Skip to content

Commit d0813ad

Browse files
65436543
authored
Merge branch 'main' into dell-oauth2-stuff
2 parents 5d62a9a + cbd4547 commit d0813ad

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+608
-511
lines changed

‎integrations/api_repo_test.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ import (
1212
"testing"
1313

1414
"code.gitea.io/gitea/models"
15+
"code.gitea.io/gitea/models/db"
16+
access_model "code.gitea.io/gitea/models/perm/access"
1517
repo_model "code.gitea.io/gitea/models/repo"
1618
"code.gitea.io/gitea/models/unittest"
1719
user_model "code.gitea.io/gitea/models/user"
@@ -205,7 +207,7 @@ func TestAPISearchRepo(t *testing.T) {
205207
assert.Len(t, repoNames, expected.count)
206208
for _, repo := range body.Data {
207209
r := getRepo(t, repo.ID)
208-
hasAccess, err := models.HasAccess(userID, r)
210+
hasAccess, err := access_model.HasAccess(db.DefaultContext, userID, r)
209211
assert.NoError(t, err, "Error when checking if User: %d has access to %s: %v", userID, repo.FullName, err)
210212
assert.True(t, hasAccess, "User: %d does not have access to %s", userID, repo.FullName)
211213

‎integrations/delete_user_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111

1212
"code.gitea.io/gitea/models"
1313
"code.gitea.io/gitea/models/organization"
14+
access_model "code.gitea.io/gitea/models/perm/access"
1415
repo_model "code.gitea.io/gitea/models/repo"
1516
"code.gitea.io/gitea/models/unittest"
1617
user_model "code.gitea.io/gitea/models/user"
@@ -21,7 +22,7 @@ func assertUserDeleted(t *testing.T, userID int64) {
2122
unittest.AssertNotExistsBean(t, &user_model.Follow{UserID: userID})
2223
unittest.AssertNotExistsBean(t, &user_model.Follow{FollowID: userID})
2324
unittest.AssertNotExistsBean(t, &repo_model.Repository{OwnerID: userID})
24-
unittest.AssertNotExistsBean(t, &models.Access{UserID: userID})
25+
unittest.AssertNotExistsBean(t, &access_model.Access{UserID: userID})
2526
unittest.AssertNotExistsBean(t, &organization.OrgUser{UID: userID})
2627
unittest.AssertNotExistsBean(t, &models.IssueUser{UID: userID})
2728
unittest.AssertNotExistsBean(t, &organization.TeamUser{UID: userID})

‎models/action.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616

1717
"code.gitea.io/gitea/models/db"
1818
"code.gitea.io/gitea/models/organization"
19+
access_model "code.gitea.io/gitea/models/perm/access"
1920
repo_model "code.gitea.io/gitea/models/repo"
2021
"code.gitea.io/gitea/models/unit"
2122
user_model "code.gitea.io/gitea/models/user"
@@ -510,7 +511,7 @@ func notifyWatchers(ctx context.Context, actions ...*Action) error {
510511
permPR[i] = false
511512
continue
512513
}
513-
perm, err := GetUserRepoPermission(ctx, repo, user)
514+
perm, err := access_model.GetUserRepoPermission(ctx, repo, user)
514515
if err != nil {
515516
permCode[i] = false
516517
permIssue[i] = false

‎models/branches.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"code.gitea.io/gitea/models/db"
1414
"code.gitea.io/gitea/models/organization"
1515
"code.gitea.io/gitea/models/perm"
16+
access_model "code.gitea.io/gitea/models/perm/access"
1617
repo_model "code.gitea.io/gitea/models/repo"
1718
"code.gitea.io/gitea/models/unit"
1819
user_model "code.gitea.io/gitea/models/user"
@@ -79,7 +80,7 @@ func (protectBranch *ProtectedBranch) CanUserPush(userID int64) bool {
7980
} else if repo, err := repo_model.GetRepositoryByID(protectBranch.RepoID); err != nil {
8081
log.Error("repo_model.GetRepositoryByID: %v", err)
8182
return false
82-
} else if writeAccess, err := HasAccessUnit(user, repo, unit.TypeCode, perm.AccessModeWrite); err != nil {
83+
} else if writeAccess, err := access_model.HasAccessUnit(db.DefaultContext, user, repo, unit.TypeCode, perm.AccessModeWrite); err != nil {
8384
log.Error("HasAccessUnit: %v", err)
8485
return false
8586
} else {
@@ -104,7 +105,7 @@ func (protectBranch *ProtectedBranch) CanUserPush(userID int64) bool {
104105
}
105106

106107
// IsUserMergeWhitelisted checks if some user is whitelisted to merge to this branch
107-
func IsUserMergeWhitelisted(ctx context.Context, protectBranch *ProtectedBranch, userID int64, permissionInRepo Permission) bool {
108+
func IsUserMergeWhitelisted(ctx context.Context, protectBranch *ProtectedBranch, userID int64, permissionInRepo access_model.Permission) bool {
108109
if !protectBranch.EnableMergeWhitelist {
109110
// Then we need to fall back on whether the user has write permission
110111
return permissionInRepo.CanWrite(unit.TypeCode)
@@ -139,7 +140,7 @@ func isUserOfficialReviewer(ctx context.Context, protectBranch *ProtectedBranch,
139140

140141
if !protectBranch.EnableApprovalsWhitelist {
141142
// Anyone with write access is considered official reviewer
142-
writeAccess, err := hasAccessUnit(ctx, user, repo, unit.TypeCode, perm.AccessModeWrite)
143+
writeAccess, err := access_model.HasAccessUnit(ctx, user, repo, unit.TypeCode, perm.AccessModeWrite)
143144
if err != nil {
144145
return false, err
145146
}
@@ -424,7 +425,7 @@ func updateApprovalWhitelist(ctx context.Context, repo *repo_model.Repository, c
424425

425426
whitelist = make([]int64, 0, len(newWhitelist))
426427
for _, userID := range newWhitelist {
427-
if reader, err := IsRepoReader(ctx, repo, userID); err != nil {
428+
if reader, err := access_model.IsRepoReader(ctx, repo, userID); err != nil {
428429
return nil, err
429430
} else if !reader {
430431
continue
@@ -449,7 +450,7 @@ func updateUserWhitelist(ctx context.Context, repo *repo_model.Repository, curre
449450
if err != nil {
450451
return nil, fmt.Errorf("GetUserByID [user_id: %d, repo_id: %d]: %v", userID, repo.ID, err)
451452
}
452-
perm, err := GetUserRepoPermission(ctx, repo, user)
453+
perm, err := access_model.GetUserRepoPermission(ctx, repo, user)
453454
if err != nil {
454455
return nil, fmt.Errorf("GetUserRepoPermission [user_id: %d, repo_id: %d]: %v", userID, repo.ID, err)
455456
}

‎models/fixture_generation.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"strings"
1010

1111
"code.gitea.io/gitea/models/db"
12+
access_model "code.gitea.io/gitea/models/perm/access"
1213
repo_model "code.gitea.io/gitea/models/repo"
1314
)
1415

@@ -22,14 +23,14 @@ func GetYamlFixturesAccess() (string, error) {
2223

2324
for _, repo := range repos {
2425
repo.MustOwner()
25-
if err := RecalculateAccesses(repo); err != nil {
26+
if err := access_model.RecalculateAccesses(db.DefaultContext, repo); err != nil {
2627
return "", err
2728
}
2829
}
2930

3031
var b strings.Builder
3132

32-
accesses := make([]*Access, 0, 200)
33+
accesses := make([]*access_model.Access, 0, 200)
3334
if err := db.GetEngine(db.DefaultContext).OrderBy("user_id, repo_id").Find(&accesses); err != nil {
3435
return "", err
3536
}

‎models/issue.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
issues_model "code.gitea.io/gitea/models/issues"
2020
"code.gitea.io/gitea/models/organization"
2121
"code.gitea.io/gitea/models/perm"
22+
access_model "code.gitea.io/gitea/models/perm/access"
2223
project_model "code.gitea.io/gitea/models/project"
2324
repo_model "code.gitea.io/gitea/models/repo"
2425
"code.gitea.io/gitea/models/unit"
@@ -489,7 +490,7 @@ func ClearIssueLabels(issue *Issue, doer *user_model.User) (err error) {
489490
return err
490491
}
491492

