mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-19 21:38:41 +00:00
bircni
ed4a23e893
Admin and write team authorize now grant that mode on every unit, including units added later, instead of only rows present in `team_unit`. Granular teams keep `authorize=none` and explicit unit rows. Closes the `TEAM-UNIT-PERMISSION` design gap from https://github.com/go-gitea/gitea/pull/34128. Maybe also fix #15962 (actually maybe it had been fixed before, the root cause is out-of-sync "access" table) ## Screenshots only writing selected: <img width="1399" height="1007" alt="image" src="https://github.com/user-attachments/assets/1d1b4c49-a59a-47b6-998f-0464a067395b" /> _Created with the help of AI_ --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
63 lines
1.8 KiB
Go
63 lines
1.8 KiB
Go
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"slices"
|
|
"strconv"
|
|
"testing"
|
|
|
|
unit_model "gitea.dev/models/unit"
|
|
"gitea.dev/tests"
|
|
)
|
|
|
|
func TestOrgProjectAccess(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
disabledRepoUnits := unit_model.DisabledRepoUnitsGet()
|
|
unit_model.DisabledRepoUnitsSet(append(slices.Clone(disabledRepoUnits), unit_model.TypeProjects))
|
|
defer unit_model.DisabledRepoUnitsSet(disabledRepoUnits)
|
|
|
|
// repo project, 404
|
|
req := NewRequest(t, "GET", "/user2/repo1/projects")
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
// user project, 200
|
|
req = NewRequest(t, "GET", "/user2/-/projects")
|
|
MakeRequest(t, req, http.StatusOK)
|
|
|
|
// org project, 200
|
|
req = NewRequest(t, "GET", "/org3/-/projects")
|
|
MakeRequest(t, req, http.StatusOK)
|
|
|
|
// change the org's visibility to private
|
|
session := loginUser(t, "user2")
|
|
req = NewRequestWithValues(t, "POST", "/org/org3/settings", map[string]string{
|
|
"name": "org3",
|
|
"visibility": "2",
|
|
})
|
|
session.MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
// user4 can still access the org's project because its team(team1) has the permission
|
|
session = loginUser(t, "user4")
|
|
req = NewRequest(t, "GET", "/org3/-/projects")
|
|
session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
// disable team1's project unit
|
|
session = loginUser(t, "user2")
|
|
req = NewRequestWithValues(t, "POST", "/org/org3/teams/team1/edit", map[string]string{
|
|
"team_name": "team1",
|
|
"repo_access": "specific",
|
|
"permission": "read",
|
|
"unit_" + strconv.Itoa(unit_model.TypeProjects.Value()): "0",
|
|
})
|
|
session.MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
// user4 can no longer access the org's project
|
|
session = loginUser(t, "user4")
|
|
req = NewRequest(t, "GET", "/org3/-/projects")
|
|
session.MakeRequest(t, req, http.StatusNotFound)
|
|
}
|