4711 Commits

Author	SHA1	Message	Date
jmiller	e98fca780e	fix: address org-governance release review (#727, #733) + dev deploy targeting ... Code-review findings on the org-governance release: - Fail closed on org-rule lookup error: getFirstMatchProtectedBranchRule swallowed FindOrgBranchRuleForBranch errors (returned nil,nil), silently dropping the org floor and falling back to the repo rule on a transient DB error. Propagate the error so the org rule stays enforced. - Stop the org rule locking out deploy-key and Actions-bot pushes: OrgProtectedBranch is team-only, so mergeMostRestrictive was ANDing the repo's WhitelistDeployKeys / WhitelistActionsUser (and the force-push, delete and merge counterparts) against the org side's always-false zero value, blocking every deploy-key and Actions push in any org with a matching branch rule. Carry those org-unmanaged fields through from the repo rule unchanged. - Org push-policy max-file-size now inspects only the pushed delta (diff-tree + cat-file --batch-check) instead of the full tip tree via ls-tree, so a pre-existing oversized file can no longer permanently block unrelated pushes. New branches (no base commit) still scan the full tree. Dev deploy targeting: - deploy-dev.yml drove the dev container image via `sed` on the SHARED compose file, but the pattern matched the *prod* service line (container_name: mokogitea) — leaving the dev service pinned to a stale image (so every "green" deploy recreated old code) while corrupting the prod image pin. Drive the dev service image from ${MOKOGITEA_DEV_TAG} instead; the env-var only affects the dev service. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 14:46:01 -05:00
jmiller	6a3db171c1	feat(org): org-level email domain policy for members (#727) ... Restricts which email domains an organization's members may have. When a policy is configured, a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership choke point services/org.AddTeamMember, which every add path (API, web, group-sync) funnels through — so one check covers them all. On violation it returns a typed ErrEmailDomainNotAllowed; the API team-add handler maps it to 422. - models/git/org_email_domain.go: OrgEmailDomainPolicy model + EmailAllowed (domain glob match) + OrgEmailDomainAllowed + typed error + CRUD. Migration 366. - API: GET/PATCH/DELETE /orgs/{org}/email_domain_policy. - Enforcement in services/org/team.go; 422 mapping in routers/api/v1/org/team.go. An empty policy imposes no restriction. This is the one bounded piece of the "access/security" tier; org 2FA-required and IP allowlists were deliberately NOT built here — they are cross-cutting enforcement (auth gating / request middleware) that needs a compiler + tests, not a blind stacked PR. Stacked on #731/#730/#729/#728 for migration ordering (this = 366). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), imports (git_model added to the api team handler, gci order), typed-error detection, migration contiguous (366). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:23:11 -05:00
jmiller	d3134b1c53	feat(org): org-level repository defaults applied on repo create/transfer (#727) ... Adds a single per-org repository-defaults config, applied to a repo when it is created in or transferred into the org via a notifier (services/org): - ForcePrivate — force new/transferred repos private (Repository.IsPrivate). - PR defaults (when ApplyPRDefaults) — allowed merge styles, default merge style, and auto-delete-branch-after-merge, written to the repo's pull-requests unit config via repo_service.UpdateRepositoryUnits. Best-effort: the notifier logs and swallows errors, so a defaults bug can never break repository creation or transfer. - models/git/org_repo_defaults.go: OrgRepoDefaults model + CRUD + migration 365. - API: GET/PATCH/DELETE /orgs/{org}/repo_defaults. - services/org/notifier.go: CreateRepository/TransferRepository -> apply defaults; registered from routers/init.go (org_service.Init()). Stacked on #730/#729/#728 for migration ordering (this = 365). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct/DTO alignment), imports used, no Init() collision in services/org, migration contiguous (365), notifier signatures match the Notifier interface. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:22:38 -05:00
