gitea: give the tools' account read on every repository, at the start and on the forge's events, so a user's private repository no longer answers its tools 404

modules/gitea/client.ts

@@ -853,6 +853,25 @@ interface AdminResponse {
   readonly body: any;
 }
 
+/** A repository as the site administrator sees it: what saying why an account cannot read it needs (readall.ts). */
+export interface ForgeRepository {
+  full_name: string;
+  owner: string;
+  name: string;
+  private: boolean;
+  archived: boolean;
+  /** The owner's own visibility: public, limited or private. A public repository of an owner not public is hidden
+   *  from whoever is no member. */
+  owner_visibility: string;
+}
+
+function forgeRepository(r: any): ForgeRepository {
+  const owner = String(r?.owner?.login ?? r?.owner?.username ?? "");
+  const name = String(r?.name ?? "");
+  return { full_name: String(r?.full_name ?? `${owner}/${name}`), owner, name, private: r?.private === true,
+    archived: r?.archived === true, owner_visibility: String(r?.owner?.visibility ?? "public") };
+}
+
 /**
  * The forge's admin client, over **basic auth** — gitea's own code, living in the module, used only
  * by the provisioner (novox/hq ADR 0048/0076).
@@ -970,6 +989,47 @@ export class GiteaAdmin {
     return repos;
   }
 
+  // ---- The tools' account reads every repository (readall.ts) ----
+
+  /** Every repository on the forge, of every user and organisation: the search as the site administrator, whom the
+   *  forge answers every repository, private ones and those of private owners included. Only a read. */
+  async everyRepository(): Promise<ForgeRepository[]> {
+    const all: ForgeRepository[] = [];
+    for (let page = 1; page <= 200; page++) {
+      const res = await this.request(`/repos/search?limit=50&page=${page}`);
+      if (res.status !== 200) GiteaAdmin.fail("/repos/search", res);
+      const list: any[] = Array.isArray(res.body?.data) ? res.body.data : [];
+      all.push(...list.map(forgeRepository));
+      if (list.length < 50) break;
+    }
+    return all;
+  }
+
+  /** One repository as the site administrator sees it, or null when the forge holds none by that name. */
+  async repository(owner: string, repo: string): Promise<ForgeRepository | null> {
+    const res = await this.request(repoPath(owner, repo));
+    if (res.status === 404) return null;
+    if (res.status !== 200) GiteaAdmin.fail(repoPath(owner, repo), res);
+    return forgeRepository(res.body);
+  }
+
+  /** What the forge itself says an account may do on a repository: none, read, write, admin or owner. */
+  async repositoryPermission(owner: string, repo: string, user: string): Promise<string> {
+    const path = `${repoPath(owner, repo)}/collaborators/${encodeURIComponent(user)}/permission`;
+    const res = await this.request(path);
+    if (res.status !== 200) GiteaAdmin.fail(path, res);
+    return String(res.body?.permission ?? "none");
+  }
+
+  /** Make an account a collaborator of a repository that reads only. The forge asks a repository's administrator for
+   *  it, which on a repository of another user only the site administrator is. Idempotent: the forge answers 204 again. */
+  async addReadCollaborator(owner: string, repo: string, user: string): Promise<void> {
+    const path = `${repoPath(owner, repo)}/collaborators/${encodeURIComponent(user)}`;
+    const res = await this.request(path, { method: "PUT", body: JSON.stringify({ permission: "read" }) });
+    if (res.status === 204 || res.status === 200) return;
+    GiteaAdmin.fail(path, res);
+  }
+
   /** Ensure the npm-owner org exists. 201 created, 2xx/404-then-created, and 422/409 (a concurrent
    *  create won the race) are all success. */
   async ensureOrg(name: string): Promise<void> {