1665 Commits

Author	SHA1	Message	Date
jmiller	fcf33d35df	chore(api): remove /manifest backward-compat alias route (use /metadata) ... The /manifest GET+PUT routes were backward-compat aliases for the canonical /metadata routes. Completing the manifest->metadata migration (#752): drop the alias so /metadata is the single path. Handlers (GetRepoMetadata/UpdateRepoMetadata) are unchanged. The MCP already calls /metadata (mcp-mokogitea-api v1.4.2, gitea_metadata_get/update); the stale gitea_manifest_* tools only exist in older deployed MCP builds and drop out on redeploy. Refs #752 Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 21:07:05 -05:00
jmiller	cac06c2ac7	feat: org branch protection per-user allowlists + Actions-bot toggle (#727) ... Extend org-level branch protection to support per-user allowlists (resolved from username OR email) and an "allow Actions bot" toggle, alongside the existing team allowlists, for all five categories (push, merge, force-push, delete, approvals). - models/git/org_protected_branch.go: add WhitelistUserIDs, MergeWhitelistUserIDs, ForcePushAllowlistUserIDs, DeleteAllowlistUserIDs, ApprovalsWhitelistUserIDs ([]int64) plus WhitelistActionsUser, MergeWhitelistActionsUser, ForcePushAllowlistActionsUser, DeleteAllowlistActionsUser (bool); copy all 9 into ProtectedBranch in ToProtectedBranch(). - models/migrations/v1_27/v368.go: migration 367 adds the 9 columns. - modules/structs/org_branch.go: add *Usernames []string and *ActionsUser bool to Create/Edit options and the response, matching repo-level json names. - routers/api/v1/org/branch_protection.go: resolveUserIDs (username then email, dedupe, 422 on unknown); wire into Create + Edit and toAPIOrgBranchProtection. - models/git/protected_branch_merge.go: add mergeAllowFlag and merge the four Actions-user flags most-restrictively (org can now express them); deploy-key flags stay repo-only pass-through. - models/git/protected_branch_merge_test.go: mergeAllowFlag truth table, user-ID intersection, deploy-key pass-through. - regenerate swagger v1 + openapi3 specs. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 17:48:47 -05:00
jmiller	93365cdd95	docs(api): swagger annotations + response models for org-governance endpoints (#727, #738) ... Annotate the four previously undocumented org-governance API handlers (tag_protection, push_policy, repo_defaults, email_domain) with swagger:operation blocks, and register the swagger:response models the branch_protection operations already referenced. Register the org option DTOs in the parameterBodies hack so their definitions are emitted. Also fix pre-existing spec-generation blockers surfaced once the spec became regenerable: a stray comment glued to the repoUpdateManifest swagger block (broke YAML parsing), missing owner/repo path params on the manifest operations, a Manifest response registration, and missing definitions for EditAccessTokenOption, the IssueBulk* options, and the Issue{Priority,Status,Type}Def types. Regenerated v1_json.tmpl and v1_openapi3_json.tmpl; spec now validates cleanly against Swagger 2.0. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 01:58:08 -05:00
jmiller	125eefc650	fix: repair build (renamed org-visibility helper) + gofmt ... Two pre-existing issues surfaced when the org-governance series was compiled locally with a real Go toolchain (go1.26.3) for the first time: - routers/api/v1/api.go:519 called organization.HasOrgOrUserVisible, which no longer exists — it was renamed to IsOwnerVisibleToDoer (models/organization/ org.go:548, identical signature). This one missed call site meant the whole routers/api/v1 package (and therefore the server binary) failed `go build`. With the rename, `go build ./...` is clean. - gofmt: api.go (a mis-indented commented-out /projects route block) and release.go (import sort: repo before updateserver) were gofmt-dirty. Fixed with gofmt -w on the two files this change already touches. Not part of #727, but blocks building/releasing the fork; found while validating the dev -> main promotion (#733). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:06:48 -05:00
