if err != nil {
  52. c.Error(err, "get user access mode")
  53. return
  54. }
  55. c.Repo.AccessMode = mode
  56. }
  57. if !c.Repo.HasAccess() {
  58. c.NotFound()
  59. return
  60. }
  61. c.Repo.Repository = r
  62. }
  63. }
  64. // orgAssignment extracts information from URL parameters to retrieve the organization or team.
  65. func orgAssignment(args ...bool) macaron.Handler {
  66. var (
  67. assignOrg bool
  68. assignTeam bool
  69. )
  70. if len(args) > 0 {
  71. assignOrg = args[0]
  72. }
  73. if len(args) > 1 {
  74. assignTeam = args[1]
  75. }
  76. return func(c *context.APIContext) {
  77. c.Org = new(context.APIOrganization)
  78. var err error
  79. if assignOrg {
  80. c.Org.Organization, err = db.GetUserByName(c.Params(":orgname"))
  81. if err != nil {
  82. c.NotFoundOrError(err, "get organization by name")
  83. return
  84. }
  85. }
  86. if assignTeam {
  87. c.Org.Team, err = db.GetTeamByID(c.ParamsInt64(":teamid"))
  88. if err != nil {
  89. c.NotFoundOrError(err, "get team by ID")
  90. return
  91. }
  92. }
  93. }
  94. }
  95. // reqToken makes sure the context user is authorized via access token.
  96. func reqToken() macaron.Handler {
  97. return func(c *context.Context) {
  98. if !c.IsTokenAuth {
  99. c.Status(http.StatusUnauthorized)
  100. return
  101. }
  102. }
  103. }
  104. // reqBasicAuth makes sure the context user is authorized via HTTP Basic Auth.
  105. func reqBasicAuth() macaron.Handler {
  106. return func(c *context.Context) {
  107. if !c.IsBasicAuth {
  108. c.Status(http.StatusUnauthorized)
  109. return
  110. }
  111. }
  112. }
  113. // reqAdmin makes sure the context user is a site admin.
  114. func reqAdmin() macaron.Handler {
  115. return func(c *context.Context) {
  116. if !c.IsLogged || !c.User.IsAdmin {
  117. c.Status(http.StatusForbidden)
  118. return
  119. }
  120. }
  121. }
  122. // reqRepoWriter makes sure the context user has at least write access to the repository.
  123. func reqRepoWriter() macaron.Handler {
  124. return func(c *context.Context) {
  125. if !c.Repo.IsWriter() {
  126. c.Status(http.StatusForbidden)
  127. return
  128. }
  129. }
  130. }
  131. // reqRepoWriter makes sure the context user has at least admin access to the repository.
  132. func reqRepoAdmin() macaron.Handler {
  133. return func(c *context.Context) {
  134. if !c.Repo.IsAdmin() {
  135. c.Status(http.StatusForbidden)
  136. return
  137. }
  138. }
  139. }
  140. func mustEnableIssues(c *context.APIContext) {
  141. if !c.Repo.Repository.EnableIssues || c.Repo.Repository.EnableExternalTracker {
  142. c.NotFound()
  143. return
  144. }
  145. }
  146. // RegisterRoutes registers all route in API v1 to the web application.
  147. // FIXME: custom form error response
  148. func RegisterRoutes(m *macaron.Macaron) {
  149. bind := binding.Bind
  150. m.Group("/v1", func() {
  151. // Handle preflight OPTIONS request
  152. m.Options("/*", func() {})
  153. // Miscellaneous
  154. m.Post("/markdown", bind(api.MarkdownOption{}), misc.Markdown)
  155. m.Post("/markdown/raw", misc.MarkdownRaw)
  156. // Users
  157. m.Group("/users", func() {
  158. m.Get("/search", user.Search)
  159. m.Group("/:username", func() {
  160. m.Get("", user.GetInfo)
  161. m.Group("/tokens", func() {
  162. m.Combo("").
  163. Get(user.ListAccessTokens).
  164. Post(bind(api.CreateAccessTokenOption{}), user.CreateAccessToken)
  165. }, reqBasicAuth())
  166. })
  167. })
  168. m.Group("/users", func() {
  169. m.Group("/:username", func() {
  170. m.Get("/keys", user.ListPublicKeys)
  171. m.Get("/followers", user.ListFollowers)
  172. m.Group("/following", func() {
  173. m.Get("", user.ListFollowing)
  174. m.Get("/:target", user.CheckFollowing)
  175. })
  176. })
  177. }, reqToken())
  178. m.Group("/user", func() {
  179. m.Get("", user.GetAuthenticatedUser)
  180. m.Combo("/emails").
