Sources: accept login:password Basic credential for Gitea (API + git store)

src/infra/environment.ts

@@ -31,11 +31,13 @@ async function writeGiteaCredentials(file: string, gitea: GiteaAccount,
   env: Record<string, string | undefined>): Promise<void> {
   const token = env[gitea.tokenEnv] ?? ''
   if (!token) throw new SetupError('giteaTokenMissing', { name: gitea.tokenEnv })
+  // A Basic-style credential (`login:password`) stores only the password part for git; a token stores itself.
+  const secret = token.includes(':') ? token.slice(token.indexOf(':') + 1) : token
   const origin = new URL(gitea.url).origin
   const scheme = origin.slice(0, origin.indexOf('://'))
   const host = origin.slice(origin.indexOf('://') + 3)
   const temporary = `${file}.${process.pid}.tmp`
-  await writeFile(temporary, `${scheme}://${encodeURIComponent(gitea.login)}:${encodeURIComponent(token)}@${host}\n`, { mode: 0o600 })
+  await writeFile(temporary, `${scheme}://${encodeURIComponent(gitea.login)}:${encodeURIComponent(secret)}@${host}\n`, { mode: 0o600 })
   await rename(temporary, file)
 }
 

src/sources/gitea-api.ts

@@ -11,7 +11,10 @@ export type GiteaFetch = (url: string, init: { method: string; headers: Record<s
 
 export interface GiteaTarget { url: string; token: string }
 
-/** Reads the token from `env[tokenEnv]`; the token is never stored in Settings, only its variable name is. */
+/** The credential scheme: `login:password` (any value with a colon) authenticates as HTTP Basic, anything else as a token. */
+export const giteaAuthorization = (secret: string): string =>
+  secret.includes(':') ? `Basic ${Buffer.from(secret, 'utf8').toString('base64')}` : `token ${secret}`
+/** Reads the credential from `env[tokenEnv]`; only its variable name is stored in Settings, never the value. */
 export function giteaClient(url: string, tokenEnv: string, env: Record<string, string | undefined> = process.env,
   fetchImpl: GiteaFetch = fetch): GiteaApi {
   if (!url) throw new Error('The Gitea Source names no URL')
@@ -27,7 +30,7 @@ export class GiteaApi {
   async raw(path: string, init: { method?: string; body?: unknown; signal?: AbortSignal } = {}): Promise<GiteaResponse> {
     return await this.fetchImpl(`${this.target.url}/api/v1/${path.replace(/^\//, '')}`, {
       method: init.method ?? 'GET',
-      headers: { authorization: `token ${this.target.token}`,
+      headers: { authorization: giteaAuthorization(this.target.token),
         ...(init.body === undefined ? {} : { 'content-type': 'application/json' }) },
       ...(init.body === undefined ? {} : { body: JSON.stringify(init.body) }),
       ...(init.signal === undefined ? {} : { signal: init.signal }) })