Allow restricting tokens to selected repositories #12266

New Issue

GiteaMirror · 2025-11-02T10:03:56-06:00

GiteaMirror commented

2025-11-02 10:03:56 -06:00

Originally created by @sugar700 on GitHub (Dec 29, 2023).

Feature Description

On GitHub, it's possible to restrict fine-grained tokens (https://github.com/settings/personal-access-tokens/new) to select repositories. For instance, it's possible to say that a token should only work for repos a/b and a/c, but not a/d. I think such functionality would make sense on Gitea as well. Such a restricted scope would comply with Principle of Least Privilege.

Screenshots

Originally created by @sugar700 on GitHub (Dec 29, 2023). ### Feature Description On GitHub, it's possible to restrict fine-grained tokens (https://github.com/settings/personal-access-tokens/new) to select repositories. For instance, it's possible to say that a token should only work for repos `a/b` and `a/c`, but not `a/d`. I think such functionality would make sense on Gitea as well. Such a restricted scope would comply with [Principle of Least Privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege). ### Screenshots ![](https://github.com/go-gitea/gitea/assets/1297598/362ff04f-037d-404d-a6e3-356367d83756)

GiteaMirror added the type/proposal label 2025-11-02 10:03:56 -06:00

GiteaMirror commented

2025-11-02 10:03:57 -06:00

@melato commented on GitHub (Jan 11, 2025):

Adding permission configuration to tokens makes it harder to rotate them, because you have to duplicate the configuration of the old token in the new token.

If you restrict tokens to selected repositories, why not restrict ssh keys to selected repositories too?

If you are an admin in the gitea instance, you can create a user that can access only the selected repositories, and create tokens or ssh keys for that user. This user should not have permissions to login, create repositories, or create organizations.

An alternative feature might be to create an entity (virtual user) with its own ssh keys, tokens, and permissions.
Then move the current token permissions (scopes) from the token to the virtual user.

@melato commented on GitHub (Jan 11, 2025): Adding permission configuration to tokens makes it harder to rotate them, because you have to duplicate the configuration of the old token in the new token. If you restrict tokens to selected repositories, why not restrict ssh keys to selected repositories too? If you are an admin in the gitea instance, you can create a user that can access only the selected repositories, and create tokens or ssh keys for that user. This user should not have permissions to login, create repositories, or create organizations. An alternative feature might be to create an entity (virtual user) with its own ssh keys, tokens, and permissions. Then move the current token permissions (scopes) from the token to the virtual user.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#12266