gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-05-19 19:41:08 +00:00

Files

Lunny Xiao f2a1271f16 fix: Unify public-only token filtering in API queries and repo access checks (#37118 )

This PR closes remaining `public-only` token gaps in the API by making
the restriction apply consistently across repository, organization,
activity, notification, and authenticated `/api/v1/user/...` routes.

Previously, `public-only` tokens were still able to:
- receive private results from some list/search/self endpoints,
- access repository data through ID-based lookups,
- and reach several authenticated self routes that should remain
unavailable for public-only access.

This change treats `public-only` as a cross-cutting visibility boundary:
- list/search endpoints now filter private resources consistently,
- repository lookups enforce the same restriction even when addressed
indirectly,
- and self routes that inherently expose or mutate private account state
now reject `public-only` tokens.

---
Generated by a coding agent with Codex 5.2

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>

2026-05-18 11:36:42 -07:00

main_test.go

make writing main test easier (#27270 )

2023-09-28 01:38:53 +00:00

org_list_test.go

Remove incorrect "db.DefaultContext" usages (#35366 )

2025-08-28 03:52:43 +00:00

org_list.go

fix: Unify public-only token filtering in API queries and repo access checks (#37118 )

2026-05-18 11:36:42 -07:00

org_test.go

refactor(org): simplify owner-team org repo creation logic (#37727 )