jmiller	6a3db171c1	feat(org): org-level email domain policy for members (#727) ... Restricts which email domains an organization's members may have. When a policy is configured, a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership choke point services/org.AddTeamMember, which every add path (API, web, group-sync) funnels through — so one check covers them all. On violation it returns a typed ErrEmailDomainNotAllowed; the API team-add handler maps it to 422. - models/git/org_email_domain.go: OrgEmailDomainPolicy model + EmailAllowed (domain glob match) + OrgEmailDomainAllowed + typed error + CRUD. Migration 366. - API: GET/PATCH/DELETE /orgs/{org}/email_domain_policy. - Enforcement in services/org/team.go; 422 mapping in routers/api/v1/org/team.go. An empty policy imposes no restriction. This is the one bounded piece of the "access/security" tier; org 2FA-required and IP allowlists were deliberately NOT built here — they are cross-cutting enforcement (auth gating / request middleware) that needs a compiler + tests, not a blind stacked PR. Stacked on #731/#730/#729/#728 for migration ordering (this = 366). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), imports (git_model added to the api team handler, gci order), typed-error detection, migration contiguous (366). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:23:11 -05:00
jmiller	d3134b1c53	feat(org): org-level repository defaults applied on repo create/transfer (#727) ... Adds a single per-org repository-defaults config, applied to a repo when it is created in or transferred into the org via a notifier (services/org): - ForcePrivate — force new/transferred repos private (Repository.IsPrivate). - PR defaults (when ApplyPRDefaults) — allowed merge styles, default merge style, and auto-delete-branch-after-merge, written to the repo's pull-requests unit config via repo_service.UpdateRepositoryUnits. Best-effort: the notifier logs and swallows errors, so a defaults bug can never break repository creation or transfer. - models/git/org_repo_defaults.go: OrgRepoDefaults model + CRUD + migration 365. - API: GET/PATCH/DELETE /orgs/{org}/repo_defaults. - services/org/notifier.go: CreateRepository/TransferRepository -> apply defaults; registered from routers/init.go (org_service.Init()). Stacked on #730/#729/#728 for migration ordering (this = 365). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct/DTO alignment), imports used, no Init() collision in services/org, migration contiguous (365), notifier signatures match the Notifier interface. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:22:38 -05:00
jmiller	3aac1b456c	feat(org): org-level push policy enforced in the pre-receive hook (#727) ... Adds a single per-org push policy that cascades to every repo of the org and is enforced in the pre-receive hook: - Branch/tag name conventions (glob) — a pushed ref name must match. Fail-closed. - Mandatory secret-scanning block-on-push — org can force secret blocking that a repo cannot disable (overrides the per-repo scanner config in the orchestrator). - Max pushed-file size — rejects a tip tree containing a blob over the limit. - Blocked file-path patterns — rejects pushes changing matching paths (reuses pull_service.CheckFileProtection). The two content checks (blocked paths, max size) FAIL OPEN on any error so a policy/parsing bug can never wedge all pushes; naming is fail-closed. - models/git/org_push_policy.go: OrgPushPolicy model + CRUD + matchers + GetOrgPushPolicyForRepo. Migration 364. - API: GET/PATCH/DELETE /orgs/{org}/push_policy (routers/api/v1/org/push_policy.go, DTOs in modules/structs/org_push_policy.go, wired in api.go). - Enforcement: routers/private/hook_pre_receive.go (branch: naming + blocked paths + max size; tag: naming) and services/security/orchestrator.go (secret mandate). Deferred: a repo-facing read-only view of the org push policy (it is an org-wide config, not per-repo overlay rules; readable via the API for now). Stacked on #729/#728 for migration ordering (this = 364). Swagger annotations omitted (can't regenerate without the toolchain). Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), escape sequences in the ls-tree parser, imports used, migration contiguous (364), fail-open on content checks. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:20:39 -05:00
jmiller	b31336d1fe	feat(org): org-level tag protection, layered with per-repo protected tags (#727) ... Adds org-level tag protection as a parallel to org-level branch protection. An org tag rule is {NamePattern, AllowlistTeamIDs}; it cascades to every repo in the org and layers on top of the repo's own protected tags — a tag is controllable (push/delete) only if allowed at BOTH levels (fail-closed). - models/git/org_protected_tag.go: OrgProtectedTag model + CRUD + ToProtectedTag() (reuses the ProtectedTag matcher/allowlist logic) + IsUserAllowedToControlTagInRepo() which ANDs the repo decision with the org decision. Migration 363. - API: /orgs/{org}/tag_protections CRUD (routers/api/v1/org/tag_protection.go, DTOs in modules/structs/org_tag.go, wired in api.go). - Enforcement: the git push/delete hook (hook_pre_receive.go) and the two release paths (release.go create/delete) now call the layered check, so no per-site tag logic changes beyond swapping the helper. - View: the repo Tag settings page lists inherited org tag rules read-only. Stacked on #728 (branch-protection PR) for migration ordering — merge #728 first. Swagger annotations omitted (can't regenerate the swagger JSON without the toolchain); routes still register. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct alignment), template nesting balances, all .Rule fields exist on OrgProtectedTag, all locale keys defined, JSON valid, migration contiguous (363). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:37:18 -05:00
jmiller	4b68853f08	feat(org): add branch-deletion protection + expandable inherited-rule view (#727) ... Two related additions: 1. Branch deletion as an org-level ability. OrgProtectedBranch gained CanDelete / EnableDeleteAllowlist / DeleteAllowlistTeamIDs (migration 362), ToProtectedBranch maps them, and the API (create/edit/response DTOs + handlers) exposes enable_delete / enable_delete_allowlist / delete_allowlist_teams. The layering merge already combined delete fields, so org delete-protection now enforces once ToProtectedBranch populates them. 2. The repo Branch Protection view now renders each inherited org rule as an expandable detail (direct push, force-push, branch deletion, merge, required approvals, status checks, protected files) with team names resolved, instead of three headline badges. Still read-only. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Verified by hand: struct-field gofmt alignment, template block nesting balances, every .Rule field exists on OrgProtectedBranch, and all locale keys referenced in the template are defined. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:16:24 -05:00
jmiller	7c75133ef1	feat: code security scanner with OWASP pattern detection (#552) ... Implements the code analysis scanner module that detects insecure patterns across Go, PHP, Python, JavaScript, and TypeScript: - SQL injection (CWE-89): string concat in queries across 4 languages - XSS (CWE-79): innerHTML, document.write, unescaped output, dangerouslySetInnerHTML - Command injection (CWE-78): exec with variables, shell=True, os.system - Path traversal (CWE-22): unsanitized path joins, file open with user input - Insecure deserialization (CWE-502): unserialize(), yaml.load() - Hardcoded credentials (CWE-798): password assignments in source - Weak cryptography (CWE-327): MD5/SHA-1 usage 22 rules total, language-filtered by file extension. Wired into the existing scanner orchestrator via the CodeScanner config toggle. API updated to expose code_scanner in GET/PATCH security config. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 08:15:34 -05:00
jmiller	23bb025700	merge: incorporate main into dev for release PR #714 ... Resolve CHANGELOG conflict — deduplicate feature entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 04:35:52 -05:00
jmiller	98301bc92b	merge: incorporate latest dev (post status-presets merge) into cascade-merge ... Resolve CHANGELOG conflict, restore issue_metadata.go from dev. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:51:37 -05:00
jmiller	5a25068d81	merge: incorporate dev changes into feature/cascade-merge ... Resolve CHANGELOG.md and api.go conflicts — keep both cascade_rules and security route groups. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:48:52 -05:00
jmiller	57894e25fd	merge: incorporate dev changes into feature/status-presets ... Resolve CHANGELOG.md conflict — keep both status presets and default teams entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:47:37 -05:00
jmiller	cf25eef480	fix: distinguish unknown preset from DB errors in ApplyIssueStatusPreset ... db.ErrNotExist returns 404, other errors return 500 instead of masking all errors as 404. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:34:07 -05:00
jmiller	84df5d7932	feat: register security scanning API routes in router ... Adds /repos/{owner}/{repo}/security/* route group for security alert management, scanning, and configuration endpoints. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:33:29 -05:00
jmiller	7b334f94c0	feat: security scanning API endpoints + pre-receive hook blocking (#692) ... Add REST API for security alerts (list, get, update status, trigger scan) and scanner config (get, update). Wire block_on_push into the pre-receive hook so pushes containing detected secrets are rejected with details. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:30:04 -05:00
