Add Attachment API (#3478)

* Add Attachment API
* repos/:owner/:repo/releases (add attachments)
* repos/:owner/:repo/releases/:id (add attachments)
* repos/:owner/:repo/releases/:id/attachments
* repos/:owner/:repo/releases/:id/attachments/:attachment_id

Signed-off-by: Jonas Franz <info@jonasfranz.de>

* Add unit tests for new attachment functions
Fix comments

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* fix lint

* Update vendor.json

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* remove version of sdk

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Fix unit tests
Add missing license header

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add CreateReleaseAttachment
Add EditReleaseAttachment
Add DeleteReleaseAttachment

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add filename query parameter for choosing another name for an attachment

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Fix order of imports

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Restricting updatable attachment columns

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* gofmt

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Update go-sdk
Replace Attachments with Assets

Signed-off-by: Jonas Franz <info@jonasfranz.de>

* Update go-sdk

Signed-off-by: Jonas Franz <info@jonasfranz.de>

* Updating go-sdk and regenerating swagger

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add missing file of go-sdk

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Change origin of code.gitea.io/sdk to code.gitea.io/sdk
Update code.gitea.io/sdk

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Update swagger

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Update updateAttachment

models/attachment.go

@@ -11,10 +11,12 @@ import (
 	"os"
 	"path"
 
-	gouuid "github.com/satori/go.uuid"
-
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
+	api "code.gitea.io/sdk/gitea"
+
+	"github.com/go-xorm/xorm"
+	gouuid "github.com/satori/go.uuid"
 )
 
 // Attachment represent a attachment of issue/comment/release.
@@ -39,6 +41,20 @@ func (a *Attachment) IncreaseDownloadCount() error {
 	return nil
 }
 
+// APIFormat converts models.Attachment to api.Attachment
+func (a *Attachment) APIFormat() *api.Attachment {
+	size, _ := a.Size()
+	return &api.Attachment{
+		ID:            a.ID,
+		Name:          a.Name,
+		Created:       a.CreatedUnix.AsTime(),
+		DownloadCount: a.DownloadCount,
+		Size:          size,
+		UUID:          a.UUID,
+		DownloadURL:   a.DownloadURL(),
+	}
+}
+
 // AttachmentLocalPath returns where attachment is stored in local file
 // system based on given UUID.
 func AttachmentLocalPath(uuid string) string {
@@ -50,6 +66,20 @@ func (a *Attachment) LocalPath() string {
 	return AttachmentLocalPath(a.UUID)
 }
 
+// Size returns the file's size of the attachment
+func (a *Attachment) Size() (int64, error) {
+	fi, err := os.Stat(a.LocalPath())
+	if err != nil {
+		return 0, err
+	}
+	return fi.Size(), nil
+}
+
+// DownloadURL returns the download url of the attached file
+func (a *Attachment) DownloadURL() string {
+	return fmt.Sprintf("%sattachments/%s", setting.AppURL, a.UUID)
+}
+
 // NewAttachment creates a new attachment object.
 func NewAttachment(name string, buf []byte, file multipart.File) (_ *Attachment, err error) {
 	attach := &Attachment{
@@ -81,6 +111,22 @@ func NewAttachment(name string, buf []byte, file multipart.File) (_ *Attachment,
 	return attach, nil
 }
 
+// GetAttachmentByID returns attachment by given id
+func GetAttachmentByID(id int64) (*Attachment, error) {
+	return getAttachmentByID(x, id)
+}
+
+func getAttachmentByID(e Engine, id int64) (*Attachment, error) {
+	attach := &Attachment{ID: id}
+
+	if has, err := e.Get(attach); err != nil {
+		return nil, err
+	} else if !has {
+		return nil, ErrAttachmentNotExist{ID: id, UUID: ""}
+	}
+	return attach, nil
+}
+
 func getAttachmentByUUID(e Engine, uuid string) (*Attachment, error) {
 	attach := &Attachment{UUID: uuid}
 	has, err := e.Get(attach)
@@ -180,3 +226,20 @@ func DeleteAttachmentsByComment(commentID int64, remove bool) (int, error) {
 
