Subscription API Routes Broken

[kdumontnu]

Description

We're trying to write a script to unsubscribe (unwatch) users from all repos, but running into some issues. It looks like these API routes are broken in a couple of ways.

• First, I created a token with read + write access to all repos (non-admin user)

Then, using that token on a repo I own:

curl -X 'GET' \
  'https://try.gitea.io/api/v1/repos/kdumontnu/template/subscription' \
  -H 'accept: application/json' \
  -H 'Authorization: ---'

returns a 500 error

---

Next, when I try "PUT" or "DELETE", I get a 401 error. "token is required". I should have access to this repo and I've provided all of the token routes.

Gitea Version

1.22-dev

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

try.gitea.io

Database

None

[jackHay22]

It looks like the GET endpoint doesn't currently require a token. I don't think that explains the 500 but I'll look into it. @kdumontnu For the PUT and DELETE endpoints the issue may be the formatting of your API token. The token value must be prepended by token in the header:

curl -X 'GET' \
  'https://try.gitea.io/api/v1/repos/kdumontnu/template/subscription' \
  -H 'accept: application/json' \
  -H 'Authorization: token ---'

Edit: requiring a token for the GET endpoint fixes the issue (by populating ctx.Doer).

[kdumontnu]

It looks like the GET endpoint doesn't currently require a token. I don't think that explains the 500 but I'll look into it. @kdumontnu For the PUT and DELETE endpoints the issue may be the formatting of your API token. The token value must be prepended by token in the header:

curl -X 'GET' \
  'https://try.gitea.io/api/v1/repos/kdumontnu/template/subscription' \
  -H 'accept: application/json' \
  -H 'Authorization: token ---'

Edit: requiring a token for the GET endpoint fixes the issue (by populating ctx.Doer).

I just used the swagger UI for the API. If that doesn't work then maybe there's another bug.

[jackHay22]

I just used the swagger UI for the API. If that doesn't work then maybe there's another bug.

Unfortunately, it's a manual step in Swagger:

[kdumontnu]

I just used the swagger UI for the API. If that doesn't work then maybe there's another bug.

Unfortunately, it's a manual step in Swagger:

Gross - good catch.

[kdumontnu]

So, once I fix the token header (thanks!), and I try to watch/unwatch a repo that I have access to, but I don't own, I get a 404.

The problem, as I see it, is that this route is a repo route when it should be a user route.

• For instance, can a repo owner "unwatch" people from their repos?

[jackHay22]

So, once I fix the token header (thanks!), and I try to watch/unwatch a repo that I have access to, but I don't own, I get a 404.

@kdumontnu I haven't been able to recreate this 404 with a public or private repo; watch/unwatch works for a user other than the owner (the user that the token belongs to).

The problem, as I see it, is that this route is a repo route when it should be a user route.

Is the idea to create a route by which a user other than ctx.Doer (the token owner) can be watched/unwatched? (i.e. the repo owner could unwatch a different user)

[kdumontnu]

So, once I fix the token header (thanks!), and I try to watch/unwatch a repo that I have access to, but I don't own, I get a 404.

@kdumontnu I haven't been able to recreate this 404 with a public or private repo; watch/unwatch works for a user other than the owner (the user that the token belongs to).

The problem, as I see it, is that this route is a repo route when it should be a user route.

Is the idea to create a route by which a user other than ctx.Doer (the token owner) can be watched/unwatched? (i.e. the repo owner could unwatch a different user)

You're able to subscribe + unsubscribe from public repos?

If I run

curl -X 'PUT' \
  'https://try.gitea.io/api/v1/repos/sdweiyu/%20test/subscription' \
  -H 'accept: application/json' \
  -H 'Authorization: token <full read/write token>'

I get a 404 response (this is just a random public repository I found). That implied to me that the API isn't using the right permissions.