fix: remove unused net/http import in require2fa.go

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Merge pull request 'feat: smart wiki filenames' (#215 ) from fix/wiki-smart-filenames into dev
2026-05-26 13:39:15 -05:00 · 2026-05-26 18:28:14 +00:00 · 2026-05-26 18:28:05 +00:00 · 2026-05-26 13:22:21 -05:00 · 2026-05-26 13:11:15 -05:00 · 2026-05-26 17:55:43 +00:00
21 changed files with 252 additions and 39 deletions
@@ -410,6 +410,7 @@ func prepareMigrationTasks() []*migration {

 		newMigration(331, "Add ActionRunAttempt model and related action fields", v1_27.AddActionRunAttemptModel),
 		newMigration(332, "Add org-level branch protection rulesets", v1_27.AddOrgProtectedBranchTable),
+		newMigration(333, "Add require_2fa to user table for org enforcement", v1_27.AddRequire2FAToUser),
 	}
 	return preparedMigrations
 }
@@ -0,0 +1,16 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"xorm.io/xorm"
+)
+
+func AddRequire2FAToUser(x *xorm.Engine) error {
+	type User struct {
+		Require2FA bool `xorm:"NOT NULL DEFAULT false"`
+	}
+	_, err := x.SyncWithOptions(xorm.SyncOptions{IgnoreDropIndices: true}, new(User))
+	return err
+}
@@ -117,6 +117,9 @@ type User struct {
 	// Maximum repository creation limit, -1 means use global default
 	MaxRepoCreation int `xorm:"NOT NULL DEFAULT -1"`

+	// Require2FA when true (and user is an org), all org members must have 2FA enabled
+	Require2FA bool `xorm:"NOT NULL DEFAULT false"`
+
 	// IsActive true: primary email is activated, user can access Web UI and Git SSH.
 	// false: an inactive user can only log in Web UI for account operations (ex: activate the account by email), no other access.
 	IsActive bool `xorm:"INDEX"`
@@ -63,7 +63,7 @@ func TestFile(t *testing.T) {
 		{
 			name:      "tags.py",
 			code:      "<>",
-			want:      lines(`<span class="o">&lt;</span><span class="o">&gt;</span>`),
+			want:      lines(`<span class="o">&lt;&gt;</span>`),
 			lexerName: "Python",
 		},
 		{
@@ -102,7 +102,7 @@ c=2
 <span class="n">def</span><span class="p">:</span>\n
    <span class="n">a</span><span class="o">=</span><span class="mi">1</span>\n
 \n
-<span class="n">b</span><span class="o">=</span><span class="sa"></span><span class="s1">&#39;</span><span class="s1">&#39;</span>\n
+<span class="n">b</span><span class="o">=</span><span class="s1">&#39;&#39;</span>\n
    \n
 <span class="n">c</span><span class="o">=</span><span class="mi">2</span>`,
 			),
@@ -114,6 +114,18 @@ c=2
 			want:      []template.HTML{"<span class=\"c1\">--\n</span>", `<span class="k">SELECT</span>`},
 			lexerName: "SQL",
 		},
+		{
+			name: "test.http",
+			code: `HTTP/1.0 400 Bad request
+Content-Type: text/html
+
+<html></html>`,
+			want: lines(`<span class="kr">HTTP</span><span class="o">/</span><span class="m">1.0</span> <span class="m">400</span> <span class="ne">Bad request</span>\n
+<span class="n">Content-Type</span><span class="o">:</span> <span class="l">text/html</span>\n
+\n
+<span class="p">&lt;</span><span class="nt">html</span><span class="p">&gt;&lt;/</span><span class="nt">html</span><span class="p">&gt;</span>`),
+			lexerName: "HTTP",
+		},
 	}

 	for _, tt := range tests {
@@ -288,24 +288,24 @@ func detectChromaLexerWithAnalyze(fileName, lang string, code []byte) chroma.Lex

 	// if lang is provided, and it matches a lexer, use it directly
 	if byLang {
-		return lexer
+		return chroma.Coalesce(lexer)
 	}

 	// if a lexer is detected and there is no conflict for the file extension, use it directly
 	fileExt := path.Ext(fileName)
 	_, hasConflicts := chromaLexers().conflictingExtLangMap[fileExt]
 	if !hasConflicts && lexer != lexers.Fallback {
-		return lexer
+		return chroma.Coalesce(lexer)
 	}

 	// try to detect language by content, for best guessing for the language
 	// when using "code" to detect, analyze.GetCodeLanguage is slow, it iterates many rules to detect language from content
 	analyzedLanguage := analyze.GetCodeLanguage(fileName, code)
-	lexer = DetectChromaLexerByFileName(fileName, analyzedLanguage)
+	lexer, _ = detectChromaLexerByFileName(fileName, analyzedLanguage)
 	if lexer == lexers.Fallback {
 		if analyzedLanguage != enry.OtherLanguage {
 			log.Warn("No chroma lexer found for enry detected language: %s (file: %s), need to fix the language mapping between enry and chroma.", analyzedLanguage, fileName)
 		}
 	}
-	return lexer
+	return chroma.Coalesce(lexer)
 }
@@ -39,6 +39,13 @@ var (
 		Channel:  "stable",
 	}

+	// LoginNotification configuration for sign-in alerts
+	LoginNotification = struct {
+		Enabled bool
+	}{
+		Enabled: true,
+	}
+
 	// IsInTesting indicates whether the testing is running (unit test or integration test). It can be used for:
 	// * Skip nonsense error logs during testing caused by unreliable code (TODO: this is only a temporary solution, we should make the test code more reliable)
 	// * Panic in dev or testing mode to make the problem more obvious and easier to debug
@@ -171,6 +178,7 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 	loadOtherFrom(cfg)
 	loadUpdateCheckerFrom(cfg)
 	loadNtfyFrom(cfg)
+	loadLoginNotificationFrom(cfg)
 	return nil
 }

@@ -181,6 +189,11 @@ func loadUpdateCheckerFrom(cfg ConfigProvider) {
 	UpdateChecker.Channel = sec.Key("CHANNEL").MustString(UpdateChecker.Channel)
 }

+func loadLoginNotificationFrom(cfg ConfigProvider) {
+	sec := cfg.Section("login_notification")
+	LoginNotification.Enabled = sec.Key("ENABLED").MustBool(true)
+}
+
 func loadRunModeFrom(rootCfg ConfigProvider) {
 	rootSec := rootCfg.Section("")
 	RunUser = rootSec.Key("RUN_USER").MustString(user.CurrentUsername())
@@ -440,6 +440,9 @@ func handleSignInFull(ctx *context.Context, u *user_model.User, remember bool) {
 		ctx.ServerError("UpdateUser", err)
 		return
 	}
+
+	// Send login notification (email + ntfy)
+	go mailer.SendLoginNotification(u, ctx.RemoteAddr(), ctx.Req.UserAgent())
 }

 // extractUserNameFromOAuth2 tries to extract a normalized username from the given OAuth2 user.
@@ -0,0 +1,37 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package org
+
+import (
+	auth_model "git.mokoconsulting.tech/MokoConsulting/MokoGitea/models/auth"
+	"git.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/setting"
+	"git.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// Check2FARequirement checks if the current org requires 2FA and if the user has it enabled.
+// If the user doesn't have 2FA and the org requires it, redirect to 2FA setup page.
+func Check2FARequirement(ctx *context.Context) {
+	if ctx.Org == nil || ctx.Org.Organization == nil || ctx.Doer == nil {
+		return
+	}
+
+	if !ctx.Org.Organization.Require2FA {
+		return
+	}
+
+	// Check if user has 2FA enabled
+	has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, ctx.Doer.ID)
+	if err != nil {
+		ctx.ServerError("HasTwoFactorOrWebAuthn", err)
+		return
+	}
+
+	if has {
+		return
+	}
+
+	// User doesn't have 2FA — show warning and redirect to settings
+	ctx.Flash.Warning("This organization requires two-factor authentication. Please enable 2FA to continue.")
+	ctx.Redirect(setting.AppSubURL + "/user/settings/security")
+}
@@ -80,12 +80,14 @@ func SettingsPost(ctx *context.Context) {
 		return
 	}