 	return DeleteAttachments(attachments, remove)
 }
+
+// UpdateAttachment updates the given attachment in database
+func UpdateAttachment(atta *Attachment) error {
+	return updateAttachment(x, atta)
+}
+
+func updateAttachment(e Engine, atta *Attachment) error {
+	var sess *xorm.Session
+	if atta.ID != 0 && atta.UUID == "" {
+		sess = e.ID(atta.ID)
+	} else {
+		// Use uuid only if id is not set and uuid is set
+		sess = e.Where("uuid = ?", atta.UUID)
+	}
+	_, err := sess.Cols("name", "issue_id", "release_id", "comment_id", "download_count").Update(atta)
+	return err
+}

models/attachment_test.go

@@ -58,3 +58,32 @@ func TestDeleteAttachments(t *testing.T) {
 	assert.True(t, IsErrAttachmentNotExist(err))
 	assert.Nil(t, attachment)
 }
+
+func TestGetAttachmentByID(t *testing.T) {
+	assert.NoError(t, PrepareTestDatabase())
+
+	attach, err := GetAttachmentByID(1)
+	assert.NoError(t, err)
+	assert.Equal(t, "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11", attach.UUID)
+}
+
+func TestAttachment_DownloadURL(t *testing.T) {
+	attach := &Attachment{
+		UUID: "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11",
+		ID:   1,
+	}
+	assert.Equal(t, "https://try.gitea.io/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11", attach.DownloadURL())
+}
+
+func TestUpdateAttachment(t *testing.T) {
+	assert.NoError(t, PrepareTestDatabase())
+
+	attach, err := GetAttachmentByID(1)
+	assert.NoError(t, err)
+	assert.Equal(t, "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11", attach.UUID)
+
+	attach.Name = "new_name"
+	assert.NoError(t, UpdateAttachment(attach))
+
+	AssertExistsAndLoadBean(t, &Attachment{Name: "new_name"})
+}

models/release.go

@@ -53,7 +53,7 @@ func (r *Release) loadAttributes(e Engine) error {
 			return err
 		}
 	}
-	return nil
+	return GetReleaseAttachments(r)
 }
 
 // LoadAttributes load repo and publisher attributes for a release
@@ -79,6 +79,10 @@ func (r *Release) TarURL() string {
 
 // APIFormat convert a Release to api.Release
 func (r *Release) APIFormat() *api.Release {
+	assets := make([]*api.Attachment, 0)
+	for _, att := range r.Attachments {
+		assets = append(assets, att.APIFormat())
+	}
 	return &api.Release{
 		ID:           r.ID,
 		TagName:      r.TagName,
@@ -92,6 +96,7 @@ func (r *Release) APIFormat() *api.Release {
 		CreatedAt:    r.CreatedUnix.AsTime(),
 		PublishedAt:  r.CreatedUnix.AsTime(),
 		Publisher:    r.Publisher.APIFormat(),
+		Attachments:  assets,
 	}
 }
 

