fix(repo): centralize repository-scoped authorization (#39063)

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/api/v1/repo/repo.go

@@ -1154,15 +1154,6 @@ func Delete(ctx *context.APIContext) {
 	owner := ctx.Repo.Owner
 	repo := ctx.Repo.Repository
 
-	canDelete, err := repo_module.CanUserDelete(ctx, repo, ctx.Doer)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	} else if !canDelete {
-		ctx.APIError(http.StatusForbidden, "Given user is not owner of organization.")
-		return
-	}
-
 	if ctx.Repo.GitRepo != nil {
 		ctx.Repo.GitRepo.Close()
 	}

routers/api/v1/repo/teams.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 
 	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
 	"gitea.dev/services/context"
 	"gitea.dev/services/convert"
 	repo_service "gitea.dev/services/repository"
@@ -188,11 +189,7 @@ func DeleteTeam(ctx *context.APIContext) {
 }
 
 func changeRepoTeam(ctx *context.APIContext, add bool) {
-	if !ctx.Repo.Owner.IsOrganization() {
-		ctx.APIError(http.StatusMethodNotAllowed, "repo is not owned by an organization")
-		return
-	}
-	if !canChangeRepoTeam(ctx) {
+	if !canChangeOrgRepoTeam(ctx) {
 		return
 	}
 
@@ -224,14 +221,10 @@ func changeRepoTeam(ctx *context.APIContext, add bool) {
 	ctx.Status(http.StatusNoContent)
 }
 
-func canChangeRepoTeam(ctx *context.APIContext) bool {
-	canChange, err := organization.OrgFromUser(ctx.Repo.Owner).CanChangeRepoTeamAccess(ctx, ctx.Doer)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return false
-	}
+func canChangeOrgRepoTeam(ctx *context.APIContext) bool {
+	canChange := access_model.CanDoerManageOrgRepoCollaboratorTeam(ctx, ctx.Repo.Repository, &ctx.Repo.Permission)
 	if !canChange {
-		ctx.APIError(http.StatusForbidden, "Must be an organization owner")
+		ctx.APIError(http.StatusForbidden, "No permission to change organization repository's team")
 		return false
 	}
 	return true