jmiller	805c566615	fix: remove leaked security scanning routes from cascade-merge branch ... The security route group belongs to feature/secret-scanning (#692) and was accidentally committed here during parallel agent work. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:29:27 -05:00
jmiller	f53bc895ba	fix: prevent IDOR in CopyStatusesFromOrg endpoint ... Add source org visibility + membership check before copying statuses. Non-public source orgs now require the doer to be a member or site admin, preventing unauthorized enumeration of private org statuses. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:26:23 -05:00
bircni	cbf34fb987	fix: Various security fixes (#38103) (#38151) ... Backport #38103 - Enforce org visibility on organization label read endpoints (private org labels no longer leak to non-members). - Block fork sync (`merge-upstream`) when the base repo is no longer readable (stops pulling commits after a parent goes private). - Remove `REVERSE_PROXY_LIMIT` / `REVERSE_PROXY_TRUSTED_PROXIES` from the Docker `app.ini` templates (the `= *` default allowed `X-WEBAUTH-USER` impersonation; reverse-proxy auth is now opt-in and admin-configured). - Enforce single-use TOTP passcodes across web login, password-reset, and Basic-Auth `X-Gitea-OTP` (fixes a TOCTOU race and a stateless replay). - Re-check branch write permission for every ref in a push (the pre-receive hook cached the first ref's result, letting a per-branch maintainer-edit grant escalate to full repo write). --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-28 02:22:18 -05:00
jmiller	f627219ca8	feat: cascade merge — auto-create PRs to downstream branches after merge (#460) ... Adds configurable cascade rules per repo. When a PR merges into a source branch, the system auto-creates PRs to each configured target branch. Skips if a matching PR already exists. - Model: CascadeMergeRule (repo_id, source, target, enabled, auto_merge) - Migration v362 creates cascade_merge_rule table - Notifier hooks into MergePullRequest/AutoMergePullRequest events - API: CRUD at /repos/{owner}/{repo}/cascade_rules (admin only) Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:06:42 -05:00
jmiller	df9305758f	feat: add issue status presets and cross-org migration (#507) ... 4 built-in presets: default, software-development, support-tickets, bug-tracking. API endpoints to list presets, apply to org, and copy statuses between orgs. Web UI dropdown on org settings page. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:05:14 -05:00
jmiller	4178e7f23e	feat: add delete allowlist for branch protection rules (#696) ... Add configurable per-user/team/deploy-key allowlist for deleting protected branches. Previously, protected branches could never be deleted via git push. Now admins can configure deletion permissions with the same granularity as force-push allowlists. - 6 new model fields: CanDelete, EnableDeleteAllowlist, DeleteAllowlistUserIDs/TeamIDs, DeleteAllowlistDeployKeys, DeleteAllowlistActionsUser - CanUserDelete() method with admin-level default (higher than push) - Migration v361 adds columns to protected_branch table - Pre-receive hook checks delete allowlist instead of unconditional block - CanDeleteBranch service uses CanUserDelete instead of IsBranchProtected - API create/edit endpoints support delete allowlist fields - Web UI settings page with radio buttons and user/team dropdowns - 12 new locale strings for the delete allowlist UI Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-27 15:35:13 -05:00
Giteabot	9db67cd554	fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895) ... Backport #37660 by @jorgeortiz85 ## Summary Fixes #37528 This PR makes the workflow dispatch API reject workflows that do not declare `workflow_dispatch`. Previously, `POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches` could create an `ActionRun` for a workflow that only declared another event such as `push`. The service now validates that the target workflow has a `workflow_dispatch` trigger before inserting the run. The API maps that validation failure to `422 Unprocessable Entity`, matching existing validation failures in this handler. The regression test creates a push-only workflow, dispatches it through the public API, asserts the `workflow_dispatch` validation message, and verifies that no run was inserted. ## Testing - `go test ./services/actions` - `TAGS="sqlite sqlite_unlock_notify" make test-integration#TestWorkflowDispatchPublicApiRequiresWorkflowDispatchTrigger` - `TAGS="sqlite sqlite_unlock_notify" make test-integration#TestWorkflowDispatchPublicApi` ## Disclosure Developed with assistance from OpenAI Codex. Co-authored-by: Jorge Ortiz <jorge.ortiz@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-06-26 21:40:12 -05:00