public/swagger.v1.json

@@ -3225,6 +3225,37 @@
     },
     "/repos/{owner}/{repo}/releases": {
       "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "List a repo's releases",
+        "operationId": "repoListReleases",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ReleaseList"
+          }
+        }
+      },
+      "post": {
         "consumes": [
           "application/json"
         ],
@@ -3267,6 +3298,44 @@
       }
     },
     "/repos/{owner}/{repo}/releases/{id}": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Get a release",
+        "operationId": "repoGetRelease",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the release to get",
+            "name": "id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/Release"
+          }
+        }
+      },
       "delete": {
         "tags": [
           "repository"
@@ -3351,6 +3420,247 @@
         }
       }
     },
+    "/repos/{owner}/{repo}/releases/{id}/assets": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "List release's attachments",
+        "operationId": "repoListReleaseAttachments",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the release",
+            "name": "id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/AttachmentList"
+          }
+        }
+      },
+      "post": {
+        "consumes": [
+          "multipart/form-data"
+        ],
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Create a release attachment",
+        "operationId": "repoCreateReleaseAttachment",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the release",
+            "name": "id",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the attachment",
+            "name": "name",
+            "in": "query"
+          },
+          {
+            "type": "file",
+            "description": "attachment to upload",
+            "name": "attachment",
+            "in": "formData",
+            "required": true
+          }
+        ],
+        "responses": {
+          "201": {
+            "$ref": "#/responses/Attachment"
+          }
+        }
+      }
+    },
+    "/repos/{owner}/{repo}/releases/{id}/assets/{attachment_id}": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Get a release attachment",
+        "operationId": "repoGetReleaseAttachment",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the release",
+            "name": "id",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the attachment to get",
+            "name": "attachment_id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/Attachment"
+          }
+        }
+      },
+      "delete": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Delete a release attachment",
+        "operationId": "repoDeleteReleaseAttachment",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the release",
+            "name": "id",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the attachment to delete",
+            "name": "attachment_id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "204": {
+            "$ref": "#/responses/empty"
+          }
+        }
+      },
+      "patch": {
+        "consumes": [
+          "application/json"
+        ],
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "repository"
+        ],
+        "summary": "Edit a release attachment",
+        "operationId": "repoEditReleaseAttachment",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "owner of the repo",
+            "name": "owner",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "name of the repo",
+            "name": "repo",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the release",
+            "name": "id",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "integer",
+            "description": "id of the attachment to edit",
+            "name": "attachment_id",
+            "in": "path",
+            "required": true
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "$ref": "#/definitions/EditAttachmentOptions"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "$ref": "#/responses/Attachment"
+          }
+        }
+      }
+    },
     "/repos/{owner}/{repo}/stargazers": {
       "get": {
         "produces": [
@@ -4994,6 +5304,45 @@
       },
       "x-go-package": "code.gitea.io/gitea/vendor/code.gitea.io/sdk/gitea"
     },
+    "Attachment": {
+      "description": "Attachment a generic attachment",
+      "type": "object",
+      "properties": {
+        "browser_download_url": {
+          "type": "string",
+          "x-go-name": "DownloadURL"
+        },
+        "created_at": {
+          "type": "string",
+          "format": "date-time",
+          "x-go-name": "Created"
+        },
+        "download_count": {
+          "type": "integer",
+          "format": "int64",
+          "x-go-name": "DownloadCount"
+        },
+        "id": {
+          "type": "integer",
+          "format": "int64",
+          "x-go-name": "ID"
+        },
+        "name": {
+          "type": "string",
+          "x-go-name": "Name"
+        },
+        "size": {
+          "type": "integer",
+          "format": "int64",
+          "x-go-name": "Size"
+        },
+        "uuid": {
+          "type": "string",
+          "x-go-name": "UUID"
+        }
+      },
+      "x-go-package": "code.gitea.io/gitea/vendor/code.gitea.io/sdk/gitea"
+    },
     "Branch": {
       "description": "Branch represents a repository branch",
       "type": "object",
@@ -5202,6 +5551,11 @@
           "uniqueItems": true,
           "x-go-name": "Key"
         },
+        "read_only": {
+          "description": "Describe if the key has only read access or read/write",
+          "type": "boolean",
+          "x-go-name": "ReadOnly"
+        },
         "title": {
           "description": "Title of the key to add",
           "type": "string",
@@ -5540,6 +5894,17 @@
       },
       "x-go-package": "code.gitea.io/gitea/vendor/code.gitea.io/sdk/gitea"
     },
+    "EditAttachmentOptions": {
+      "description": "EditAttachmentOptions options for editing attachments",
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "x-go-name": "Name"
+        }
+      },
+      "x-go-package": "code.gitea.io/gitea/vendor/code.gitea.io/sdk/gitea"
+    },
     "EditHookOption": {
       "description": "EditHookOption options when modify one hook",
       "type": "object",
@@ -6459,6 +6824,13 @@
       "description": "Release represents a repository release",
       "type": "object",
       "properties": {
+        "assets": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Attachment"
+          },
+          "x-go-name": "Attachments"
+        },
         "author": {
           "$ref": "#/definitions/User"
         },
@@ -6848,6 +7220,19 @@
     "AccessTokenList": {
       "description": "AccessTokenList represents a list of API access token."
     },
+    "Attachment": {
+      "schema": {
+        "$ref": "#/definitions/Attachment"
+      }
+    },
+    "AttachmentList": {
+      "schema": {
+        "type": "array",
+        "items": {
+          "$ref": "#/definitions/Attachment"
+        }
+      }
+    },
     "Branch": {
       "schema": {
         "$ref": "#/definitions/Branch"
@@ -7131,7 +7516,7 @@
     },
     "parameterBodies": {
       "schema": {
-        "$ref": "#/definitions/MigrateRepoForm"
+        "$ref": "#/definitions/EditAttachmentOptions"
       },
       "headers": {
         "AddCollaboratorOption": {},
@@ -7152,6 +7537,7 @@
         "CreateTeamOption": {},
         "CreateUserOption": {},
         "DeleteEmailOption": {},
+        "EditAttachmentOptions": {},
         "EditHookOption": {},
         "EditIssueCommentOption": {},
         "EditIssueOption": {},

