247 Commits

Author	SHA1	Message	Date
jmiller	81ea2fcb05	docs: README org-governance feature + CHANGELOG CI fixes (#727) ... Add an Org Governance entry to the README key-features list (org-wide branch/tag protection, push policy, repo defaults, email-domain allowlist) and record the recent build/CI fixes (#734, #735, #736, #737) under CHANGELOG [Unreleased]. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 01:28:36 -05:00
jmiller	6a3db171c1	feat(org): org-level email domain policy for members (#727) ... Restricts which email domains an organization's members may have. When a policy is configured, a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership choke point services/org.AddTeamMember, which every add path (API, web, group-sync) funnels through — so one check covers them all. On violation it returns a typed ErrEmailDomainNotAllowed; the API team-add handler maps it to 422. - models/git/org_email_domain.go: OrgEmailDomainPolicy model + EmailAllowed (domain glob match) + OrgEmailDomainAllowed + typed error + CRUD. Migration 366. - API: GET/PATCH/DELETE /orgs/{org}/email_domain_policy. - Enforcement in services/org/team.go; 422 mapping in routers/api/v1/org/team.go. An empty policy imposes no restriction. This is the one bounded piece of the "access/security" tier; org 2FA-required and IP allowlists were deliberately NOT built here — they are cross-cutting enforcement (auth gating / request middleware) that needs a compiler + tests, not a blind stacked PR. Stacked on #731/#730/#729/#728 for migration ordering (this = 366). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), imports (git_model added to the api team handler, gci order), typed-error detection, migration contiguous (366). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:23:11 -05:00
jmiller	d3134b1c53	feat(org): org-level repository defaults applied on repo create/transfer (#727) ... Adds a single per-org repository-defaults config, applied to a repo when it is created in or transferred into the org via a notifier (services/org): - ForcePrivate — force new/transferred repos private (Repository.IsPrivate). - PR defaults (when ApplyPRDefaults) — allowed merge styles, default merge style, and auto-delete-branch-after-merge, written to the repo's pull-requests unit config via repo_service.UpdateRepositoryUnits. Best-effort: the notifier logs and swallows errors, so a defaults bug can never break repository creation or transfer. - models/git/org_repo_defaults.go: OrgRepoDefaults model + CRUD + migration 365. - API: GET/PATCH/DELETE /orgs/{org}/repo_defaults. - services/org/notifier.go: CreateRepository/TransferRepository -> apply defaults; registered from routers/init.go (org_service.Init()). Stacked on #730/#729/#728 for migration ordering (this = 365). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct/DTO alignment), imports used, no Init() collision in services/org, migration contiguous (365), notifier signatures match the Notifier interface. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:22:38 -05:00
jmiller	3aac1b456c	feat(org): org-level push policy enforced in the pre-receive hook (#727) ... Adds a single per-org push policy that cascades to every repo of the org and is enforced in the pre-receive hook: - Branch/tag name conventions (glob) — a pushed ref name must match. Fail-closed. - Mandatory secret-scanning block-on-push — org can force secret blocking that a repo cannot disable (overrides the per-repo scanner config in the orchestrator). - Max pushed-file size — rejects a tip tree containing a blob over the limit. - Blocked file-path patterns — rejects pushes changing matching paths (reuses pull_service.CheckFileProtection). The two content checks (blocked paths, max size) FAIL OPEN on any error so a policy/parsing bug can never wedge all pushes; naming is fail-closed. - models/git/org_push_policy.go: OrgPushPolicy model + CRUD + matchers + GetOrgPushPolicyForRepo. Migration 364. - API: GET/PATCH/DELETE /orgs/{org}/push_policy (routers/api/v1/org/push_policy.go, DTOs in modules/structs/org_push_policy.go, wired in api.go). - Enforcement: routers/private/hook_pre_receive.go (branch: naming + blocked paths + max size; tag: naming) and services/security/orchestrator.go (secret mandate). Deferred: a repo-facing read-only view of the org push policy (it is an org-wide config, not per-repo overlay rules; readable via the API for now). Stacked on #729/#728 for migration ordering (this = 364). Swagger annotations omitted (can't regenerate without the toolchain). Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), escape sequences in the ls-tree parser, imports used, migration contiguous (364), fail-open on content checks. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:20:39 -05:00
