fix: add missing query parameters on runner list page (#39163)

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

models/organization/org.go

@@ -91,6 +91,14 @@ func (org *Organization) IsOwnedBy(ctx context.Context, uid int64) (bool, error)
 	return IsOrganizationOwner(ctx, org.ID, uid)
 }
 
+// CanChangeRepoTeamAccess reports whether a repository administrator can change team access.
+func (org *Organization) CanChangeRepoTeamAccess(ctx context.Context, doer *user_model.User) (bool, error) {
+	if org.RepoAdminChangeTeamAccess || doer.IsAdmin {
+		return true, nil
+	}
+	return org.IsOwnedBy(ctx, doer.ID)
+}
+
 // IsOrgAdmin returns true if given user is in the owner team or an admin team.
 func (org *Organization) IsOrgAdmin(ctx context.Context, uid int64) (bool, error) {
 	return IsOrganizationAdmin(ctx, org.ID, uid)

models/organization/org_list.go

@@ -89,6 +89,9 @@ func DoerViewOtherVisibility(doer, other *user_model.User) structs.VisibleType {
 	if doer.IsAdmin || doer.ID == other.ID {
 		return structs.VisibleTypePrivate
 	}
+	if doer.IsRestricted {
+		return structs.VisibleTypePublic
+	}
 	return structs.VisibleTypeLimited
 }
 

models/organization/org_list_test.go

@@ -77,8 +77,14 @@ func testLoadOrgListTeams(t *testing.T) {
 }
 
 func testDoerViewOtherVisibility(t *testing.T) {
+	viewer := &user_model.User{ID: 1}
+	other := &user_model.User{ID: 2}
+	restrictedViewer := &user_model.User{ID: 3, IsRestricted: true}
+
 	assert.Equal(t, structs.VisibleTypePublic, organization.DoerViewOtherVisibility(nil, nil))
-	assert.Equal(t, structs.VisibleTypeLimited, organization.DoerViewOtherVisibility(&user_model.User{ID: 1}, &user_model.User{ID: 2}))
-	assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(&user_model.User{ID: 1}, &user_model.User{ID: 1}))
-	assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(&user_model.User{ID: 1, IsAdmin: true}, &user_model.User{ID: 2}))
+	assert.Equal(t, structs.VisibleTypeLimited, organization.DoerViewOtherVisibility(viewer, other))
+	assert.Equal(t, structs.VisibleTypePublic, organization.DoerViewOtherVisibility(restrictedViewer, other))
+	assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(viewer, viewer))
+	assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(restrictedViewer, restrictedViewer))
+	assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(&user_model.User{ID: 4, IsAdmin: true, IsRestricted: true}, other))
 }

models/packages/package_blob.go

@@ -126,6 +126,10 @@ func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model
 	if user.IsAdmin {
 		return true, nil
 	}
+	ownerVisibilities := []structs.VisibleType{structs.VisibleTypePublic}
+	if !user.IsRestricted {
+		ownerVisibilities = append(ownerVisibilities, structs.VisibleTypeLimited)
+	}
 
 	maxTeamAuthorize := builder.
 		Select("max(team.authorize)").
@@ -144,7 +148,7 @@ func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model
 		// owner = user
 		builder.Eq{"`user`.id": user.ID}.
 			// user can see owner
-			Or(builder.Eq{"`user`.visibility": structs.VisibleTypePublic}.Or(builder.Eq{"`user`.visibility": structs.VisibleTypeLimited})).
+			Or(builder.In("`user`.visibility", ownerVisibilities)).
 			// owner is an organization and user has access to it
 			Or(builder.Eq{"`user`.type": user_model.UserTypeOrganization}.
 				And(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamAuthorize}.Or(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamUnitAccessMode}))),

models/packages/package_blob_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -49,3 +50,25 @@ func TestGetOrInsertBlobConcurrent(t *testing.T) {
 	}
 	assert.Equal(t, numGoroutines-1, existedCount)
 }
+
+func TestIsBlobAccessibleForRestrictedUser(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 33})
+	pkg, err := TryInsertPackage(t.Context(), &Package{OwnerID: owner.ID, Type: TypeContainer, Name: "limited", LowerName: "limited"})
+	require.NoError(t, err)
+	version, err := GetOrInsertVersion(t.Context(), &PackageVersion{PackageID: pkg.ID, Version: "1", LowerVersion: "1"})
+	require.NoError(t, err)
+	blob, _, err := GetOrInsertBlob(t.Context(), &PackageBlob{Size: 1, HashMD5: "md5", HashSHA1: "sha1", HashSHA256: "sha256", HashSHA512: "sha512"})
+	require.NoError(t, err)
+	_, err = TryInsertFile(t.Context(), &PackageFile{VersionID: version.ID, BlobID: blob.ID, Name: "blob", LowerName: "blob"})
+	require.NoError(t, err)
+
+	accessible, err := IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}))
+	require.NoError(t, err)
+	assert.True(t, accessible)
+
+	accessible, err = IsBlobAccessibleForUser(t.Context(), blob.ID, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 29}))
+	require.NoError(t, err)
+	assert.False(t, accessible)
+}

modules/actions/jobparser/model.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"strings"
 
