Files
Shivansh Gargandwxiaoguang 640cd615c4 feat: restrict pull/issue creation on access basis (#40069)
Adds a repository-level **"Restrict to collaborators"** option under the
Issues and Pull Request unit settings. When enabled, only users with
collaborator access to the base repository (owner, team members, or
explicit collaborators) can open issues or pull requests against it.

Public repositories often need to be visible/cloneable by everyone, but
owners may want to limit who can open pull requests (e.g. restrict to an
internal team while still keeping the code public)

* Fixes: https://github.com/go-gitea/gitea/issues/40015
* Fixes: https://github.com/go-gitea/gitea/issues/31890
* Fixes: https://github.com/go-gitea/gitea/issues/28021
* Fixes: https://github.com/go-gitea/gitea/issues/14801

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-11-10 00:53:49 +00:00

354 lines
11 KiB
Go

// Copyright 2019 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package issue
import (
"context"
"fmt"
activities_model "gitea.dev/models/activities"
"gitea.dev/models/db"
issues_model "gitea.dev/models/issues"
"gitea.dev/models/perm"
access_model "gitea.dev/models/perm/access"
project_model "gitea.dev/models/project"
repo_model "gitea.dev/models/repo"
system_model "gitea.dev/models/system"
"gitea.dev/models/unit"
user_model "gitea.dev/models/user"
"gitea.dev/modules/git"
"gitea.dev/modules/log"
"gitea.dev/modules/storage"
"gitea.dev/modules/util"
notify_service "gitea.dev/services/notify"
)
// NewIssue creates new issue with labels for repository.
func NewIssue(ctx context.Context, repo *repo_model.Repository, perm access_model.Permission, issue *issues_model.Issue, labelIDs []int64, uuids []string, assigneeIDs, projectIDs []int64) error {
if err := issue.LoadPoster(ctx); err != nil {
return err
}
if user_model.IsUserBlockedBy(ctx, issue.Poster, repo.OwnerID) {
return util.ErrorWrapTranslatable(user_model.ErrBlockedUser, "repo.creation_blocked_by_owner")
}
if user_model.IsUserBlockedBy(ctx, issue.Poster, assigneeIDs...) {
return util.ErrorWrapTranslatable(user_model.ErrBlockedUser, "repo.creation_blocked_by_assignee")
}
restriction := repo.MustGetUnit(ctx, unit.TypeIssues).IssuesConfig().CreationRestriction
if restriction != repo_model.CreationRestrictionReader {
err := CheckCreationRestriction(perm, unit.TypeIssues, restriction)
if err != nil {
return err
}
}
assigneeCommentMap := make(map[int64]*issues_model.Comment)
assignees := make(map[int64]*user_model.User)
var addedProjectIDs []int64
if err := db.WithTx(ctx, func(ctx context.Context) error {
if err := issues_model.NewIssue(ctx, repo, issue, labelIDs, uuids); err != nil {
return err
}
for _, assigneeID := range assigneeIDs {
assignee, err := user_model.GetUserByID(ctx, assigneeID)
if err != nil {
log.Error("GetUserByID: %v", err)
continue
}
assignees[assigneeID] = assignee
comment, err := AddAssigneeIfNotAssigned(ctx, issue, issue.Poster, assignee)
if err != nil {
return err
}
assigneeCommentMap[assigneeID] = comment
}
if len(projectIDs) > 0 {
var err error
if addedProjectIDs, _, err = issues_model.IssueAssignOrRemoveProject(ctx, issue, issue.Poster, projectIDs); err != nil {
return err
}
}
return nil
}); err != nil {
return err
}
mentions, err := issues_model.FindAndUpdateIssueMentions(ctx, issue, issue.Poster, issue.Content)
if err != nil {
return err
}
notify_service.NewIssue(ctx, issue, mentions)
if len(issue.Labels) > 0 {
notify_service.IssueChangeLabels(ctx, issue.Poster, issue, issue.Labels, nil)
}
if issue.Milestone != nil {
notify_service.IssueChangeMilestone(ctx, issue.Poster, issue, 0)
}
if len(assigneeIDs) > 0 {
for _, assignee := range assignees {
notify_service.IssueChangeAssignee(ctx, issue.Poster, issue, assignee, false, assigneeCommentMap[assignee.ID])
}
}
notify_service.IssueChangeProjects(ctx, issue.Poster, issue, addedProjectIDs, nil)
return nil
}
// ChangeTitle changes the title of this issue, as the given user.