jmiller	f7c2b205c5	fix: reject empty token update requests with 400	2026-06-25 09:58:00 -05:00
jmiller	d2d7c0a762	feat: add ability to edit API token scopes (#697) ... Add PATCH /users/{username}/tokens/{id} API endpoint and web UI edit button so token scopes can be modified after creation without having to delete and recreate the token.	2026-06-25 09:57:59 -05:00
jmiller	49f6380fa4	feat: add licensing API token scope (#697) ... Add read:licensing / write:licensing token scope category so licensing endpoints are guarded by the same permission system as all other API endpoints. Public-only tokens are rejected for licensing endpoints.	2026-06-25 09:22:15 -05:00
Jonathan Miller	5c43cf1f02	fix(metadata): support partial updates — only sent fields are changed ... Previously PUT /metadata replaced all fields, wiping any not included in the request. Now loads existing metadata first and merges only the fields present in the JSON body.	2026-06-23 17:28:40 -05:00
Jonathan Miller	c8c74c7afe	fix: handle DB errors in licensing API, fix wiki API URL-decode fallback ... - licensing/manage.go: capture Update/Delete errors instead of silently discarding them (UpdateLicense, UpdateTier, DeleteTier) - wiki.go API: fix findEntryForFile to allow URL-decode fallback for non-ASCII page names (was returning on ErrNotExist instead of falling through)	2026-06-23 17:25:47 -05:00
Jonathan Miller	7b68963b67	feat(metadata): add deploy fields to repo metadata API (#692) ... - Migration v360: adds deploy_host, deploy_port, deploy_user, deploy_path, docker_image, docker_registry, container_name, health_url to repo_manifest - API: GET/PUT /metadata now includes deploy fields - Settings: preserve deploy fields on web UI save - Remove 4 unneeded workflows (gitleaks, npm-publish, notify, workflow-sync) - gitleaks will become built-in (#692) - npm-publish/notify not applicable to Go repo - workflow-sync moving to MokoCLI	2026-06-23 14:32:31 -05:00
Jonathan Miller	1178975be3	feat(wiki): full-text search across wiki pages (#550) ... - Web: WikiSearch handler with case-insensitive search of titles and content - Web: search.tmpl with search form and results display - Web: "Search wiki" link added to wiki dropdown menu - API: GET /wiki/search?q=term endpoint with pagination - Recursive traversal handles nested folder wikis	2026-06-23 12:05:48 -05:00
Jonathan Miller	78b0ce9650	fix: org metadata API respects visibility for unauthenticated requests (#690) ... Add checkOrgVisibility() guard to issue-statuses, issue-priorities, and issue-types endpoints. Public orgs remain accessible to everyone. Private/limited orgs return 404 for unauthenticated callers.	2026-06-21 18:17:00 -05:00
Jonathan Miller	71d52e432e	feat: enforce required baseline issue statuses (#681) ... Add IsRequired field to IssueStatusDef. Open and Closed statuses are seeded as required and cannot be deleted. Delete attempts return an error flash in the web UI and ErrStatusRequired in the model layer. API response now includes is_required field.	2026-06-21 11:29:49 -05:00
Jonathan Miller	9149fa100c	feat: make metadata/manifest GET endpoint publicly accessible (#676) ... Remove reqRepoReader auth requirement from GET /repos/{owner}/{repo}/metadata and /manifest endpoints. PUT (update) still requires token + admin.	2026-06-21 10:20:56 -05:00
Jonathan Miller	6d194f9bdf	fix: sort imports in manage.go (stdlib before module imports)	2026-06-20 23:03:44 -05:00
Jonathan Miller	403db405cb	fix: resolve all compile errors in licensing endpoints ... - ctx.BindJSON → json.NewDecoder(ctx.Req.Body).Decode - ctx.Orm() → db.GetEngine(ctx) - ctx.NotFound() → ctx.APIErrorNotFound() - GetAttachmentsByReleaseID → db.GetEngine query	2026-06-20 22:57:19 -05:00
Jonathan Miller	79cc30e9a8	fix: use ctx.APIError instead of ctx.Error in licensing endpoints ... APIContext doesn't have an Error method — use APIError(status, msg) which is the correct 2-arg pattern for Gitea API error responses.	2026-06-20 21:47:02 -05:00
Jonathan Miller	1d1b867df5	feat: add license management API — admin CRUD, user self-service, tier management (#624) ... Admin: POST/GET/PATCH/DELETE /api/v1/licensing/licenses (reqSiteAdmin) User: GET /api/v1/licensing/my/licenses, manage domains (reqToken) Tiers: GET/POST/PATCH/DELETE /api/v1/licensing/tiers (reqSiteAdmin) Includes pagination, entitlement/activation detail in GET, tier change triggers entitlement rebuild, delete-tier blocked if active licenses exist.	2026-06-20 20:04:15 -05:00