  181. Get(user.ListEmails).
  182. Post(bind(api.CreateEmailOption{}), user.AddEmail).
  183. Delete(bind(api.CreateEmailOption{}), user.DeleteEmail)
  184. m.Get("/followers", user.ListMyFollowers)
  185. m.Group("/following", func() {
  186. m.Get("", user.ListMyFollowing)
  187. m.Combo("/:username").
  188. Get(user.CheckMyFollowing).
  189. Put(user.Follow).
  190. Delete(user.Unfollow)
  191. })
  192. m.Group("/keys", func() {
  193. m.Combo("").
  194. Get(user.ListMyPublicKeys).
  195. Post(bind(api.CreateKeyOption{}), user.CreatePublicKey)
  196. m.Combo("/:id").
  197. Get(user.GetPublicKey).
  198. Delete(user.DeletePublicKey)
  199. })
  200. m.Get("/issues", repo.ListUserIssues)
  201. }, reqToken())
  202. // Repositories
  203. m.Get("/users/:username/repos", reqToken(), repo.ListUserRepositories)
  204. m.Get("/orgs/:org/repos", reqToken(), repo.ListOrgRepositories)
  205. m.Combo("/user/repos", reqToken()).
  206. Get(repo.ListMyRepos).
  207. Post(bind(api.CreateRepoOption{}), repo.Create)
  208. m.Post("/org/:org/repos", reqToken(), bind(api.CreateRepoOption{}), repo.CreateOrgRepo)
  209. m.Group("/repos", func() {
  210. m.Get("/search", repo.Search)
  211. m.Get("/:username/:reponame", repoAssignment(), repo.Get)
  212. m.Get("/:username/:reponame/releases", repoAssignment(), repo.Releases)
  213. })
  214. m.Group("/repos", func() {
  215. m.Post("/migrate", bind(form.MigrateRepo{}), repo.Migrate)
  216. m.Delete("/:username/:reponame", repoAssignment(), repo.Delete)
  217. m.Group("/:username/:reponame", func() {
  218. m.Group("/hooks", func() {
  219. m.Combo("").
  220. Get(repo.ListHooks).
  221. Post(bind(api.CreateHookOption{}), repo.CreateHook)
  222. m.Combo("/:id").
  223. Patch(bind(api.EditHookOption{}), repo.EditHook).
  224. Delete(repo.DeleteHook)
  225. }, reqRepoAdmin())
  226. m.Group("/collaborators", func() {
  227. m.Get("", repo.ListCollaborators)
  228. m.Combo("/:collaborator").
  229. Get(repo.IsCollaborator).
  230. Put(bind(api.AddCollaboratorOption{}), repo.AddCollaborator).
  231. Delete(repo.DeleteCollaborator)
  232. }, reqRepoAdmin())
  233. m.Get("/raw/*", context.RepoRef(), repo.GetRawFile)
  234. m.Group("/contents", func() {
  235. m.Get("", repo.GetContents)
  236. m.Get("/*", repo.GetContents)
  237. })
  238. m.Get("/archive/*", repo.GetArchive)
  239. m.Group("/git/trees", func() {
  240. m.Get("/:sha", repo.GetRepoGitTree)
  241. })
  242. m.Get("/forks", repo.ListForks)
  243. m.Group("/branches", func() {
  244. m.Get("", repo.ListBranches)
  245. m.Get("/*", repo.GetBranch)
  246. })
  247. m.Group("/commits", func() {
  248. m.Get("/:sha", repo.GetSingleCommit)
  249. m.Get("/*", repo.GetReferenceSHA)
  250. })
  251. m.Group("/keys", func() {
  252. m.Combo("").
  253. Get(repo.ListDeployKeys).
  254. Post(bind(api.CreateKeyOption{}), repo.CreateDeployKey)
  255. m.Combo("/:id").
  256. Get(repo.GetDeployKey).
  257. Delete(repo.DeleteDeploykey)
  258. }, reqRepoAdmin())
  259. m.Group("/issues", func() {
  260. m.Combo("").
  261. Get(repo.ListIssues).
  262. Post(bind(api.CreateIssueOption{}), repo.CreateIssue)
  263. m.Group("/comments", func() {
  264. m.Get("", repo.ListRepoIssueComments)
  265. m.Patch("/:id", bind(api.EditIssueCommentOption{}), repo.EditIssueComment)
  266. })
  267. m.Group("/:index", func() {
  268. m.Combo("").