jmiller	3aac1b456c	feat(org): org-level push policy enforced in the pre-receive hook (#727) ... Adds a single per-org push policy that cascades to every repo of the org and is enforced in the pre-receive hook: - Branch/tag name conventions (glob) — a pushed ref name must match. Fail-closed. - Mandatory secret-scanning block-on-push — org can force secret blocking that a repo cannot disable (overrides the per-repo scanner config in the orchestrator). - Max pushed-file size — rejects a tip tree containing a blob over the limit. - Blocked file-path patterns — rejects pushes changing matching paths (reuses pull_service.CheckFileProtection). The two content checks (blocked paths, max size) FAIL OPEN on any error so a policy/parsing bug can never wedge all pushes; naming is fail-closed. - models/git/org_push_policy.go: OrgPushPolicy model + CRUD + matchers + GetOrgPushPolicyForRepo. Migration 364. - API: GET/PATCH/DELETE /orgs/{org}/push_policy (routers/api/v1/org/push_policy.go, DTOs in modules/structs/org_push_policy.go, wired in api.go). - Enforcement: routers/private/hook_pre_receive.go (branch: naming + blocked paths + max size; tag: naming) and services/security/orchestrator.go (secret mandate). Deferred: a repo-facing read-only view of the org push policy (it is an org-wide config, not per-repo overlay rules; readable via the API for now). Stacked on #729/#728 for migration ordering (this = 364). Swagger annotations omitted (can't regenerate without the toolchain). Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), escape sequences in the ls-tree parser, imports used, migration contiguous (364), fail-open on content checks. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:20:39 -05:00
jmiller	b31336d1fe	feat(org): org-level tag protection, layered with per-repo protected tags (#727) ... Adds org-level tag protection as a parallel to org-level branch protection. An org tag rule is {NamePattern, AllowlistTeamIDs}; it cascades to every repo in the org and layers on top of the repo's own protected tags — a tag is controllable (push/delete) only if allowed at BOTH levels (fail-closed). - models/git/org_protected_tag.go: OrgProtectedTag model + CRUD + ToProtectedTag() (reuses the ProtectedTag matcher/allowlist logic) + IsUserAllowedToControlTagInRepo() which ANDs the repo decision with the org decision. Migration 363. - API: /orgs/{org}/tag_protections CRUD (routers/api/v1/org/tag_protection.go, DTOs in modules/structs/org_tag.go, wired in api.go). - Enforcement: the git push/delete hook (hook_pre_receive.go) and the two release paths (release.go create/delete) now call the layered check, so no per-site tag logic changes beyond swapping the helper. - View: the repo Tag settings page lists inherited org tag rules read-only. Stacked on #728 (branch-protection PR) for migration ordering — merge #728 first. Swagger annotations omitted (can't regenerate the swagger JSON without the toolchain); routes still register. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct alignment), template nesting balances, all .Rule fields exist on OrgProtectedTag, all locale keys defined, JSON valid, migration contiguous (363). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:37:18 -05:00
jmiller	4b68853f08	feat(org): add branch-deletion protection + expandable inherited-rule view (#727) ... Two related additions: 1. Branch deletion as an org-level ability. OrgProtectedBranch gained CanDelete / EnableDeleteAllowlist / DeleteAllowlistTeamIDs (migration 362), ToProtectedBranch maps them, and the API (create/edit/response DTOs + handlers) exposes enable_delete / enable_delete_allowlist / delete_allowlist_teams. The layering merge already combined delete fields, so org delete-protection now enforces once ToProtectedBranch populates them. 2. The repo Branch Protection view now renders each inherited org rule as an expandable detail (direct push, force-push, branch deletion, merge, required approvals, status checks, protected files) with team names resolved, instead of three headline badges. Still read-only. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Verified by hand: struct-field gofmt alignment, template block nesting balances, every .Rule field exists on OrgProtectedBranch, and all locale keys referenced in the template are defined. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:16:24 -05:00