routers/api/v1/api.go

@@ -469,9 +469,18 @@ func RegisterRoutes(m *macaron.Macaron) {
 				m.Group("/releases", func() {
 					m.Combo("").Get(repo.ListReleases).
 						Post(reqToken(), reqRepoWriter(), context.ReferencesGitRepo(), bind(api.CreateReleaseOption{}), repo.CreateRelease)
-					m.Combo("/:id").Get(repo.GetRelease).
+					m.Group("/:id", func() {
+						m.Combo("").Get(repo.GetRelease).
 							Patch(reqToken(), reqRepoWriter(), context.ReferencesGitRepo(), bind(api.EditReleaseOption{}), repo.EditRelease).
 							Delete(reqToken(), reqRepoWriter(), repo.DeleteRelease)
+						m.Group("/assets", func() {
+							m.Combo("").Get(repo.ListReleaseAttachments).
+								Post(reqToken(), reqRepoWriter(), repo.CreateReleaseAttachment)
+							m.Combo("/:asset").Get(repo.GetReleaseAttachment).
+								Patch(reqToken(), reqRepoWriter(), bind(api.EditAttachmentOptions{}), repo.EditReleaseAttachment).
+								Delete(reqToken(), reqRepoWriter(), repo.DeleteReleaseAttachment)
+						})
+					})
 				})
 				m.Post("/mirror-sync", reqToken(), reqRepoWriter(), repo.MirrorSync)
 				m.Get("/editorconfig/:filename", context.RepoRef(), repo.GetEditorconfig)

routers/api/v1/repo/release.go

@@ -13,7 +13,7 @@ import (
 
 // GetRelease get a single release of a repository
 func GetRelease(ctx *context.APIContext) {
-	// swagger:operation GET /repos/{owner}/{repo}/releases repository repoGetRelease
+	// swagger:operation GET /repos/{owner}/{repo}/releases/{id} repository repoGetRelease
 	// ---
 	// summary: Get a release
 	// produces:
@@ -29,7 +29,7 @@ func GetRelease(ctx *context.APIContext) {
 	//   description: name of the repo
 	//   type: string
 	//   required: true
-	// - name: repo
+	// - name: id
 	//   in: path
 	//   description: id of the release to get
 	//   type: integer

