fix(repo): centralize repository-scoped authorization (#39063)

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/packages/package_update.go

@@ -9,6 +9,7 @@ import (
 
 	org_model "gitea.dev/models/organization"
 	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/perm"
 	access_model "gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unit"
@@ -38,42 +39,42 @@ func LinkToRepository(ctx context.Context, pkg *packages_model.Package, repo *re
 	return nil
 }
 
+func canDoerManagePackage(ctx context.Context, pkg *packages_model.Package, doer *user_model.User) bool {
+	owner, err := user_model.GetUserByID(ctx, pkg.OwnerID)
+	if err != nil {
+		return false
+	}
+	if doer.IsAdmin {
+		return true
+	}
+	if !owner.IsOrganization() {
+		return doer.ID == pkg.OwnerID
+	}
+
+	teams, _ := org_model.GetUserOrgTeams(ctx, owner.ID, doer.ID)
+	if teams.HasAllRepoAdminAccess() {
+		return true
+	}
+
+	if pkg.RepoID != 0 {
+		// old behavior: repo admin can manage the package linked to the repo
+		teams, _ = org_model.GetUserRepoTeams(ctx, owner.ID, doer.ID, pkg.RepoID)
+		for _, team := range teams {
+			if team.AccessMode >= perm.AccessModeAdmin {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
 func UnlinkFromRepository(ctx context.Context, pkg *packages_model.Package, doer *user_model.User) error {
 	if pkg.RepoID == 0 {
 		return util.ErrInvalidArgument
 	}
-
-	repo, err := repo_model.GetRepositoryByID(ctx, pkg.RepoID)
-	if err != nil && !repo_model.IsErrRepoNotExist(err) {
-		return fmt.Errorf("error getting repository %d: %w", pkg.RepoID, err)
-	}
-	if err == nil {
-		perms, err := access_model.GetDoerRepoPermission(ctx, repo, doer)
-		if err != nil {
-			return fmt.Errorf("error getting permissions for user %d on repository %d: %w", doer.ID, repo.ID, err)
-		}
-		if !perms.CanWrite(unit.TypePackages) {
-			return util.ErrPermissionDenied
-		}
-	}
-
-	user, err := user_model.GetUserByID(ctx, pkg.OwnerID)
-	if err != nil {
-		return err
-	}
-	if !doer.IsAdmin {
-		if !user.IsOrganization() {
-			if doer.ID != pkg.OwnerID {
-				return fmt.Errorf("no permission to unlink package '%v' from its repository, or packages are disabled", pkg.Name)
-			}
-		} else {
-			isOrgAdmin, err := org_model.OrgFromUser(user).IsOrgAdmin(ctx, doer.ID)
-			if err != nil {
-				return err
-			} else if !isOrgAdmin {
-				return fmt.Errorf("no permission to unlink package '%v' from its repository, or packages are disabled", pkg.Name)
-			}
-		}
+	if !canDoerManagePackage(ctx, pkg, doer) {
+		return util.ErrPermissionDenied
 	}
 	return packages_model.UnlinkRepository(ctx, pkg.ID)
 }

services/packages/packages_test.go

@@ -0,0 +1,44 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package packages
+
+import (
+	"testing"
+
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMain(m *testing.M) {
+	unittest.MainTest(m)
+}
+
+func TestUnlinkFromRepositoryRequiresTargetRepoAdmin(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	repo := &repo_model.Repository{OwnerID: 3, OwnerName: "org3", Name: "package-repo", LowerName: "package-repo", IsPrivate: true}
+	require.NoError(t, db.Insert(t.Context(), repo))
+	require.NoError(t, db.Insert(t.Context(),
+		&repo_model.RepoUnit{RepoID: repo.ID, Type: unit_model.TypeCode},
+		&repo_model.RepoUnit{RepoID: repo.ID, Type: unit_model.TypePackages},
+		&organization.TeamRepo{OrgID: repo.OwnerID, TeamID: 14, RepoID: repo.ID},
+	))
+	pkg := &packages_model.Package{OwnerID: repo.OwnerID, RepoID: repo.ID, Type: packages_model.TypeGeneric, Name: "package", LowerName: "package"}
+	require.NoError(t, db.Insert(t.Context(), pkg))
+	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
+
+	assert.Error(t, UnlinkFromRepository(t.Context(), pkg, doer))
+	assert.Equal(t, repo.ID, unittest.AssertExistsAndLoadBean(t, &packages_model.Package{ID: pkg.ID}).RepoID)
+
+	require.NoError(t, db.Insert(t.Context(), &organization.TeamRepo{OrgID: repo.OwnerID, TeamID: 12, RepoID: repo.ID}))
+	require.NoError(t, UnlinkFromRepository(t.Context(), pkg, doer))
+	assert.Zero(t, unittest.AssertExistsAndLoadBean(t, &packages_model.Package{ID: pkg.ID}).RepoID)
+}