492-
perm, err := GetUserRepoPermission(ctx, issue.Repo, doer)
493+
perm, err := access_model.GetUserRepoPermission(ctx, issue.Repo, doer)
493494
if err != nil {
494495
return err
495496
}
@@ -2314,7 +2315,7 @@ func ResolveIssueMentionsByVisibility(ctx context.Context, issue *Issue, doer *u
23142315
continue
23152316
}
23162317
// Normal users must have read access to the referencing issue
2317-
perm, err := GetUserRepoPermission(ctx, issue.Repo, user)
2318+
perm, err := access_model.GetUserRepoPermission(ctx, issue.Repo, user)
23182319
if err != nil {
23192320
return nil, fmt.Errorf("GetUserRepoPermission [%d]: %v", user.ID, err)
23202321
}

‎models/issue_xref.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"fmt"
1010

1111
"code.gitea.io/gitea/models/db"
12+
access_model "code.gitea.io/gitea/models/perm/access"
1213
repo_model "code.gitea.io/gitea/models/repo"
1314
user_model "code.gitea.io/gitea/models/user"
1415
"code.gitea.io/gitea/modules/log"
@@ -215,7 +216,7 @@ func (issue *Issue) verifyReferencedIssue(stdCtx context.Context, ctx *crossRefe
215216

216217
// Check doer permissions; set action to None if the doer can't change the destination
217218
if refIssue.RepoID != ctx.OrigIssue.RepoID || ref.Action != references.XRefActionNone {
218-
perm, err := GetUserRepoPermission(stdCtx, refIssue.Repo, ctx.Doer)
219+
perm, err := access_model.GetUserRepoPermission(stdCtx, refIssue.Repo, ctx.Doer)
219220
if err != nil {
220221
return nil, references.XRefActionNone, err
221222
}

‎models/lfs_lock.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313

1414
"code.gitea.io/gitea/models/db"
1515
"code.gitea.io/gitea/models/perm"
16+
access_model "code.gitea.io/gitea/models/perm/access"
1617
repo_model "code.gitea.io/gitea/models/repo"
1718
"code.gitea.io/gitea/models/unit"
1819
user_model "code.gitea.io/gitea/models/user"
@@ -171,7 +172,7 @@ func CheckLFSAccessForRepo(ctx context.Context, ownerID int64, repo *repo_model.
171172
if err != nil {
172173
return err
173174
}
174-
perm, err := GetUserRepoPermission(ctx, repo, u)
175+
perm, err := access_model.GetUserRepoPermission(ctx, repo, u)
175176
if err != nil {
176177
return err
177178
}

‎models/org.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212

1313
"code.gitea.io/gitea/models/db"
1414
"code.gitea.io/gitea/models/organization"
15+
access_model "code.gitea.io/gitea/models/perm/access"
1516
repo_model "code.gitea.io/gitea/models/repo"
1617
user_model "code.gitea.io/gitea/models/user"
1718

@@ -142,7 +143,7 @@ func removeOrgUser(ctx context.Context, orgID, userID int64) error {
142143
if _, err = sess.
143144
Where("user_id = ?", userID).
144145
In("repo_id", repoIDs).
145-
Delete(new(Access)); err != nil {
146+
Delete(new(access_model.Access)); err != nil {
146147
return err
147148
}
148149
}

‎models/org_team.go

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313

1414
"code.gitea.io/gitea/models/db"
1515
"code.gitea.io/gitea/models/organization"
16+
access_model "code.gitea.io/gitea/models/perm/access"
1617
repo_model "code.gitea.io/gitea/models/repo"
1718
user_model "code.gitea.io/gitea/models/user"
1819
"code.gitea.io/gitea/modules/log"
@@ -33,7 +34,7 @@ func addRepository(ctx context.Context, t *organization.Team, repo *repo_model.R
3334

3435
t.NumRepos++
3536

36-
if err = recalculateTeamAccesses(ctx, repo, 0); err != nil {
37+
if err = access_model.RecalculateTeamAccesses(ctx, repo, 0); err != nil {
3738
return fmt.Errorf("recalculateAccesses: %v", err)
3839
}
3940

