gitea user and pswd, some pages removed, logs

app/gitea_provisioning.py

@@ -12,10 +12,80 @@ from app.db.users import update_gitea_sync_state
 GITEA_ACCOUNT_ROLES = {"admin", "developer"}
 
 
+def desired_gitea_username(user: dict) -> str:
+    """Cílové Gitea uživatelské jméno: vlastní (nastavené adminem), jinak automatické portal-{id}."""
+    custom = (user.get("gitea_username") or "").strip()
+    if custom:
+        return custom
+    return _gitea_username(int(user["id"]))
+
+
+def apply_gitea_credentials(user: dict, new_username: str = "", new_password: str = "") -> dict:
+    """Admin nastaví Gitea uživatelské jméno a/nebo heslo přes admin API.
+    Vrací {"status": "synced"/"error", "applied": [...], "gitea_username", "gitea_user_id"}.
+    Heslo se nikam neukládá – jen se předá do Gitea."""
+    new_username = (new_username or "").strip()
+    new_password = new_password or ""
+
+    if not new_username and not new_password:
+        return {"status": "error", "error": "Nebyla zadána žádná změna."}
+    if not _requires_gitea_account(user):
+        return {
+            "status": "error",
+            "error": "Uživatel nemá mít Gitea účet (potřebuje roli admin/developer a aktivní účet).",
+        }
+
+    try:
+        current_username = desired_gitea_username(user)
+        gitea_user = _ensure_gitea_user(user, current_username)
+        current_login = _gitea_login(gitea_user) or current_username
+
+        applied: list[str] = []
+        if new_username and new_username != current_login:
+            _rename_gitea_user(current_login, new_username)
+            current_login = new_username
+            applied.append("username")
+        if new_password:
+            _set_gitea_password(current_login, user, new_password, gitea_user=gitea_user)
+            applied.append("password")
+
+        return {
+            "status": "synced",
+            "applied": applied,
+            "gitea_username": current_login,
+            "gitea_user_id": int(gitea_user["id"]),
+        }
+    except Exception as exc:
+        return {"status": "error", "error": str(exc)[:500]}
+
+
+def _rename_gitea_user(current_username: str, new_username: str) -> dict:
+    # Gitea admin rename endpoint (Gitea >= 1.20). Starší Gitea endpoint nemá → vrátí HTTP 404,
+    # což apply_gitea_credentials zachytí a nahlásí jako srozumitelnou chybu.
+    return _request_json(
+        "POST",
+        f"/api/v1/admin/users/{quote(current_username)}/rename",
+        {"new_username": new_username},
+        expected=(200, 204),
+    )
+
+
+def _set_gitea_password(username: str, user: dict, password: str, gitea_user: dict | None = None) -> dict:
+    payload = {
+        "login_name": _gitea_login_name(gitea_user) or username,
+        "source_id": _gitea_source_id(gitea_user),
+        "email": _email(user),
+        "full_name": _display_name(user),
+        "password": password,
+        "must_change_password": False,
+    }
+    return _request_json("PATCH", f"/api/v1/admin/users/{quote(username)}", payload, expected=(200,))
+
+
 def sync_gitea_user(user: dict) -> dict:
     user_id = int(user["id"])
     desired_active = _requires_gitea_account(user)
-    username = _gitea_username(user_id)
+    username = desired_gitea_username(user)
 
     update_gitea_sync_state(user_id, "syncing")
     try: