Skip to content

Allow OAuth2 and basic auth for actions badge SVG endpoint#36830

Closed
silverwind wants to merge 5 commits intogo-gitea:mainfrom
silverwind:badgetoken
Closed

Allow OAuth2 and basic auth for actions badge SVG endpoint#36830
silverwind wants to merge 5 commits intogo-gitea:mainfrom
silverwind:badgetoken

Conversation

@silverwind
Copy link
Copy Markdown
Member

@silverwind silverwind commented Mar 4, 2026

Add OAuth2 and basic auth support to actions workflow badges. Previously, the only way to retrieve badges from private repos was cookies, which was inconvenient.

Enable OAuth2 and basic auth token processing for the actions workflow
badge path so that badges can be retrieved for private repositories.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Mar 4, 2026
@github-actions github-actions bot added the modifies/go Pull requests that update Go code label Mar 4, 2026
@silverwind silverwind added the type/enhancement An improvement of existing functionality label Mar 4, 2026
@silverwind silverwind changed the title Allow token auth for actions badge SVG endpoint Allow OAuth2 and basic auth for actions badge SVG endpoint Mar 4, 2026
@silverwind
Copy link
Copy Markdown
Member Author

Renamed and also restricted to GET which is consistent with isFeedRequest. The badge only has a GET route, but I guess it's good to have this additional enforcement.

@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Mar 5, 2026
@wxiaoguang
Copy link
Copy Markdown
Contributor

I believe a proper fix should be like this: Refactor auth middleware #36848

Then this PR's purpose can be simply and clearly done like this:

image

@silverwind
Copy link
Copy Markdown
Member Author

If the fix is just a one-liner, you can include it in that PR.

@wxiaoguang
Copy link
Copy Markdown
Contributor

If the fix is just a one-liner, you can include it in that PR.

Already included. Need to debug some "chi router" related problems. Just a moment.

@wxiaoguang
Copy link
Copy Markdown
Contributor

If the fix is just a one-liner, you can include it in that PR.

Already included. Need to debug some "chi router" related problems. Just a moment.

CI passes

wxiaoguang added a commit that referenced this pull request Mar 8, 2026
Principles: let the caller decide what it needs, but not let the
framework (middleware) guess what it should do.

Then a lot of hacky code can be removed. And some FIXMEs can be fixed.

This PR introduces a new kind of middleware: "PreMiddleware", it will be
executed before all other middlewares on the same routing level, then a
route can declare its options for other middlewares.

By the way, allow the workflow badge to be accessed by Basic or OAuth2
auth.

Fixes: #36830
Fixes: #36859
silverwind pushed a commit to silverwind/gitea that referenced this pull request Mar 8, 2026
Principles: let the caller decide what it needs, but not let the
framework (middleware) guess what it should do.

Then a lot of hacky code can be removed. And some FIXMEs can be fixed.

This PR introduces a new kind of middleware: "PreMiddleware", it will be
executed before all other middlewares on the same routing level, then a
route can declare its options for other middlewares.

By the way, allow the workflow badge to be accessed by Basic or OAuth2
auth.

Fixes: go-gitea#36830
Fixes: go-gitea#36859
@silverwind silverwind deleted the badgetoken branch March 10, 2026 17:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

lgtm/need 1 This PR needs approval from one additional maintainer to be merged. modifies/go Pull requests that update Go code type/enhancement An improvement of existing functionality

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants