Hash App token

[techknowlogick]

Fix #3789

[jonasfranz]

What do you think about using bcyrpt with salt?

[techknowlogick]

@jonasfranz

I thought about that, but Gitea needs to search for token in DB, and if it is hashed with a salt, then Gitea would have to loop through all keys that exist in system and compute which one is the match. It could be simplified if the token_last_eight was used as a part of the SQL select, but I went with less resource intensive operation, and less impactful code change.

Typing this out now, has made me consider this even more, and good news is that it wouldn't require another PR to go-sdk. So I think I will make the change. Thanks for prompting me to re-consider.

[tamalsaha]

@techknowlogick , I left a comment #3789 (comment)

[techknowlogick]

Ready for review

[codecov-io]

Codecov Report

Merging #6724 into master will decrease coverage by 0.05%.
The diff coverage is 21.48%.

@@            Coverage Diff             @@
##           master    #6724      +/-   ##
==========================================
- Coverage   41.24%   41.19%   -0.06%     
==========================================
  Files         422      423       +1     
  Lines       58277    58394     +117     
==========================================
+ Hits        24037    24055      +18     
- Misses      31061    31161     +100     
+ Partials     3179     3178       -1

Impacted Files	Coverage Δ
models/migrations/migrations.go	1.52% <ø> (ø)	⬆️
models/migrations/v85.go	0% <0%> (ø)
models/error.go	32.08% <0%> (ø)	⬆️
modules/base/tool.go	72.54% <100%> (+0.27%)	⬆️
routers/user/setting/applications.go	45.61% <100%> (ø)	⬆️
routers/api/v1/user/app.go	63.26% <50%> (ø)	⬆️
models/token.go	81.48% <80.76%> (-2.73%)	⬇️
models/unit.go	62.16% <0%> (-5.41%)	⬇️
models/repo_list.go	66.84% <0%> (-1.06%)	⬇️
... and 2 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1fa9662...ed40913. Read the comment docs.

[zeripath]

I think v85.go might need changes equivalent to #6823 (once we're sure that that is correct.)

[techknowlogick]

@zeripath ahah yeah. I’ve been keeping an eye on those changes and I’ve just set this to blocked so it will only get merged once the other PR does

[tboerger]

Great that you introduce such a breaking change into a minor release, you just killed the current Drone authentication.

[lafriks]

@tboerger it has been fixed already in #6903

[zeripath]

@tboerger I think we've had a few of these problems lately - would it be possible to write an integration test for Gitea that would ensure that we don't kill drone authentication by mistake.