Preconfigure OAuth Git credential helpers

[hickford]

OAuth Git credential helpers are universally useful so preregister on every instance. https://git-scm.com/doc/credential-helpers

Fixes #25189

[hickford]

Tested, working

[denyskon]

I'm not a fan of that approach, because even if the admin explicitly deletes that OAuth application, it reappears on restart. I don't think that's wanted behavior.

How about the following idea:

1. Add a (prechecked?) checkbox on installation page if OAuth applications for git credential helpers should be created
2. Create them directly after install
3. Add a gitea admin subcommand to create the OAuth applications for existing instances or if they were deleted previously

[lunny]

Or we can have a configuration to enable/disable the feature.

[denyskon]

The problem as it seems to me is that our system of OAuth applications isn't made for preconfigured ones.

If we make a configuration option for this, we'd have to decide how to handle if something changes manually, for example an admin deletes one of the predefined OAuth apps while keeping the configuration parameter. This would probably result in the same thing I described in my previous comment - deleted OAuth apps reappearing again.

What we could do is creating another field for OAuth apps where we set whether they are visible are hidden in the UI.

I still think the best way to do it though would be a checkbox on the installation page, and then we maybe could add a button in the OAuth apps UI to recreate those OAuth apps if they were deleted.

[hickford]

even if the admin explicitly deletes that OAuth application, it reappears on restart. I don't think that's wanted behavior.

I agree, that's unexpected.

add a button in the OAuth apps UI to recreate those OAuth apps if they were deleted

I can't think why an admin would want to delete these Git credential helper OAuth apps (or later recreate them). If admin wants to disable HTTPS authentication, they can set existing configuration DISABLE_HTTP_GIT. Deleting the apps wouldn't actually block Git Credential Manager or git-credential-oauth, just break their default configuration, and force users to do manual configuration. To block them completely, admin would have to disable OAuth entirely with oauth.ENABLE = false.

Security is strong -- Gitea requires individual users consent to authorize the apps on each authentication (assuming #25061) https://imgur.com/a/7RRUPES . The applications are registered with loopback redirect URI 127.0.0.1 , so unlike web apps, there's no risk of domain hijacking. They are public clients, not confidential clients, so there's no risk of secret leakage because they don't have secrets.

[hickford]

if the admin explicitly deletes that OAuth application, it reappears on restart

I've added a config option to prevent the applications being recreated, though I can't think when this would be useful.

[a1012112796]

how about add a subcommand like ./gitea manager init-git-credential to insert this record into db?

[denyskon]

@hickford I proposed another solution in #26291. I'll close this PR for now, feel free to reopen if you don't like my proposal.