89dd0a3eba · krz/gitbay

CHANGELOG.org +3

	@@ -9,6 +9,9 @@ anything beyond "replace the binary and restart" is needed.
9	- Removing an SSH key, removing a deploy key, or disabling or deleting an	9	- Removing an SSH key, removing a deploy key, or disabling or deleting an
10	account closes every open connection using an affected key, git	10	account closes every open connection using an affected key, git
11	transports included; every command re-reads its key (#256).	11	transports included; every command re-reads its key (#256).
		12	- A request whose credential has an expiry cannot run a command that
		13	mints another one — tokens, keys, login links, invites, accounts,
		14	verified addresses (#257).
12		15
13	* v1.36.0 — 2026-09-23	16	* v1.36.0 — 2026-09-23
14		17

internal/control/adminhost.go +11 −8

 			{"--verified", "", "mark that address verified", ""},
 			{"--key", "-", "read a public key from stdin", ""},
 		},
-		Examples:   []string{"admin user create alice --email alice@example.org --key - < key.pub"},
+		Examples:        []string{"admin user create alice --email alice@example.org --key - < key.pub"},
-		ReadsStdin: true, Run: runAdminUserCreate})
+		ReadsStdin:      true,
+		MintsCredential: true, Run: runAdminUserCreate})
 	register(Command{Path: []string{"admin", "user", "disable"},
 		Summary:  "suspend an account: SSH, web sessions and API tokens refused until re-enabled",
 		Usage:    "admin user disable <username>",
 		Examples: []string{"admin user delete alice --yes"},
 		Run:      runAdminUserDelete})
 	register(Command{Path: []string{"admin", "email", "verify"},
-		Summary:  "mark an address verified by admin assertion",
+		Summary:         "mark an address verified by admin assertion",
-		Usage:    "admin email verify <username> <address>",
+		Usage:           "admin email verify <username> <address>",
-		Examples: []string{"admin email verify alice alice@example.org"},
+		Examples:        []string{"admin email verify alice alice@example.org"},
-		Run:      runAdminEmailVerify})
+		MintsCredential: true,
+		Run:             runAdminEmailVerify})
 	register(Command{Path: []string{"admin", "invite"},
 		Summary: "issue a registration invite and mail its code",
 		Usage:   "admin invite --email <address>",
 		Flags: []Flag{
 			{"--email", "<address>", "who the invite is for", ""},
 		},
-		Examples: []string{"admin invite --email alice@example.org"},
+		Examples:        []string{"admin invite --email alice@example.org"},
-		Run:      runAdminInvite})
+		MintsCredential: true,
+		Run:             runAdminInvite})
 	register(Command{Path: []string{"admin", "stats"},
 		Summary:  "instance statistics: counts and per-repository disk usage",
 		Usage:    "admin stats",

internal/control/control.go +17 −1

 	// Source identifies the credential behind this session for the audit
 	// log: an SSH key fingerprint, or "api" for token requests.
 	Source string
+	// TokenID is the API token behind this request, 0 for none. A
+	// credential the request creates records it.
+	TokenID int64
+	// Expires is when the credential behind this request lapses; nil
+	// when it does not. Dispatch refuses MintsCredential commands when
+	// it is set.
+	Expires *time.Time
 	// Cmd is the command being run, set by Dispatch, so a usage error can
 	// print the registered usage rather than a copy of it.
 	Cmd Command
 	Examples   []string // full argv after the program, repository named
 	ReadsStdin bool
 	ReadOnly   bool // safe for read-scoped API tokens
-	Run        func(c *Ctx, args []string) int
+	// MintsCredential marks a command that creates a credential or a way
+	// to obtain one: tokens, keys, login links, invites, accounts,
+	// verified addresses. An expiring credential may not run it.
+	MintsCredential bool
+	Run             func(c *Ctx, args []string) int
 }
 var registry []Command
 	if c.ReadOnly && !cmd.ReadOnly {
 		return c.fail(protocol.ExitDenied, "this token is read-only; %s modifies state — mint one with --scope full", joinPath(cmd.Path))
 	}
+	// What an expiring credential creates would outlive it (#257).
+	if cmd.MintsCredential && c.Expires != nil {
+		return c.fail(protocol.ExitDenied,
+			"%s creates a credential, and the one this request came with expires; use a token or key without an expiry", joinPath(cmd.Path))
+	}
 	// The SSH listener refuses a disabled account before it gets here; the
 	// API and the web reach Dispatch directly, so the check lives here too.
 	if c.User.Disabled {

internal/control/deploykey.go +3 −2

 		Flags: []Flag{
 			{"--rw", "", "the key may push, not just fetch", ""},
 		},
-		Examples:   []string{"repo deploy-key add krz/gitbay < key.pub"},
+		Examples:        []string{"repo deploy-key add krz/gitbay < key.pub"},
-		ReadsStdin: true, Run: runDeployKeyAdd})
+		ReadsStdin:      true,
+		MintsCredential: true, Run: runDeployKeyAdd})
 	register(Command{Path: []string{"repo", "deploy-key", "list"},
 		Summary:  "list deploy keys",
 		Usage:    "repo deploy-key list <owner/name>",