+	require2FA := ctx.FormBool("require_2fa")
 	opts := &user_service.UpdateOptions{
 		FullName:                  optional.FromPtr(form.FullName),
 		Description:               optional.FromPtr(form.Description),
 		Website:                   optional.FromPtr(form.Website),
 		Location:                  optional.FromPtr(form.Location),
 		RepoAdminChangeTeamAccess: optional.FromPtr(form.RepoAdminChangeTeamAccess),
+		Require2FA:                optional.Some(require2FA),
 	}
 	if ctx.Doer.IsAdmin {
 		opts.MaxRepoCreation = optional.FromPtr(form.MaxRepoCreation)
@@ -960,7 +960,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 			m.Get("/milestones/{team}", reqMilestonesDashboardPageEnabled, user.Milestones)
 			m.Post("/members/action/{action}", org.MembersAction)
 			m.Get("/teams", org.Teams)
-		}, context.OrgAssignment(context.OrgAssignmentOptions{RequireMember: true, RequireTeamMember: true}))
+		}, context.OrgAssignment(context.OrgAssignmentOptions{RequireMember: true, RequireTeamMember: true}), org.Check2FARequirement)

 		m.Group("/{org}", func() {
 			m.Get("/teams/{team}", org.TeamMembers)
@@ -0,0 +1,84 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package mailer
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	user_model "git.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"git.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"git.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/setting"
+	sender_service "git.mokoconsulting.tech/MokoConsulting/MokoGitea/services/mailer/sender"
+)
+
+// SendLoginNotification sends email and ntfy notifications when a user signs in.
+func SendLoginNotification(u *user_model.User, ip, userAgent string) {
+	if !setting.LoginNotification.Enabled {
+		return
+	}
+
+	timestamp := time.Now().UTC().Format("2006-01-02 15:04:05 UTC")
+	subject := fmt.Sprintf("[%s] New sign-in: %s", setting.AppName, u.Name)
+
+	body := fmt.Sprintf(`New sign-in detected
+
+Account:    %s (%s)
+IP Address: %s
+Browser:    %s
+Time:       %s
+Instance:   %s
+
+If this wasn't you, change your password immediately and review your active sessions.
+
+— %s`, u.Name, u.Email, ip, userAgent, timestamp, setting.AppURL, setting.AppName)
+
+	// Email notification
+	if setting.MailService != nil && u.Email != "" {
+		msg := sender_service.NewMessage(u.EmailTo(), subject, body)
+		msg.Info = fmt.Sprintf("Login notification for %s", u.Name)
+		SendAsync(msg)
+		log.Debug("Login notification email sent to %s", u.Email)
+	}
+
+	// ntfy push notification
+	if setting.Ntfy.Enabled && setting.Ntfy.ServerURL != "" {
+		go sendLoginNtfy(subject, u.Name, ip, timestamp)
+	}
+}
+
+func sendLoginNtfy(title, username, ip, timestamp string) {
+	body := fmt.Sprintf("User: %s\nIP: %s\nTime: %s", username, ip, timestamp)
+	url := fmt.Sprintf("%s/%s", setting.Ntfy.ServerURL, setting.Ntfy.DefaultTopic)
+
+	req, err := http.NewRequest("POST", url, bytes.NewBufferString(body))
+	if err != nil {
+		log.Error("ntfy login: create request: %v", err)
+		return
+	}
+
+	req.Header.Set("Title", title)
+	req.Header.Set("Priority", "default")
+	req.Header.Set("Tags", "key,login")
+	req.Header.Set("Click", setting.AppURL+"-/admin")
+	if setting.Ntfy.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+setting.Ntfy.Token)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Error("ntfy login: send: %v", err)
+		return
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+
+	if resp.StatusCode >= 300 {
+		log.Error("ntfy login: status %d", resp.StatusCode)
+	}
+}
@@ -9,6 +9,7 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"io"
+	"strings"

 	repo_model "git.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
 	"git.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
@@ -17,9 +18,8 @@ import (
 )

 // GenerateReleaseChecksums computes SHA256 checksums for all attachments
-// on a release and adds a checksums.sha256 manifest file as an attachment.
+// on a release and creates a [filename].sha256 file for each one.
 func GenerateReleaseChecksums(ctx context.Context, rel *repo_model.Release) error {
-	// Load attachments into rel.Attachments
 	if err := repo_model.GetReleaseAttachments(ctx, rel); err != nil {
 		return fmt.Errorf("GetReleaseAttachments: %w", err)
 	}
@@ -28,20 +28,19 @@ func GenerateReleaseChecksums(ctx context.Context, rel *repo_model.Release) erro
 		return nil
 	}

-	// Remove existing checksums file if present
+	// Remove existing .sha256 files
 	for _, a := range rel.Attachments {
-		if a.Name == "checksums.sha256" {
+		if strings.HasSuffix(a.Name, ".sha256") {
 			if err := repo_model.DeleteAttachment(ctx, a, true); err != nil {
-				log.Warn("Failed to delete old checksums.sha256: %v", err)
+				log.Warn("Failed to delete old %s: %v", a.Name, err)
 			}
-			break
 		}
 	}

-	// Compute SHA256 for each attachment
-	var manifest bytes.Buffer
+	// Compute SHA256 for each non-checksum attachment and create individual .sha256 files
+	created := 0
 	for _, a := range rel.Attachments {
-		if a.Name == "checksums.sha256" {
+		if strings.HasSuffix(a.Name, ".sha256") {
 			continue
 		}

@@ -59,24 +58,24 @@ func GenerateReleaseChecksums(ctx context.Context, rel *repo_model.Release) erro
 		}
 		fr.Close()

-		fmt.Fprintf(&manifest, "%x  %s\n", h.Sum(nil), a.Name)
+		checksumContent := fmt.Sprintf("%x  %s\n", h.Sum(nil), a.Name)
+		checksumReader := bytes.NewBufferString(checksumContent)
+
+		checksumAttach := &repo_model.Attachment{
+			RepoID:    rel.RepoID,
+			ReleaseID: rel.ID,
+			Name:      a.Name + ".sha256",
+		}
+
+		if _, err := attachment_service.NewAttachment(ctx, checksumAttach, checksumReader, int64(len(checksumContent))); err != nil {
+			log.Warn("Failed to create %s: %v", checksumAttach.Name, err)
+			continue
+		}
+		created++
 	}

-	if manifest.Len() == 0 {
-		return nil
+	if created > 0 {
+		log.Info("Generated %d .sha256 checksum files for release %s (repo %d)", created, rel.TagName, rel.RepoID)
 	}
-
-	// Create the checksums.sha256 attachment
-	checksumAttach := &repo_model.Attachment{
-		RepoID:    rel.RepoID,
-		ReleaseID: rel.ID,
-		Name:      "checksums.sha256",
-	}
-
-	if _, err := attachment_service.NewAttachment(ctx, checksumAttach, &manifest, int64(manifest.Len())); err != nil {
-		return fmt.Errorf("create checksums.sha256 attachment: %w", err)
-	}
-
-	log.Info("Generated checksums.sha256 for release %s (repo %d)", rel.TagName, rel.RepoID)
 	return nil
 }
@@ -56,6 +56,7 @@ type UpdateOptions struct {
 	EmailNotificationsPreference optional.Option[string]
 	SetLastLogin                 bool
 	RepoAdminChangeTeamAccess    optional.Option[bool]
+	Require2FA                   optional.Option[bool]
 }

 func UpdateUser(ctx context.Context, u *user_model.User, opts *UpdateOptions) error {
@@ -169,6 +170,11 @@ func UpdateUser(ctx context.Context, u *user_model.User, opts *UpdateOptions) er

 		cols = append(cols, "repo_admin_change_team_access")
 	}
+	if opts.Require2FA.Has() {
+		u.Require2FA = opts.Require2FA.Value()
+
+		cols = append(cols, "require_2fa")
+	}

 	if opts.EmailNotificationsPreference.Has() {
 		u.EmailNotificationsPreference = opts.EmailNotificationsPreference.Value()
@@ -6,6 +6,7 @@ package wiki
 import (
 	"net/url"
 	"path"
+	"regexp"
 	"strings"

 	repo_model "git.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
@@ -148,10 +149,24 @@ func WebPathFromRequest(s string) WebPath {
 	return WebPath(s)
 }

+var multiHyphenRe = regexp.MustCompile(`-{2,}`)
+var nonAlphanumRe = regexp.MustCompile(`[^a-zA-Z0-9\-]`)
+
+// sanitizeWikiTitle converts a user-provided title into a clean, URL-friendly slug.
+// Spaces and special characters become hyphens, consecutive hyphens collapse to one.
+func sanitizeWikiTitle(title string) string {
+	title = strings.TrimSpace(title)
+	title = strings.ReplaceAll(title, " ", "-")
+	title = nonAlphanumRe.ReplaceAllString(title, "-")
+	title = multiHyphenRe.ReplaceAllString(title, "-")
+	title = strings.Trim(title, "-")
+	return title
+}
+
 func UserTitleToWebPath(base, title string) WebPath {
 	// TODO: no support for subdirectory, because the old wiki code's behavior is always using %2F, instead of subdirectory.
 	// So we do not add the support for writing slashes in title at the moment.
-	title = strings.TrimSpace(title)
+	title = sanitizeWikiTitle(title)
 	title = util.PathJoinRelX(base, escapeSegToWeb(title, false))
 	if title == "" || title == "." {
 		title = "unnamed"
@@ -1,12 +1,12 @@
 <div class="flex-container-nav">
-	<div class="ui fluid vertical menu">
+	<div class="ui fluid vertical menu" style="text-align: left !important;">
 		<div class="header item">{{ctx.Locale.Tr "admin.settings"}}</div>

 		<details class="item toggleable-item" {{if or .PageIsAdminDashboard .PageIsAdminSelfCheck}}open{{end}}>
 			<summary>{{svg "octicon-tools" 16}} {{ctx.Locale.Tr "admin.maintenance"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsAdminDashboard}}active {{end}}item" href="{{AppSubUrl}}/-/admin">
-					{{svg "octicon-dashboard" 16}} {{ctx.Locale.Tr "admin.dashboard"}}
+					{{svg "octicon-meter" 16}} {{ctx.Locale.Tr "admin.dashboard"}}
 				</a>
 				<a class="{{if .PageIsAdminSelfCheck}}active {{end}}item" href="{{AppSubUrl}}/-/admin/self_check">
 					{{svg "octicon-check-circle" 16}} {{ctx.Locale.Tr "admin.self_check"}}
@@ -36,6 +36,7 @@
 		</div>
 		<a href="{{AssetUrlPrefix}}/licenses.txt">{{ctx.Locale.Tr "licenses"}}</a>
 		{{if .EnableSwagger}}<a href="{{AppSubUrl}}/api/swagger">API</a>{{end}}
+		<a href="{{HelpURL}}" target="_blank">{{ctx.Locale.Tr "help"}}</a>
 		{{template "custom/extra_links_footer" .}}
 	</div>
 </footer>
@@ -35,9 +35,7 @@

 		{{template "custom/extra_links" .}}

-		{{if not .IsSigned}}
-			<a class="item" target="_blank" href="{{HelpURL}}">{{ctx.Locale.Tr "help"}}</a>
-		{{end}}
+		<a class="item" target="_blank" href="{{HelpURL}}">{{ctx.Locale.Tr "help"}}</a>
 	</div>

 	<!-- the full dropdown menus -->
@@ -48,6 +48,16 @@
 			</div>
 			{{end}}

+			<div class="divider"></div>
+
+			<div class="inline field">
+				<div class="ui checkbox">
+					<input type="checkbox" name="require_2fa" {{if .Org.Require2FA}}checked{{end}}>
+					<label>{{svg "octicon-shield-lock" 16}} Require two-factor authentication for all members</label>
+				</div>
+				<p class="help">When enabled, organization members without 2FA configured will be prompted to set it up before accessing organization resources.</p>
+			</div>
+
 			<div class="field">
 				<button class="ui primary button">{{ctx.Locale.Tr "org.settings.update_settings"}}</button>
 			</div>
@@ -1,4 +1,7 @@
 <div class="ui container fluid">
+	<div class="tw-text-center tw-mb-4">
+		<img src="{{AssetUrlPrefix}}/img/login-logo.png" style="max-width: 220px; max-height: 80px; object-fit: contain;" onerror="this.style.display='none'">
+	</div>
 	{{if or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn)}}
 	{{template "base/alert" .}}
 	{{end}}
@@ -11,6 +11,10 @@
  width: 240px;
 }