routers/api/v1/repo/release_attachment.go

@@ -0,0 +1,322 @@
+// Copyright 2018 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package repo
+
+import (
+	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/modules/context"
+	"code.gitea.io/gitea/modules/setting"
+	api "code.gitea.io/sdk/gitea"
+	"errors"
+	"net/http"
+	"strings"
+)
+
+// GetReleaseAttachment gets a single attachment of the release
+func GetReleaseAttachment(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/releases/{id}/assets/{attachment_id} repository repoGetReleaseAttachment
+	// ---
+	// summary: Get a release attachment
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the release
+	//   type: integer
+	//   required: true
+	// - name: attachment_id
+	//   in: path
+	//   description: id of the attachment to get
+	//   type: integer
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/Attachment"
+	releaseID := ctx.ParamsInt64(":id")
+	attachID := ctx.ParamsInt64(":asset")
+	attach, err := models.GetAttachmentByID(attachID)
+	if err != nil {
+		ctx.Error(500, "GetAttachmentByID", err)
+		return
+	}
+	if attach.ReleaseID != releaseID {
+		ctx.Status(404)
+		return
+	}
+	// FIXME Should prove the existence of the given repo, but results in unnecessary database requests
+	ctx.JSON(200, attach.APIFormat())
+}
+
+// ListReleaseAttachments lists all attachments of the release
+func ListReleaseAttachments(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/releases/{id}/assets repository repoListReleaseAttachments
+	// ---
+	// summary: List release's attachments
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the release
+	//   type: integer
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/AttachmentList"
+	releaseID := ctx.ParamsInt64(":id")
+	release, err := models.GetReleaseByID(releaseID)
+	if err != nil {
+		ctx.Error(500, "GetReleaseByID", err)
+		return
+	}
+	if release.RepoID != ctx.Repo.Repository.ID {
+		ctx.Status(404)
+		return
+	}
+	if err := release.LoadAttributes(); err != nil {
+		ctx.Error(500, "LoadAttributes", err)
+		return
+	}
+	ctx.JSON(200, release.APIFormat().Attachments)
+}
+
+// CreateReleaseAttachment creates an attachment and saves the given file
+func CreateReleaseAttachment(ctx *context.APIContext) {
+	// swagger:operation POST /repos/{owner}/{repo}/releases/{id}/assets repository repoCreateReleaseAttachment
+	// ---
+	// summary: Create a release attachment
+	// produces:
+	// - application/json
+	// consumes:
+	// - multipart/form-data
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the release
+	//   type: integer
+	//   required: true
+	// - name: name
+	//   in: query
+	//   description: name of the attachment
+	//   type: string
+	//   required: false
+	// - name: attachment
+	//   in: formData
+	//   description: attachment to upload
+	//   type: file
+	//   required: true
+	// responses:
+	//   "201":
+	//     "$ref": "#/responses/Attachment"
+
+	// Check if attachments are enabled
+	if !setting.AttachmentEnabled {
+		ctx.Error(404, "AttachmentEnabled", errors.New("attachment is not enabled"))
+		return
+	}
+
+	// Check if release exists an load release
+	releaseID := ctx.ParamsInt64(":id")
+	release, err := models.GetReleaseByID(releaseID)
+	if err != nil {
+		ctx.Error(500, "GetReleaseByID", err)
+		return
+	}
+
+	// Get uploaded file from request
+	file, header, err := ctx.GetFile("attachment")
+	if err != nil {
+		ctx.Error(500, "GetFile", err)
+		return
+	}
+	defer file.Close()
+
+	buf := make([]byte, 1024)