@@ -62,7 +63,7 @@ func addAllRepositories(ctx context.Context, t *organization.Team) error {
6263
}
6364

6465
for _, repo := range orgRepos {
65-
if !hasRepository(ctx, t, repo.ID) {
66+
if !organization.HasTeamRepo(ctx, t.OrgID, t.ID, repo.ID) {
6667
if err := addRepository(ctx, t, &repo); err != nil {
6768
return fmt.Errorf("addRepository: %v", err)
6869
}
@@ -108,11 +109,6 @@ func AddRepository(t *organization.Team, repo *repo_model.Repository) (err error
108109
return committer.Commit()
109110
}
110111

111-
// HasRepository returns true if given repository belong to team.
112-
func HasRepository(t *organization.Team, repoID int64) bool {
113-
return hasRepository(db.DefaultContext, t, repoID)
114-
}
115-
116112
// RemoveAllRepositories removes all repositories from team and recalculates access
117113
func RemoveAllRepositories(t *organization.Team) (err error) {
118114
if t.IncludesAllRepositories {
@@ -138,13 +134,13 @@ func removeAllRepositories(ctx context.Context, t *organization.Team) (err error
138134
e := db.GetEngine(ctx)
139135
// Delete all accesses.
140136
for _, repo := range t.Repos {
141-
if err := recalculateTeamAccesses(ctx, repo, t.ID); err != nil {
137+
if err := access_model.RecalculateTeamAccesses(ctx, repo, t.ID); err != nil {
142138
return err
143139
}
144140

145141
// Remove watches from all users and now unaccessible repos
146142
for _, user := range t.Members {
147-
has, err := hasAccess(ctx, user.ID, repo)
143+
has, err := access_model.HasAccess(ctx, user.ID, repo)
148144
if err != nil {
149145
return err
150146
} else if has {
@@ -177,8 +173,9 @@ func removeAllRepositories(ctx context.Context, t *organization.Team) (err error
177173
return nil
178174
}
179175

180-
func hasRepository(ctx context.Context, t *organization.Team, repoID int64) bool {
181-
return organization.HasTeamRepo(ctx, t.OrgID, t.ID, repoID)
176+
// HasRepository returns true if given repository belong to team.
177+
func HasRepository(t *organization.Team, repoID int64) bool {
178+
return organization.HasTeamRepo(db.DefaultContext, t.OrgID, t.ID, repoID)
182179
}
183180

184181
// removeRepository removes a repository from a team and recalculates access
@@ -196,7 +193,7 @@ func removeRepository(ctx context.Context, t *organization.Team, repo *repo_mode
196193

197194
// Don't need to recalculate when delete a repository from organization.
198195
if recalculate {
199-
if err = recalculateTeamAccesses(ctx, repo, t.ID); err != nil {
196+
if err = access_model.RecalculateTeamAccesses(ctx, repo, t.ID); err != nil {
200197
return err
201198
}
202199
}
@@ -206,7 +203,7 @@ func removeRepository(ctx context.Context, t *organization.Team, repo *repo_mode
206203
return fmt.Errorf("getTeamUsersByTeamID: %v", err)
207204
}
208205
for _, teamUser := range teamUsers {
209-
has, err := hasAccess(ctx, teamUser.UID, repo)
206+
has, err := access_model.HasAccess(ctx, teamUser.UID, repo)
210207
if err != nil {
211208
return err
212209
} else if has {
@@ -378,7 +375,7 @@ func UpdateTeam(t *organization.Team, authChanged, includeAllChanged bool) (err
378375
}
379376

380377
for _, repo := range t.Repos {
381-
if err = recalculateTeamAccesses(ctx, repo, 0); err != nil {
378+
if err = access_model.RecalculateTeamAccesses(ctx, repo, 0); err != nil {
382379
return fmt.Errorf("recalculateTeamAccesses: %v", err)
383380
}
384381
}
@@ -522,7 +519,7 @@ func AddTeamMember(team *organization.Team, userID int64) error {
522519
In("repo_id", subQuery).
523520
And("mode < ?", team.AccessMode).
524521
SetExpr("mode", team.AccessMode).
525-
Update(new(Access)); err != nil {
522+
Update(new(access_model.Access)); err != nil {
526523
return fmt.Errorf("update user accesses: %v", err)
527524
}
528525