jmiller	24b3516c1d	fix(org): layer org-level branch protection with repo rules, most-restrictive wins (#727) ... Org-level branch protection was already consulted at the single enforcement choke point `GetFirstMatchProtectedBranchRule`, but only as a FALLBACK: if any repo-level rule matched the branch, the org rule was ignored entirely. That let a repo define a looser rule for a pattern and effectively opt out of the org's protection. Make the choke point LAYER the two rules instead: when both an org rule and a repo rule match a branch, return their most-restrictive (fail-closed) combination, so the org rule is a mandatory floor a repo can only tighten. - models/git/protected_branch_merge.go: mergeMostRestrictive + helpers. Allow flags AND'd; gate/require/block flags OR'd; RequiredApprovals max'd; required sets (status contexts, protected files) unioned; allow sets (whitelists, unprotected files) intersected. A disabled allowlist means "everyone", so it only constrains when enabled. - models/git/protected_branch_list.go: GetFirstMatchProtectedBranchRule now fetches both the repo rule and the org rule and merges when both match; returns whichever exists when only one matches. Org lookup factored into getFirstMatchOrgProtectedBranchRule. Supersedes the materialization approach previously proposed for this issue — the org fallback already existed, so only this one function needed to change. Fail-closed by design: any merge edge errs toward MORE protection (over-restrict) rather than less, so it cannot open a hole. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here — relying on CI to validate build, formatting, and tests. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 19:42:08 -05:00
jmiller	23bb025700	merge: incorporate main into dev for release PR #714 ... Resolve CHANGELOG conflict — deduplicate feature entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 04:35:52 -05:00
jmiller	98301bc92b	merge: incorporate latest dev (post status-presets merge) into cascade-merge ... Resolve CHANGELOG conflict, restore issue_metadata.go from dev. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:51:37 -05:00
jmiller	5a25068d81	merge: incorporate dev changes into feature/cascade-merge ... Resolve CHANGELOG.md and api.go conflicts — keep both cascade_rules and security route groups. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:48:52 -05:00
jmiller	57894e25fd	merge: incorporate dev changes into feature/status-presets ... Resolve CHANGELOG.md conflict — keep both status presets and default teams entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:47:37 -05:00
jmiller	5da6a40f10	fix: resolve merge conflict marker and fix import paths in cherry-picked tests ... - Remove residual <<<<<<< HEAD marker from api_org_test.go - Convert code.gitea.io/gitea to mokoconsulting paths in 5 new test files: cmd/serv_test.go, models/auth/twofactor_test.go, modules/git/commit_info_nogogit_test.go, routers/private/hook_pre_receive_test.go, services/actions/notifier_helper_test.go - Add changelog entries for new features (#460, #507, #513) Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:31:44 -05:00
bircni	c0f89a373d	fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183) ... Backport #38009 The OAuth2 sign-in callback unconditionally set IsActive=true on the local user row whenever the IdP authenticated them, silently undoing an administrator's "Disable Account" action and granting the user a fresh session in the same response. Treat the local IsActive flag as an authoritative admin override: inactive users get a session and are routed through the existing activate / prohibit-login pages by verifyAuthWithOptions, matching the local-credentials sign-in path. Adds an integration regression test that disables a linked local user and asserts the row stays IsActive=false after a full OIDC callback. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-28 02:24:00 -05:00
bircni	cbf34fb987	fix: Various security fixes (#38103) (#38151) ... Backport #38103 - Enforce org visibility on organization label read endpoints (private org labels no longer leak to non-members). - Block fork sync (`merge-upstream`) when the base repo is no longer readable (stops pulling commits after a parent goes private). - Remove `REVERSE_PROXY_LIMIT` / `REVERSE_PROXY_TRUSTED_PROXIES` from the Docker `app.ini` templates (the `= *` default allowed `X-WEBAUTH-USER` impersonation; reverse-proxy auth is now opt-in and admin-configured). - Enforce single-use TOTP passcodes across web login, password-reset, and Basic-Auth `X-Gitea-OTP` (fixes a TOCTOU race and a stateless replay). - Re-check branch write permission for every ref in a push (the pre-receive hook cached the first ref's result, letting a per-branch maintainer-edit grant escalate to full repo write). --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-28 02:22:18 -05:00