jmiller	b31336d1fe	feat(org): org-level tag protection, layered with per-repo protected tags (#727) ... Adds org-level tag protection as a parallel to org-level branch protection. An org tag rule is {NamePattern, AllowlistTeamIDs}; it cascades to every repo in the org and layers on top of the repo's own protected tags — a tag is controllable (push/delete) only if allowed at BOTH levels (fail-closed). - models/git/org_protected_tag.go: OrgProtectedTag model + CRUD + ToProtectedTag() (reuses the ProtectedTag matcher/allowlist logic) + IsUserAllowedToControlTagInRepo() which ANDs the repo decision with the org decision. Migration 363. - API: /orgs/{org}/tag_protections CRUD (routers/api/v1/org/tag_protection.go, DTOs in modules/structs/org_tag.go, wired in api.go). - Enforcement: the git push/delete hook (hook_pre_receive.go) and the two release paths (release.go create/delete) now call the layered check, so no per-site tag logic changes beyond swapping the helper. - View: the repo Tag settings page lists inherited org tag rules read-only. Stacked on #728 (branch-protection PR) for migration ordering — merge #728 first. Swagger annotations omitted (can't regenerate the swagger JSON without the toolchain); routes still register. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct alignment), template nesting balances, all .Rule fields exist on OrgProtectedTag, all locale keys defined, JSON valid, migration contiguous (363). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:37:18 -05:00
jmiller	4b68853f08	feat(org): add branch-deletion protection + expandable inherited-rule view (#727) ... Two related additions: 1. Branch deletion as an org-level ability. OrgProtectedBranch gained CanDelete / EnableDeleteAllowlist / DeleteAllowlistTeamIDs (migration 362), ToProtectedBranch maps them, and the API (create/edit/response DTOs + handlers) exposes enable_delete / enable_delete_allowlist / delete_allowlist_teams. The layering merge already combined delete fields, so org delete-protection now enforces once ToProtectedBranch populates them. 2. The repo Branch Protection view now renders each inherited org rule as an expandable detail (direct push, force-push, branch deletion, merge, required approvals, status checks, protected files) with team names resolved, instead of three headline badges. Still read-only. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Verified by hand: struct-field gofmt alignment, template block nesting balances, every .Rule field exists on OrgProtectedBranch, and all locale keys referenced in the template are defined. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:16:24 -05:00
jmiller	24b3516c1d	fix(org): layer org-level branch protection with repo rules, most-restrictive wins (#727) ... Org-level branch protection was already consulted at the single enforcement choke point `GetFirstMatchProtectedBranchRule`, but only as a FALLBACK: if any repo-level rule matched the branch, the org rule was ignored entirely. That let a repo define a looser rule for a pattern and effectively opt out of the org's protection. Make the choke point LAYER the two rules instead: when both an org rule and a repo rule match a branch, return their most-restrictive (fail-closed) combination, so the org rule is a mandatory floor a repo can only tighten. - models/git/protected_branch_merge.go: mergeMostRestrictive + helpers. Allow flags AND'd; gate/require/block flags OR'd; RequiredApprovals max'd; required sets (status contexts, protected files) unioned; allow sets (whitelists, unprotected files) intersected. A disabled allowlist means "everyone", so it only constrains when enabled. - models/git/protected_branch_list.go: GetFirstMatchProtectedBranchRule now fetches both the repo rule and the org rule and merges when both match; returns whichever exists when only one matches. Org lookup factored into getFirstMatchOrgProtectedBranchRule. Supersedes the materialization approach previously proposed for this issue — the org fallback already existed, so only this one function needed to change. Fail-closed by design: any merge edge errs toward MORE protection (over-restrict) rather than less, so it cannot open a hole. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here — relying on CI to validate build, formatting, and tests. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 19:42:08 -05:00
