gitea

github/gitea

Fork 0

mirror of https://github.com/go-gitea/gitea.git synced 2026-10-19 16:18:11 +00:00

Files

T

History

silverwindandwxiaoguang 5264304a34 refactor: carry the API token on the doer (#39690 )

The token a request authenticated with now lives on the doer, so
permission and visibility checks apply its scope from the doer alone.
Replaces https://github.com/go-gitea/gitea/pull/39167, following
https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619.

1. Public-only tokens get 404 instead of 403 for hidden users, orgs and
repos, like GitHub.
2. Org ownership, site admin, repo and org creation, generation and
transfer endpoints reject public-only tokens.
3. API pull request responses set `head.repo` to `null` and
`head.repo_id` to `-1` when the caller cannot see the head repository.
4. Public-only tokens see org memberships like anonymous callers, so
concealed members stay hidden.
5. Site admin access in activity feeds, follower lists, org members,
Actions run lists and packages needs a session or an `all`-scoped token.

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-19 00:34:01 +00:00

admin

test: run integration tests on random ports and speed up slow tests (#39842 )

2026-10-18 12:56:04 +00:00

auth

refactor: carry the API token on the doer (#39690 )

2026-10-19 00:34:01 +00:00

devtest

chore: refactor legacy JS init code to use "data-global-init" (#39836 )

2026-10-18 13:59:51 +00:00

explore

refactor: pagination/pager (#39162 )