gitea: gitea_team_rights reads a forge team's members and units and a user's effective rights, read-only (issue 1563) #524

2026-10-27T20:55:59Z

mesh-tools commented

2026-10-27 20:55:59 +00:00

Issue 1563; the last proof of issue 971 / 1481 (ADR 0466 §3: every build key sits on one forge user, nox-builder, in team builders, which reads every repository and pushes nothing). No tool could read a team's members or rights: the mesh-tools token gets 403 on the organisation's teams.

Tool. gitea_team_rights {org?, team?, user?, repositories?, list?}: the organisation's teams (members, permission, units, includes all repositories, read_only) and, for a user, the teams it is in and its effective right on every repository as the forge answers it for that user (?sudo=), with writes listing every repository above read. A user the forge does not know is refused, never answered as writing nothing. Every request is a GET through the module's administrator login, handled as gitea_branch_protection_get handles it (ADR 0375); arguments are only compared with the forge's answers or encoded; the answer carries logins and rights, no email, token or key. Paged at 50.

Quick or thorough. Quick: list a team's units and infer "pushes nothing". Thorough (chosen): ask the forge each repository's right as the user sees it, so a collaborator right or another team counts; that is the proof 971 needs.

Tests. Four tests against a fake forge shaped from gitea's API objects (Team, User, Repository.permissions), including the user path through sudo and an unknown user refused; each fails without the tool or its guard. npm test: 217 pass.

Live check after delivery. gitea_team_rights {team: "builders", user: "nox-builder"} must show read_only true, teams [builders], writes [] and a read count equal to the repositories.

Review notes kept for later: the module's paging loops stop early if the forge's page size is under 50 (all of them at once).

Reviewed-by: review-1563@shanks at 36d5993323

Issue 1563; the last proof of issue 971 / 1481 (ADR 0466 §3: every build key sits on one forge user, nox-builder, in team builders, which reads every repository and pushes nothing). No tool could read a team's members or rights: the mesh-tools token gets 403 on the organisation's teams. **Tool.** `gitea_team_rights {org?, team?, user?, repositories?, list?}`: the organisation's teams (members, permission, units, includes all repositories, read_only) and, for a user, the teams it is in and its effective right on every repository as the forge answers it for that user (`?sudo=`), with `writes` listing every repository above read. A user the forge does not know is refused, never answered as writing nothing. Every request is a GET through the module's administrator login, handled as gitea_branch_protection_get handles it (ADR 0375); arguments are only compared with the forge's answers or encoded; the answer carries logins and rights, no email, token or key. Paged at 50. **Quick or thorough.** Quick: list a team's units and infer "pushes nothing". Thorough (chosen): ask the forge each repository's right as the user sees it, so a collaborator right or another team counts; that is the proof 971 needs. **Tests.** Four tests against a fake forge shaped from gitea's API objects (Team, User, Repository.permissions), including the user path through sudo and an unknown user refused; each fails without the tool or its guard. npm test: 217 pass. **Live check after delivery.** `gitea_team_rights {team: "builders", user: "nox-builder"}` must show read_only true, teams [builders], writes [] and a read count equal to the repositories. Review notes kept for later: the module's paging loops stop early if the forge's page size is under 50 (all of them at once). Reviewed-by: review-1563@shanks at 36d59933239e5d2d542f9ece477a283b0efd1a5c

mesh-tools added 2 commits 2026-10-27 20:55:59 +00:00

Add gitea_team_rights: read a forge team's members, units and a user's effective rights, with the administrator's login, GET only (issue 1563) f8ddcc98f6

gitea_team_rights: refuse a forge user that does not exist; keep ForgeRepository's doc comment on it (issue 1563)

mesh/delivery merged: source.main moved to novox/mesh-catalog@bf94af0a820f

Details

mesh/check checking 36d59933239e on bf94af0a820f

36d5993323

mesh-tools commented

2026-10-27 20:56:05 +00:00

Delivery novox/mesh-catalog@36d59933239e — merged since 2026-10-27T21:01:01Z

Source — source.main moved to novox/mesh-catalog@bf94af0a82. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-27 20:56 (new) → proposed (announced): novox/mesh-catalog#524's head announced
2026-10-27 20:56 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-27 21:01 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@36d59933239e` — **merged** since 2026-10-27T21:01:01Z **Source** — source.main moved to novox/mesh-catalog@bf94af0a820f. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-27 20:56 (new) → proposed (announced): novox/mesh-catalog#524's head announced - 2026-10-27 20:56 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-27 21:01 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit bf94af0a82 into main

2026-10-27 21:00:58 +00:00

mesh-tools deleted branch fix/1563-team-rights

2026-10-27 21:00:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#524