1835 Commits

Author	SHA1	Message	Date
jmiller	f7c2b205c5	fix: reject empty token update requests with 400	2026-06-25 09:58:00 -05:00
jmiller	d2d7c0a762	feat: add ability to edit API token scopes (#697) ... Add PATCH /users/{username}/tokens/{id} API endpoint and web UI edit button so token scopes can be modified after creation without having to delete and recreate the token.	2026-06-25 09:57:59 -05:00
jmiller	49f6380fa4	feat: add licensing API token scope (#697) ... Add read:licensing / write:licensing token scope category so licensing endpoints are guarded by the same permission system as all other API endpoints. Public-only tokens are rejected for licensing endpoints.	2026-06-25 09:22:15 -05:00
Jonathan Miller	5c43cf1f02	fix(metadata): support partial updates — only sent fields are changed ... Previously PUT /metadata replaced all fields, wiping any not included in the request. Now loads existing metadata first and merges only the fields present in the JSON body.	2026-06-23 17:28:40 -05:00
Jonathan Miller	c8c74c7afe	fix: handle DB errors in licensing API, fix wiki API URL-decode fallback ... - licensing/manage.go: capture Update/Delete errors instead of silently discarding them (UpdateLicense, UpdateTier, DeleteTier) - wiki.go API: fix findEntryForFile to allow URL-decode fallback for non-ASCII page names (was returning on ErrNotExist instead of falling through)	2026-06-23 17:25:47 -05:00
Jonathan Miller	7b68963b67	feat(metadata): add deploy fields to repo metadata API (#692) ... - Migration v360: adds deploy_host, deploy_port, deploy_user, deploy_path, docker_image, docker_registry, container_name, health_url to repo_manifest - API: GET/PUT /metadata now includes deploy fields - Settings: preserve deploy fields on web UI save - Remove 4 unneeded workflows (gitleaks, npm-publish, notify, workflow-sync) - gitleaks will become built-in (#692) - npm-publish/notify not applicable to Go repo - workflow-sync moving to MokoCLI	2026-06-23 14:32:31 -05:00
Jonathan Miller	1178975be3	feat(wiki): full-text search across wiki pages (#550) ... - Web: WikiSearch handler with case-insensitive search of titles and content - Web: search.tmpl with search form and results display - Web: "Search wiki" link added to wiki dropdown menu - API: GET /wiki/search?q=term endpoint with pagination - Recursive traversal handles nested folder wikis	2026-06-23 12:05:48 -05:00
Jonathan Miller	78b0ce9650	fix: org metadata API respects visibility for unauthenticated requests (#690) ... Add checkOrgVisibility() guard to issue-statuses, issue-priorities, and issue-types endpoints. Public orgs remain accessible to everyone. Private/limited orgs return 404 for unauthenticated callers.	2026-06-21 18:17:00 -05:00
Jonathan Miller	71d52e432e	feat: enforce required baseline issue statuses (#681) ... Add IsRequired field to IssueStatusDef. Open and Closed statuses are seeded as required and cannot be deleted. Delete attempts return an error flash in the web UI and ErrStatusRequired in the model layer. API response now includes is_required field.	2026-06-21 11:29:49 -05:00
Jonathan Miller	9149fa100c	feat: make metadata/manifest GET endpoint publicly accessible (#676) ... Remove reqRepoReader auth requirement from GET /repos/{owner}/{repo}/metadata and /manifest endpoints. PUT (update) still requires token + admin.	2026-06-21 10:20:56 -05:00
Jonathan Miller	6d194f9bdf	fix: sort imports in manage.go (stdlib before module imports)	2026-06-20 23:03:44 -05:00
Jonathan Miller	403db405cb	fix: resolve all compile errors in licensing endpoints ... - ctx.BindJSON → json.NewDecoder(ctx.Req.Body).Decode - ctx.Orm() → db.GetEngine(ctx) - ctx.NotFound() → ctx.APIErrorNotFound() - GetAttachmentsByReleaseID → db.GetEngine query	2026-06-20 22:57:19 -05:00
Jonathan Miller	79cc30e9a8	fix: use ctx.APIError instead of ctx.Error in licensing endpoints ... APIContext doesn't have an Error method — use APIError(status, msg) which is the correct 2-arg pattern for Gitea API error responses.	2026-06-20 21:47:02 -05:00
