use CollaborativeOwnerIDs

Zettat123 · Zettat123 · commit 6142f66358c7 · 2024-11-26T17:12:27.000+08:00
diff --git a/models/repo/repo_unit.go b/models/repo/repo_unit.go
@@ -169,8 +169,10 @@ func (cfg *PullRequestsConfig) GetDefaultMergeStyle() MergeStyle {
 }
 
 type ActionsConfig struct {
-	DisabledWorkflows       []string
-	AccessbleFromOtherRepos bool
+	DisabledWorkflows []string
+	// CollaborativeOwnerIDs is a list of owner IDs used to share actions from private repos.
+	// Only workflows from the private repos whose owners are in CollaborativeOwnerIDs can access the current repo's actions.
+	CollaborativeOwnerIDs []int64
 }
 
 func (cfg *ActionsConfig) EnableWorkflow(file string) {
@@ -195,6 +197,20 @@ func (cfg *ActionsConfig) DisableWorkflow(file string) {
 	cfg.DisabledWorkflows = append(cfg.DisabledWorkflows, file)
 }
 
+func (cfg *ActionsConfig) AddCollaborativeOwner(ownerID int64) {
+	if !slices.Contains(cfg.CollaborativeOwnerIDs, ownerID) {
+		cfg.CollaborativeOwnerIDs = append(cfg.CollaborativeOwnerIDs, ownerID)
+	}
+}
+
+func (cfg *ActionsConfig) RemoveCollaborativeOwner(ownerID int64) {
+	cfg.CollaborativeOwnerIDs = util.SliceRemoveAll(cfg.CollaborativeOwnerIDs, ownerID)
+}
+
+func (cfg *ActionsConfig) IsCollaborativeOwner(ownerID int64) bool {
+	return slices.Contains(cfg.CollaborativeOwnerIDs, ownerID)
+}
+
 // FromDB fills up a ActionsConfig from serialized format.
 func (cfg *ActionsConfig) FromDB(bs []byte) error {
 	return json.UnmarshalHandleDoubleEncode(bs, &cfg)
diff --git a/models/user/search.go b/models/user/search.go
@@ -6,6 +6,7 @@ package user
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strings"
 
 	"code.gitea.io/gitea/models/db"
@@ -22,7 +23,7 @@ type SearchUserOptions struct {
 	db.ListOptions
 
 	Keyword       string
-	Type          UserType
+	Types         []UserType
 	UID           int64
 	LoginName     string // this option should be used only for admin user
 	SourceID      int64  // this option should be used only for admin user
@@ -45,15 +46,16 @@ type SearchUserOptions struct {
 
 func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) *xorm.Session {
 	var cond builder.Cond
-	cond = builder.Eq{"type": opts.Type}
+	cond = builder.In("type", opts.Types)
 	if opts.IncludeReserved {
-		if opts.Type == UserTypeIndividual {
+		if slices.Contains(opts.Types, UserTypeIndividual) {
 			cond = cond.Or(builder.Eq{"type": UserTypeUserReserved}).Or(
 				builder.Eq{"type": UserTypeBot},
 			).Or(
 				builder.Eq{"type": UserTypeRemoteUser},
 			)
-		} else if opts.Type == UserTypeOrganization {
+		}
+		if slices.Contains(opts.Types, UserTypeOrganization) {
 			cond = cond.Or(builder.Eq{"type": UserTypeOrganizationReserved})
 		}
 	}
diff --git a/models/user/user.go b/models/user/user.go
@@ -1317,3 +1317,15 @@ func DisabledFeaturesWithLoginType(user *User) *container.Set[string] {
 	}
 	return &setting.Admin.UserDisabledFeatures
 }
+
+// GetUserOrOrgIDByName returns the id for a user or an org by name
+func GetUserOrOrgIDByName(ctx context.Context, name string) (int64, error) {
+	var id int64
+	has, err := db.GetEngine(ctx).Table("user").Where("name = ?", name).Cols("id").Get(&id)
+	if err != nil {
+		return 0, err
+	} else if !has {
+		return 0, fmt.Errorf("user or org with name %s: %w", name, util.ErrNotExist)
+	}
+	return id, nil
+}
diff --git a/models/user/user_test.go b/models/user/user_test.go
@@ -76,7 +76,7 @@ func TestSearchUsers(t *testing.T) {
 