Lunny Xiao	26ad4fd03f	fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141) ... Backport #37875 This fixes an OIDC sign-in edge case where a stale `external_login_user` record can still point to an organization or a deleted user. In that situation, Gitea may keep resolving the external login to the wrong account during sign-in. For affected instances, this matches the behavior reported in #36439 and #37812, where a user signing in with OIDC/Entra ID could appear as an organization, or hit a 404 after that organization was removed. - validate the user resolved from `external_login_user` during OAuth2/OIDC login - ignore stale links when the linked user no longer exists - ignore stale links when the linked user is not an individual user - remove the stale external login row so the sign-in flow can relink the external account to the correct user - Fixes #37812 - Related to #36439 Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.8) <noreply@anthropic.com> Co-authored-by: bircni <bircni@icloud.com>	2026-06-28 02:20:21 -05:00
Giteabot	d3c6998d3e	fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)	2026-06-28 02:17:27 -05:00
Giteabot	e9648f367e	fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041) ... Backport #38010 by @bircni `ifNeedApproval` in `services/actions/notifier_helper.go` decided whether a fork PR's workflow run had to wait for maintainer approval. The bypass clause counted any prior `approved_by > 0` run for `(repo_id, trigger_user_id)`, so the very first Approve-and-run click on a contributor's fork PR permanently trusted that user for every future fork PR in the same repository — including PRs whose only change is the workflow YAML itself. Approving a workflow *run* is not the same as merging *code*. This change aligns the gate with GitHub Actions' first-time-contributor model: trust is granted only after the user has had a pull request merged in the repo. ## Behavior change - **Before**: one approval = permanent trust for that user in that repo. - **After**: every fork PR is gated until the contributor has at least one merged PR in the repo. Existing already-approved runs and merged PRs continue to work; only the trust criterion for *future* fork PRs changes. Maintainers who rely on the implicit "approve once" trust will see the approval banner reappear until they merge a PR from that contributor. --------- Signed-off-by: bircni <bircni@icloud.com> Co-authored-by: bircni <bircni@icloud.com>	2026-06-28 02:17:26 -05:00
Giteabot	725acbe112	fix: bound CODEOWNERS regex match time (#38011) (#38025) ... Backport #38011 by @bircni User-supplied CODEOWNERS patterns were compiled without a match timeout, so a crafted pattern (e.g. (a+)+) against a crafted file path could backtrack for tens of seconds inside the PR creation transaction and exhaust the database connection pool. Set MatchTimeout on each compiled rule; the caller already treats match errors as non-matches. Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-28 02:17:26 -05:00
jmiller	e99658ddc0	feat(orgs): auto-create default teams on org creation (#513) ... New organizations now get three default teams in addition to Owners: - Developers (write: code, issues, PRs, wiki, projects; read: releases) - Reviewers (read: code, issues, PRs, releases, wiki) - CI/CD (write: actions, packages, releases; read: code) Teams are defined in DefaultOrgTeams and created inside the same transaction as the org, so creation is atomic. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:08:47 -05:00
jmiller	f627219ca8	feat: cascade merge — auto-create PRs to downstream branches after merge (#460) ... Adds configurable cascade rules per repo. When a PR merges into a source branch, the system auto-creates PRs to each configured target branch. Skips if a matching PR already exists. - Model: CascadeMergeRule (repo_id, source, target, enabled, auto_merge) - Migration v362 creates cascade_merge_rule table - Notifier hooks into MergePullRequest/AutoMergePullRequest events - API: CRUD at /repos/{owner}/{repo}/cascade_rules (admin only) Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:06:42 -05:00
jmiller	df9305758f	feat: add issue status presets and cross-org migration (#507) ... 4 built-in presets: default, software-development, support-tickets, bug-tracking. API endpoints to list presets, apply to org, and copy statuses between orgs. Web UI dropdown on org settings page. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:05:14 -05:00