+	n, _ := file.Read(buf)
+	if n > 0 {
+		buf = buf[:n]
+	}
+
+	// Check if the filetype is allowed by the settings
+	fileType := http.DetectContentType(buf)
+
+	allowedTypes := strings.Split(setting.AttachmentAllowedTypes, ",")
+	allowed := false
+	for _, t := range allowedTypes {
+		t := strings.Trim(t, " ")
+		if t == "*/*" || t == fileType {
+			allowed = true
+			break
+		}
+	}
+
+	if !allowed {
+		ctx.Error(400, "DetectContentType", errors.New("File type is not allowed"))
+		return
+	}
+
+	var filename = header.Filename
+	if query := ctx.Query("name"); query != "" {
+		filename = query
+	}
+
+	// Create a new attachment and save the file
+	attach, err := models.NewAttachment(filename, buf, file)
+	if err != nil {
+		ctx.Error(500, "NewAttachment", err)
+		return
+	}
+	attach.ReleaseID = release.ID
+	if err := models.UpdateAttachment(attach); err != nil {
+		ctx.Error(500, "UpdateAttachment", err)
+		return
+	}
+	ctx.JSON(201, attach.APIFormat())
+}
+
+// EditReleaseAttachment updates the given attachment
+func EditReleaseAttachment(ctx *context.APIContext, form api.EditAttachmentOptions) {
+	// swagger:operation PATCH /repos/{owner}/{repo}/releases/{id}/assets/{attachment_id} repository repoEditReleaseAttachment
+	// ---
+	// summary: Edit a release attachment
+	// produces:
+	// - application/json
+	// consumes:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the release
+	//   type: integer
+	//   required: true
+	// - name: attachment_id
+	//   in: path
+	//   description: id of the attachment to edit
+	//   type: integer
+	//   required: true
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/EditAttachmentOptions"
+	// responses:
+	//   "201":
+	//     "$ref": "#/responses/Attachment"
+
+	// Check if release exists an load release
+	releaseID := ctx.ParamsInt64(":id")
+	attachID := ctx.ParamsInt64(":attachment")
+	attach, err := models.GetAttachmentByID(attachID)
+	if err != nil {
+		ctx.Error(500, "GetAttachmentByID", err)
+		return
+	}
+	if attach.ReleaseID != releaseID {
+		ctx.Status(404)
+		return
+	}
+	// FIXME Should prove the existence of the given repo, but results in unnecessary database requests
+	if form.Name != "" {
+		attach.Name = form.Name
+	}
+
+	if err := models.UpdateAttachment(attach); err != nil {
+		ctx.Error(500, "UpdateAttachment", attach)
+	}
+	ctx.JSON(201, attach.APIFormat())
+}
+
+// DeleteReleaseAttachment delete a given attachment
+func DeleteReleaseAttachment(ctx *context.APIContext) {
+	// swagger:operation DELETE /repos/{owner}/{repo}/releases/{id}/assets/{attachment_id} repository repoDeleteReleaseAttachment
+	// ---
+	// summary: Delete a release attachment
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the release
+	//   type: integer
+	//   required: true
+	// - name: attachment_id
+	//   in: path
+	//   description: id of the attachment to delete
+	//   type: integer
+	//   required: true
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+
+	// Check if release exists an load release
+	releaseID := ctx.ParamsInt64(":id")
+	attachID := ctx.ParamsInt64(":attachment")
+	attach, err := models.GetAttachmentByID(attachID)
+	if err != nil {
+		ctx.Error(500, "GetAttachmentByID", err)
+		return
+	}
+	if attach.ReleaseID != releaseID {
+		ctx.Status(404)
+		return
+	}
+	// FIXME Should prove the existence of the given repo, but results in unnecessary database requests
+
+	if err := models.DeleteAttachment(attach, true); err != nil {
+		ctx.Error(500, "DeleteAttachment", err)
+		return
+	}
+	ctx.Status(204)
+}