 	"gitea.dev/modules/util"
 
@@ -173,17 +174,29 @@ func (j *Job) RunsOn() []string {
 }
 
 type Step struct {
-	ID               string            `yaml:"id,omitempty"`
-	If               yaml.Node         `yaml:"if,omitempty"`
-	Name             string            `yaml:"name,omitempty"`
-	Uses             string            `yaml:"uses,omitempty"`
-	Run              string            `yaml:"run,omitempty"`
-	WorkingDirectory string            `yaml:"working-directory,omitempty"`
-	Shell            string            `yaml:"shell,omitempty"`
-	Env              yaml.Node         `yaml:"env,omitempty"`
-	With             map[string]string `yaml:"with,omitempty"`
-	ContinueOnError  bool              `yaml:"continue-on-error,omitempty"`
-	TimeoutMinutes   string            `yaml:"timeout-minutes,omitempty"`
+	ID                 string            `yaml:"id,omitempty"`
+	If                 yaml.Node         `yaml:"if,omitempty"`
+	Name               string            `yaml:"name,omitempty"`
+	Uses               string            `yaml:"uses,omitempty"`
+	Run                string            `yaml:"run,omitempty"`
+	WorkingDirectory   string            `yaml:"working-directory,omitempty"`
+	Shell              string            `yaml:"shell,omitempty"`
+	Env                yaml.Node         `yaml:"env,omitempty"`
+	With               map[string]string `yaml:"with,omitempty"`
+	RawContinueOnError yaml.Node         `yaml:"continue-on-error,omitempty"` // raw: the runner evaluates it with the steps context
+	TimeoutMinutes     string            `yaml:"timeout-minutes,omitempty"`
+}
+
+// UnmarshalYAML canonicalizes booleans like continue-on-error
+func (s *Step) UnmarshalYAML(node *yaml.Node) error {
+	type rawStep Step
+	if err := node.Decode((*rawStep)(s)); err != nil {
+		return err
+	}
+	if raw := &s.RawContinueOnError; raw.Tag == "!!bool" {
+		raw.Value = strings.ToLower(raw.Value)
+	}
+	return nil
 }
 
 // String gets the name of step

modules/actions/jobparser/roundtrip_test.go

@@ -4,8 +4,10 @@
 package jobparser
 
 import (
+	"bytes"
 	"testing"
 
+	"gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/require"
 )
 
@@ -62,3 +64,42 @@ jobs:
 	require.Len(t, gotJob.Steps, 1)
 	require.Equal(t, wantRun, gotJob.Steps[0].Run, "round-trip must preserve run content; got payload:\n%s", payload)
 }
+
+// Typing a step's continue-on-error as a bool used to reject the whole `jobs:` node.
+func TestSingleWorkflowRoundTripStepContinueOnError(t *testing.T) {
+	const wf = `name: demo
+on: push
+jobs:
+  job1:
+    runs-on: ubuntu-latest
+    steps:
+      - id: quarantine
+        run: echo "q=true" >> "$GITHUB_OUTPUT"
+      - run: exit 1
+        continue-on-error: ${{ steps.quarantine.outputs.q == 'true' }}
+      - run: exit 1
+        continue-on-error: true
+      - run: exit 1
+        continue-on-error: TRUE
+      - run: exit 1
+        continue-on-error: false
+      - run: exit 1
+        continue-on-error: yes
+`
+	want := []string{"", "${{ steps.quarantine.outputs.q == 'true' }}", "true", "true", "false", "yes"}
+
+	sws, err := Parse([]byte(wf))
+	require.NoError(t, err)
+	require.Len(t, sws, 1)
+
+	payload, err := sws[0].Marshal()
+	require.NoError(t, err)
+
+	rw, err := model.ReadWorkflow(bytes.NewReader(payload))
+	require.NoError(t, err, "payload:\n%s", payload)
+	steps := rw.Jobs["job1"].Steps
+	require.Len(t, steps, len(want))
+	for i, w := range want {
+		require.Equal(t, w, steps[i].RawContinueOnError, "step %d, payload:\n%s", i, payload)
+	}
+}

routers/api/packages/swift/swift.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"regexp"
 	"sort"
 	"strings"
@@ -145,7 +146,7 @@ func EnumeratePackageVersions(ctx *context.Context) {
 		return pds[i].SemVer.LessThan(pds[j].SemVer)
 	})
 