@@ -533,9 +530,9 @@ func AddTeamMember(team *organization.Team, userID int64) error {
533530
return fmt.Errorf("select id accesses: %v", err)
534531
}
535532

536-
accesses := make([]*Access, 0, 100)
533+
accesses := make([]*access_model.Access, 0, 100)
537534
for i, repoID := range repoIDs {
538-
accesses = append(accesses, &Access{RepoID: repoID, UserID: userID, Mode: team.AccessMode})
535+
accesses = append(accesses, &access_model.Access{RepoID: repoID, UserID: userID, Mode: team.AccessMode})
539536
if (i%100 == 0 || i == len(repoIDs)-1) && len(accesses) > 0 {
540537
if err = db.Insert(ctx, accesses); err != nil {
541538
return fmt.Errorf("insert new user accesses: %v", err)
@@ -595,7 +592,7 @@ func removeTeamMember(ctx context.Context, team *organization.Team, userID int64
595592

596593
// Delete access to team repositories.
597594
for _, repo := range team.Repos {
598-
if err := recalculateUserAccess(ctx, repo, userID); err != nil {
595+
if err := access_model.RecalculateUserAccess(ctx, repo, userID); err != nil {
599596
return err
600597
}
601598

‎models/org_team_test.go

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"code.gitea.io/gitea/models/db"
1212
"code.gitea.io/gitea/models/organization"
1313
"code.gitea.io/gitea/models/perm"
14+
access_model "code.gitea.io/gitea/models/perm/access"
1415
repo_model "code.gitea.io/gitea/models/repo"
1516
"code.gitea.io/gitea/models/unittest"
1617
user_model "code.gitea.io/gitea/models/user"
@@ -129,7 +130,7 @@ func TestUpdateTeam(t *testing.T) {
129130
team = unittest.AssertExistsAndLoadBean(t, &organization.Team{Name: "newName"}).(*organization.Team)
130131
assert.True(t, strings.HasPrefix(team.Description, "A long description!"))
131132

132-
access := unittest.AssertExistsAndLoadBean(t, &Access{UserID: 4, RepoID: 3}).(*Access)
133+
access := unittest.AssertExistsAndLoadBean(t, &access_model.Access{UserID: 4, RepoID: 3}).(*access_model.Access)
133134
assert.EqualValues(t, perm.AccessModeAdmin, access.Mode)
134135

135136
unittest.CheckConsistencyFor(t, &organization.Team{ID: team.ID})
@@ -161,7 +162,7 @@ func TestDeleteTeam(t *testing.T) {
161162
// check that team members don't have "leftover" access to repos
162163
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4}).(*user_model.User)
163164
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3}).(*repo_model.Repository)
164-
accessMode, err := AccessLevel(user, repo)
165+
accessMode, err := access_model.AccessLevel(user, repo)
165166
assert.NoError(t, err)
166167
assert.True(t, accessMode < perm.AccessModeWrite)
167168
}
@@ -198,3 +199,21 @@ func TestRemoveTeamMember(t *testing.T) {
198199
err := RemoveTeamMember(team, 2)
199200
assert.True(t, organization.IsErrLastOrgOwner(err))
200201
}
202+
203+
func TestRepository_RecalculateAccesses3(t *testing.T) {
204+
assert.NoError(t, unittest.PrepareTestDatabase())
205+
team5 := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 5}).(*organization.Team)
206+
user29 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 29}).(*user_model.User)
207+
208+
has, err := db.GetEngine(db.DefaultContext).Get(&access_model.Access{UserID: 29, RepoID: 23})
209+
assert.NoError(t, err)
210+
assert.False(t, has)
211+
212+
// adding user29 to team5 should add an explicit access row for repo 23
213+
// even though repo 23 is public
214+
assert.NoError(t, AddTeamMember(team5, user29.ID))
215+
216+
has, err = db.GetEngine(db.DefaultContext).Get(&access_model.Access{UserID: 29, RepoID: 23})
217+
assert.NoError(t, err)
218+
assert.True(t, has)
219+
}

0 commit comments

Comments
 (0)