123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607 |
- // Copyright 2018 The Gitea Authors. All rights reserved.
- // Copyright 2016 The Gogs Authors. All rights reserved.
- // SPDX-License-Identifier: MIT
-
- package models
-
- import (
- "context"
- "fmt"
- "strings"
-
- "code.gitea.io/gitea/models/db"
- git_model "code.gitea.io/gitea/models/git"
- issues_model "code.gitea.io/gitea/models/issues"
- "code.gitea.io/gitea/models/organization"
- access_model "code.gitea.io/gitea/models/perm/access"
- repo_model "code.gitea.io/gitea/models/repo"
- user_model "code.gitea.io/gitea/models/user"
- "code.gitea.io/gitea/modules/log"
- "code.gitea.io/gitea/modules/setting"
- "code.gitea.io/gitea/modules/util"
-
- "xorm.io/builder"
- )
-
- func AddRepository(ctx context.Context, t *organization.Team, repo *repo_model.Repository) (err error) {
- if err = organization.AddTeamRepo(ctx, t.OrgID, t.ID, repo.ID); err != nil {
- return err
- }
-
- if err = organization.IncrTeamRepoNum(ctx, t.ID); err != nil {
- return fmt.Errorf("update team: %w", err)
- }
-
- t.NumRepos++
-
- if err = access_model.RecalculateTeamAccesses(ctx, repo, 0); err != nil {
- return fmt.Errorf("recalculateAccesses: %w", err)
- }
-
- // Make all team members watch this repo if enabled in global settings
- if setting.Service.AutoWatchNewRepos {
- if err = t.LoadMembers(ctx); err != nil {
- return fmt.Errorf("getMembers: %w", err)
- }
- for _, u := range t.Members {
- if err = repo_model.WatchRepo(ctx, u.ID, repo.ID, true); err != nil {
- return fmt.Errorf("watchRepo: %w", err)
- }
- }
- }
-
- return nil
- }
-
- // addAllRepositories adds all repositories to the team.
- // If the team already has some repositories they will be left unchanged.
- func addAllRepositories(ctx context.Context, t *organization.Team) error {
- orgRepos, err := organization.GetOrgRepositories(ctx, t.OrgID)
- if err != nil {
- return fmt.Errorf("get org repos: %w", err)
- }
-
- for _, repo := range orgRepos {
- if !organization.HasTeamRepo(ctx, t.OrgID, t.ID, repo.ID) {
- if err := AddRepository(ctx, t, repo); err != nil {
- return fmt.Errorf("AddRepository: %w", err)
- }
- }
- }
-
- return nil
- }
-
- // AddAllRepositories adds all repositories to the team
- func AddAllRepositories(t *organization.Team) (err error) {
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
-
- if err = addAllRepositories(ctx, t); err != nil {
- return err
- }
-
- return committer.Commit()
- }
-
- // RemoveAllRepositories removes all repositories from team and recalculates access
- func RemoveAllRepositories(t *organization.Team) (err error) {
- if t.IncludesAllRepositories {
- return nil
- }
-
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
-
- if err = removeAllRepositories(ctx, t); err != nil {
- return err
- }
-
- return committer.Commit()
- }
-
- // removeAllRepositories removes all repositories from team and recalculates access
- // Note: Shall not be called if team includes all repositories
- func removeAllRepositories(ctx context.Context, t *organization.Team) (err error) {
- e := db.GetEngine(ctx)
- // Delete all accesses.
- for _, repo := range t.Repos {
- if err := access_model.RecalculateTeamAccesses(ctx, repo, t.ID); err != nil {
- return err
- }
-
- // Remove watches from all users and now unaccessible repos
- for _, user := range t.Members {
- has, err := access_model.HasAccess(ctx, user.ID, repo)
- if err != nil {
- return err
- } else if has {
- continue
- }
-
- if err = repo_model.WatchRepo(ctx, user.ID, repo.ID, false); err != nil {
- return err
- }
-
- // Remove all IssueWatches a user has subscribed to in the repositories
- if err = issues_model.RemoveIssueWatchersByRepoID(ctx, user.ID, repo.ID); err != nil {
- return err
- }
- }
- }
-
- // Delete team-repo
- if _, err := e.