jmiller	4178e7f23e	feat: add delete allowlist for branch protection rules (#696) ... Add configurable per-user/team/deploy-key allowlist for deleting protected branches. Previously, protected branches could never be deleted via git push. Now admins can configure deletion permissions with the same granularity as force-push allowlists. - 6 new model fields: CanDelete, EnableDeleteAllowlist, DeleteAllowlistUserIDs/TeamIDs, DeleteAllowlistDeployKeys, DeleteAllowlistActionsUser - CanUserDelete() method with admin-level default (higher than push) - Migration v361 adds columns to protected_branch table - Pre-receive hook checks delete allowlist instead of unconditional block - CanDeleteBranch service uses CanUserDelete instead of IsBranchProtected - API create/edit endpoints support delete allowlist fields - Web UI settings page with radio buttons and user/team dropdowns - 12 new locale strings for the delete allowlist UI Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-27 15:35:13 -05:00
jmiller	49f6380fa4	feat: add licensing API token scope (#697) ... Add read:licensing / write:licensing token scope category so licensing endpoints are guarded by the same permission system as all other API endpoints. Public-only tokens are rejected for licensing endpoints.	2026-06-25 09:22:15 -05:00
Jonathan Miller	7b68963b67	feat(metadata): add deploy fields to repo metadata API (#692) ... - Migration v360: adds deploy_host, deploy_port, deploy_user, deploy_path, docker_image, docker_registry, container_name, health_url to repo_manifest - API: GET/PUT /metadata now includes deploy fields - Settings: preserve deploy fields on web UI save - Remove 4 unneeded workflows (gitleaks, npm-publish, notify, workflow-sync) - gitleaks will become built-in (#692) - npm-publish/notify not applicable to Go repo - workflow-sync moving to MokoCLI	2026-06-23 14:32:31 -05:00
Jonathan Miller	71d52e432e	feat: enforce required baseline issue statuses (#681) ... Add IsRequired field to IssueStatusDef. Open and Closed statuses are seeded as required and cannot be deleted. Delete attempts return an error flash in the web UI and ErrStatusRequired in the model layer. API response now includes is_required field.	2026-06-21 11:29:49 -05:00
Jonathan Miller	7d5eff194d	feat: add license CRUD, audit logging, status transitions (#618) ... - RevokeLicense, SuspendLicense, ReactivateLicense convenience methods - LicenseAuditLog table for tracking status and tier changes - UpdateLicenseTier now logs old→new tier before rebuilding entitlements - SetLicenseStatus logs old→new status transitions	2026-06-20 16:29:30 -05:00
Jonathan Miller	86bbad9fa1	feat: add licensing tables — license, entitlement, activation, product_tier (#617) ... Migration v359 creates 4 tables for the consumer DLID licensing system: - license: DLID-based licenses with tier, status, expiry - license_entitlement: per-license product/repo access mapping - license_activation: domain tracking with limit enforcement - product_tier: 13 seeded tiers from base to enterprise Models in models/licensing/ with CRUD, DLID generation (CRC32 checksum), entitlement rebuild on tier change, and domain activation with upsert.	2026-06-20 15:51:04 -05:00
Jonathan Miller	adb13241ad	Merge remote-tracking branch 'origin/main' into dev ... # Conflicts: # .mokogitea/manifest.xml # .mokogitea/workflows/issue-branch.yml	2026-06-20 13:04:01 -05:00
Jonathan Miller	65fdbdafd3	feat: support .mokogitea, .profile, and .github as org/user profile repo names (#651) ... Primary profile repo name is now .mokogitea with fallback chain: .mokogitea > .profile > .github (and their -private variants). Co-Authored-By: Claude <noreply@anthropic.com>	2026-06-20 12:55:20 -05:00
Jonathan Miller	51b1063924	fix: use information_schema check instead of DROP COLUMN IF EXISTS ... MySQL 8.0.x does not support IF EXISTS on ALTER TABLE DROP COLUMN. Query information_schema.COLUMNS first to check column existence.	2026-06-20 11:39:08 -05:00
Jonathan Miller	2b6684536e	feat: remove display_name, compute from extension_type + name (#650) ... - Remove DisplayName field from RepoMetadata and UpdateStreamConfig - Add DerivedDisplayName() method: "{Type} - {Name}" (e.g. "Package - MokoSuiteBackup") - API returns computed display_name in GET, ignores it on PUT - Update server feeds use DerivedDisplayName() instead of stored value - Remove display_name from web forms (repo licensing, org update streams) - License settings API computes display_name from repo metadata - Migration v358: drop display_name columns from both tables	2026-06-20 10:45:54 -05:00
Jonathan Miller	7ebe6d54be	refactor: rename PackageType → ExtensionType (#646) ... Rename package_type column and Go field to extension_type across model, API, update server, manifest sync, settings UI, and changelog. SQL migration renames the column. XML tag <package-type> in .mokogitea/manifest.xml is unchanged (backward compat). Fixes #646	2026-06-19 02:00:04 -05:00
