fix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058)

services/context/package.go

@@ -14,7 +14,6 @@ import (
 	"gitea.dev/models/unit"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
-	"gitea.dev/modules/structs"
 	"gitea.dev/modules/templates"
 )
 
@@ -155,10 +154,10 @@ func determineAccessMode(ctx *Base, pkgOwner, doer *user_model.User) (perm.Acces
 			// 1. Check if user is package owner
 			if doer.ID == pkgOwner.ID {
 				accessMode = perm.AccessModeOwner
-			} else if pkgOwner.Visibility == structs.VisibleTypePublic || pkgOwner.Visibility == structs.VisibleTypeLimited { // 2. Check if package owner is public or limited
+			} else if pkgOwner.Visibility.IsPublic() || (pkgOwner.Visibility.IsLimited() && !doer.IsRestricted) { // 2. Check if package owner is visible to the doer
 				accessMode = perm.AccessModeRead
 			}
-		} else if pkgOwner.Visibility == structs.VisibleTypePublic { // 3. Check if package owner is public
+		} else if pkgOwner.Visibility.IsPublic() { // 3. Check if package owner is public
 			accessMode = perm.AccessModeRead
 		}
 	}

services/context/package_test.go

@@ -0,0 +1,26 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package context
+
+import (
+	"testing"
+
+	"gitea.dev/models/perm"
+	"gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDeterminePackageAccessModeForLimitedOwner(t *testing.T) {
+	owner := &user.User{ID: 1, Visibility: structs.VisibleTypeLimited}
+
+	accessMode, err := determineAccessMode(&Base{}, owner, &user.User{ID: 2, IsActive: true})
+	assert.NoError(t, err)
+	assert.Equal(t, perm.AccessModeRead, accessMode)
+
+	accessMode, err = determineAccessMode(&Base{}, owner, &user.User{ID: 3, IsActive: true, IsRestricted: true})
+	assert.NoError(t, err)
+	assert.Equal(t, perm.AccessModeNone, accessMode)
+}