- Where("team_id=?", t.ID).
- Delete(new(organization.TeamRepo)); err != nil {
- return err
- }
-
- t.NumRepos = 0
- if _, err = e.ID(t.ID).Cols("num_repos").Update(t); err != nil {
- return err
- }
-
- return nil
- }
-
- // HasRepository returns true if given repository belong to team.
- func HasRepository(t *organization.Team, repoID int64) bool {
- return organization.HasTeamRepo(db.DefaultContext, t.OrgID, t.ID, repoID)
- }
-
- // removeRepository removes a repository from a team and recalculates access
- // Note: Repository shall not be removed from team if it includes all repositories (unless the repository is deleted)
- func removeRepository(ctx context.Context, t *organization.Team, repo *repo_model.Repository, recalculate bool) (err error) {
- e := db.GetEngine(ctx)
- if err = organization.RemoveTeamRepo(ctx, t.ID, repo.ID); err != nil {
- return err
- }
-
- t.NumRepos--
- if _, err = e.ID(t.ID).Cols("num_repos").Update(t); err != nil {
- return err
- }
-
- // Don't need to recalculate when delete a repository from organization.
- if recalculate {
- if err = access_model.RecalculateTeamAccesses(ctx, repo, t.ID); err != nil {
- return err
- }
- }
-
- teamUsers, err := organization.GetTeamUsersByTeamID(ctx, t.ID)
- if err != nil {
- return fmt.Errorf("getTeamUsersByTeamID: %w", err)
- }
- for _, teamUser := range teamUsers {
- has, err := access_model.HasAccess(ctx, teamUser.UID, repo)
- if err != nil {
- return err
- } else if has {
- continue
- }
-
- if err = repo_model.WatchRepo(ctx, teamUser.UID, repo.ID, false); err != nil {
- return err
- }
-
- // Remove all IssueWatches a user has subscribed to in the repositories
- if err := issues_model.RemoveIssueWatchersByRepoID(ctx, teamUser.UID, repo.ID); err != nil {
- return err
- }
- }
-
- return nil
- }
-
- // RemoveRepository removes repository from team of organization.
- // If the team shall include all repositories the request is ignored.
- func RemoveRepository(t *organization.Team, repoID int64) error {
- if !HasRepository(t, repoID) {
- return nil
- }
-
- if t.IncludesAllRepositories {
- return nil
- }
-
- repo, err := repo_model.GetRepositoryByID(db.DefaultContext, repoID)
- if err != nil {
- return err
- }
-
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
-
- if err = removeRepository(ctx, t, repo, true); err != nil {
- return err
- }
-
- return committer.Commit()
- }
-
- // NewTeam creates a record of new team.
- // It's caller's responsibility to assign organization ID.
- func NewTeam(t *organization.Team) (err error) {
- if len(t.Name) == 0 {
- return util.NewInvalidArgumentErrorf("empty team name")
- }
-
- if err = organization.IsUsableTeamName(t.Name); err != nil {
- return err
- }
-
- has, err := db.GetEngine(db.DefaultContext).ID(t.OrgID).Get(new(user_model.User))
- if err != nil {
- return err
- }
- if !has {
- return organization.ErrOrgNotExist{ID: t.OrgID}
- }
-
- t.LowerName = strings.ToLower(t.Name)
- has, err = db.GetEngine(db.DefaultContext).
- Where("org_id=?", t.OrgID).
- And("lower_name=?", t.LowerName).
- Get(new(organization.Team))
- if err != nil {
- return err
- }
- if has {
- return organization.ErrTeamAlreadyExist{OrgID: t.OrgID, Name: t.LowerName}
- }
-
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
-
- if err = db.Insert(ctx, t); err != nil {
- return err
- }
-
- // insert units for team
- if len(t.Units) > 0 {
- for _, unit := range t.Units {
- unit.TeamID = t.ID
- }
- if err = db.Insert(ctx, &t.Units); err != nil {
- return err
- }
- }
-
- // Add all repositories to the team if it has access to all of them.