-	baseURL := fmt.Sprintf("%sapi/packages/%s/swift/%s/%s/", setting.AppURL, ctx.Package.Owner.LowerName, packageScope, packageName)
+	baseURL := fmt.Sprintf("%sapi/packages/%s/swift/%s/%s/", setting.AppURL, url.PathEscape(ctx.Package.Owner.LowerName), url.PathEscape(packageScope), url.PathEscape(packageName))
 
 	releases := make(map[string]Release)
 	for _, pd := range pds {
@@ -156,7 +157,7 @@ func EnumeratePackageVersions(ctx *context.Context) {
 	}
 
 	setResponseHeaders(ctx.Resp, &headers{
-		Link: fmt.Sprintf(`<%s%s>; rel="latest-version"`, baseURL, pds[len(pds)-1].Version.Version),
+		Link: fmt.Sprintf(`<%s%s>; rel="latest-version"`, baseURL, url.PathEscape(pds[len(pds)-1].Version.Version)),
 	})
 
 	ctx.JSON(http.StatusOK, EnumeratePackageVersionsResponse{
@@ -322,16 +323,15 @@ func formFileOptionalReadCloser(ctx *context.Context, formKey string) (io.ReadCl
 func UploadPackageFile(ctx *context.Context) {
 	packageScope := ctx.PathParam("scope")
 	packageName := ctx.PathParam("name")
+	packageVersion := ctx.PathParam("version")
 
-	v, err := version.NewVersion(ctx.PathParam("version"))
+	_, err := version.NewSemver(packageVersion)
 
-	if !scopePattern.MatchString(packageScope) || !namePattern.MatchString(packageName) || err != nil {
+	if err != nil || !scopePattern.MatchString(packageScope) || !namePattern.MatchString(packageName) {
 		apiError(ctx, http.StatusBadRequest, err)
 		return
 	}
 
-	packageVersion := v.Core().String()
-
 	file, err := formFileOptionalReadCloser(ctx, "source-archive")
 	if file == nil || err != nil {
 		apiError(ctx, http.StatusBadRequest, "unable to read source-archive file")

routers/api/v1/api.go

@@ -1701,7 +1701,7 @@ func Routes() *web.Router {
 			m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions)
 		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser, auth_model.AccessTokenScopeCategoryOrganization), context.UserAssignmentAPI(), checkTokenPublicOnly(), individualPermsChecker)
 		m.Post("/orgs", tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), reqToken(), bind(api.CreateOrgOption{}), org.Create)
-		m.Get("/orgs", org.GetAll, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization))
+		m.Get("/orgs", tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), org.GetAll)
 		m.Group("/orgs/{org}", func() {
 			m.Combo("").Get(org.Get).
 				Patch(reqToken(), reqOrgOwnership(), bind(api.EditOrgOption{}), org.Edit).

routers/api/v1/org/team.go

@@ -683,16 +683,13 @@ func getRepositoryByParams(ctx *context.APIContext) *repo_model.Repository {
 }
 
 func canChangeTeamRepository(ctx *context.APIContext) bool {
-	if ctx.Org.Organization.RepoAdminChangeTeamAccess {
-		return true
-	}
-	isOwner, err := ctx.Org.Organization.IsOwnedBy(ctx, ctx.Doer.ID)
+	canChange, err := ctx.Org.Organization.CanChangeRepoTeamAccess(ctx, ctx.Doer)
 	if err != nil {
 		ctx.APIErrorInternal(err)
 		return false
 	}
-	if !isOwner {
-		ctx.APIError(http.StatusForbidden, "user is nor repo admin nor owner")
+	if !canChange {
+		ctx.APIError(http.StatusForbidden, "Must be an organization owner")
 		return false
 	}
 	return true

routers/api/v1/repo/teams.go

@@ -137,6 +137,8 @@ func AddTeam(ctx *context.APIContext) {
 	// responses:
 	//   "204":
 	//     "$ref": "#/responses/empty"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
 	//   "422":
 	//     "$ref": "#/responses/validationError"
 	//   "405":
@@ -173,6 +175,8 @@ func DeleteTeam(ctx *context.APIContext) {
 	// responses:
 	//   "204":
 	//     "$ref": "#/responses/empty"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
 	//   "422":
 	//     "$ref": "#/responses/validationError"
 	//   "405":
@@ -186,9 +190,9 @@ func DeleteTeam(ctx *context.APIContext) {
 func changeRepoTeam(ctx *context.APIContext, add bool) {
 	if !ctx.Repo.Owner.IsOrganization() {
 		ctx.APIError(http.StatusMethodNotAllowed, "repo is not owned by an organization")
+		return
 	}
-	if !ctx.Repo.Owner.RepoAdminChangeTeamAccess && !ctx.Repo.Permission.IsOwner() {
-		ctx.APIError(http.StatusForbidden, "user is nor repo admin nor owner")
+	if !canChangeRepoTeam(ctx) {
 		return
 	}
 