internal/control/identity.go +4 −3

 			{"--scope", "full|git|runner", "what the key may do", "full"},
 			{"--label", "<text>", "a name for the key", ""},
 		},
-		Examples:   []string{"keys add --label laptop < key.pub"},
+		Examples:        []string{"keys add --label laptop < key.pub"},
-		ReadsStdin: true,
+		ReadsStdin:      true,
-		Run:        runKeysAdd,
+		MintsCredential: true,
+		Run:             runKeysAdd,
 	})
 	register(Command{
 		Path:     []string{"keys", "label"},

internal/control/register.go +4 −3

 		Usage:    "email add <address>",
 		Examples: []string{"email add cmc@example.org"}, Run: runEmailAdd})
 	register(Command{Path: []string{"email", "verify"},
-		Summary:  "confirm a verification code",
+		Summary:         "confirm a verification code",
-		Usage:    "email verify <code>",
+		Usage:           "email verify <code>",
-		Examples: []string{"email verify abc123"}, Run: runEmailVerify})
+		MintsCredential: true,
+		Examples:        []string{"email verify abc123"}, Run: runEmailVerify})
 	register(Command{Path: []string{"email", "list"},
 		Summary:  "list the addresses on your account",
 		Usage:    "email list",

internal/control/runnerrepo.go +5 −4

 // read-only git.
 func init() {
 	register(Command{Path: []string{"repo", "runner", "add"},
-		Summary:    "attach a runner's public key to a repository",
+		Summary:         "attach a runner's public key to a repository",
-		Usage:      "repo runner add <owner/name> < key.pub",
+		Usage:           "repo runner add <owner/name> < key.pub",
-		Examples:   []string{"repo runner add krz/gitbay < key.pub"},
+		Examples:        []string{"repo runner add krz/gitbay < key.pub"},
-		ReadsStdin: true, Run: runRepoRunnerAdd})
+		ReadsStdin:      true,
+		MintsCredential: true, Run: runRepoRunnerAdd})
 	register(Command{Path: []string{"repo", "runner", "list"},
 		Summary:  "list the runners attached to a repository",
 		Usage:    "repo runner list <owner/name>",

internal/control/token.go +5 −4

 			{"--scope", "full|read", "what the token may do", "full"},
 			{"--ttl", "30d|720h", "how long the token is valid", "never expires"},
 		},
-		Examples: []string{"token create --name laptop --scope read --ttl 30d"},
+		Examples:        []string{"token create --name laptop --scope read --ttl 30d"},
-		Run:      runTokenCreate})
+		MintsCredential: true,
+		Run:             runTokenCreate})
 	register(Command{Path: []string{"token", "list"},
 		Summary:  "list API tokens",
 		Usage:    "token list",
 	}
 	// The gb_ prefix makes leaked tokens findable by secret scanners.
 	token := "gb_" + raw
-	if err := c.Store.CreateAPIToken(c.User.ID, name, store.HashToken(token), scope, expires); err != nil {
+	if err := c.Store.CreateAPIToken(c.User.ID, name, store.HashToken(token), scope, expires, c.TokenID); err != nil {
 		return c.failErr(err)
 	}
 	type out struct {
 	if len(args) != 1 {
 		return c.usage()
 	}
-	if err := c.Store.RevokeAPIToken(c.User.ID, args[0]); err != nil {
+	if _, err := c.Store.RevokeAPIToken(c.User.ID, args[0], false); err != nil {
 		if errors.Is(err, store.ErrNotFound) {
 			return c.fail(protocol.ExitNotFound, "no token named %q", args[0])
 		}

