Pre-register OAuth2 applications for git credential helpers

custom/conf/app.example.ini

@@ -544,6 +544,9 @@ ENABLE = true
 ;;
 ;; Maximum length of oauth2 token/cookie stored on server
 ;MAX_TOKEN_LENGTH = 32767
+;;
+;; Pre-register OAuth2 applications for some universally useful services
+;DEFAULT_APPLICATIONS = git-credential-oauth, Git Credential Manager
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

docs/content/administration/config-cheat-sheet.en-us.md

@@ -1100,6 +1100,7 @@ This section only does "set" config, a removed config key from this section won'
 - `JWT_SECRET_URI`: **_empty_**: Instead of defining JWT_SECRET in the configuration, this configuration option can be used to give Gitea a path to a file that contains the secret (example value: `file:/etc/gitea/oauth2_jwt_secret`)
 - `JWT_SIGNING_PRIVATE_KEY_FILE`: **jwt/private.pem**: Private key file path used to sign OAuth2 tokens. The path is relative to `APP_DATA_PATH`. This setting is only needed if `JWT_SIGNING_ALGORITHM` is set to `RS256`, `RS384`, `RS512`, `ES256`, `ES384` or `ES512`. The file must contain a RSA or ECDSA private key in the PKCS8 format. If no key exists a 4096 bit key will be created for you.
 - `MAX_TOKEN_LENGTH`: **32767**: Maximum length of token/cookie to accept from OAuth2 provider
+- `DEFAULT_APPLICATIONS`: **git-credential-oauth, Git Credential Manager**: Pre-register OAuth applications for some services on startup. See the [OAuth2 documentation](/development/oauth2-provider.md) for the list of available options.
 
 ## i18n (`i18n`)
 

docs/content/development/oauth2-provider.en-us.md

@@ -78,6 +78,17 @@ Gitea token scopes are as follows:
 |     **read:user** | Grants read access to user operations, such as getting user repo subscriptions and user settings.                                                    |
 |     **write:user** | Grants read/write/delete access to user operations, such as updating user repo subscriptions, followed users, and user settings.                     |
 
+## Pre-configured Applications
+
+Gitea creates OAuth applications for the following services by default on startup:
+
+- [git-credential-oauth](https://github.com/hickford/git-credential-oauth)
+- [Git Credential Manager](https://github.com/git-ecosystem/git-credential-manager)
+
+as we assume that these are universally useful.
+
+To prevent unexpected behavior, they are being displayed as locked in the UI and their creation can instead be controlled by the `DEFAULT_APPLICATIONS` parameter in `app.ini`.
+
 ## Client types
 
 Gitea supports both confidential and public client types, [as defined by RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1).

models/auth/oauth2.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 
@@ -38,6 +39,7 @@ type OAuth2Application struct {
 	RedirectURIs       []string           `xorm:"redirect_uris JSON TEXT"`
 	CreatedUnix        timeutil.TimeStamp `xorm:"INDEX created"`
 	UpdatedUnix        timeutil.TimeStamp `xorm:"INDEX updated"`
+	Locked             bool               `xorm:"NOT NULL DEFAULT FALSE"`
 }
 
 func init() {
@@ -46,6 +48,64 @@ func init() {
 	db.RegisterModel(new(OAuth2Grant))
 }
 
+func Init(ctx context.Context) error {
+	defaultApplications := []*OAuth2Application{
+		{
+			Name:         "git-credential-oauth",
+			ClientID:     "a4792ccc-144e-407e-86c9-5e7d8d9c3269",
+			RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
+			Locked:       true,
+		},
+		{
+			Name:         "Git Credential Manager",
+			ClientID:     "e90ee53c-94e2-48ac-9358-a874fb9e0662",
+			RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
+			Locked:       true,
+		},
+	}
+
+	registeredOAuth2Apps, _ := GetOAuth2ApplicationsByUserID(ctx, 0)
+
+	var enabledOAuth2Apps []*OAuth2Application
+	for _, entry := range setting.OAuth2.DefaultApplications {
+		app := util.SliceFind(defaultApplications, func(a *OAuth2Application) bool { return a.Name == entry })
+		if app != -1 {
+			enabledOAuth2Apps = append(enabledOAuth2Apps, defaultApplications[app])
+		}
+	}
+
+	var disabledOAuth2Apps []*OAuth2Application
+	for _, entry := range defaultApplications {
+		app := util.SliceFind(enabledOAuth2Apps, func(a *OAuth2Application) bool { return a.ClientID == entry.ClientID })
+		registeredApp := util.SliceFind(registeredOAuth2Apps, func(a *OAuth2Application) bool { return a.ClientID == entry.ClientID })
+		if app == -1 && registeredApp != -1 {
+			disabledOAuth2Apps = append(disabledOAuth2Apps, registeredOAuth2Apps[registeredApp])
+		}
+	}
+
+	var createOAuth2Apps []*OAuth2Application
+	for _, app := range enabledOAuth2Apps {
+		registeredApp := util.SliceFind(registeredOAuth2Apps, func(a *OAuth2Application) bool { return a.ClientID == app.ClientID })
+		if registeredApp == -1 {
+			createOAuth2Apps = append(createOAuth2Apps, app)
+		}
+	}
+
+	if len(createOAuth2Apps) > 0 {
+		if err := db.Insert(ctx, createOAuth2Apps); err != nil {
+			return err
+		}
+	}
+
+	for _, app := range disabledOAuth2Apps {
+		if err := deleteOAuth2Application(ctx, app.ID, 0); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 // TableName sets the table name to `oauth2_application`
 func (app *OAuth2Application) TableName() string {
 	return "oauth2_application"