@@ -220,6 +224,19 @@ func changeRepoTeam(ctx *context.APIContext, add bool) {
 	ctx.Status(http.StatusNoContent)
 }
 
+func canChangeRepoTeam(ctx *context.APIContext) bool {
+	canChange, err := organization.OrgFromUser(ctx.Repo.Owner).CanChangeRepoTeamAccess(ctx, ctx.Doer)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return false
+	}
+	if !canChange {
+		ctx.APIError(http.StatusForbidden, "Must be an organization owner")
+		return false
+	}
+	return true
+}
+
 func getTeamByParam(ctx *context.APIContext) *organization.Team {
 	team, err := organization.GetTeam(ctx, ctx.Repo.Owner.ID, ctx.PathParam("team"))
 	if err != nil {

routers/web/repo/actions/badge.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
 	"gitea.dev/modules/badge"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/util"
@@ -17,6 +18,11 @@ import (
 )
 
 func GetWorkflowBadge(ctx *context.Context) {
+	context.CheckRepoScopedToken(ctx, ctx.Repo.Repository, auth_model.Read)
+	if ctx.Written() {
+		return
+	}
+
 	workflowFile := ctx.PathParam("workflow_name")
 	branch := ctx.FormString("branch", ctx.Repo.Repository.DefaultBranch)
 	event := ctx.FormString("event")

routers/web/repo/setting/collaboration.go

@@ -43,6 +43,13 @@ func Collaboration(ctx *context.Context) {
 	ctx.Data["OrgName"] = ctx.Repo.Repository.OwnerName
 	ctx.Data["Org"] = ctx.Repo.Repository.Owner
 	ctx.Data["Units"] = unit_model.Units
+	if ctx.Repo.Owner.IsOrganization() {
+		ctx.Data["CanChangeRepoTeamAccess"], err = organization.OrgFromUser(ctx.Repo.Owner).CanChangeRepoTeamAccess(ctx, ctx.Doer)
+		if err != nil {
+			ctx.ServerError("CanChangeRepoTeamAccess", err)
+			return
+		}
+	}
 
 	ctx.HTML(http.StatusOK, tplCollaboration)
 }
@@ -155,9 +162,7 @@ func DeleteCollaboration(ctx *context.Context) {
 
 // AddTeamPost response for adding a team to a repository
 func AddTeamPost(ctx *context.Context) {
-	if !ctx.Repo.Owner.RepoAdminChangeTeamAccess && !ctx.Repo.Permission.IsOwner() {
-		ctx.Flash.Error(ctx.Tr("repo.settings.change_team_access_not_allowed"))
-		ctx.Redirect(ctx.Repo.RepoLink + "/settings/collaboration")
+	if !canChangeRepoTeamAccess(ctx) {
 		return
 	}
 
@@ -201,9 +206,7 @@ func AddTeamPost(ctx *context.Context) {
 
 // DeleteTeam response for deleting a team from a repository
 func DeleteTeam(ctx *context.Context) {
-	if !ctx.Repo.Owner.RepoAdminChangeTeamAccess && !ctx.Repo.Permission.IsOwner() {
-		ctx.Flash.Error(ctx.Tr("repo.settings.change_team_access_not_allowed"))
-		ctx.Redirect(ctx.Repo.RepoLink + "/settings/collaboration")
+	if !canChangeRepoTeamAccess(ctx) {
 		return
 	}
 
@@ -221,3 +224,16 @@ func DeleteTeam(ctx *context.Context) {
 	ctx.Flash.Success(ctx.Tr("repo.settings.remove_team_success"))
 	ctx.JSONRedirect(ctx.Repo.RepoLink + "/settings/collaboration")
 }
+
+func canChangeRepoTeamAccess(ctx *context.Context) bool {
+	canChange, err := organization.OrgFromUser(ctx.Repo.Owner).CanChangeRepoTeamAccess(ctx, ctx.Doer)
+	if err != nil {
+		ctx.ServerError("CanChangeRepoTeamAccess", err)
+		return false
+	}
+	if !canChange {
+		ctx.Flash.Error(ctx.Tr("repo.settings.change_team_access_not_allowed"))
+		ctx.Redirect(ctx.Repo.RepoLink + "/settings/collaboration")
+	}
+	return canChange
+}