internal/control/token_test.go added +72

@@ -0,0 +1,72 @@
	1	package control
	2
	3	import (
	4	"bytes"
	5	"slices"
	6	"strings"
	7	"testing"
	8	"time"
	9
	10	"gitbay.org/gitbay/internal/protocol"
	11	"gitbay.org/gitbay/internal/store"
	12	)
	13
	14	// The minting commands, pinned: adding one to the list, or dropping
	15	// one, is a decision this test makes someone take.
	16	func TestMintingCommandsMarked(t *testing.T) {
	17	want := []string{
	18	"admin email verify", "admin invite", "admin user create", "email verify",
	19	"keys add", "repo deploy-key add", "repo runner add", "token create", "web login",
	20	}
	21	var got []string
	22	for _, cmd := range Commands() {
	23	if cmd.MintsCredential {
	24	got = append(got, joinPath(cmd.Path))
	25	}
	26	}
	27	slices.Sort(got)
	28	if !slices.Equal(got, want) {
	29	t.Fatalf("MintsCredential on %q, want %q", got, want)
	30	}
	31	}
	32
	33	// Dispatch refuses before the command runs, so no arguments are needed.
	34	func TestExpiringCredentialCannotMint(t *testing.T) {
	35	exp := time.Now().Add(time.Hour)
	36	for _, cmd := range Commands() {
	37	if !cmd.MintsCredential {
	38	continue
	39	}
	40	var out, errOut bytes.Buffer
	41	c := &Ctx{User: store.User{ID: 1, Username: "root", IsAdmin: true}, Scope: "full", Expires: &exp, Stdout: &out, Stderr: &errOut}
	42	if code := Dispatch(c, cmd.Path); code != protocol.ExitDenied \|\| !strings.Contains(errOut.String(), "expires") {
	43	t.Errorf("%s: exit %d %q, want %d and the reason", joinPath(cmd.Path), code, errOut.String(), protocol.ExitDenied)
	44	}
	45	}
	46	}
	47
	48	func TestTokenCreateDefaultsToReadAndRecordsCreator(t *testing.T) {
	49	st, _, uid := newQueueTestRepo(t)
	50	if err := st.CreateAPIToken(uid, "parent", "h-parent", "full", nil, 0); err != nil {
	51	t.Fatal(err)
	52	}
	53	_, parent, err := st.APITokenUser("h-parent")
	54	if err != nil {
	55	t.Fatal(err)
	56	}
	57	c, errOut := pruneCtx(st, t.TempDir(), store.User{ID: uid, Username: "alice"})
	58	c.Cfg.Limits.WriteRate = -1
	59	c.TokenID = parent.ID
	60	if code := Dispatch(c, []string{"token", "create", "--name", "child"}); code != protocol.ExitOK {
	61	t.Fatalf("exit %d: %s", code, errOut)
	62	}
	63	toks, err := st.ListAPITokens(uid)
	64	if err != nil {
	65	t.Fatal(err)
	66	}
	67	for _, tk := range toks {
	68	if tk.Name == "child" && (tk.Scope != "read" \|\| tk.CreatedBy != "parent") {
	69	t.Fatalf("child: %+v", tk)
	70	}
	71	}
	72	}

internal/control/web.go +4 −3

 func init() {
 	register(Command{Path: []string{"web", "login"},
-		Summary:  "mint a one-time browser login URL",
+		Summary:         "mint a one-time browser login URL",
-		Usage:    "web login",
+		Usage:           "web login",
-		Examples: []string{"web login"}, Run: runWebLogin})
+		MintsCredential: true,
+		Examples:        []string{"web login"}, Run: runWebLogin})
 	register(Command{Path: []string{"web", "sessions", "list"},
 		Summary:  "list your browser sessions",
 		Usage:    "web sessions list",

internal/httpd/api.go +10 −8

 // semantics. Exit codes map onto HTTP statuses; the body is the command's
 // JSON envelope with exit_code added.
 func (s *Server) apiCmd(w http.ResponseWriter, r *http.Request) {
-	user, scope, ok := s.apiAuth(w, r)
+	user, tok, ok := s.apiAuth(w, r)
 	if !ok {
 		return
 	}
 		Stderr:   &stderr,
 		JSON:     true,
 		ViaAPI:   true,
-		ReadOnly: scope == "read",
+		ReadOnly: tok.Scope == "read",
+		TokenID:  tok.ID,
+		Expires:  tok.ExpiresAt,
 		Done:     s.until(r),
 		Stopping: s.stopping,
 	}
 }
 // apiAuth resolves the bearer token; failures are uniform 401s.
-func (s *Server) apiAuth(w http.ResponseWriter, r *http.Request) (store.User, string, bool) {
+func (s *Server) apiAuth(w http.ResponseWriter, r *http.Request) (store.User, store.APIToken, bool) {
 	token, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
 	if !ok || token == "" {
 		w.Header().Set("WWW-Authenticate", `Bearer realm="gitbay api"`)
 		apiError(w, http.StatusUnauthorized, "missing bearer token; mint one over SSH: token create --name <n>")
-		return store.User{}, "", false
+		return store.User{}, store.APIToken{}, false
 	}
-	user, scope, err := s.st.APITokenUser(store.HashToken(strings.TrimSpace(token)))
+	user, tok, err := s.st.APITokenUser(store.HashToken(strings.TrimSpace(token)))
 	if err != nil {
 		if errors.Is(err, store.ErrNotFound) {
 			apiError(w, http.StatusUnauthorized, "invalid or expired token")
-			return store.User{}, "", false
+			return store.User{}, store.APIToken{}, false
 		}
 		apiError(w, http.StatusInternalServerError, "internal error")
-		return store.User{}, "", false
+		return store.User{}, store.APIToken{}, false
 	}
-	return user, scope, true
+	return user, tok, true
 }
 func apiError(w http.ResponseWriter, status int, msg string) {

Commit 89dd0a3eba

Commit `89dd0a3eba`