  269. Get(repo.GetIssue).
  270. Patch(bind(api.EditIssueOption{}), repo.EditIssue)
  271. m.Group("/comments", func() {
  272. m.Combo("").
  273. Get(repo.ListIssueComments).
  274. Post(bind(api.CreateIssueCommentOption{}), repo.CreateIssueComment)
  275. m.Combo("/:id").
  276. Patch(bind(api.EditIssueCommentOption{}), repo.EditIssueComment).
  277. Delete(repo.DeleteIssueComment)
  278. })
  279. m.Get("/labels", repo.ListIssueLabels)
  280. m.Group("/labels", func() {
  281. m.Combo("").
  282. Post(bind(api.IssueLabelsOption{}), repo.AddIssueLabels).
  283. Put(bind(api.IssueLabelsOption{}), repo.ReplaceIssueLabels).
  284. Delete(repo.ClearIssueLabels)
  285. m.Delete("/:id", repo.DeleteIssueLabel)
  286. }, reqRepoWriter())
  287. })
  288. }, mustEnableIssues)
  289. m.Group("/labels", func() {
  290. m.Get("", repo.ListLabels)
  291. m.Get("/:id", repo.GetLabel)
  292. })
  293. m.Group("/labels", func() {
  294. m.Post("", bind(api.CreateLabelOption{}), repo.CreateLabel)
  295. m.Combo("/:id").
  296. Patch(bind(api.EditLabelOption{}), repo.EditLabel).
  297. Delete(repo.DeleteLabel)
  298. }, reqRepoWriter())
  299. m.Group("/milestones", func() {
  300. m.Get("", repo.ListMilestones)
  301. m.Get("/:id", repo.GetMilestone)
  302. })
  303. m.Group("/milestones", func() {
  304. m.Post("", bind(api.CreateMilestoneOption{}), repo.CreateMilestone)
  305. m.Combo("/:id").
  306. Patch(bind(api.EditMilestoneOption{}), repo.EditMilestone).
  307. Delete(repo.DeleteMilestone)
  308. }, reqRepoWriter())
  309. m.Patch("/issue-tracker", reqRepoWriter(), bind(api.EditIssueTrackerOption{}), repo.IssueTracker)
  310. m.Post("/mirror-sync", reqRepoWriter(), repo.MirrorSync)
  311. m.Get("/editorconfig/:filename", context.RepoRef(), repo.GetEditorconfig)
  312. }, repoAssignment())
  313. }, reqToken())
  314. m.Get("/issues", reqToken(), repo.ListUserIssues)
  315. // Organizations
  316. m.Combo("/user/orgs", reqToken()).
  317. Get(org.ListMyOrgs).
  318. Post(bind(api.CreateOrgOption{}), org.CreateMyOrg)
  319. m.Get("/users/:username/orgs", org.ListUserOrgs)
  320. m.Group("/orgs/:orgname", func() {
  321. m.Combo("").
  322. Get(org.Get).
  323. Patch(bind(api.EditOrgOption{}), org.Edit)
  324. m.Get("/teams", org.ListTeams)
  325. }, orgAssignment(true))
  326. m.Group("/admin", func() {
  327. m.Group("/users", func() {
  328. m.Post("", bind(api.CreateUserOption{}), admin.CreateUser)
  329. m.Group("/:username", func() {
  330. m.Combo("").
  331. Patch(bind(api.EditUserOption{}), admin.EditUser).
  332. Delete(admin.DeleteUser)
  333. m.Post("/keys", bind(api.CreateKeyOption{}), admin.CreatePublicKey)
  334. m.Post("/orgs", bind(api.CreateOrgOption{}), admin.CreateOrg)
  335. m.Post("/repos", bind(api.CreateRepoOption{}), admin.CreateRepo)
  336. })
  337. })
  338. m.Group("/orgs/:orgname", func() {
  339. m.Group("/teams", func() {
  340. m.Post("", orgAssignment(true), bind(api.CreateTeamOption{}), admin.CreateTeam)
  341. })
  342. })
  343. m.Group("/teams", func() {
  344. m.Group("/:teamid", func() {
  345. m.Combo("/members/:username").
  346. Put(admin.AddTeamMember).
  347. Delete(admin.RemoveTeamMember)
  348. m.Combo("/repos/:reponame").
  349. Put(admin.AddTeamRepository).
  350. Delete(admin.RemoveTeamRepository)
  351. }, orgAssignment(false, true))
  352. })
  353. }, reqAdmin())
  354. m.Any("/*", func(c *context.Context) {
  355. c.NotFound()
  356. })
  357. }, context.APIContexter())
  358. }