func ChangeTitle(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, title string) error {
oldTitle := issue.Title
issue.Title = title
if oldTitle == title {
return nil
}
if err := issue.LoadRepo(ctx); err != nil {
return err
}
if user_model.IsUserBlockedBy(ctx, doer, issue.PosterID, issue.Repo.OwnerID) {
if !access_model.IsUserRepoAdmin(ctx, issue.Repo, doer) {
return user_model.ErrBlockedUser
}
}
if err := issues_model.ChangeIssueTitle(ctx, issue, doer, oldTitle); err != nil {
return err
}
var reviewNotifiers []*ReviewRequestNotifier
if issue.IsPull && issues_model.HasWorkInProgressPrefix(oldTitle) && !issues_model.HasWorkInProgressPrefix(title) {
if err := issue.LoadPullRequest(ctx); err != nil {
return err
}
var err error
reviewNotifiers, err = PullRequestCodeOwnersReview(ctx, issue.PullRequest)
if err != nil {
log.Error("PullRequestCodeOwnersReview: %v", err)
}
}
notify_service.IssueChangeTitle(ctx, doer, issue, oldTitle)
ReviewRequestNotify(ctx, issue, issue.Poster, reviewNotifiers)
return nil
}
// ChangeTimeEstimate changes the time estimate of this issue, as the given user.
func ChangeTimeEstimate(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, timeEstimate int64) (err error) {
issue.TimeEstimate = timeEstimate
return issues_model.ChangeIssueTimeEstimate(ctx, issue, doer, timeEstimate)
}
// ChangeIssueRef changes the branch of this issue, as the given user.
func ChangeIssueRef(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, ref string) error {
oldRef := issue.Ref
issue.Ref = ref
if err := issues_model.ChangeIssueRef(ctx, issue, doer, oldRef); err != nil {
return err
}
notify_service.IssueChangeRef(ctx, doer, issue, oldRef)
return nil
}
// DeleteIssue deletes an issue
func DeleteIssue(ctx context.Context, doer *user_model.User, issue *issues_model.Issue) error {
// load issue before deleting it
if err := issue.LoadAttributes(ctx); err != nil {
return err
}
if err := issue.LoadPullRequest(ctx); err != nil {
return err
}
// delete entries in database
attachmentPaths, err := deleteIssue(ctx, issue)
if err != nil {
return err
}
for _, attachmentPath := range attachmentPaths {
system_model.RemoveStorageWithNotice(ctx, storage.Attachments, "Delete issue attachment", attachmentPath)
}
// delete pull request related git data
if issue.IsPull {
if err := issue.PullRequest.LoadBaseRepo(ctx); err != nil {
return err
}
for _, ref := range []git.RefName{git.RefNameFromPullIndex(issue.Index), git.MergeRefNameFromPullIndex(issue.Index), git.MergedRefNameFromPullIndex(issue.Index)} {
if err := git.RemoveRef(ctx, issue.PullRequest.BaseRepo, ref.String()); err != nil {
log.Error("RemoveRef %s: %v", ref, err)
}
}
}
notify_service.DeleteIssue(ctx, doer, issue)
return nil
}
// GetRefEndNamesAndURLs retrieves the ref end names (e.g. refs/heads/branch-name -> branch-name)
// and their respective URLs.
func GetRefEndNamesAndURLs(issues []*issues_model.Issue, repoLink string) (map[int64]string, map[int64]string) {
issueRefEndNames := make(map[int64]string, len(issues))
issueRefURLs := make(map[int64]string, len(issues))
for _, issue := range issues {
if issue.Ref != "" {
ref := git.RefName(issue.Ref)
issueRefEndNames[issue.ID] = ref.ShortName()
issueRefURLs[issue.ID] = repoLink + "/src/" + ref.RefWebLinkPath()
}
}
return issueRefEndNames, issueRefURLs
}
// deleteIssue deletes the issue
func deleteIssue(ctx context.Context, issue *issues_model.Issue) ([]string, error) {
return db.WithTx2(ctx, func(ctx context.Context) ([]string, error) {
if _, err := db.GetEngine(ctx).ID(issue.ID).NoAutoCondition().Delete(issue); err != nil {
return nil, err
}
if err := issues_model.DecrRepoIssueNumbers(ctx, issue.RepoID, issue.IsPull, true, issue.IsClosed); err != nil {
return nil, err
}
if err := issues_model.UpdateMilestoneCounters(ctx, issue.MilestoneID); err != nil {
return nil, fmt.Errorf("error updating counters for milestone id %d: %w",
issue.MilestoneID, err)
}