 	// test orgs
 	testOrgSuccess := func(opts *user_model.SearchUserOptions, expectedOrgIDs []int64) {
-		opts.Type = user_model.UserTypeOrganization
+		opts.Types = []user_model.UserType{user_model.UserTypeOrganization}
 		testSuccess(opts, expectedOrgIDs)
 	}
 
@@ -100,7 +100,7 @@ func TestSearchUsers(t *testing.T) {
 
 	// test users
 	testUserSuccess := func(opts *user_model.SearchUserOptions, expectedUserIDs []int64) {
-		opts.Type = user_model.UserTypeIndividual
+		opts.Types = []user_model.UserType{user_model.UserTypeIndividual}
 		testSuccess(opts, expectedUserIDs)
 	}
 
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
@@ -3755,10 +3755,11 @@ variables.update.failed = Failed to edit variable.
 variables.update.success = The variable has been edited.
 
 general = General
-general.settings = Actions General Settings
-general.actions_accessible_from_other_repositories = Accessible from repositories owned by '%s'
-general.actions_accessible_from_other_repositories_desc = Workflows in other repositories that are owned by the user '%s' can access the actions and reusable workflows in this repository. Access is allowed only from private repositories.
-general.actions_always_accessible_desc = The actions and workflows of a public repository are always accessible to other repositories.
+general.collaborative_owners_management = Collaborative Owners Management
+general.add_collaborative_owner = Add Collaborative Owner
+general.collaborative_owner_not_exist = The collaborative owner does not exist.
+general.remove_collaborative_owner = Remove Collaborative Owner
+general.remove_collaborative_owner_desc = Removing a collaborative owner will prevent the repositories of the owner from accessing the actions in this repository. Continue?
 
 [projects]
 deleted.display_name = Deleted Project
diff --git a/routers/api/v1/admin/org.go b/routers/api/v1/admin/org.go
@@ -103,7 +103,7 @@ func GetAllOrgs(ctx *context.APIContext) {
 
 	users, maxResults, err := user_model.SearchUsers(ctx, &user_model.SearchUserOptions{
 		Actor:       ctx.Doer,
-		Type:        user_model.UserTypeOrganization,
+		Types:       []user_model.UserType{user_model.UserTypeOrganization},
 		OrderBy:     db.SearchOrderByAlphabetically,
 		ListOptions: listOptions,
 		Visible:     []api.VisibleType{api.VisibleTypePublic, api.VisibleTypeLimited, api.VisibleTypePrivate},
diff --git a/routers/api/v1/admin/user.go b/routers/api/v1/admin/user.go
@@ -423,7 +423,7 @@ func SearchUsers(ctx *context.APIContext) {
 
 	users, maxResults, err := user_model.SearchUsers(ctx, &user_model.SearchUserOptions{
 		Actor:       ctx.Doer,
-		Type:        user_model.UserTypeIndividual,
+		Types:       []user_model.UserType{user_model.UserTypeIndividual},
 		LoginName:   ctx.FormTrim("login_name"),
 		SourceID:    ctx.FormInt64("source_id"),
 		OrderBy:     db.SearchOrderByAlphabetically,
diff --git a/routers/api/v1/org/org.go b/routers/api/v1/org/org.go
@@ -203,7 +203,7 @@ func GetAll(ctx *context.APIContext) {
 	publicOrgs, maxResults, err := user_model.SearchUsers(ctx, &user_model.SearchUserOptions{
 		Actor:       ctx.Doer,
 		ListOptions: listOptions,
-		Type:        user_model.UserTypeOrganization,
+		Types:       []user_model.UserType{user_model.UserTypeOrganization},
 		OrderBy:     db.SearchOrderByAlphabetically,
 		Visible:     vMode,
 	})
diff --git a/routers/api/v1/user/user.go b/routers/api/v1/user/user.go
@@ -76,7 +76,7 @@ func Search(ctx *context.APIContext) {
 			Actor:         ctx.Doer,
 			Keyword:       ctx.FormTrim("q"),
 			UID:           uid,
-			Type:          user_model.UserTypeIndividual,
+			Types:         []user_model.UserType{user_model.UserTypeIndividual},
 			SearchByEmail: true,
 			Visible:       visible,
 			ListOptions:   listOptions,
diff --git a/routers/web/admin/orgs.go b/routers/web/admin/orgs.go
@@ -29,7 +29,7 @@ func Organizations(ctx *context.Context) {
 