jmiller	0cc569aef6	fix: render org teams list and make issue type editable (#720, #721) ... #720: org Teams page wrote ctx.Data["OrgListTeams"] but the template iterates .Teams, so no teams rendered. Use the canonical Teams key (matches org/home.go). #721: issue type sidebar gated editing on a FieldEditFlags data key that no handler sets (always nil -> always read-only). Use HasIssuesOrPullsWritePermission like the priority field; the /custom-type endpoint is already protected by reqRepoIssuesOrPullsWriter.	2026-07-04 16:27:32 -05:00
jmiller	aea4370845	ci: no-op PR RC Release when updates.xml is absent ... The RC release workflow drives a Joomla-style updates.xml update stream. On a generic repo with no updates.xml, the Determine RC version step ran sed on a missing file and aborted under set -e (exit 2). Detect updates.xml presence and gate the update-stream steps (edit/create-release/commit) on it so the job succeeds and no-ops when there is nothing to package.	2026-07-04 13:53:15 -05:00
jmiller	fc234bc911	fix: remove dangling mcp-mokogitea-api submodule gitlink ... The tree carried a gitlink at mcp-mokogitea-api (mode 160000) with no .gitmodules entry, so git submodule update --init --recursive failed with exit 128 at checkout, breaking every PR build/release job. mcp-mokogitea-api is a separate repo, not a submodule; remove the gitlink from the index (keeping the local working-tree clone) and gitignore the path so it can't be re-added.	2026-07-04 13:46:35 -05:00
jmiller	b252e9569f	ci: allow fix/patch branches to target main and guard missing manifest ... Branch policy in pr-check.yml only allowed fix/* and patch/* to target dev/rc, blocking fix/* PRs to main despite the documented policy. Allow fix/* -> main and patch/* -> main. Also guard the Detect platform step for a missing .mokogitea/manifest.xml (removed in favor of the metadata API) so it no longer aborts the Validate PR job under set -e.	2026-07-04 13:36:47 -05:00
jmiller	982e45a56e	fix: support radio inputs in admin system config form ... The system config form JS (config.ts) only mapped checkbox, text, textarea, and datetime-local elements. The fork landing_page.tmpl uses radio inputs for the Mode field, so fillFromSystemConfig() hit unsupportedElement() and threw, aborting all JS init on the admin settings page. Add radio handling in both directions: fill checks the option whose value matches the config value; collect returns the checked option's value and skips/nulls unchecked radios so a group resolves to exactly one value. Adds a radio-group test case.	2026-07-04 01:20:43 -05:00
jmiller	7c75133ef1	feat: code security scanner with OWASP pattern detection (#552) ... Implements the code analysis scanner module that detects insecure patterns across Go, PHP, Python, JavaScript, and TypeScript: - SQL injection (CWE-89): string concat in queries across 4 languages - XSS (CWE-79): innerHTML, document.write, unescaped output, dangerouslySetInnerHTML - Command injection (CWE-78): exec with variables, shell=True, os.system - Path traversal (CWE-22): unsanitized path joins, file open with user input - Insecure deserialization (CWE-502): unserialize(), yaml.load() - Hardcoded credentials (CWE-798): password assignments in source - Weak cryptography (CWE-327): MD5/SHA-1 usage 22 rules total, language-filtered by file extension. Wired into the existing scanner orchestrator via the CodeScanner config toggle. API updated to expose code_scanner in GET/PATCH security config. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 08:15:34 -05:00
jmiller	fa845164bb	fix: pr-check platform detection queries metadata API instead of removed manifest.xml ... The manifest.xml file no longer exists — platform is stored in the MokoGitea metadata API. The old sed command failed with exit 2 under bash -e, cascading failure to all subsequent validate steps. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 05:59:14 -05:00