models/migrations/v1_21/v271.go

@@ -0,0 +1,15 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_21 //nolint
+
+import (
+	"xorm.io/xorm"
+)
+
+func OAuth2ApplicationAddLockedProperty(x *xorm.Engine) error {
+	type OAuth2Application struct {
+		Locked bool `xorm:"NOT NULL DEFAULT FALSE"`
+	}
+	return x.Sync(new(OAuth2Application))
+}

modules/setting/oauth2.go

@@ -100,6 +100,7 @@ var OAuth2 = struct {
 	JWTSecretBase64            string `ini:"JWT_SECRET"`
 	JWTSigningPrivateKeyFile   string `ini:"JWT_SIGNING_PRIVATE_KEY_FILE"`
 	MaxTokenLength             int
+	DefaultApplications        []string
 }{
 	Enable:                     true,
 	AccessTokenExpirationTime:  3600,
@@ -108,6 +109,7 @@ var OAuth2 = struct {
 	JWTSigningAlgorithm:        "RS256",
 	JWTSigningPrivateKeyFile:   "jwt/private.pem",
 	MaxTokenLength:             math.MaxInt16,
+	DefaultApplications:        []string{"git-credential-oauth", "Git Credential Manager"},
 }
 
 func loadOAuth2From(rootCfg ConfigProvider) {

modules/util/slice.go

@@ -88,3 +88,13 @@ func SliceRemoveAllFunc[T comparable](slice []T, targetFunc func(T) bool) []T {
 	}
 	return slice[:idx]
 }
+
+// SliceFind returns the element id of the first element that matches the condition, otherwise -1
+func SliceFind[T any](slice []T, condFunc func(T) bool) int {
+	for i, e := range slice {
+		if condFunc(e) {
+			return i
+		}
+	}
+	return -1
+}

options/locale/locale_en-US.ini

@@ -849,6 +849,7 @@ oauth2_client_secret_hint = The secret won't be visible if you revisit this page
 oauth2_application_edit = Edit
 oauth2_application_create_description = OAuth2 applications gives your third-party application access to user accounts on this instance.
 oauth2_application_remove_description = Removing an OAuth2 application will prevent it to access authorized user accounts on this instance. Continue?
+oauth2_application_locked = Gitea pre-registers some OAuth2 applications on startup if enabled in config. To prevent unexpected bahavior, these can be edited, but not removed. Please refer to the OAuth2 documentation for more information.
 
 authorized_oauth2_applications = Authorized OAuth2 Applications
 authorized_oauth2_applications_description = You've granted access to your personal Gitea account to these third party applications. Please revoke access for applications no longer needed.

routers/init.go

@@ -10,6 +10,7 @@ import (
 
 	"code.gitea.io/gitea/models"
 	asymkey_model "code.gitea.io/gitea/models/asymkey"
+	authmodel "code.gitea.io/gitea/models/auth"
 	"code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/eventsource"
 	"code.gitea.io/gitea/modules/git"
@@ -138,6 +139,7 @@ func InitWebInstalled(ctx context.Context) {
 	mustInit(oauth2.Init)
 
 	mustInitCtx(ctx, models.Init)
+	mustInitCtx(ctx, authmodel.Init)
 	mustInit(repo_service.Init)
 
 	// Booting long running goroutines.

routers/web/repo/http.go

@@ -147,7 +147,7 @@ func httpBase(ctx *context.Context) *serviceHandler {
 		// rely on the results of Contexter
 		if !ctx.IsSigned {
 			// TODO: support digit auth - which would be Authorization header with digit
-			ctx.Resp.Header().Set("WWW-Authenticate", "Basic realm=\".\"")
+			ctx.Resp.Header().Set("WWW-Authenticate", `Basic realm="Gitea"`)
 			ctx.Error(http.StatusUnauthorized)
 			return nil
 		}

templates/user/settings/applications_oauth2_list.tmpl

@@ -15,13 +15,14 @@
 						<span class="ui label">{{.ClientID}}</span>
 					</div>
 				</div>
-				<div class="flex-item-trailing">
+				<div class="flex-item-trailing" {{if .Locked}} data-tooltip-content="{{$.locale.Tr "settings.oauth2_application_locked"}}"{{end}}>
 					<a href="{{$.Link}}/oauth2/{{.ID}}" class="ui primary tiny button">
 						{{svg "octicon-pencil" 16 "gt-mr-2"}}
 						{{$.locale.Tr "settings.oauth2_application_edit"}}
 					</a>
 					<button class="ui red tiny button delete-button" data-modal-id="remove-gitea-oauth2-application"
-							data-url="{{$.Link}}/oauth2/{{.ID}}/delete">
+							data-url="{{$.Link}}/oauth2/{{.ID}}/delete"
+							{{if .Locked}}disabled{{end}}>
 						{{svg "octicon-trash" 16 "gt-mr-2"}}
 						{{$.locale.Tr "settings.delete_key"}}
 					</button>