#!/usr/bin/env python3 """Read-only Gitea repo 全量盤點工具。 此工具可查詢 Gitea org/user API endpoint，或吃管理介面匯出的 JSON。 執行期間不寫入 Gitea，也不會把 API token 寫入輸出檔。 """ from __future__ import annotations import argparse import json import os import sys import urllib.error import urllib.request from pathlib import Path from urllib.parse import quote, urlencode, urlsplit, urlunsplit def redact_url(value: str) -> str: if "://" not in value: if "@" in value and ":" in value.split("@", 1)[1]: return value.split("@", 1)[1] return value parts = urlsplit(value) netloc = parts.netloc.split("@", 1)[-1] return urlunsplit((parts.scheme, netloc, parts.path, parts.query, parts.fragment)) def api_get_json(url: str, token: str | None, timeout: int) -> tuple[int, object]: headers = { "Accept": "application/json", "User-Agent": "awoooi-security-inventory/1.0", } if token: headers["Authorization"] = f"token {token}" request = urllib.request.Request(url, headers=headers, method="GET") try: with urllib.request.urlopen(request, timeout=timeout) as response: body = response.read().decode("utf-8") return response.status, json.loads(body) except urllib.error.HTTPError as exc: body = exc.read().decode("utf-8", errors="replace") try: payload: object = json.loads(body) except json.JSONDecodeError: payload = {"message": body.strip()} return exc.code, payload def repo_summary(repo: dict[str, object], github_owner: str | None) -> dict[str, object]: owner = repo.get("owner") if isinstance(repo.get("owner"), dict) else {} owner_name = owner.get("login") if isinstance(owner, dict) else None raw_full_name = str(repo.get("full_name") or "") name = str(repo.get("name") or raw_full_name.rsplit("/", 1)[-1] or "") full_name = raw_full_name or (f"{owner_name}/{name}" if owner_name else name) clone_url = str(repo.get("clone_url") or repo.get("html_url") or "") ssh_url = str(repo.get("ssh_url") or "") github_repo = f"{github_owner}/{name}" if github_owner and name else "" return { "gitea_repo": full_name, "name": name, "owner": owner_name or "", "private": bool(repo.get("private", False)), "empty": bool(repo.get("empty", False)), "archived": bool(repo.get("archived", False)), "default_branch": str(repo.get("default_branch") or ""), "clone_url_redacted": redact_url(clone_url), "ssh_url_redacted": redact_url(ssh_url), "github_repo_candidate": github_repo, } def load_export(path: Path) -> object: return json.loads(path.read_text(encoding="utf-8")) def extract_repos(payload: object) -> list[dict[str, object]]: if isinstance(payload, list): return [item for item in payload if isinstance(item, dict)] if isinstance(payload, dict): for key in ("data", "repos", "repositories"): value = payload.get(key) if isinstance(value, list): return [item for item in value if isinstance(item, dict)] return [] def build_inventory( *, base_url: str, org: str, github_owner: str | None, token_present: bool, http_status: int | None, payload: object, query_mode: str, query: str, ) -> dict[str, object]: repos = [repo_summary(repo, github_owner) for repo in extract_repos(payload)] if query_mode == "export": visibility_scope = "admin_export" elif token_present: visibility_scope = "authenticated" else: visibility_scope = "public_only" if repos and visibility_scope in ("authenticated", "admin_export"): status = "ok" elif repos: status = "partial" else: status = "blocked" blocking_reason = "" if repos and status == "partial": blocking_reason = "未提供 token，結果只代表公開可見 repo；private/internal repos 仍需只讀 token 或管理匯出" elif not repos: if http_status in (401, 403): blocking_reason = "Gitea API 需要只讀 token 或權限不足" elif query_mode == "search" and http_status == 200: blocking_reason = "Gitea public repo search 未回傳 repo，可能沒有公開 repo 或需要只讀 token" elif http_status == 404: blocking_reason = "Gitea API 查無 