jmiller	23bb025700	merge: incorporate main into dev for release PR #714 ... Resolve CHANGELOG conflict — deduplicate feature entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 04:35:52 -05:00
jmiller	98301bc92b	merge: incorporate latest dev (post status-presets merge) into cascade-merge ... Resolve CHANGELOG conflict, restore issue_metadata.go from dev. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:51:37 -05:00
jmiller	5a25068d81	merge: incorporate dev changes into feature/cascade-merge ... Resolve CHANGELOG.md and api.go conflicts — keep both cascade_rules and security route groups. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:48:52 -05:00
jmiller	57894e25fd	merge: incorporate dev changes into feature/status-presets ... Resolve CHANGELOG.md conflict — keep both status presets and default teams entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:47:37 -05:00
jmiller	2857a1f6a1	feat: security scanning API + pre-receive hook blocking (#692)	2026-06-28 08:45:45 +00:00
jmiller	5da6a40f10	fix: resolve merge conflict marker and fix import paths in cherry-picked tests ... - Remove residual <<<<<<< HEAD marker from api_org_test.go - Convert code.gitea.io/gitea to mokoconsulting paths in 5 new test files: cmd/serv_test.go, models/auth/twofactor_test.go, modules/git/commit_info_nogogit_test.go, routers/private/hook_pre_receive_test.go, services/actions/notifier_helper_test.go - Add changelog entries for new features (#460, #507, #513) Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:31:44 -05:00
jmiller	b0bbaab621	docs: add security section to changelog for upstream v1.26.3/v1.26.4 fixes ... Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:35:07 -05:00
jmiller	7b334f94c0	feat: security scanning API endpoints + pre-receive hook blocking (#692) ... Add REST API for security alerts (list, get, update status, trigger scan) and scanner config (get, update). Wire block_on_push into the pre-receive hook so pushes containing detected secrets are rejected with details. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:30:04 -05:00
jmiller	e99658ddc0	feat(orgs): auto-create default teams on org creation (#513) ... New organizations now get three default teams in addition to Owners: - Developers (write: code, issues, PRs, wiki, projects; read: releases) - Reviewers (read: code, issues, PRs, releases, wiki) - CI/CD (write: actions, packages, releases; read: code) Teams are defined in DefaultOrgTeams and created inside the same transaction as the org, so creation is atomic. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:08:47 -05:00
jmiller	f627219ca8	feat: cascade merge — auto-create PRs to downstream branches after merge (#460) ... Adds configurable cascade rules per repo. When a PR merges into a source branch, the system auto-creates PRs to each configured target branch. Skips if a matching PR already exists. - Model: CascadeMergeRule (repo_id, source, target, enabled, auto_merge) - Migration v362 creates cascade_merge_rule table - Notifier hooks into MergePullRequest/AutoMergePullRequest events - API: CRUD at /repos/{owner}/{repo}/cascade_rules (admin only) Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:06:42 -05:00
jmiller	df9305758f	feat: add issue status presets and cross-org migration (#507) ... 4 built-in presets: default, software-development, support-tickets, bug-tracking. API endpoints to list presets, apply to org, and copy statuses between orgs. Web UI dropdown on org settings page. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:05:14 -05:00
jmiller	4178e7f23e	feat: add delete allowlist for branch protection rules (#696) ... Add configurable per-user/team/deploy-key allowlist for deleting protected branches. Previously, protected branches could never be deleted via git push. Now admins can configure deletion permissions with the same granularity as force-push allowlists. - 6 new model fields: CanDelete, EnableDeleteAllowlist, DeleteAllowlistUserIDs/TeamIDs, DeleteAllowlistDeployKeys, DeleteAllowlistActionsUser - CanUserDelete() method with admin-level default (higher than push) - Migration v361 adds columns to protected_branch table - Pre-receive hook checks delete allowlist instead of unconditional block - CanDeleteBranch service uses CanUserDelete instead of IsBranchProtected - API create/edit endpoints support delete allowlist fields - Web UI settings page with radio buttons and user/team dropdowns - 12 new locale strings for the delete allowlist UI Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-27 15:35:13 -05:00
