feat: manage bot accounts from the admin UI, API and CLI - #38966
Draft
joestump-agent wants to merge 34 commits into
Draft
feat: manage bot accounts from the admin UI, API and CLI#38966joestump-agent wants to merge 34 commits into
joestump-agent wants to merge 34 commits into
Conversation
…dlers Extract the duplicated "scope-*" form parsing into auth.AccessTokenScopeFromForm and use it from both the user-facing ApplicationsPost and the new admin bot-token handler.
Bot accounts are meant for token-based automation only, but the reverse-proxy and external-source (LDAP/SMTP/PAM) auth paths resolved users by name/email without checking the user type. A bot whose name or email matched a proxy header or external identity could obtain an interactive session. Guard reverse-proxy auth and the UserSignIn external-source fallback so only individual users may sign in interactively, matching the existing local-password and OAuth2 behavior. Add regression tests covering both. Assisted-by: Claude:claude-opus-4-8
Allow a site admin to convert an existing account between the individual
and bot types. Only individual <-> bot is permitted; organizations and
reserved types are rejected.
When converting to a bot the account becomes a local, token-only account:
password, auth source and persisted sessions are cleared, OAuth2
applications/grants and external login links are removed, while access
tokens and owned content (repositories, org membership, ...) are kept.
Exposed through the admin Edit User page (User Type dropdown), the API
(POST /admin/users/{username}/convert-type) and the CLI
(gitea admin user change-type), all backed by user_service.ConvertUserType.
The CLI user-type parsing is shared with "user create".
Assisted-by: Claude:claude-opus-4-8
Document the bot account model: definition, the no-interactive-sign-in guarantee across all auth paths, the capability matrix, and the individual <-> bot conversion rules with every side effect spelled out. Assisted-by: Claude:claude-opus-4-8
- reject and clear passwords when creating a bot via the admin UI, so bots stay passwordless like the CLI and edit-user paths already enforce - wrap the individual->bot credential teardown in a transaction so a mid-sequence failure cannot leave a half-converted account - guard DeleteBotToken so the admin bot-token route only acts on bots Assisted-by: Claude Code:claude-opus-4-8
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Claude:claude-opus-5
Bot accounts are non-interactive: converting a user to a bot strips its password and auth source so it can never sign in. Impersonation sets the session UID directly, bypassing credentials entirely, which would hand out a session that signing in could never produce. Guard the handler and hide the button on the admin user view page. Assisted-by: Claude:claude-opus-5
The admin user list mixes individuals, bots, reserved and remote accounts with no way to narrow them down. Add a "User Type" dropdown that filters to individuals or bots; unfiltered behaviour is unchanged.
# Conflicts: # routers/web/web.go # services/forms/user_form.go
# Conflicts: # options/locale/locale_en-US.json
- Replace the new RenderWithErrDeprecated call for the bot-admin error with a flash message and redirect, per reviewer request to not add more usages of the deprecated helper. - Drop the unit TestImpersonateUser duplicate and cover bot impersonation rejection in the TestAdminBotUser integration test. - Update TestConvertUserTypeRejectsNonConvertibleTarget to expect 400, matching APIErrorAuto's current mapping of invalid-argument errors. Pick-up of go-gitea#38181 by bircni, whose authorship is preserved via the merged commits. 💘 Generated with Crush Assisted-by: Crush:glm-5.3
…tions The organization path of CreateRepoTransferNotification skips bot members and notifies the rest by their real user id, but had no test coverage. Assisted-by: Claude Code:claude-fable-5
Reinstates the design doc removed during the original review, with the sign-in enforcement matrix and conversion side-effects corrected to match the current implementation (renamed error, SSPI/session/OpenID handling, kept vs cleared artifacts). Assisted-by: Claude Code:claude-fable-5
GiteaBot
added
the
lgtm/need 2
|
👋🏼 Human operator of @joestump-agent chiming in. I picked this up from @bircni's PR. I will flip this from WIP to ready for review once status checks are green and I do a final manual review. Here are the screenshots: 
|
Member
|
I can help if needed - let me check the code again |
Member
|
Did some adjustments:
|
bircni
added
the
release/highlight
Author
|
Thanks @bircni — read through the adjustments and they all look right, especially centralising the bot invariant in |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds first-class bot accounts (
UserTypeBot): local, password-less users for automation thatauthenticate only with access tokens.
Continues #38181 by
@bircni (commits preserved), rebased on
mainwith the outstanding review threads addressed.Since Gitea squash-merges, we'd appreciate bircni's authorship being preserved via a co-author
line by a maintainer.
Bots also close a security gap: several auth paths (reverse-proxy, SSPI, external sources, sessions,
password reset) resolved users without a type check, so a bot could obtain an interactive session.
All now require an individual, with regression tests.
The full model — what a bot can and cannot do, and every side effect of conversion (password,
sessions, OAuth2 grants, external/OpenID links and notifications cleared; access tokens and owned
content kept) — is documented in
models/user/bot_user_design.md.Usage
manage their own).
POST /admin/users/{username}/convert-type, orgitea admin user change-type --username <name> --user-type bot|individual.Screenshots
Click to open
🤖 This was posted autonomously by
glm-5.3using Crush.