Jonathan Miller	1d1b867df5	feat: add license management API — admin CRUD, user self-service, tier management (#624) ... Admin: POST/GET/PATCH/DELETE /api/v1/licensing/licenses (reqSiteAdmin) User: GET /api/v1/licensing/my/licenses, manage domains (reqToken) Tiers: GET/POST/PATCH/DELETE /api/v1/licensing/tiers (reqSiteAdmin) Includes pagination, entitlement/activation detail in GET, tier change triggers entitlement rebuild, delete-tier blocked if active licenses exist.	2026-06-20 20:04:15 -05:00
Jonathan Miller	5bd449017c	feat: add signed download endpoint with ed25519 tokens (#622) ... GET /api/v1/licensing/download/{product}/{version}.zip?token=XXX&expires=YYY&dlid=ZZZ ed25519 keypair auto-generated on first use, stored in Gitea data dir. Update XML endpoint now generates signed URLs with 5-minute TTL. Download verifies signature + expiry + DLID + entitlement before serving the release ZIP attachment. Downloads logged to audit trail.	2026-06-20 19:59:37 -05:00
Jonathan Miller	3e909df6d4	feat: add license validation API — public validate + authenticated status (#623) ... GET /api/v1/licensing/validate?dlid=XXX&product=YYY&domain=ZZZ (public) GET /api/v1/licensing/{dlid}/status (authenticated, reqToken) Public endpoint returns valid/invalid with reason codes for Joomla plugin and external integration use. Authenticated endpoint returns full license detail with entitlement list and domain usage for admin dashboards.	2026-06-20 19:51:50 -05:00
Jonathan Miller	6f6a8b0f2c	fix: remove invalid SortType field from FindReleasesOptions	2026-06-20 17:18:52 -05:00
Jonathan Miller	212b8c9e6d	feat: add DLID-gated update XML endpoint for Joomla updater (#621) ... GET /api/v1/licensing/updates/{product}.xml?dlid=XXX&domain=YYY Validates DLID format (CRC32), checks license status and entitlement, auto-activates domain, returns Joomla-compatible update XML from the entitled repo's stable release. Invalid/expired returns empty <updates/>.	2026-06-20 17:15:24 -05:00
Jonathan Miller	2b6684536e	feat: remove display_name, compute from extension_type + name (#650) ... - Remove DisplayName field from RepoMetadata and UpdateStreamConfig - Add DerivedDisplayName() method: "{Type} - {Name}" (e.g. "Package - MokoSuiteBackup") - API returns computed display_name in GET, ignores it on PUT - Update server feeds use DerivedDisplayName() instead of stored value - Remove display_name from web forms (repo licensing, org update streams) - License settings API computes display_name from repo metadata - Migration v358: drop display_name columns from both tables	2026-06-20 10:45:54 -05:00
Jonathan Miller	7ebe6d54be	refactor: rename PackageType → ExtensionType (#646) ... Rename package_type column and Go field to extension_type across model, API, update server, manifest sync, settings UI, and changelog. SQL migration renames the column. XML tag <package-type> in .mokogitea/manifest.xml is unchanged (backward compat). Fixes #646	2026-06-19 02:00:04 -05:00
Jonathan Miller	45caf41499	fix: rename custom fields handlers, clean metadata API naming	2026-06-19 01:14:11 -05:00
Jonathan Miller	1ec0a70c0c	fix: rename API handlers to avoid collision with custom_fields GetRepoMetadata	2026-06-18 21:08:29 -05:00
Jonathan Miller	3c9e3ffa13	fix: lowercase Joomla element names, rename Manifest → Metadata (#635) ... AutoElementName() was using m.Name without lowercasing or cleaning, producing elements like pkg_MokoSuiteBackup instead of pkg_mokosuitebackup. Added cleanJoomlaElement() to replicate Joomla's InputFilter::clean('cmd') behavior. Removed incorrect "plugin": "plg_" — Joomla plugins use bare names. Renamed RepoManifest → RepoMetadata across all non-migration Go files. DB table remains repo_manifest for backward compatibility. Migration files unchanged to preserve migration chain. API endpoints /manifest and /metadata both continue to work (backward compat route preserved in api.go). Fixes #635	2026-06-18 16:03:54 -05:00