routers/web/repo/setting/settings_test.go

@@ -240,40 +240,27 @@ func TestAddTeamPost(t *testing.T) {
 
 func TestAddTeamPost_NotAllowed(t *testing.T) {
 	unittest.PrepareTestEnv(t)
-	ctx, _ := contexttest.MockContext(t, "org26/repo43")
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 32})
+	require.NoError(t, repo.LoadOwner(t.Context()))
+	adminTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 12})
+	targetTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2})
+	require.NoError(t, repo_service.TeamAddRepository(t.Context(), adminTeam, repo))
+	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
+	repoContext := &context.Repository{Owner: repo.Owner, Repository: repo}
+	renderCtx, _ := contexttest.MockContext(t, repo.Link()+"/settings/collaboration")
+	renderCtx.Repo = repoContext
+	renderCtx.Doer = doer
+	Collaboration(renderCtx)
+	assert.Equal(t, false, renderCtx.Data["CanChangeRepoTeamAccess"])
 
-	ctx.Req.Form.Set("team", "team11")
-
-	org := &user_model.User{
-		LowerName: "org26",
-		Type:      user_model.UserTypeOrganization,
-	}
-
-	team := &organization.Team{
-		ID:    11,
-		OrgID: 26,
-	}
-
-	re := &repo_model.Repository{
-		ID:      43,
-		Owner:   org,
-		OwnerID: 26,
-	}
-
-	repo := &context.Repository{
-		Owner: &user_model.User{
-			ID:                        26,
-			LowerName:                 "org26",
-			RepoAdminChangeTeamAccess: false,
-		},
-		Repository: re,
-	}
-
-	ctx.Repo = repo
+	ctx, _ := contexttest.MockContext(t, repo.Link()+"/settings/collaboration")
+	ctx.Req.Form.Set("team", targetTeam.Name)
+	ctx.Repo = repoContext
+	ctx.Doer = doer
 
 	AddTeamPost(ctx)
 
-	assert.False(t, repo_service.HasRepository(t.Context(), team, re.ID))
+	assert.False(t, repo_service.HasRepository(t.Context(), targetTeam, repo.ID))
 	assert.Equal(t, http.StatusSeeOther, ctx.Resp.WrittenStatus())
 	assert.NotEmpty(t, ctx.Flash.ErrorMsg)
 }

routers/web/shared/actions/runners.go

@@ -162,6 +162,7 @@ func Runners(ctx *context.Context) {
 	ctx.Data["AllowBulkActions"] = rCtx.IsAdmin
 
 	pager := context.NewPagination(count, opts.PageSize, opts.Page, 5)
+	pager.AddParamFromQuery(ctx.Req.URL.Query())
 
 	ctx.Data["Page"] = pager
 

services/context/package.go

@@ -14,7 +14,6 @@ import (
 	"gitea.dev/models/unit"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
-	"gitea.dev/modules/structs"
 	"gitea.dev/modules/templates"
 )
 
@@ -155,10 +154,10 @@ func determineAccessMode(ctx *Base, pkgOwner, doer *user_model.User) (perm.Acces
 			// 1. Check if user is package owner
 			if doer.ID == pkgOwner.ID {
 				accessMode = perm.AccessModeOwner
-			} else if pkgOwner.Visibility == structs.VisibleTypePublic || pkgOwner.Visibility == structs.VisibleTypeLimited { // 2. Check if package owner is public or limited
+			} else if pkgOwner.Visibility.IsPublic() || (pkgOwner.Visibility.IsLimited() && !doer.IsRestricted) { // 2. Check if package owner is visible to the doer
 				accessMode = perm.AccessModeRead
 			}
-		} else if pkgOwner.Visibility == structs.VisibleTypePublic { // 3. Check if package owner is public
+		} else if pkgOwner.Visibility.IsPublic() { // 3. Check if package owner is public
 			accessMode = perm.AccessModeRead
 		}
 	}

services/context/package_test.go

@@ -0,0 +1,26 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package context
+
+import (
+	"testing"
+
+	"gitea.dev/models/perm"
+	"gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDeterminePackageAccessModeForLimitedOwner(t *testing.T) {
+	owner := &user.User{ID: 1, Visibility: structs.VisibleTypeLimited}
+
+	accessMode, err := determineAccessMode(&Base{}, owner, &user.User{ID: 2, IsActive: true})
+	assert.NoError(t, err)
+	assert.Equal(t, perm.AccessModeRead, accessMode)
+
+	accessMode, err = determineAccessMode(&Base{}, owner, &user.User{ID: 3, IsActive: true, IsRestricted: true})
+	assert.NoError(t, err)
+	assert.Equal(t, perm.AccessModeNone, accessMode)
+}