org/user repos，需確認 org 名稱或使用管理匯出" elif http_status is None: blocking_reason = "匯入檔案沒有可解析的 repo list" else: blocking_reason = f"Gitea API 回應無 repo list，HTTP {http_status}" return { "schema_version": "gitea_repo_inventory_v1", "base_url": redact_url(base_url.rstrip("/")), "org": org, "github_owner": github_owner or "", "query_mode": query_mode, "query": query, "visibility_scope": visibility_scope, "token_present": token_present, "http_status": http_status, "status": status, "blocking_reason": blocking_reason, "repo_count": len(repos), "repos": repos, } def write_markdown(inventory: dict[str, object], path: Path) -> None: lines = [ "# Gitea Repo 全量盤點快照", "", "| 項目 | 值 |", "|------|----|", f"| 狀態 | `{inventory['status']}` |", f"| Gitea base URL | `{inventory['base_url']}` |", f"| Org/User | `{inventory['org']}` |", f"| GitHub owner 候選 | `{inventory['github_owner']}` |", f"| 查詢模式 | `{inventory.get('query_mode', '')}` |", f"| 查詢字串 | `{inventory.get('query', '')}` |", f"| 可見性範圍 | `{inventory.get('visibility_scope', '')}` |", f"| 是否提供 token | `{inventory['token_present']}` |", f"| HTTP status | `{inventory['http_status']}` |", f"| Repo 數量 | `{inventory['repo_count']}` |", f"| 阻塞原因 | {inventory['blocking_reason'] or '無'} |", "", "## Repo 清單", "", "| Gitea repo | GitHub 候選 | default branch | private | archived |", "|------------|------------------|----------------|---------|----------|", ] repos = inventory.get("repos") if isinstance(repos, list): for repo in repos: if not isinstance(repo, dict): continue lines.append( "| " + " | ".join( [ f"`{repo.get('gitea_repo', '')}`", f"`{repo.get('github_repo_candidate', '')}`", f"`{repo.get('default_branch', '')}`", f"`{repo.get('private', '')}`", f"`{repo.get('archived', '')}`", ] ) + " |" ) lines.extend( [ "", "> 注意：本檔由 read-only Gitea inventory 工具產生，不包含 API token 或 remote URL 帳密。", "", ] ) path.write_text("\n".join(lines), encoding="utf-8") def main() -> int: parser = argparse.ArgumentParser() parser.add_argument("--base-url", default="http://192.168.0.110:3001") parser.add_argument("--org", default="wooo") parser.add_argument("--scope", choices=["org", "user", "search"], default="org") parser.add_argument("--query", default="") parser.add_argument("--limit", type=int, default=50) parser.add_argument("--github-owner", default="") parser.add_argument("--token-env", default="GITEA_READONLY_TOKEN") parser.add_argument("--input-json") parser.add_argument("--output-json", required=True) parser.add_argument("--output-md", required=True) parser.add_argument("--timeout", type=int, default=5) args = parser.parse_args() token = os.environ.get(args.token_env) http_status: int | None = None if args.input_json: payload = load_export(Path(args.input_json)) query_mode = "export" query = "input-json" else: if args.scope == "search": params = {"limit": str(args.limit)} if args.query: params["q"] = args.query url = f"{args.base_url.rstrip('/')}/api/v1/repos/search?{urlencode(params)}" else: quoted = quote(args.org, safe="") prefix = "orgs" if args.scope == "org" else "users" url = f"{args.base_url.rstrip('/')}/api/v1/{prefix}/{quoted}/repos" http_status, payload = api_get_json(url, token, args.timeout) query_mode = args.scope query = args.query inventory = build_inventory( base_url=args.base_url, org=args.org, github_owner=args.github_owner or None, token_present=bool(token), http_status=http_status, payload=payload, query_mode=query_mode, query=query, ) Path(args.output_json).write_text( json.dumps(inventory, ensure_ascii=False, indent=2) + "\n", encoding="utf-8", ) write_markdown(inventory, Path(args.output_md)) if inventory["status"] == "blocked": print(inventory["blocking_reason"], file=sys.stderr) return 2 return 0 if __name__ == "__main__": raise SystemExit(main())