Jonathan Miller	91e50fe4bf	fix: remove version from manifest first-class fields ... Version is not a required metadata field — it's derived from git tags and releases, not stored in the manifest. Remove from RepoManifest model and the manifest API request/response struct. VersionPrefix, StandardsVersion, and TargetVersion are kept as they serve different purposes (tag parsing, standards compliance, platform targeting).	2026-06-18 11:01:23 -05:00
jmiller	9d45a767e7	Merge pull request 'feat(issues): make status_id, priority_id, type_id required on create (#598)' (#613) from feature/598-required-issue-metadata into main	2026-06-12 02:59:37 +00:00
Jonathan Miller	e0d4f5fd15	fix: handle SetIssueStatusID/PriorityID/TypeID errors on create ... Explicit caller-provided values now return 500 on failure instead of silently discarding the error. Default auto-assignment still uses best-effort (log and continue) since it's a fallback.	2026-06-11 21:57:39 -05:00
Jonathan Miller	c67e7373fb	fix: move required custom field validation before issue creation ... Validation now runs before NewIssue() to prevent orphaned issues when a required field is missing. Reuses the defs query for both validation and saving.	2026-06-11 21:56:14 -05:00
Jonathan Miller	cbaca15cda	feat(issues): make status_id, priority_id, type_id required on create (#598) ... - Change CreateIssueOption fields from *int64 (optional) to int64 - API auto-assigns org defaults when value is 0 - MCP gitea_issue_create now requires status_id, priority_id, type_id (pass 0 for org default) - Keep optional on gitea_issue_update (partial updates) Co-Authored-By: Moko Consulting <hello@mokoconsulting.tech>	2026-06-11 21:49:37 -05:00
Jonathan Miller	245b5a8e6a	feat(custom-fields): add required flag UI and API validation (#597) ... - Add required checkbox to org custom field settings form - Show red asterisk (*) indicator on required fields in the list - Validate required custom fields on API issue create (return 422) - Add locale strings for required field UI The Required column already exists in the DB (migration v343) and is already validated in the web form. This adds the missing org settings UI checkbox and API-side validation. Co-Authored-By: Moko Consulting <hello@mokoconsulting.tech>	2026-06-11 21:46:24 -05:00
Jonathan Miller	0f1002f3c9	fix: address review findings for wiki API ... - Log warning when wiki blob exceeds max size (was silent empty return) - Fix stale WebPathFromRequest test to match folder-based wiki behavior	2026-06-11 17:03:21 -05:00
Jonathan Miller	3a7b07590f	fix: wiki API sub-page support and content response (#606, #607) ... - Change wiki API routes from {pageName} to wildcard (*) to support pages with path separators (e.g. mcp/fleet-overview) - Use ListEntriesRecursiveFast() in ListWikiPages to include pages in subdirectories, not just root-level files - Add error logging in wikiContentsByEntry for diagnosing empty content_base64 responses - Fix pagination to count only regular files, not directories Co-Authored-By: Moko Consulting <hello@mokoconsulting.tech>	2026-06-11 16:56:10 -05:00
Jonathan Miller	7ed335e6c3	feat(api): add /metadata API route alongside /manifest for backward compat	2026-06-10 04:33:58 -05:00
Jonathan Miller	704d9d10be	feat(issues): status/priority/type dropdowns on new issue form (#598) ... - Add type, priority, status dropdowns to new issue sidebar - Pre-select org defaults (is_default for type/priority, first open status) - Auto-assign defaults on API create when not provided - Required indicators (*) on dropdowns and custom fields - Validate required custom fields on submit (#597) - Add feed_visibility to update server settings on manifest page	2026-06-09 23:19:19 -05:00
Jonathan Miller	549e890cd0	refactor: rename models/licenses to models/updateserver ... Rename the licensing/update server model package to better reflect its purpose. All imports updated from licenses_model to updateserver_model. License key management UI files kept (only imports updated).	2026-06-09 20:29:03 -05:00