Jonathan Miller	5bd449017c	feat: add signed download endpoint with ed25519 tokens (#622) ... GET /api/v1/licensing/download/{product}/{version}.zip?token=XXX&expires=YYY&dlid=ZZZ ed25519 keypair auto-generated on first use, stored in Gitea data dir. Update XML endpoint now generates signed URLs with 5-minute TTL. Download verifies signature + expiry + DLID + entitlement before serving the release ZIP attachment. Downloads logged to audit trail.	2026-06-20 19:59:37 -05:00
Jonathan Miller	3e909df6d4	feat: add license validation API — public validate + authenticated status (#623) ... GET /api/v1/licensing/validate?dlid=XXX&product=YYY&domain=ZZZ (public) GET /api/v1/licensing/{dlid}/status (authenticated, reqToken) Public endpoint returns valid/invalid with reason codes for Joomla plugin and external integration use. Authenticated endpoint returns full license detail with entitlement list and domain usage for admin dashboards.	2026-06-20 19:51:50 -05:00
Jonathan Miller	6f6a8b0f2c	fix: remove invalid SortType field from FindReleasesOptions	2026-06-20 17:18:52 -05:00
Jonathan Miller	212b8c9e6d	feat: add DLID-gated update XML endpoint for Joomla updater (#621) ... GET /api/v1/licensing/updates/{product}.xml?dlid=XXX&domain=YYY Validates DLID format (CRC32), checks license status and entitlement, auto-activates domain, returns Joomla-compatible update XML from the entitled repo's stable release. Invalid/expired returns empty <updates/>.	2026-06-20 17:15:24 -05:00
Jonathan Miller	2b6684536e	feat: remove display_name, compute from extension_type + name (#650) ... - Remove DisplayName field from RepoMetadata and UpdateStreamConfig - Add DerivedDisplayName() method: "{Type} - {Name}" (e.g. "Package - MokoSuiteBackup") - API returns computed display_name in GET, ignores it on PUT - Update server feeds use DerivedDisplayName() instead of stored value - Remove display_name from web forms (repo licensing, org update streams) - License settings API computes display_name from repo metadata - Migration v358: drop display_name columns from both tables	2026-06-20 10:45:54 -05:00
Jonathan Miller	7ebe6d54be	refactor: rename PackageType → ExtensionType (#646) ... Rename package_type column and Go field to extension_type across model, API, update server, manifest sync, settings UI, and changelog. SQL migration renames the column. XML tag <package-type> in .mokogitea/manifest.xml is unchanged (backward compat). Fixes #646	2026-06-19 02:00:04 -05:00
Jonathan Miller	45caf41499	fix: rename custom fields handlers, clean metadata API naming	2026-06-19 01:14:11 -05:00
Jonathan Miller	1ec0a70c0c	fix: rename API handlers to avoid collision with custom_fields GetRepoMetadata	2026-06-18 21:08:29 -05:00
Jonathan Miller	3c9e3ffa13	fix: lowercase Joomla element names, rename Manifest → Metadata (#635) ... AutoElementName() was using m.Name without lowercasing or cleaning, producing elements like pkg_MokoSuiteBackup instead of pkg_mokosuitebackup. Added cleanJoomlaElement() to replicate Joomla's InputFilter::clean('cmd') behavior. Removed incorrect "plugin": "plg_" — Joomla plugins use bare names. Renamed RepoManifest → RepoMetadata across all non-migration Go files. DB table remains repo_manifest for backward compatibility. Migration files unchanged to preserve migration chain. API endpoints /manifest and /metadata both continue to work (backward compat route preserved in api.go). Fixes #635	2026-06-18 16:03:54 -05:00
Jonathan Miller	91e50fe4bf	fix: remove version from manifest first-class fields ... Version is not a required metadata field — it's derived from git tags and releases, not stored in the manifest. Remove from RepoManifest model and the manifest API request/response struct. VersionPrefix, StandardsVersion, and TargetVersion are kept as they serve different purposes (tag parsing, standards compliance, platform targeting).	2026-06-18 11:01:23 -05:00
jmiller	9d45a767e7	Merge pull request 'feat(issues): make status_id, priority_id, type_id required on create (#598)' (#613) from feature/598-required-issue-metadata into main	2026-06-12 02:59:37 +00:00
Jonathan Miller	e0d4f5fd15	fix: handle SetIssueStatusID/PriorityID/TypeID errors on create ... Explicit caller-provided values now return 500 on failure instead of silently discarding the error. Default auto-assignment still uses best-effort (log and continue) since it's a fallback.	2026-06-11 21:57:39 -05:00