Jonathan Miller	3c9e3ffa13	fix: lowercase Joomla element names, rename Manifest → Metadata (#635) ... AutoElementName() was using m.Name without lowercasing or cleaning, producing elements like pkg_MokoSuiteBackup instead of pkg_mokosuitebackup. Added cleanJoomlaElement() to replicate Joomla's InputFilter::clean('cmd') behavior. Removed incorrect "plugin": "plg_" — Joomla plugins use bare names. Renamed RepoManifest → RepoMetadata across all non-migration Go files. DB table remains repo_manifest for backward compatibility. Migration files unchanged to preserve migration chain. API endpoints /manifest and /metadata both continue to work (backward compat route preserved in api.go). Fixes #635	2026-06-18 16:03:54 -05:00
Jonathan Miller	91e50fe4bf	fix: remove version from manifest first-class fields ... Version is not a required metadata field — it's derived from git tags and releases, not stored in the manifest. Remove from RepoManifest model and the manifest API request/response struct. VersionPrefix, StandardsVersion, and TargetVersion are kept as they serve different purposes (tag parsing, standards compliance, platform targeting).	2026-06-18 11:01:23 -05:00
Jonathan Miller	08f6454dd2	fix: address PR review findings — error handling, type safety, comments ... Review fixes: - Propagate updateDomainRestriction error in grace-period path instead of silently discarding it (was same bug class as the TOCTOU fix) - Propagate IsDomainKnownForKey error inside transaction — discarding it defeated the atomicity guarantee - Wrap updateDomainRestriction error with context message - Use boolean flags for changelog manifest fallback instead of fragile sentinel comparison against strings.ToLower(repo.Name) - Type-assert ctx.Data["RepoUpdatePlatform"] to string instead of comparing interface{} values - Use log.Warn instead of log.Error for manifest fallback (intentional degradation, not a failure) - Clarify comments: doc comment scope, hyphen removal wording	2026-06-18 09:51:33 -05:00
Jonathan Miller	a83d2ee3bd	fix: changelog element mismatch, platform gating, domain race condition ... Three fixes for the Joomla update server system: 1. changelog_xml.go: Resolve element name from manifest first (same priority as updates.xml) so changelog.xml and updates.xml emit matching <element> values. Previously only checked the config table. 2. updateserver.go: Only serve Joomla XML when platform is joomla, both, or unset. Previously only blocked dolibarr, meaning WordPress/ PrestaShop/Drupal/WHMCS repos incorrectly served Joomla XML. 3. license_key.go: Wrap domain auto-association in db.WithTx to prevent TOCTOU race where concurrent requests from different domains could exceed MaxSites. Also removes a duplicate site-limit check that was unreachable dead code.	2026-06-18 09:14:13 -05:00
Jonathan Miller	73a1320d72	fix: derive Joomla element name with correct lowercase + type prefix ... AutoElementName() was using the manifest Name field verbatim, producing element names like "pkg_MokoSuiteBackup" instead of "pkg_mokosuitebackup". Joomla's updater matches by element+type+client_id in #__extensions, so the case mismatch made updates invisible. Changes: - Lowercase name and strip hyphens in AutoElementName() - Remove incorrect "plg_" prefix for plugins (Joomla plugins have no element prefix; the folder column determines the plugin group) Fixes #635	2026-06-18 08:33:35 -05:00
Jonathan Miller	97ea4fc4d0	feat(migration): migrate update server metadata fields to repo manifest ... Migration 355: copies extension metadata from update_stream_config to repo_manifest where manifest fields are empty. Fields migrated: display_name, extension_name→element_name, extension_type→package_type, target_version, maintainer, maintainer_url, info_url, php_minimum, platform. Only fills empty manifest fields (won't overwrite existing data).	2026-06-09 23:38:14 -05:00
Jonathan Miller	549e890cd0	refactor: rename models/licenses to models/updateserver ... Rename the licensing/update server model package to better reflect its purpose. All imports updated from licenses_model to updateserver_model. License key management UI files kept (only imports updated).	2026-06-09 20:29:03 -05:00
Jonathan Miller	1caf26453f	feat: issue metadata API + org wiki tab with internal/external mode ... Issue Status/Priority/Type API: - Expose status_id, priority_id, type_id (with resolved names) on Issue API struct - New endpoints: GET /orgs/{org}/issue-statuses, /issue-priorities, /issue-types - CreateIssue and EditIssue handlers accept status_id, priority_id, type_id - MCP tools: 5 new tools + updated create/update with metadata params Org Wiki Tab: - Convention repos: wiki (public) and wiki-private (members-only) - Inline wiki rendering with markdown pipeline, sidebar, footer, page list - Public/private view dropdown (same UX as org profile README selector) - External wiki mode: link to outside URL from wiki tab - Wiki mode setting in org settings (internal vs external with URL field) - Migration 354: add wiki_mode and wiki_url to user table	2026-06-09 10:20:54 -05:00