Jonathan Miller	1caf26453f	feat: issue metadata API + org wiki tab with internal/external mode ... Issue Status/Priority/Type API: - Expose status_id, priority_id, type_id (with resolved names) on Issue API struct - New endpoints: GET /orgs/{org}/issue-statuses, /issue-priorities, /issue-types - CreateIssue and EditIssue handlers accept status_id, priority_id, type_id - MCP tools: 5 new tools + updated create/update with metadata params Org Wiki Tab: - Convention repos: wiki (public) and wiki-private (members-only) - Inline wiki rendering with markdown pipeline, sidebar, footer, page list - Public/private view dropdown (same UX as org profile README selector) - External wiki mode: link to outside URL from wiki tab - Wiki mode setting in org settings (internal vs external with URL field) - Migration 354: add wiki_mode and wiki_url to user table	2026-06-09 10:20:54 -05:00
Jonathan Miller	c26ad626bd	feat(manifest): add distribution metadata fields (phase 1 consolidation) ... Add DisplayName, Maintainer, MaintainerURL, InfoURL, TargetVersion, and PHPMinimum to RepoManifest. These fields were previously only in UpdateStreamConfig and are now in the manifest as the single source of truth. Distribution section shown conditionally for joomla/wordpress/ dolibarr platforms. Closes #582 phase 1.	2026-06-07 13:36:58 -05:00
Jonathan Miller	09aa8d8201	feat(manifest): add version prefix + fix platform dropdown values ... - Add version_prefix field for fork versioning (e.g., v1.26.1-moko.) - Change platform dropdown from programming languages to deployment targets (Joomla, Dolibarr, WordPress, Generic, etc.) so template repos can be mapped to platforms - Available in settings UI and REST API	2026-06-07 12:24:07 -05:00
Jonathan Miller	33ebcd7726	feat(manifest): add version prefix + fix platform dropdown values ... - Add version_prefix field for fork versioning (e.g., v1.26.1-moko.) - Change platform dropdown from programming languages to deployment targets (Joomla, Dolibarr, WordPress, Generic, etc.) so template repos can be mapped to platforms - Available in settings UI and REST API	2026-06-07 12:11:24 -05:00
Jonathan Miller	34fe0c5934	fix(api): use correct APIContext error methods for manifest endpoint ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:08:23 -05:00
Jonathan Miller	3aaa7c0843	feat(settings): repo manifest settings with auto-migration and API (#315) ... Add a "Manifest" page in repo settings that stores moko-platform manifest fields (identity, governance, build) in the database. Includes: - RepoManifest model with all manifest.xml fields - Migration v347 adding repo_manifest table - Auto-detect and migrate .mokogitea/manifest.xml on first settings visit - Repo settings UI with Identity/Governance/Build sections - REST API: GET/PUT /api/v1/repos/{owner}/{repo}/manifest for Actions workflows and moko-platform CLI Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:02:23 -05:00
Jonathan Miller	33076e4e1b	fix(issues): address review findings for custom field search ... - Clear custom field filters when field definitions fail to load, preventing invisible filtering with no UI to undo - Log malformed options JSON instead of silently dropping fields - Extract parseCustomFieldQueryParams helper (web) and parseAPICustomFieldFilters helper (API) to deduplicate cf_ parsing - API returns 400 for non-numeric or non-positive cf_ field IDs - Validate field IDs are positive in web handler - Add entity_type='issue' to subquery to prevent cross-entity matching Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 06:06:32 -05:00
Jonathan Miller	a3c6f54ad3	feat(issues): advanced search with custom field filters (#496) ... Add the ability to filter issues by custom field values throughout the entire search stack: - DB: applyCustomFieldCondition joins custom_field_value with AND semantics (all specified fields must match) - Indexer: CustomFieldFilters map passed through SearchOptions and ToDBOptions - Web: parse cf_{fieldID}={value} query params, show dropdown filters in the issue list sidebar for org-level fields - API: both SearchIssues and ListIssues accept cf_ query params Closes #496 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 06:06:32 -05:00