 	explore.RenderUserSearch(ctx, &user_model.SearchUserOptions{
 		Actor:           ctx.Doer,
-		Type:            user_model.UserTypeOrganization,
+		Types:           []user_model.UserType{user_model.UserTypeOrganization},
 		IncludeReserved: true, // administrator needs to list all accounts include reserved
 		ListOptions: db.ListOptions{
 			PageSize: setting.UI.Admin.OrgPagingNum,
diff --git a/routers/web/admin/users.go b/routers/web/admin/users.go
@@ -71,7 +71,7 @@ func Users(ctx *context.Context) {
 
 	explore.RenderUserSearch(ctx, &user_model.SearchUserOptions{
 		Actor: ctx.Doer,
-		Type:  user_model.UserTypeIndividual,
+		Types: []user_model.UserType{user_model.UserTypeIndividual},
 		ListOptions: db.ListOptions{
 			PageSize: setting.UI.Admin.UserPagingNum,
 		},
diff --git a/routers/web/explore/org.go b/routers/web/explore/org.go
@@ -46,7 +46,7 @@ func Organizations(ctx *context.Context) {
 
 	RenderUserSearch(ctx, &user_model.SearchUserOptions{
 		Actor:       ctx.Doer,
-		Type:        user_model.UserTypeOrganization,
+		Types:       []user_model.UserType{user_model.UserTypeOrganization},
 		ListOptions: db.ListOptions{PageSize: setting.UI.ExplorePagingNum},
 		Visible:     visibleTypes,
 
diff --git a/routers/web/explore/user.go b/routers/web/explore/user.go
@@ -156,7 +156,7 @@ func Users(ctx *context.Context) {
 
 	RenderUserSearch(ctx, &user_model.SearchUserOptions{
 		Actor:       ctx.Doer,
-		Type:        user_model.UserTypeIndividual,
+		Types:       []user_model.UserType{user_model.UserTypeIndividual},
 		ListOptions: db.ListOptions{PageSize: setting.UI.ExplorePagingNum},
 		IsActive:    optional.Some(true),
 		Visible:     []structs.VisibleType{structs.VisibleTypePublic, structs.VisibleTypeLimited, structs.VisibleTypePrivate},
diff --git a/routers/web/home.go b/routers/web/home.go
@@ -69,7 +69,7 @@ func HomeSitemap(ctx *context.Context) {
 	m := sitemap.NewSitemapIndex()
 	if !setting.Service.Explore.DisableUsersPage {
 		_, cnt, err := user_model.SearchUsers(ctx, &user_model.SearchUserOptions{
-			Type:        user_model.UserTypeIndividual,
+			Types:       []user_model.UserType{user_model.UserTypeIndividual},
 			ListOptions: db.ListOptions{PageSize: 1},
 			IsActive:    optional.Some(true),
 			Visible:     []structs.VisibleType{structs.VisibleTypePublic},
diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
@@ -201,7 +201,7 @@ func httpBase(ctx *context.Context) *serviceHandler {
 						ctx.ServerError("GetRepositoryByID", err)
 						return nil
 					}
-					if !actionsCfg.AccessbleFromOtherRepos || taskRepo.OwnerID != repo.OwnerID || !taskRepo.IsPrivate {
+					if !actionsCfg.IsCollaborativeOwner(taskRepo.OwnerID) || taskRepo.OwnerID != repo.OwnerID || !taskRepo.IsPrivate {
 						// See https://docs.github.com/en/actions/sharing-automations/sharing-actions-and-workflows-from-your-private-repository
 						// Any actions or reusable workflows stored in the private repository can be used in
 						// workflows defined in other private repositories owned by the same organization or user.
diff --git a/routers/web/repo/setting/actions.go b/routers/web/repo/setting/actions.go
@@ -4,11 +4,16 @@
 package setting
 