templates/repo/settings/collaboration.tmpl

@@ -51,7 +51,7 @@
 			<h4 class="ui top attached header">
 				{{ctx.Locale.Tr "repo.settings.teams"}}
 			</h4>
-			{{$allowedToChangeTeams := (or (.Org.RepoAdminChangeTeamAccess) (.Permission.IsOwner))}}
+			{{$allowedToChangeTeams := .CanChangeRepoTeamAccess}}
 			{{if .Teams}}
 			<div class="ui attached segment">
 				<div class="flex-divided-list items-with-main">

templates/swagger/v1_json.tmpl

@@ -17781,6 +17781,9 @@
           "204": {
             "$ref": "#/responses/empty"
           },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
           "404": {
             "$ref": "#/responses/notFound"
           },
@@ -17828,6 +17831,9 @@
           "204": {
             "$ref": "#/responses/empty"
           },
+          "403": {
+            "$ref": "#/responses/forbidden"
+          },
           "404": {
             "$ref": "#/responses/notFound"
           },

templates/swagger/v1_openapi3_json.tmpl

@@ -29943,6 +29943,9 @@
           "204": {
             "$ref": "#/components/responses/empty"
           },
+          "403": {
+            "$ref": "#/components/responses/forbidden"
+          },
           "404": {
             "$ref": "#/components/responses/notFound"
           },
@@ -30040,6 +30043,9 @@
           "204": {
             "$ref": "#/components/responses/empty"
           },
+          "403": {
+            "$ref": "#/components/responses/forbidden"
+          },
           "404": {
             "$ref": "#/components/responses/notFound"
           },

tests/integration/api_org_test.go

@@ -121,6 +121,9 @@ func testAPIOrgGeneral(t *testing.T) {
 	user1Token := getTokenForLoggedInUser(t, user1Session, auth_model.AccessTokenScopeWriteOrganization)
 
 	t.Run("OrgGetAll", func(t *testing.T) {
+		miscToken := getTokenForLoggedInUser(t, user1Session, auth_model.AccessTokenScopeReadMisc)
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/orgs").AddTokenAuth(miscToken), http.StatusForbidden)
+
 		// accessing with a token will return all orgs
 		req := NewRequest(t, "GET", "/api/v1/orgs").AddTokenAuth(user1Token)
 		resp := MakeRequest(t, req, http.StatusOK)
@@ -130,6 +133,14 @@ func testAPIOrgGeneral(t *testing.T) {
 		assert.Equal(t, "Limited Org 36", apiOrgList[1].FullName)
 		assert.Equal(t, api.UserVisibilityLimited, apiOrgList[1].Visibility)
 
+		publicOnlyToken := getTokenForLoggedInUser(t, user1Session, auth_model.AccessTokenScopeReadOrganization, auth_model.AccessTokenScopePublicOnly)
+		resp = MakeRequest(t, NewRequest(t, "GET", "/api/v1/orgs").AddTokenAuth(publicOnlyToken), http.StatusOK)
+		apiOrgList = DecodeJSON(t, resp, []*api.Organization{})
+		assert.Len(t, apiOrgList, 9)
+		for _, org := range apiOrgList {
+			assert.Equal(t, api.UserVisibilityPublic, org.Visibility)
+		}
+
 		// accessing without a token will return only public orgs
 		req = NewRequest(t, "GET", "/api/v1/orgs")
 		resp = MakeRequest(t, req, http.StatusOK)

tests/integration/api_packages_swift_test.go

@@ -35,6 +35,7 @@ func TestPackageSwift(t *testing.T) {
 	packageID := packageScope + "." + packageName
 	packageVersion := "1.0.3"
 	packageVersion2 := "1.0.4"
+	packageVersion2Beta := "1.0.4-beta.1" // full version should be kept
 	packageVersion3 := "1.0.5"
 	packageAuthor := "KN4CK3R"
 	packageDescription := "Gitea Test Package"
@@ -215,7 +216,7 @@ func TestPackageSwift(t *testing.T) {
 			MakeRequest(t, req, expectedStatus)
 		}
 
-		uploadURL := fmt.Sprintf("%s/%s/%s/%s", url, packageScope, packageName, packageVersion2)
+		uploadURL := fmt.Sprintf("%s/%s/%s/%s", url, packageScope, packageName, packageVersion2Beta)
 
 		req := NewRequestWithBody(t, "PUT", uploadURL, bytes.NewReader([]byte{}))
 		MakeRequest(t, req, http.StatusUnauthorized)
@@ -229,18 +230,21 @@ func TestPackageSwift(t *testing.T) {
 				"Package.swift":           contentManifest1,
 				"Package@swift-5.6.swift": contentManifest2,
 			}),
-			makePackageMetadataJSON(packageVersion2),
+			makePackageMetadataJSON(packageVersion2Beta),
 		)
 