routers/api/v1/swagger/options.go

@@ -63,4 +63,6 @@ type swaggerParameterBodies struct {
 	EditUserOption   api.EditUserOption
 
 	MigrateRepoForm auth.MigrateRepoForm
+
+	EditAttachmentOptions api.EditAttachmentOptions
 }

routers/api/v1/swagger/repo.go

@@ -90,3 +90,15 @@ type swaggerResponseWatchInfo struct {
 type swaggerResponseSearchResults struct {
 	Body api.SearchResults `json:"body"`
 }
+
+// swagger:response AttachmentList
+type swaggerResponseAttachmentList struct {
+	//in: body
+	Body []api.Attachment `json:"body"`
+}
+
+// swagger:response Attachment
+type swaggerResponseAttachment struct {
+	//in: body
+	Body api.Attachment `json:"body"`
+}

vendor/code.gitea.io/sdk/gitea/attachment.go

@@ -3,15 +3,90 @@
 // license that can be found in the LICENSE file.
 
 package gitea // import "code.gitea.io/sdk/gitea"
-import "time"
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"time"
+)
 
 // Attachment a generic attachment
+// swagger:model
 type Attachment struct {
 	ID            int64  `json:"id"`
 	Name          string `json:"name"`
 	Size          int64  `json:"size"`
 	DownloadCount int64  `json:"download_count"`
+	// swagger:strfmt date-time
 	Created     time.Time `json:"created_at"`
 	UUID        string    `json:"uuid"`
 	DownloadURL string    `json:"browser_download_url"`
 }
+
+// ListReleaseAttachments list release's attachments
+func (c *Client) ListReleaseAttachments(user, repo string, release int64) ([]*Attachment, error) {
+	attachments := make([]*Attachment, 0, 10)
+	err := c.getParsedResponse("GET",
+		fmt.Sprintf("/repos/%s/%s/releases/%d/assets", user, repo, release),
+		nil, nil, &attachments)
+	return attachments, err
+}
+
+// ListReleaseAttachments list release's attachments
+func (c *Client) GetReleaseAttachment(user, repo string, release int64, id int64) (*Attachment, error) {
+	a := new(Attachment)
+	err := c.getParsedResponse("GET",
+		fmt.Sprintf("/repos/%s/%s/releases/%d/assets/%d", user, repo, release, id),
+		nil, nil, &a)
+	return a, err
+}
+
+// CreateReleaseAttachment creates an attachment for the given release
+func (c *Client) CreateReleaseAttachment(user, repo string, release int64, file io.Reader, filename string) (*Attachment, error) {
+	// Write file to body
+	body := new(bytes.Buffer)
+	writer := multipart.NewWriter(body)
+	part, err := writer.CreateFormFile("attachment", filename)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err = io.Copy(part, file); err != nil {
+		return nil, err
+	}
+	if err = writer.Close(); err != nil {
+		return nil, err
+	}
+
+	// Send request
+	attachment := new(Attachment)
+	err = c.getParsedResponse("POST",
+		fmt.Sprintf("/repos/%s/%s/releases/%d/assets", user, repo, release),
+		http.Header{"Content-Type": {writer.FormDataContentType()}}, body, &attachment)
+	return attachment, err
+}
+
+// EditReleaseAttachment updates the given attachment with the given options
+func (c *Client) EditReleaseAttachment(user, repo string, release int64, attachment int64, form EditAttachmentOptions) (*Attachment, error) {
+	body, err := json.Marshal(&form)
+	if err != nil {
+		return nil, err
+	}
+	attach := new(Attachment)
+	return attach, c.getParsedResponse("PATCH", fmt.Sprintf("/repos/%s/%s/releases/%d/assets/%d", user, repo, release, attachment), jsonHeader, bytes.NewReader(body), attach)
+}
+
+// DeleteReleaseAttachment deletes the given attachment including the uploaded file
+func (c *Client) DeleteReleaseAttachment(user, repo string, release int64, id int64) error {
+	_, err := c.getResponse("DELETE", fmt.Sprintf("/repos/%s/%s/releases/%d/assets/%d", user, repo, release, id), nil, nil)
+	return err
+}
+
+// EditAttachmentOptions options for editing attachments
+// swagger:model
+type EditAttachmentOptions struct {
+	Name string `json:"name"`
+}

vendor/code.gitea.io/sdk/gitea/gitea.go

@@ -7,6 +7,7 @@ package gitea
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"net/http"
@@ -69,6 +70,8 @@ func (c *Client) getResponse(method, path string, header http.Header, body io.Re
 		return nil, errors.New("403 Forbidden")
 	case 404:
 		return nil, errors.New("404 Not Found")
+	case 422:
+		return nil, fmt.Errorf("422 Unprocessable Entity: %s", string(data))
 	}
 
 	if resp.StatusCode/100 != 2 {

vendor/code.gitea.io/sdk/gitea/release.go

@@ -28,6 +28,7 @@ type Release struct {
 	// swagger:strfmt date-time
 	PublishedAt time.Time     `json:"published_at"`
 	Publisher   *User         `json:"author"`
+	Attachments []*Attachment `json:"assets"`
 }
 
 // ListReleases list releases of a repository

vendor/code.gitea.io/sdk/gitea/user_search.go

@@ -0,0 +1,14 @@
+package gitea
+
+import "fmt"
+
+type searchUsersResponse struct {
+	Users []*User `json:"data"`
+}
+
+// SearchUsers finds users by query
+func (c *Client) SearchUsers(query string, limit int) ([]*User, error) {
+	resp := new(searchUsersResponse)
+	err := c.getParsedResponse("GET", fmt.Sprintf("/users/search?q=%s&limit=%d", query, limit), nil, nil, &resp)
+	return resp.Users, err
+}

vendor/vendor.json

@@ -9,10 +9,10 @@
 			"revisionTime": "2018-02-10T03:05:43Z"
 		},
 		{
-			"checksumSHA1": "Qtq0kW+BnpYMOriaoCjMa86WGG8=",
+			"checksumSHA1": "PWaIU7g1YSkETxka2DIS1EYsPK0=",
 			"path": "code.gitea.io/sdk/gitea",
-			"revision": "79eee8f12c7fc1cc5b802c5cdc5b494ef3733866",
+			"revision": "cdbef997666132599cc92dc22aa94de3db04adeb",
-			"revisionTime": "2017-12-20T06:57:50Z"
+			"revisionTime": "2018-03-02T14:48:43Z"
 		},
 		{
 			"checksumSHA1": "bOODD4Gbw3GfcuQPU2dI40crxxk=",