 import (
+	"errors"
+	"fmt"
 	"net/http"
+	"strings"
 
 	repo_model "code.gitea.io/gitea/models/repo"
 	unit_model "code.gitea.io/gitea/models/unit"
+	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/base"
+	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/context"
 )
 
@@ -19,35 +24,74 @@ func ActionsGeneralSettings(ctx *context.Context) {
 	ctx.Data["PageType"] = "general"
 	ctx.Data["PageIsActionsSettingsGeneral"] = true
 
-	var accessbleFromOtherRepos bool
-	if !ctx.Repo.Repository.IsPrivate {
-		accessbleFromOtherRepos = true
-	} else {
+	if ctx.Repo.Repository.IsPrivate {
 		actionsUnit, err := ctx.Repo.Repository.GetUnit(ctx, unit_model.TypeActions)
 		if err != nil {
 			ctx.ServerError("GetUnit", err)
 			return
 		}
-		accessbleFromOtherRepos = actionsUnit.ActionsConfig().AccessbleFromOtherRepos
+		collaborativeOwnerIDs := actionsUnit.ActionsConfig().CollaborativeOwnerIDs
+		collaborativeOwners, err := user_model.GetUsersByIDs(ctx, collaborativeOwnerIDs)
+		if err != nil {
+			ctx.ServerError("GetUsersByIDs", err)
+			return
+		}
+		ctx.Data["CollaborativeOwners"] = collaborativeOwners
 	}
-	ctx.Data["AccessibleFromOtherRepos"] = accessbleFromOtherRepos
 
 	ctx.HTML(http.StatusOK, tplRepoActionsGeneralSettings)
 }
 
-func ActionsGeneralSettingsPost(ctx *context.Context) {
+func AddCollaborativeOwner(ctx *context.Context) {
+	redirectURL := fmt.Sprintf("%s/settings/actions/general", ctx.Repo.RepoLink)
+	name := strings.ToLower(ctx.FormString("collaborative_owner"))
+
+	ownerID, err := user_model.GetUserOrOrgIDByName(ctx, name)
+	if err != nil {
+		if errors.Is(err, util.ErrNotExist) {
+			ctx.Flash.Error(ctx.Tr("form.user_not_exist"))
+			ctx.Redirect(redirectURL)
+		} else {
+			ctx.ServerError("GetUserOrOrgIDByName", err)
+		}
+		return
+	}
+
 	actionsUnit, err := ctx.Repo.Repository.GetUnit(ctx, unit_model.TypeActions)
 	if err != nil {
 		ctx.ServerError("GetUnit", err)
 		return
 	}
 	actionsCfg := actionsUnit.ActionsConfig()
-	actionsCfg.AccessbleFromOtherRepos = ctx.FormBool("actions_accessible_from_other_repositories")
+	actionsCfg.AddCollaborativeOwner(ownerID)
+	if err := repo_model.UpdateRepoUnit(ctx, actionsUnit); err != nil {
+		ctx.ServerError("UpdateRepoUnit", err)
+		return
+	}
+
+	ctx.Redirect(redirectURL)
+}
 
