Creating Token via API with Token authentication is not possible

[davidhiendl]

Description

In trying to write a Drone Secrets Extension to allow Drone pipelines to obtain a per-pipeline Gitea API Token automatically I ran into 2 problems:

1. Trying to create a token for a user does not work when using a token for authorization:

curl -X 'POST' \
  'https://gitea.test/api/v1/users/test123/tokens' \
  -H 'accept: application/json' \
  -H 'Authorization: token xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "drone_123123_2022-09-16-14-00"
}'

Response: {"message":"auth required","url":"https://gitea.test/api/swagger"}
Note: The token was created for an admin user account.

Edit: Forgot to mention the same problem seems to be present for listing and deleting tokens as well.

2. Trying to create API tokens for different users via the API is not possible. In the following example I'm trying to create a token for the user "test123" (the user has been created already). However the token is created for my primary user (the one specified via basic auth credentials). This requires the sudo get param, the URL is however confusing because it also contains a username path param.

curl -X 'POST' \
  'https://gitea.test/api/v1/users/test123/tokens' \
  -H 'accept: application/json' \
  -u "admin:xxxxxxxx" \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "drone_123123_2022-09-16-14-00"
}'

The reason appears to be that the controller uses the request context user instead of the one specified in the path parameter:

gitea/routers/api/v1/user/app.go

Line 101 in 548387b

UID: ctx.Doer.ID,

Gitea Version

1.17.2

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

• official docker image
• deployed via helm chart

Database

PostgreSQL

[lunny]

You can use ?sudo=my_user with an admin token.

[davidhiendl]

@lunny Thanks for the info. Adding GET parameter with the target username works. It is however confusing, that the URL has a .../{username}/... path param.
But the first problem remains: It appears those endpoints don't work with a token.

[abdennour]

actually i am using the admin user which is bootstrapped with helm..

base_url=http://$USERNAME:$PASSWORD@gitea:3000/api/v1
curl -u $USERNAME:$PASSWORD -X POST ${base_url}/users/$USERNAME/tokens 

tried many times, but always getting

{"message":"auth required","url":"http://gitea:3000"}

My requirements is to bootstrap many things (organizations, repos,...etc) just after having the Gitea up & running... while doing ZERO manual administration

[davidhiendl]

@abdennour Your API URL is wrong, there is an additional "v" in it: .../apiv/v1/... -> .../api/v1/...
Also you need to use the sudo-param as @lunny pointed out.

[abdennour]

It's typo while copy paste here , not in the source code . Could you confirm if we remove that typo, everything else should work ? I am using the official helm chart to install it BTW

@davidhiendl alsi I already tried with ?sudo=$USERNAME .. but it does not work : (

[davidhiendl]

@abdennour I'm using Golang to create users using the api/v1/admin/users endpoints and tokens using the api/v1/users/{user}/tokens?sudo={user}. Works fine.

[abdennour]

If you could share snippet of code, I would appreciate that. I am familiar with Go and I can proceed with that @davidhiendl

[davidhiendl]

@abdennour I've tried to use the API with curl via Ansible for automation and it works just fine. If the following does not work I suspect there is something else wrong on your end.

curl -X 'POST' \
  'https://gitea.example.com/api/v1/admin/users' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -u "adminuser:adminpassword" \
  -d '{
  "email": "user@example.com",
  "full_name": "Example User",
  "login_name": "example",
  "must_change_password": true,
  "password": "example123",
  "restricted": true,
  "send_notify": true,
  "username": "example"
}'

[davidhiendl]

I updated the ticket name and description to better reflect the problem besides the sudo param.

[abdennour]

Thank you @davidhiendl ! Actually, I switched to the CLI and it works like a charm :

tea login add --name admin
tea org list

docker run -it --rm \
  -e GITEA_SERVER_URL=http://gitea:3000 \
  -e GITEA_SERVER_USER=gitea_admin \
  -e GITEA_SERVER_PASSWORD=**** \
  abdennour/gitea-cli:0.9.0-alpine \
    organizations list

[abdennour]

FYI guys,, you need to generate a token before... then use that token for subsequent calls.
And to generate the token, you need to use this syntax:

curl -X POST -u ${GITEA_SERVER_USER}:${GITEA_SERVER_PASSWORD} "${GITEA_SERVER_URL}/api/v1/users/${GITEA_SERVER_USER}/tokens" -H  "accept: application/json" -H "Content-Type: application/json" -d "{  
	\"name\": \"${TOKENNAME}\"
}"

Note that body which requires name param
Then pipe response with grep -o -P '(?<=sha1":").*(?=","token)' & your token is parsed. Good luck!