Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-28 15:45:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(repo): centralize repository-scoped authorization (#39063)

Browse Source 
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
bircni
2026-08-26 14:12:53 +02:00
committed by GitHub
parent 90c43e8e78
commit e21c37703e
27 changed files with 383 additions and 476 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/api_repo_delete_test.go
+54
View File
@@ -0,0 +1,54 @@
// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package integration
import (
"net/http"
"testing"
auth_model "gitea.dev/models/auth"
"gitea.dev/models/organization"
"gitea.dev/models/perm"
repo_model "gitea.dev/models/repo"
"gitea.dev/models/unittest"
user_model "gitea.dev/models/user"
repo_service "gitea.dev/services/repository"
"gitea.dev/tests"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestAPIRepositoryDelete(t *testing.T) {
defer tests.PrepareTestEnv(t)()
t.Run("AdminNoPermToDeleteRepo", func(t *testing.T) {
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
org := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3})
doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
teams, err := organization.GetUserOrgTeams(t.Context(), org.ID, doer.ID)
require.NoError(t, err)
require.Len(t, teams, 1)
team := teams[0]
assert.Equal(t, perm.AccessModeAdmin, team.AccessMode)
assert.True(t, team.CanCreateOrgRepo)
token := getUserToken(t, doer.Name, auth_model.AccessTokenScopeWriteRepository)
unrelatedRepo, err := repo_service.CreateRepository(t.Context(), owner, org, repo_service.CreateRepoOptions{Name: "unrelated-admin-team"})
require.NoError(t, err)
targetRepo, err := repo_service.CreateRepository(t.Context(), owner, org, repo_service.CreateRepoOptions{Name: "target-admin-team"})
require.NoError(t, err)
require.NoError(t, repo_service.TeamAddRepository(t.Context(), team, targetRepo))
req := NewRequest(t, "DELETE", "/api/v1/repos/"+unrelatedRepo.FullName()).AddTokenAuth(token)
MakeRequest(t, req, http.StatusForbidden)
unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: unrelatedRepo.ID})
req = NewRequest(t, "DELETE", "/api/v1/repos/"+targetRepo.FullName()).AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
unittest.AssertNotExistsBean(t, &repo_model.Repository{ID: targetRepo.ID})
})
}