+func DeleteCollaborativeOwner(ctx *context.Context) {
+	redirectURL := fmt.Sprintf("%s/settings/actions/general", ctx.Repo.RepoLink)
+	ownerID := ctx.FormInt64("id")
+
+	actionsUnit, err := ctx.Repo.Repository.GetUnit(ctx, unit_model.TypeActions)
+	if err != nil {
+		ctx.ServerError("GetUnit", err)
+		return
+	}
+	actionsCfg := actionsUnit.ActionsConfig()
+	if !actionsCfg.IsCollaborativeOwner(ownerID) {
+		ctx.Flash.Error(ctx.Tr("actions.general.collaborative_owner_not_exist"))
+		ctx.Redirect(redirectURL)
+		return
+	}
+	actionsCfg.RemoveCollaborativeOwner(ownerID)
 	if err := repo_model.UpdateRepoUnit(ctx, actionsUnit); err != nil {
 		ctx.ServerError("UpdateRepoUnit", err)
 		return
 	}
 
-	ctx.Redirect(ctx.Repo.RepoLink + "/settings/actions/general")
+	ctx.JSONRedirect(redirectURL)
 }
diff --git a/routers/web/user/search.go b/routers/web/user/search.go
@@ -16,10 +16,14 @@ import (
 
 // SearchCandidates searches candidate users for dropdown list
 func SearchCandidates(ctx *context.Context) {
+	searchUserTypes := []user_model.UserType{user_model.UserTypeIndividual}
+	if ctx.FormBool("orgs") {
+		searchUserTypes = append(searchUserTypes, user_model.UserTypeOrganization)
+	}
 	users, _, err := user_model.SearchUsers(ctx, &user_model.SearchUserOptions{
 		Actor:       ctx.Doer,
 		Keyword:     ctx.FormTrim("q"),
-		Type:        user_model.UserTypeIndividual,
+		Types:       searchUserTypes,
 		IsActive:    optional.Some(true),
 		ListOptions: db.ListOptions{PageSize: setting.UI.MembersPagingNum},
 	})
diff --git a/routers/web/web.go b/routers/web/web.go
@@ -1133,9 +1133,13 @@ func registerRoutes(m *web.Router) {
 			addSettingsRunnersRoutes()
 			addSettingsSecretsRoutes()
 			addSettingsVariablesRoutes()
-			m.Combo("/general").
-				Get(repo_setting.ActionsGeneralSettings).
-				Post(repo_setting.ActionsGeneralSettingsPost)
+			m.Group("/general", func() {
+				m.Get("", repo_setting.ActionsGeneralSettings)
+				m.Group("/collaborative_owner", func() {
+					m.Post("/add", repo_setting.AddCollaborativeOwner)
+					m.Post("/delete", repo_setting.DeleteCollaborativeOwner)
+				})
+			})
 		}, actions.MustEnableActions)
 		// the follow handler must be under "settings", otherwise this incomplete repo can't be accessed
 		m.Group("/migrate", func() {
diff --git a/templates/repo/settings/actions_general.tmpl b/templates/repo/settings/actions_general.tmpl
diff --git a/web_src/js/features/comp/SearchUserBox.ts b/web_src/js/features/comp/SearchUserBox.ts

Original file line number	Diff line number	Diff line change
`@@ -76,7 +76,7 @@ func TestSearchUsers(t *testing.T) {`
`76`	`76`
`77`	`77`	`// test orgs`
`78`	`78`	`testOrgSuccess := func(opts *user_model.SearchUserOptions, expectedOrgIDs []int64) {`
`79`		`- opts.Type = user_model.UserTypeOrganization`
	`79`	`+ opts.Types = []user_model.UserType{user_model.UserTypeOrganization}`
`80`	`80`	`testSuccess(opts, expectedOrgIDs)`
`81`	`81`	`}`
`82`	`82`
`@@ -100,7 +100,7 @@ func TestSearchUsers(t *testing.T) {`
`100`	`100`
`101`	`101`	`// test users`
`102`	`102`	`testUserSuccess := func(opts *user_model.SearchUserOptions, expectedUserIDs []int64) {`
`103`		`- opts.Type = user_model.UserTypeIndividual`
	`103`	`+ opts.Types = []user_model.UserType{user_model.UserTypeIndividual}`
`104`	`104`	`testSuccess(opts, expectedUserIDs)`
`105`	`105`	`}`
`106`	`106`