Add new CLI flags to set name and scopes when creating a user with access token

cmd/admin_user_create.go

@@ -66,11 +66,22 @@ var microcmdUserCreate = &cli.Command{
 			Name:  "access-token",
 			Usage: "Generate access token for the user",
 		},
+		&cli.StringFlag{
+			Name:  "with-scopes",
+			Usage: "Comma separated list of scopes to apply to access token (--access-token is required)",
+			Value: "",
+		},
 		&cli.BoolFlag{
 			Name:  "restricted",
 			Usage: "Make a restricted user account",
 		},
 	},
+	Before: func(c *cli.Context) error {
+		if c.String("with-scopes") != "" && !c.Bool("access-token") {
+			return errors.New("--access-token is required when using --with-scopes")
+		}
+		return nil
+	},
 }
 
 func runCreateUser(c *cli.Context) error {
@@ -197,6 +208,13 @@ func runCreateUser(c *cli.Context) error {
 			UID:  u.ID,
 		}
 
+		// include access token scopes
+		accessTokenScope, err := auth_model.AccessTokenScope(c.String("with-scopes")).Normalize()
+		if err != nil {
+			return fmt.Errorf("invalid access token scope provided: %w", err)
+		}
+		t.Scope = accessTokenScope
+
 		if err := auth_model.NewAccessToken(ctx, t); err != nil {
 			return err
 		}

cmd/admin_user_create_test.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	auth_model "code.gitea.io/gitea/models/auth"
 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
@@ -48,11 +49,11 @@ func TestAdminUserCreate(t *testing.T) {
 		assert.Equal(t, check{IsAdmin: false, MustChangePassword: false}, createCheck("u5", "--must-change-password=false"))
 	})
 
-	t.Run("UserType", func(t *testing.T) {
-		createUser := func(name, args string) error {
-			return app.Run(strings.Fields(fmt.Sprintf("./gitea admin user create --username %s --email %[email protected] %s", name, name, args)))
-		}
+	createUser := func(name, args string) error {
+		return app.Run(strings.Fields(fmt.Sprintf("./gitea admin user create --username %s --email %[email protected] %s", name, name, args)))
+	}
 
+	t.Run("UserType", func(t *testing.T) {
 		reset()
 		assert.ErrorContains(t, createUser("u", "--user-type invalid"), "invalid user type")
 		assert.ErrorContains(t, createUser("u", "--user-type bot --password 123"), "can only be set for individual users")
@@ -63,4 +64,25 @@ func TestAdminUserCreate(t *testing.T) {
 		assert.Equal(t, user_model.UserTypeBot, u.Type)
 		assert.Equal(t, "", u.Passwd)
 	})
+
+	t.Run("AccessToken", func(t *testing.T) {
+		resetIncluingTokens := func() {
+			reset()
+			require.NoError(t, db.TruncateBeans(db.DefaultContext, &auth_model.AccessToken{}))
+		}
+
+		reset()
+		assert.NoError(t, createUser("u", "--random-password --access-token"))
+		a := unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{Name: "gitea-admin"})
+		assert.Empty(t, string(a.Scope))
+
+		resetIncluingTokens()
+		assert.ErrorContains(t, createUser("u", "--random-password --with-scopes all"), "--access-token is required when using --with-scopes")
+
+		assert.NoError(t, createUser("u", "--random-password --access-token --with-scopes read:issue,read:user"))
+		a = unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{Name: "gitea-admin"})
+		hasScopes, err := a.Scope.HasScope(auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopeReadUser)
+		assert.NoError(t, err)
+		assert.True(t, hasScopes)
+	})
 }