Jonathan Miller	cd4c701cb6	fix(custom-fields): address code review findings ... - API: return 500 on GetCustomFieldsByOwner failure instead of silently swallowing the error - resolveExtensionMetadata: add DownloadGating/KeyPrefix to metadata struct instead of mutating the caller's cfg pointer (side effect) - resolveExtensionMetadata: add Description custom field mapping - Composer: use meta.PHPMinimum instead of bypassing the cascade - Web form: flash error on custom field save failure instead of silent log Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 21:59:50 -05:00
Jonathan Miller	9ebe1b26b1	feat(custom-fields): pre-fill custom fields from issue template YAML frontmatter ... Add `custom_fields` map to IssueTemplate struct so templates can specify default values (e.g. `Priority: Medium`). On new issue form, org-level issue-scoped fields appear in the sidebar with template defaults pre-selected. NewIssuePost saves the values after issue creation. The API create issue endpoint also accepts `custom_fields` by name. Closes #493 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 21:47:15 -05:00
Jonathan Miller	539619be2f	feat(api): custom fields API for org definitions, repo metadata, and issue values ... API endpoints: - GET/POST/DELETE /api/v1/orgs/{org}/custom-fields — org field definitions - GET/PUT /api/v1/repos/{owner}/{repo}/metadata — repo-scoped field values - GET/PUT /api/v1/repos/{owner}/{repo}/issues/{index}/custom-fields — issue values All endpoints use field names as keys (not IDs) for ergonomic access. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 19:20:21 -05:00
Jonathan Miller	fb5002d317	fix(build): replace invalid UTF-8 character in API comment ... The em dash in the TODO comment was encoded as invalid UTF-8, causing a Go compiler error. Replace with ASCII hyphen. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 07:37:42 -05:00
Jonathan Miller	c15582aa64	fix(build): remove stale custom field API routes, structs, and migration ... Comment out custom-fields API routes in api.go that referenced handler functions from the deleted routers/api/v1/repo/custom_field.go. Remove the unreferenced modules/structs/custom_field.go and the duplicate v1_25/v323 migration (superseded by v1_27/v343). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 07:26:16 -05:00
Jonathan Miller	877f39d4f4	fix(build): remove stale custom field API file from prior session ... The old API file references non-existent struct names and fields. Will be rebuilt properly after the web UI is complete. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 07:02:40 -05:00
Jonathan Miller	75f05e1c80	fix(build): update custom field API to match renamed model functions ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 06:52:56 -05:00
Jonathan Miller	0e7d3c4a34	fix(security): ownership guards, RepoScope parsing, CSRF tokens, XSS escaping ... SECURITY: Add verifyPackageOwnership/verifyKeyOwnership checks to all API handlers that accept ID parameters. Prevents cross-org access where an admin of org A could modify org B's license data. FIX: RepoScope validation now properly parses JSON arrays using json.Unmarshal instead of strings.Contains. The old approach matched substrings (repo ID "2" matched inside "12"). Now uses typed int64 comparison. FIX: Add {{$.CsrfTokenHtml}} to both delete confirmation modal forms (package and key) in repo and org templates. Without CSRF tokens, the form-fetch-action POST requests would be rejected. FIX: HTML-escape release notes in WordPress changelog to prevent XSS via malicious release note content reaching WP admin dashboards. FIX: Parse AllowedChannels JSON format before comma-split fallback to avoid garbage values from splitting JSON arrays by comma. FIX: Add missing third return value (false) on error path in validateUpdateKey to prevent compile error. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-02 06:59:29 -05:00