Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-19 23:58:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

enhance: inherit team access for all units (#38938)

Browse Source 
Admin and write team authorize now grant that mode on every unit,
including units added later, instead of only rows present in
`team_unit`. Granular teams keep `authorize=none` and explicit unit
rows.

Closes the `TEAM-UNIT-PERMISSION` design gap from
https://github.com/go-gitea/gitea/pull/34128.

Maybe also fix #15962 (actually maybe it had been fixed before, the root
cause is out-of-sync "access" table)


## Screenshots

only writing selected:
<img width="1399" height="1007" alt="image"
src="https://github.com/user-attachments/assets/1d1b4c49-a59a-47b6-998f-0464a067395b"
/>


_Created with the help of AI_

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
bircni
2026-08-17 22:30:24 +02:00
committed by GitHub
parent 1cf904f101
commit ed4a23e893
43 changed files with 305 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/organization/team_test.go
+27
View File
@@ -8,7 +8,9 @@ import (
"gitea.dev/models/db"
"gitea.dev/models/organization"
"gitea.dev/models/perm"
repo_model "gitea.dev/models/repo"
"gitea.dev/models/unit"
"gitea.dev/models/unittest"
user_model "gitea.dev/models/user"
"gitea.dev/modules/structs"
@@ -291,3 +293,28 @@ func TestIsUsableTeamName(t *testing.T) {
assert.NoError(t, organization.IsUsableTeamName("usable"))
assert.True(t, db.IsErrNameReserved(organization.IsUsableTeamName("new")))
}
func TestTeam_UnitAccessModeEx(t *testing.T) {
team := &organization.Team{
AccessMode: perm.AccessModeWrite, Units: []*organization.TeamUnit{
{Type: unit.TypeIssues, AccessMode: perm.AccessModeRead}, // team mode wins
{Type: unit.TypeWiki, AccessMode: perm.AccessModeAdmin}, // unit mode wins
},
}
mode, exist := team.UnitAccessModeEx(t.Context(), unit.TypeActions)
assert.True(t, exist)
assert.Equal(t, perm.AccessModeWrite, mode)
assert.Equal(t, perm.AccessModeWrite, team.UnitAccessMode(t.Context(), unit.TypeIssues))
assert.Equal(t, perm.AccessModeAdmin, team.UnitAccessMode(t.Context(), unit.TypeWiki))
assert.Equal(t, perm.AccessModeRead, team.UnitAccessMode(t.Context(), unit.TypeExternalWiki)) // limited by unit definition
team = &organization.Team{AccessMode: perm.AccessModeOwner, Units: []*organization.TeamUnit{}}
mode, exist = team.UnitAccessModeEx(t.Context(), unit.TypePackages)
assert.True(t, exist)
assert.Equal(t, perm.AccessModeAdmin, mode)
team = &organization.Team{AccessMode: perm.AccessModeNone, Units: []*organization.TeamUnit{}}
mode, exist = team.UnitAccessModeEx(t.Context(), unit.TypeActions)
assert.False(t, exist)
assert.Equal(t, perm.AccessModeNone, mode)
}