+.flex-container-nav .ui.menu .item {
+  text-align: left;
+}
+
 /* wide sidebar on the right, used in frontpage */
 .flex-container-sidebar {
  width: 35%;
@@ -9,8 +9,8 @@ details.toggleable-item .menu {

 details.toggleable-item summary {
  display: flex;
-  justify-content: space-between;
  align-items: center;
+  gap: 0.5em;
  padding: 0.92857143em 1.14285714em;
 }

@@ -20,6 +20,7 @@ details.toggleable-item summary::-webkit-details-marker /* Safari */ {
 }

 details.toggleable-item summary::after {
+  margin-left: auto;
  transition: transform 0.25s ease;
  content: "";
  width: 14px;
@@ -35,3 +36,8 @@ details.toggleable-item summary::after {
 details.toggleable-item[open] summary::after {
  transform: rotate(90deg);
 }
+
+.flex-container-nav .ui.menu .item {
+  text-align: left !important;
+  justify-content: flex-start !important;
+}
Author	SHA1	Message	Date
Jonathan Miller	0cc7297f23	fix: remove unused net/http import in require2fa.go Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-26 13:39:15 -05:00
jmiller	9dc85cfc2d	Merge pull request 'feat: smart wiki filenames' (#215 ) from fix/wiki-smart-filenames into dev	2026-05-26 18:28:14 +00:00
jmiller	6bc0cb5bc8	Merge pull request 'feat: org-level 2FA requirement (#208 )' (#214 ) from feat/208-org-2fa-requirement into dev	2026-05-26 18:28:05 +00:00
Jonathan Miller	1fb97eeeeb	feat: smart wiki filenames — sanitize special characters to hyphens Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 3s Details New wiki page titles are now sanitized before creating the git file: - Spaces and special characters replaced with hyphens - Consecutive hyphens collapsed to single hyphen - Leading/trailing hyphens trimmed Examples: - "My Page Name" -> "My-Page-Name" - "API & Docs (v2)" -> "API-Docs-v2" - "100% Complete!!" -> "100-Complete" Only affects NEW pages. Existing wiki pages with legacy filenames (spaces, URL encoding) continue to work — the read path is unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-26 13:22:21 -05:00
Jonathan Miller	1032ae4268	feat: organization-level 2FA requirement for members (#208 ) Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details Adds a Require2FA toggle to organization settings. When enabled, org members without 2FA are redirected to the security settings page with a warning flash message. Changes: - New Require2FA field on User model (migration v333) - Org settings UI checkbox with shield-lock icon - Check2FARequirement middleware on member-required org routes - UpdateOptions extended with Require2FA field Closes #208 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-26 13:11:15 -05:00
jmiller	af1c6178ef	Merge pull request 'fix: http content file render (#207 )' (#212 ) from fix/207-http-content-render into dev	2026-05-26 17:55:43 +00:00
Giteabot	0f23219ee4	fix: http content file render (#37850 ) (#37856 ) Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details Backport #37850 Fix #37849 Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>	2026-05-26 12:54:37 -05:00
jmiller	bc475c91f6	Merge pull request 'feat: login notification via email and ntfy' (#209 ) from feat/login-notifications into dev Branch Policy Check / Verify merge target (pull_request) Successful in 2s Details PR RC Release / Build RC Release (pull_request) Successful in 21s Details	2026-05-26 16:40:51 +00:00
Jonathan Miller	25268d7dd7	feat: login notification via email and ntfy on successful sign-in Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details When a user signs in, sends notifications with username, IP address, user agent, and timestamp. Notifications go through: - Email to the user's registered address - ntfy push to the configured topic Enabled by default, configurable via app.ini: [login_notification] ENABLED = true The notification fires asynchronously (goroutine) so it doesn't block the login redirect. Hooks into handleSignInFull which is the single choke point for all auth methods (password, 2FA, OAuth). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-26 11:39:44 -05:00
jmiller	c7193abc0c	Merge pull request 'fix: help link in footer, login logo on signin page' (#205 ) from fix/help-footer-login-logo into dev Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 22s Details	2026-05-26 04:52:00 +00:00
Jonathan Miller	e6a4dfccf0	fix(ui): add help link to footer, show login logo on signin page Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details - Help link added to footer right-links (next to API and Licenses) - Login logo (login-logo.png) now shown on the signin page, not just the home page. Hidden via onerror when not uploaded. - Landing page is set to 'login' so home.tmpl never renders — the logo needed to be on signin_inner.tmpl instead. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 23:51:37 -05:00