+		stableURL := fmt.Sprintf("%s/%s/%s/%s", url, packageScope, packageName, packageVersion2)
+		uploadPackage(t, stableURL, http.StatusCreated, test.WriteZipArchive(map[string]string{"Package.swift": contentManifest1}), "")
+
 		pvs, err := packages.GetVersionsByPackageType(t.Context(), user.ID, packages.TypeSwift)
 		assert.NoError(t, err)
-		require.Len(t, pvs, 2) // ATTENTION: many subtests are unable to run separately, they depend on the results of previous tests
-		thisPackageVersion := pvs[0]
+		require.Len(t, pvs, 3) // ATTENTION: many subtests are unable to run separately, they depend on the results of previous tests
+		thisPackageVersion := pvs[1]
 		pd, err := packages.GetPackageDescriptor(t.Context(), thisPackageVersion)
 		assert.NoError(t, err)
 		assert.NotNil(t, pd.SemVer)
 		assert.Equal(t, packageID, pd.Package.Name)
-		assert.Equal(t, packageVersion2, pd.Version.Version)
+		assert.Equal(t, packageVersion2Beta, pd.Version.Version)
 		assert.IsType(t, &swift_module.Metadata{}, pd.Metadata)
 		metadata := pd.Metadata.(*swift_module.Metadata)
 		assert.Equal(t, packageDescription, metadata.Description)
@@ -253,7 +257,7 @@ func TestPackageSwift(t *testing.T) {
 		pfs, err := packages.GetFilesByVersionID(t.Context(), thisPackageVersion.ID)
 		assert.NoError(t, err)
 		assert.Len(t, pfs, 1)
-		assert.Equal(t, fmt.Sprintf("%s-%s.zip", packageName, packageVersion2), pfs[0].Name)
+		assert.Equal(t, fmt.Sprintf("%s-%s.zip", packageName, packageVersion2Beta), pfs[0].Name)
 		assert.True(t, pfs[0].IsLead)
 
 		uploadPackage(
@@ -265,6 +269,9 @@ func TestPackageSwift(t *testing.T) {
 			}),
 			"",
 		)
+
+		invalidURL := fmt.Sprintf("%s/%s/%s/%s", url, packageScope, packageName, "1.0.6-")
+		uploadPackage(t, invalidURL, http.StatusBadRequest, bytes.NewReader(nil), "")
 	})
 
 	t.Run("Download", func(t *testing.T) {
@@ -295,18 +302,19 @@ func TestPackageSwift(t *testing.T) {
 			SetHeader("Accept", swift_router.AcceptJSON)
 		resp := MakeRequest(t, req, http.StatusOK)
 
-		versionURL := setting.AppURL + url[1:] + fmt.Sprintf("/%s/%s/%s", packageScope, packageName, packageVersion2)
+		versionURL := setting.AppURL + url[1:] + fmt.Sprintf("/%s/%s/%s", packageScope, packageName, packageVersion2Beta)
+		latestVersionURL := setting.AppURL + url[1:] + fmt.Sprintf("/%s/%s/%s", packageScope, packageName, packageVersion2)
 
 		assert.Equal(t, "1", resp.Header().Get("Content-Version"))
-		assert.Equal(t, fmt.Sprintf(`<%s>; rel="latest-version"`, versionURL), resp.Header().Get("Link"))
+		assert.Equal(t, fmt.Sprintf(`<%s>; rel="latest-version"`, latestVersionURL), resp.Header().Get("Link"))
 
 		body := resp.Body.String()
 
 		result := DecodeJSON(t, resp, &swift_router.EnumeratePackageVersionsResponse{})
 
-		assert.Len(t, result.Releases, 2)
-		assert.Contains(t, result.Releases, packageVersion2)
-		assert.Equal(t, versionURL, result.Releases[packageVersion2].URL)
+		assert.Len(t, result.Releases, 3)
+		assert.Contains(t, result.Releases, packageVersion2Beta)
+		assert.Equal(t, versionURL, result.Releases[packageVersion2Beta].URL)
 
 		req = NewRequest(t, "GET", fmt.Sprintf("%s/%s/%s.json", url, packageScope, packageName)).
 			AddBasicAuth(user.Name)
@@ -358,6 +366,13 @@ func TestPackageSwift(t *testing.T) {
 		resp = MakeRequest(t, req, http.StatusOK)
 
 		assert.Equal(t, body, resp.Body.String())
+
+		req = NewRequest(t, "GET", fmt.Sprintf("%s/%s/%s/%s", url, packageScope, packageName, packageVersion2Beta)).
+			AddBasicAuth(user.Name).
+			SetHeader("Accept", swift_router.AcceptJSON)
+		resp = MakeRequest(t, req, http.StatusOK)
+
+		assert.Equal(t, packageVersion2Beta, DecodeJSON(t, resp, &swift_router.PackageVersionMetadataResponse{}).Version)
 	})
 
 	t.Run("UploadEmptyJSONMetadata", func(t *testing.T) {

tests/integration/api_repo_teams_test.go

@@ -9,12 +9,14 @@ import (
 	"testing"
 