Jonathan Miller	c26ad626bd	feat(manifest): add distribution metadata fields (phase 1 consolidation) ... Add DisplayName, Maintainer, MaintainerURL, InfoURL, TargetVersion, and PHPMinimum to RepoManifest. These fields were previously only in UpdateStreamConfig and are now in the manifest as the single source of truth. Distribution section shown conditionally for joomla/wordpress/ dolibarr platforms. Closes #582 phase 1.	2026-06-07 13:36:58 -05:00
Jonathan Miller	2eb2ed67bf	fix(licensing): allow disabling update server by deleting repo-level config ... When the update server checkbox is unchecked, delete the repo-level config override instead of saving it with LicensingEnabled=false. This allows the org-level config to take effect properly and fixes the issue where the update server could not be turned off once enabled.	2026-06-07 13:12:24 -05:00
jmiller	f86527994b	Merge pull request 'fix(manifest): fix template end mismatch in Joomla settings block' (#575) from fix/manifest-template-end into dev	2026-06-07 17:51:45 +00:00
Jonathan Miller	c016c603b4	fix(manifest): fix template end mismatch in Joomla settings block	2026-06-07 12:51:20 -05:00
Jonathan Miller	aae7b65329	fix(manifest): sync version_prefix + element_name, rename moko-platform everywhere ... - manifest_sync.go: add VersionPrefix and ElementName to XML parse and DB sync - deploy workflow: use manifest API for version prefix instead of hardcoded sed - pre-release workflow: rename moko-platform paths to mokoplatform - All workflow headers: rename moko-platform references - manifest.xml: update root element to mokoplatform, add version-prefix field - Server: symlink /opt/mokoplatform -> /opt/moko-platform for compatibility	2026-06-07 12:36:43 -05:00
Jonathan Miller	09aa8d8201	feat(manifest): add version prefix + fix platform dropdown values ... - Add version_prefix field for fork versioning (e.g., v1.26.1-moko.) - Change platform dropdown from programming languages to deployment targets (Joomla, Dolibarr, WordPress, Generic, etc.) so template repos can be mapped to platforms - Available in settings UI and REST API	2026-06-07 12:24:07 -05:00
Jonathan Miller	33ebcd7726	feat(manifest): add version prefix + fix platform dropdown values ... - Add version_prefix field for fork versioning (e.g., v1.26.1-moko.) - Change platform dropdown from programming languages to deployment targets (Joomla, Dolibarr, WordPress, Generic, etc.) so template repos can be mapped to platforms - Available in settings UI and REST API	2026-06-07 12:11:24 -05:00
Jonathan Miller	37d59e7b59	feat(cdn): built-in CDN for release asset delivery (#561) ... Add CDN system that serves release assets via a dedicated hostname (e.g., cdn.mokoconsulting.tech) with per-asset public/private toggles, IP/referrer allowlists, and aggressive caching headers. - Host-based routing intercepts CDN domain before auth middleware - Per-attachment cdn_public flag controls CDN visibility - Releases in an update stream are excluded from CDN (update server takes precedence) - CORS, ETag, Cache-Control headers for downstream CDN compatibility - IP/CIDR and referrer domain allowlists for abuse prevention	2026-06-07 11:07:30 -05:00
Jonathan Miller	dd1454c3cf	feat(issues): first-class Type field + status/priority/type badges in issue list ... - IssueTypeDef model with auto-seed defaults (Bug, Feature, Enhancement, Task, Documentation, Security) - Migration v350 adding issue_type_def table + type_id on issues - Type dropdown in issue sidebar - Type, Priority, Status colored badges in issue list view - Status/Priority/Type definitions loaded in issue list handler	2026-06-06 17:12:44 -05:00
Jonathan Miller	f7c1904625	feat(security): built-in security scanning platform (#508) ... Add a pluggable security scanning framework with secret detection as the first scanner module. Scans run on push to default branch and on-demand via the Security settings page. Includes: - Scanner interface for pluggable scanner types - Secret scanner with 15 built-in patterns (AWS, GitHub, Stripe, etc.) - SecurityAlert model with fingerprint-based dedup - SecurityScannerConfig per-repo settings - Migration v349 for security tables - Repo settings Security page with alerts table - Scan Now button for on-demand scanning - Alert resolve/dismiss actions - Push-time scanning in post-receive hook	2026-06-06 16:23:08 -05:00