jmiller	a5c805b0f6	Merge pull request 'fix(ui): show help link for all users' (#204 ) from fix/help-link-always-visible into dev Branch Policy Check / Verify merge target (pull_request) Successful in 2s Details PR RC Release / Build RC Release (pull_request) Successful in 24s Details	2026-05-26 04:45:56 +00:00
Jonathan Miller	46ce0a7e32	fix(ui): show help link in navbar for all users, not just anonymous Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details The help link was wrapped in {{if not .IsSigned}} which hid it for logged-in users. Removed the condition so it's always visible. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 23:45:49 -05:00
jmiller	c236c4e018	Merge pull request 'fix(ui): replace missing octicon-dashboard icon' (#202 ) from fix/missing-dashboard-icon into dev Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 20s Details	2026-05-26 04:39:00 +00:00
Jonathan Miller	b79b48b760	fix(ui): replace missing octicon-dashboard with octicon-meter Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details octicon-dashboard doesn't exist in Gitea's SVG set, causing the icon to render as raw text. octicon-meter is the equivalent gauge icon. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 23:38:53 -05:00
jmiller	22a529dfd8	Merge pull request 'rc: admin nav CSS fix' (#201 ) from rc/05.03.05 into main	2026-05-26 04:30:31 +00:00
jmiller	09dc64eef0	Merge pull request 'fix(ui): admin sidebar left-align CSS' (#200 ) from fix/admin-nav-css into dev Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 22s Details	2026-05-26 04:30:13 +00:00
Jonathan Miller	d541a07263	fix(ui): left-align admin sidebar — fix justify-content and text-align Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details Changed details.toggleable-item summary from justify-content: space-between to gap + margin-left: auto on the chevron. Added .flex-container-nav .item rule to force left alignment on all menu items including standalone links. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 23:29:52 -05:00
jmiller	2eee4bbf1c	Merge pull request 'rc: admin nav left align' (#199 ) from rc/05.03.04 into main	2026-05-26 03:57:55 +00:00
jmiller	2dea95a431	Merge pull request 'fix(ui): force left-align admin sidebar' (#198 ) from fix/admin-nav-left-align into dev Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 21s Details	2026-05-26 03:57:36 +00:00
Jonathan Miller	f69212859a	fix(ui): force left-align on admin sidebar menu via inline style Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details The compiled CSS bundle doesn't pick up the flexcontainer.css change. Use inline style with !important on the menu container to override Fomantic UI's default center alignment. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 22:57:30 -05:00
jmiller	3828411311	Merge pull request 'rc: admin nav alignment' (#197 ) from rc/05.03.03 into main	2026-05-26 03:48:02 +00:00
jmiller	447a45ec15	Merge pull request 'fix(ui): left-align admin sidebar menu items' (#196 ) from fix/admin-nav-alignment into dev Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 25s Details	2026-05-26 03:47:43 +00:00
Jonathan Miller	f19fd9683f	fix(ui): left-align all admin sidebar menu items Branch Policy Check / Verify merge target (pull_request) Successful in 2s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details Fomantic UI's vertical menu centers text by default. Added text-align: left to .flex-container-nav menu items so all admin sidebar entries align consistently. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 22:47:36 -05:00
jmiller	039ab896cc	Merge pull request 'rc: per-file checksums + login logo fix' (#195 ) from rc/05.03.02 into main	2026-05-26 03:37:00 +00:00
jmiller	65660863d6	Merge pull request 'fix: per-file sha256 checksums' (#194 ) from fix/checksum-per-file into dev Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 21s Details	2026-05-26 03:36:45 +00:00
Jonathan Miller	198ae92579	fix: generate per-file [filename].sha256 instead of single manifest Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details PR RC Release / Build RC Release (pull_request) Successful in 2s Details Each release attachment now gets its own .sha256 checksum file (e.g. asset.zip.sha256) instead of a single checksums.sha256 manifest. Old .sha256 files are cleaned up before regenerating. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 22:35:51 -05:00
jmiller	bc4eae2e0f	Merge pull request 'rc: login logo default none' (#193 ) from rc/05.03.01 into main	2026-05-26 03:28:57 +00:00