ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 14:03:24 +09:00
Code Issues Projects Releases Wiki Activity

fix(repo): centralize repository-scoped authorization (#39063)

Browse Source 
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
bircni
2026-08-26 20:12:53 +08:00
committed by GitHub
co-authored by wxiaoguang
parent 90c43e8e78
commit e21c37703e
27 changed files with 383 additions and 476 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/packages/package_update.go
+33 -32
View File
@@ -9,6 +9,7 @@ import (
org_model "gitea.dev/models/organization"
packages_model "gitea.dev/models/packages"
"gitea.dev/models/perm"
access_model "gitea.dev/models/perm/access"
repo_model "gitea.dev/models/repo"
"gitea.dev/models/unit"
@@ -38,42 +39,42 @@ func LinkToRepository(ctx context.Context, pkg *packages_model.Package, repo *re
return nil
}
func canDoerManagePackage(ctx context.Context, pkg *packages_model.Package, doer *user_model.User) bool {
owner, err := user_model.GetUserByID(ctx, pkg.OwnerID)
if err != nil {
return false
}
if doer.IsAdmin {
return true
}
if !owner.IsOrganization() {
return doer.ID == pkg.OwnerID
}
teams, _ := org_model.GetUserOrgTeams(ctx, owner.ID, doer.ID)
if teams.HasAllRepoAdminAccess() {
return true
}
if pkg.RepoID != 0 {
// old behavior: repo admin can manage the package linked to the repo
teams, _ = org_model.GetUserRepoTeams(ctx, owner.ID, doer.ID, pkg.RepoID)
for _, team := range teams {
if team.AccessMode >= perm.AccessModeAdmin {
return true
}
}
}
return false
}
func UnlinkFromRepository(ctx context.Context, pkg *packages_model.Package, doer *user_model.User) error {
if pkg.RepoID == 0 {
return util.ErrInvalidArgument
}
repo, err := repo_model.GetRepositoryByID(ctx, pkg.RepoID)
if err != nil && !repo_model.IsErrRepoNotExist(err) {
return fmt.Errorf("error getting repository %d: %w", pkg.RepoID, err)
}
if err == nil {
perms, err := access_model.GetDoerRepoPermission(ctx, repo, doer)
if err != nil {
return fmt.Errorf("error getting permissions for user %d on repository %d: %w", doer.ID, repo.ID, err)
}
if !perms.CanWrite(unit.TypePackages) {
return util.ErrPermissionDenied
}
}
user, err := user_model.GetUserByID(ctx, pkg.OwnerID)
if err != nil {
return err
}
if !doer.IsAdmin {
if !user.IsOrganization() {
if doer.ID != pkg.OwnerID {
return fmt.Errorf("no permission to unlink package '%v' from its repository, or packages are disabled", pkg.Name)
}
} else {
isOrgAdmin, err := org_model.OrgFromUser(user).IsOrgAdmin(ctx, doer.ID)
if err != nil {
return err
} else if !isOrgAdmin {
return fmt.Errorf("no permission to unlink package '%v' from its repository, or packages are disabled", pkg.Name)
}
}
if !canDoerManagePackage(ctx, pkg, doer) {
return util.ErrPermissionDenied
}
return packages_model.UnlinkRepository(ctx, pkg.ID)
}