if err := activities_model.DeleteIssueActions(ctx, issue.RepoID, issue.ID, issue.Index); err != nil {
return nil, err
}
// find attachments related to this issue and remove them
if err := issue.LoadAttachments(ctx); err != nil {
return nil, err
}
var attachmentPaths []string
for i := range issue.Attachments {
attachmentPaths = append(attachmentPaths, issue.Attachments[i].RelativePath())
}
// delete all database data still assigned to this issue
if err := db.DeleteBeans(ctx,
&issues_model.ContentHistory{IssueID: issue.ID},
&issues_model.Comment{IssueID: issue.ID},
&issues_model.IssueLabel{IssueID: issue.ID},
&issues_model.IssueDependency{IssueID: issue.ID},
&issues_model.IssueAssignees{IssueID: issue.ID},
&issues_model.IssueUser{IssueID: issue.ID},
&activities_model.Notification{IssueID: issue.ID},
&issues_model.Reaction{IssueID: issue.ID},
&issues_model.IssueWatch{IssueID: issue.ID},
&issues_model.Stopwatch{IssueID: issue.ID},
&issues_model.TrackedTime{IssueID: issue.ID},
&project_model.ProjectIssue{IssueID: issue.ID},
&repo_model.Attachment{IssueID: issue.ID},
&issues_model.PullRequest{IssueID: issue.ID},
&issues_model.Comment{RefIssueID: issue.ID},
&issues_model.IssueDependency{DependencyID: issue.ID},
&issues_model.Comment{DependentIssueID: issue.ID},
&issues_model.IssuePin{IssueID: issue.ID},
); err != nil {
return nil, err
}
return attachmentPaths, nil
})
}
// DeleteOrphanedIssues delete issues without a repo
func DeleteOrphanedIssues(ctx context.Context) error {
var attachmentPaths []string
err := db.WithTx(ctx, func(ctx context.Context) error {
repoIDs, err := issues_model.GetOrphanedIssueRepoIDs(ctx)
if err != nil {
return err
}
for i := range repoIDs {
paths, err := DeleteIssuesByRepoID(ctx, repoIDs[i])
if err != nil {
return err
}
attachmentPaths = append(attachmentPaths, paths...)
}
return nil
})
if err != nil {
return err
}
// Remove issue attachment files.
for i := range attachmentPaths {
system_model.RemoveStorageWithNotice(ctx, storage.Attachments, "Delete issue attachment", attachmentPaths[i])
}
return nil
}
// DeleteIssuesByRepoID deletes issues by repositories id
func DeleteIssuesByRepoID(ctx context.Context, repoID int64) (attachmentPaths []string, err error) {
for {
issues := make([]*issues_model.Issue, 0, db.DefaultMaxInSize)
if err := db.GetEngine(ctx).
Where("repo_id = ?", repoID).
Limit(db.DefaultMaxInSize).
Find(&issues); err != nil {
return nil, err
}
if len(issues) == 0 {
break
}
for _, issue := range issues {
issueAttachPaths, err := deleteIssue(ctx, issue)
if err != nil {
return nil, fmt.Errorf("deleteIssue [issue_id: %d]: %w", issue.ID, err)
}
attachmentPaths = append(attachmentPaths, issueAttachPaths...)
}
}
return attachmentPaths, err
}
// CanSelfChangeOrAccessContent checks whether the doer can access the content:
// * If the doer is the content poster, then the doer can access the content if they have read access to issues.
// * If the doer is not the content poster, then the doer can access the content if they have the required access mode to the unit type (issues or pull requests).
// * If the issue is locked, then the doer can only access the content if they have write access.
func CanSelfChangeOrAccessContent(doer *user_model.User, doerPerm access_model.Permission, refIssue *issues_model.Issue, contentPosterID int64, accessMode perm.AccessMode) bool {
unitType := util.Iif(refIssue.IsPull, unit.TypePullRequests, unit.TypeIssues)
if doer == nil || !doerPerm.CanAccess(perm.AccessModeRead, unitType) {
return false
}
ok := doer.ID == contentPosterID || doerPerm.CanAccess(accessMode, unitType)
if !ok {
return false
}
// TODO: the UI can also be updated in the future to hide the "edit" menu
if refIssue.IsLocked && !doerPerm.CanWrite(unitType) {
return false
}
return true
}
// IsLockedForDoer returns whether the lock keeps a doer with perm from commenting
func IsLockedForDoer(issue *issues_model.Issue, perm access_model.Permission) bool {
return issue.IsLocked && !perm.CanWriteIssuesOrPulls(issue.IsPull)
}