jmiller	afe46361c7	feat: workflow subdirectory discovery + move custom workflows to custom/ (#693) ... Gitea's ListWorkflows already uses ListEntriesRecursiveFast (git ls-tree -r) which discovers workflows in subdirectories. Added test cases confirming subdirectory and deeply nested paths are recognized by IsWorkflow. Moved 6 repo-specific workflows (no FILE INFORMATION sync header) to .mokogitea/workflows/custom/ to separate them from template-synced workflows: deploy-mokogitea, deploy-dev, cascade-dev, pr-rc-release, test-mokogitea, upstream-bug-sync. Also fixes deploy-mokogitea.yml: merged the dev health check into the deploy job as step 1 to avoid runner status reporting failures on inter-job handoff (check-dev job was recorded as "skipped" despite passing, cancelling deploy). Closes #693 Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-27 14:34:46 -05:00
jmiller	882eb2cce7	docs: add cherry-pick entries to changelog ... Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-26 21:41:36 -05:00
jmiller	86e1db1dc8	refactor: move ci-issue-reporter to MokoCLI, use reusable workflow ... Moved automation/ci-issue-reporter.sh to MokoCLI (cli/ci_issue_reporter.sh) as a centralized CLI tool. pr-check and repo-health now call the new ci-issue-reporter.yml reusable workflow instead of sparse-checkout + inline.	2026-06-25 12:32:22 -05:00
jmiller	5c1b4e6509	docs: add changelog entries for token standardization and validation fix	2026-06-25 11:23:30 -05:00
jmiller	d2d7c0a762	feat: add ability to edit API token scopes (#697) ... Add PATCH /users/{username}/tokens/{id} API endpoint and web UI edit button so token scopes can be modified after creation without having to delete and recreate the token.	2026-06-25 09:57:59 -05:00
jmiller	49f6380fa4	feat: add licensing API token scope (#697) ... Add read:licensing / write:licensing token scope category so licensing endpoints are guarded by the same permission system as all other API endpoints. Public-only tokens are rejected for licensing endpoints.	2026-06-25 09:22:15 -05:00
Jonathan Miller	f7d70ae95a	docs: update changelog with wiki search, metadata deploy fields, fixes	2026-06-23 17:33:35 -05:00
Jonathan Miller	b283fad8bd	docs: update README and changelog with wiki features documentation ... - README: rewrite with current feature set, fix stale code.mokoconsulting.tech URLs - CHANGELOG: add missing wiki feature entries (#667, #668, #671, #673, #674, #675) - Wiki Features page published to org wiki (standards/Wiki-Features)	2026-06-23 09:08:58 -05:00
Jonathan Miller	95a747b1d5	docs: update changelog with post-#682 fixes and #672	2026-06-21 18:13:28 -05:00
Jonathan Miller	e7b70f54ed	docs: add #670 to changelog	2026-06-21 17:24:17 -05:00
Jonathan Miller	ff27e77c37	docs: update changelog with session 2 changes	2026-06-21 16:54:20 -05:00
Jonathan Miller	8d03a4afbc	Merge remote-tracking branch 'origin/main' into rc ... # Conflicts: # .mokogitea/manifest.xml # .mokogitea/workflows/issue-branch.yml # CHANGELOG.md	2026-06-20 19:15:33 -05:00
Jonathan Miller	ae8b110e89	chore: add changelog entries for licensing system and profile aliases	2026-06-20 17:51:27 -05:00
gitea-actions[bot]	88e5def821	chore(release): build 06.19.00-rc [skip ci]	2026-06-20 22:19:00 +00:00
gitea-actions[bot]	3ddfc7a504	chore(release): build 06.19.00 [skip ci]	2026-06-20 18:08:18 +00:00
gitea-actions[bot]	5613f58a3d	chore(release): build 06.19.00 [skip ci]	2026-06-20 16:43:23 +00:00
gitea-actions[bot]	916949517f	chore(release): build 06.19.00 [skip ci]	2026-06-20 16:02:47 +00:00
gitea-actions[bot]	cfc8f45724	chore(release): build 06.19.00 [skip ci]	2026-06-20 15:51:40 +00:00
gitea-actions[bot]	717fd314e2	chore(release): build 06.19.00 [skip ci]	2026-06-19 07:11:36 +00:00
gitea-actions[bot]	77f3ac9e96	chore(release): build 06.18.00 [skip ci]	2026-06-19 06:21:22 +00:00
gitea-actions[bot]	309d848db5	chore(release): build 06.17.00 [skip ci]	2026-06-18 21:07:39 +00:00
gitea-actions[bot]	3690f31b77	chore(release): build 06.17.00 [skip ci]	2026-06-18 17:05:18 +00:00
gitea-actions[bot]	3af6265802	chore(release): build 06.16.00 [skip ci]	2026-06-18 16:58:44 +00:00
gitea-actions[bot]	9b766c3dee	chore(release): build 06.15.00 [skip ci]	2026-06-18 15:37:13 +00:00