Skip to content

fix(repo): centralize repository-scoped authorization - #39063

Merged
wxiaoguang merged 18 commits into
go-gitea:mainfrom
bircni:fix/repository-authorization-cleanup
Aug 26, 2026
Merged

fix(repo): centralize repository-scoped authorization#39063
wxiaoguang merged 18 commits into
go-gitea:mainfrom
bircni:fix/repository-authorization-cleanup

Conversation

@bircni

@bircni bircni commented Aug 23, 2026 •
edited by wxiaoguang
Loading

Copy link
Copy Markdown
Member

Make authorization for repository team access, repository deletion, and package unlinking self-contained and specific to the target repository.

This prevents organization-wide admin-team membership or synthetic task permissions from being combined with access to a different repository. Web and API routes now use the same authorization decisions.

Follow-up to #39046 and #23940.

Allow repo admin in an org to delete their own repos

@bircni
bircni requested a review from wxiaoguang August 23, 2026 16:18
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Aug 23, 2026
@github-actions github-actions Bot added topic/repo Related to repositories type/bug labels Aug 23, 2026
@wxiaoguang
wxiaoguang marked this pull request as draft August 23, 2026 16:28
@wxiaoguang

wxiaoguang commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

It needs to be reviewed carefully by human.

wxiaoguang
wxiaoguang reviewed Aug 23, 2026
View reviewed changes
Comment thread routers/api/v1/api.go Outdated
@bircni
bircni marked this pull request as ready for review August 24, 2026 16:23
@wxiaoguang wxiaoguang self-assigned this Aug 25, 2026
@wxiaoguang
wxiaoguang marked this pull request as draft August 25, 2026 08:07
wxiaoguang
wxiaoguang reviewed Aug 25, 2026
View reviewed changes
Comment thread tests/integration/api_repo_delete_test.go Outdated
@wxiaoguang
wxiaoguang force-pushed the fix/repository-authorization-cleanup branch from 58de054 to c2105e3 Compare August 26, 2026 08:00
@wxiaoguang wxiaoguang removed their assignment Aug 26, 2026
@wxiaoguang
wxiaoguang marked this pull request as ready for review August 26, 2026 09:47
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Aug 26, 2026
This was referenced Aug 26, 2026
Merged
Closed
Closed
@wxiaoguang
wxiaoguang force-pushed the fix/repository-authorization-cleanup branch from fe135f3 to 151b2c3 Compare August 26, 2026 11:03
@wxiaoguang

wxiaoguang commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Large enough, nothing worse.

If nothing seriously wrong, can leave other improvements to the future.

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Aug 26, 2026
@wxiaoguang

wxiaoguang commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Reviewed by AI two rounds, let's merge and see whether we need following-up fixes.

@wxiaoguang
wxiaoguang merged commit e21c377 into go-gitea:main Aug 26, 2026
27 checks passed
@GiteaBot GiteaBot added this to the 28.0.0 milestone Aug 26, 2026
@wxiaoguang wxiaoguang mentioned this pull request Aug 26, 2026
Closed
@bircni
bircni deleted the fix/repository-authorization-cleanup branch August 26, 2026 15:17
zjjhot added a commit to zjjhot/gitea that referenced this pull request Aug 28, 2026
@zjjhot
Merge branch 'main' of https://github.com/go-gitea/gitea
d99f020 
* 'main' of https://github.com/go-gitea/gitea:
  fix(packages): preserve SemVer prerelease identifiers in Swift Registry (go-gitea#39156)
  [skip ci] Updated translations via Crowdin
  ci(snap): pack snaps without an LXD container (go-gitea#39152)
  chore: apply golangci "forbidigo" to all packages (go-gitea#39151)
  refactor: drop two unmaintained dependencies, rename the byte size helpers (go-gitea#39083)
  fix(actions): keep step-level continue-on-error expressions unevaluated (go-gitea#39141)
  [skip ci] Updated translations via Crowdin
  feat: add deploy tokens (go-gitea#37306)
  chore: raise minimum git version to 2.25 (go-gitea#39131)
  fix: recognize linguist language aliases (go-gitea#39135)
  fix(repo): centralize repository-scoped authorization (go-gitea#39063)
zjjhot added a commit to zjjhot/gitea that referenced this pull request Aug 28, 2026
@zjjhot
Merge branch 'main' into mainzjj
3c2bee6 
* main:
  fix(packages): preserve SemVer prerelease identifiers in Swift Registry (go-gitea#39156)
  [skip ci] Updated translations via Crowdin
  ci(snap): pack snaps without an LXD container (go-gitea#39152)
  chore: apply golangci "forbidigo" to all packages (go-gitea#39151)
  refactor: drop two unmaintained dependencies, rename the byte size helpers (go-gitea#39083)
  fix(actions): keep step-level continue-on-error expressions unevaluated (go-gitea#39141)
  [skip ci] Updated translations via Crowdin
  feat: add deploy tokens (go-gitea#37306)
  chore: raise minimum git version to 2.25 (go-gitea#39131)
  fix: recognize linguist language aliases (go-gitea#39135)
  fix(repo): centralize repository-scoped authorization (go-gitea#39063)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@silverwind silverwind silverwind approved these changes
@wxiaoguang wxiaoguang wxiaoguang approved these changes

Assignees

No one assigned

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. topic/repo Related to repositories type/bug

Projects

None yet

Milestone

28.0.0

Development

Successfully merging this pull request may close these issues.

Members cannot delete repositories they have created on their own Missing team permission to delete repos

4 participants

@bircni @wxiaoguang @silverwind @GiteaBot