 	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/organization"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -63,6 +65,19 @@ func TestAPIRepoTeams(t *testing.T) {
 		AddTokenAuth(token)
 	MakeRequest(t, req, http.StatusForbidden)
 
+	adminTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 12})
+	targetTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2})
+	existingTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 7})
+	assert.NoError(t, repo_service.TeamAddRepository(t.Context(), adminTeam, publicOrgRepo))
+	user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
+	token = getUserToken(t, user.Name, auth_model.AccessTokenScopeWriteRepository)
+	req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), targetTeam.Name)).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+	assert.False(t, repo_service.HasRepository(t.Context(), targetTeam, publicOrgRepo.ID))
+	req = NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), existingTeam.Name)).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+	assert.True(t, repo_service.HasRepository(t.Context(), existingTeam, publicOrgRepo.ID))
+
 	// AddTeam with user2
 	user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	session = loginUser(t, user.Name)

tests/integration/api_team_test.go

@@ -329,6 +329,15 @@ func TestAPIAddRemoveTeamRepositoryRequiresOrgOwnerOrSetting(t *testing.T) {
 	req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
 	MakeRequest(t, req, http.StatusForbidden)
 	unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
+
+	siteAdmin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+	token = getUserToken(t, siteAdmin.Name, auth_model.AccessTokenScopeWriteOrganization)
+	req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusNoContent)
+	unittest.AssertNotExistsBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
+	req = NewRequest(t, "PUT", url).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusNoContent)
+	unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
 }
 
 func TestAPITeamVisibilityAccess(t *testing.T) {

tests/integration/api_user_orgs_test.go

@@ -77,6 +77,9 @@ func TestUserOrgs(t *testing.T) {
 	orgs = getUserOrgs(t, unrelatedUsername, privateMemberUsername)
 	assert.Empty(t, orgs)
 
+	orgs = getUserOrgs(t, "user29", adminUsername)
+	assert.Empty(t, orgs)
+
 	// not authenticated call should not be allowed
 	testUserOrgsUnauthenticated(t, privateMemberUsername)
 }

tests/integration/repo_home_token_scope_test.go

@@ -11,30 +11,33 @@ import (
 	"gitea.dev/tests"
 )
 
-// TestRepoHomeContentTokenScopes ensures the web repository home page enforces the
-// repository read scope (and public-only confinement) of an API token used via basic
-// auth, so a wrongly-scoped token cannot read private repository content.
-func TestRepoHomeContentTokenScopes(t *testing.T) {
+func TestRepoWebTokenScopes(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
-	// user2/repo2 is a private repository owned by user2
-	const url = "/user2/repo2"
-
-	// a token without repository scope must be denied
 	miscToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadMisc)
-	reqDenied := NewRequest(t, "GET", url)
-	reqDenied.SetBasicAuth("user2", miscToken)
-	MakeRequest(t, reqDenied, http.StatusForbidden)
-
-	// a public-only token must be denied on a private repo
 	publicOnlyToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
-	reqPublicOnly := NewRequest(t, "GET", url)
-	reqPublicOnly.SetBasicAuth("user2", publicOnlyToken)
-	MakeRequest(t, reqPublicOnly, http.StatusForbidden)
+	readToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
 
-	// a token with repository read scope is allowed
-	ownerReadToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
-	reqAllowed := NewRequest(t, "GET", url)
-	reqAllowed.SetBasicAuth("user2", ownerReadToken)
-	MakeRequest(t, reqAllowed, http.StatusOK)
+	for _, test := range []struct {
+		name string
+		url  string
+	}{
+		{"repository home", "/user2/repo2"},
+		{"workflow badge", "/org3/repo3/actions/workflows/test.yml/badge.svg"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			assertBasicAuthStatus(t, test.url, miscToken, http.StatusForbidden)
+			assertBasicAuthStatus(t, test.url, publicOnlyToken, http.StatusForbidden)
+			assertBasicAuthStatus(t, test.url, readToken, http.StatusOK)
+		})
+	}
+
+	assertBasicAuthStatus(t, "/user2/repo1/actions/workflows/test.yml/badge.svg", publicOnlyToken, http.StatusOK)
+}
+
+func assertBasicAuthStatus(t *testing.T, url, token string, status int) {
+	t.Helper()
+	req := NewRequest(t, http.MethodGet, url)
+	req.SetBasicAuth("user2", token)
+	MakeRequest(t, req, status)
 }