mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-20 16:25:34 +00:00
silverwindandwxiaoguang
5264304a34
The token a request authenticated with now lives on the doer, so permission and visibility checks apply its scope from the doer alone. Replaces https://github.com/go-gitea/gitea/pull/39167, following https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619. 1. Public-only tokens get 404 instead of 403 for hidden users, orgs and repos, like GitHub. 2. Org ownership, site admin, repo and org creation, generation and transfer endpoints reject public-only tokens. 3. API pull request responses set `head.repo` to `null` and `head.repo_id` to `-1` when the caller cannot see the head repository. 4. Public-only tokens see org memberships like anonymous callers, so concealed members stay hidden. 5. Site admin access in activity feeds, follower lists, org members, Actions run lists and packages needs a session or an `all`-scoped token. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
32 lines
1.0 KiB
Go
32 lines
1.0 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package context
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/models/perm"
|
|
"gitea.dev/models/user"
|
|
"gitea.dev/modules/structs"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestDeterminePackageAccessModeForLimitedOwner(t *testing.T) {
|
|
owner := &user.User{ID: 1, Visibility: structs.VisibleTypeLimited}
|
|
|
|
accessMode, err := determineAccessMode(&Base{}, owner, &user.User{ID: 2, IsActive: true})
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, perm.AccessModeRead, accessMode)
|
|
|
|
accessMode, err = determineAccessMode(&Base{}, owner, &user.User{ID: 3, IsActive: true, IsRestricted: true})
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, perm.AccessModeNone, accessMode)
|
|
|
|
publicOnlyAdmin := &user.User{ID: 4, IsActive: true, IsAdmin: true, ExtDoerData: user.NewTokenExtDoerData(user.CredentialAccessToken, 1, "public-only,read:package")}
|
|
accessMode, err = determineAccessMode(&Base{}, owner, publicOnlyAdmin)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, perm.AccessModeNone, accessMode)
|
|
}
|