mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-07-25 02:48:05 +00:00
45 lines
1.5 KiB
Go
45 lines
1.5 KiB
Go
// Copyright 2026 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package authz
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"forgejo.org/models/perm"
|
|
repo_model "forgejo.org/models/repo"
|
|
"forgejo.org/modules/structs"
|
|
|
|
"xorm.io/builder"
|
|
)
|
|
|
|
// Grants access only to public repositories. Does not change the level of access for any public repos.
|
|
type PublicReposAuthorizationReducer struct{}
|
|
|
|
func (*PublicReposAuthorizationReducer) ReduceRepoAccess(ctx context.Context, repo *repo_model.Repository, accessMode perm.AccessMode) (perm.AccessMode, error) {
|
|
if err := repo.LoadOwner(ctx); err != nil {
|
|
return 0, fmt.Errorf("failed to LoadOwner during ReduceRepoAccess: %w", err)
|
|
}
|
|
|
|
// Fine-grained access tokens remove access to any private repositories, or repository owned by non-public users,
|
|
// that aren't listed in their resource list.
|
|
if !repo.Owner.Visibility.IsPublic() || repo.IsPrivate {
|
|
return perm.AccessModeNone, nil
|
|
}
|
|
|
|
return accessMode, nil
|
|
}
|
|
|
|
func (*PublicReposAuthorizationReducer) RepoReadAccessFilter() builder.Cond {
|
|
// Allow access only to non-private repositories, that aren't in a private or limited organization.
|
|
return builder.And(
|
|
builder.Eq{"is_private": false},
|
|
builder.NotIn("owner_id", builder.Select("id").From("`user`").Where(
|
|
builder.Or(builder.Eq{"visibility": structs.VisibleTypeLimited}, builder.Eq{"visibility": structs.VisibleTypePrivate}),
|
|
)))
|
|
}
|
|
|
|
func (*PublicReposAuthorizationReducer) AllowAdminOverride() bool {
|
|
return false
|
|
}
|