- if t.IncludesAllRepositories {
- err = addAllRepositories(ctx, t)
- if err != nil {
- return fmt.Errorf("addAllRepositories: %w", err)
- }
- }
-
- // Update organization number of teams.
- if _, err = db.Exec(ctx, "UPDATE `user` SET num_teams=num_teams+1 WHERE id = ?", t.OrgID); err != nil {
- return err
- }
- return committer.Commit()
- }
-
- // UpdateTeam updates information of team.
- func UpdateTeam(t *organization.Team, authChanged, includeAllChanged bool) (err error) {
- if len(t.Name) == 0 {
- return util.NewInvalidArgumentErrorf("empty team name")
- }
-
- if len(t.Description) > 255 {
- t.Description = t.Description[:255]
- }
-
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
- sess := db.GetEngine(ctx)
-
- t.LowerName = strings.ToLower(t.Name)
- has, err := sess.
- Where("org_id=?", t.OrgID).
- And("lower_name=?", t.LowerName).
- And("id!=?", t.ID).
- Get(new(organization.Team))
- if err != nil {
- return err
- } else if has {
- return organization.ErrTeamAlreadyExist{OrgID: t.OrgID, Name: t.LowerName}
- }
-
- if _, err = sess.ID(t.ID).Cols("name", "lower_name", "description",
- "can_create_org_repo", "authorize", "includes_all_repositories").Update(t); err != nil {
- return fmt.Errorf("update: %w", err)
- }
-
- // update units for team
- if len(t.Units) > 0 {
- for _, unit := range t.Units {
- unit.TeamID = t.ID
- }
- // Delete team-unit.
- if _, err := sess.
- Where("team_id=?", t.ID).
- Delete(new(organization.TeamUnit)); err != nil {
- return err
- }
- if _, err = sess.Cols("org_id", "team_id", "type", "access_mode").Insert(&t.Units); err != nil {
- return err
- }
- }
-
- // Update access for team members if needed.
- if authChanged {
- if err = t.LoadRepositories(ctx); err != nil {
- return fmt.Errorf("LoadRepositories: %w", err)
- }
-
- for _, repo := range t.Repos {
- if err = access_model.RecalculateTeamAccesses(ctx, repo, 0); err != nil {
- return fmt.Errorf("recalculateTeamAccesses: %w", err)
- }
- }
- }
-
- // Add all repositories to the team if it has access to all of them.
- if includeAllChanged && t.IncludesAllRepositories {
- err = addAllRepositories(ctx, t)
- if err != nil {
- return fmt.Errorf("addAllRepositories: %w", err)
- }
- }
-
- return committer.Commit()
- }
-
- // DeleteTeam deletes given team.
- // It's caller's responsibility to assign organization ID.
- func DeleteTeam(t *organization.Team) error {
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
- sess := db.GetEngine(ctx)
-
- if err := t.LoadRepositories(ctx); err != nil {
- return err
- }
-
- if err := t.LoadMembers(ctx); err != nil {
- return err
- }
-
- // update branch protections
- {
- protections := make([]*git_model.ProtectedBranch, 0, 10)
- err := sess.In("repo_id",
- builder.Select("id").From("repository").Where(builder.Eq{"owner_id": t.OrgID})).
- Find(&protections)
- if err != nil {
- return fmt.Errorf("findProtectedBranches: %w", err)
- }
- for _, p := range protections {
- lenIDs, lenApprovalIDs, lenMergeIDs := len(p.WhitelistTeamIDs), len(p.ApprovalsWhitelistTeamIDs), len(p.MergeWhitelistTeamIDs)
- p.WhitelistTeamIDs = util.SliceRemoveAll(p.WhitelistTeamIDs, t.ID)
- p.ApprovalsWhitelistTeamIDs = util.SliceRemoveAll(p.ApprovalsWhitelistTeamIDs, t.ID)
- p.MergeWhitelistTeamIDs = util.SliceRemoveAll(p.MergeWhitelistTeamIDs, t.ID)
- if lenIDs != len(p.WhitelistTeamIDs) ||
- lenApprovalIDs != len(p.ApprovalsWhitelistTeamIDs) ||
- lenMergeIDs != len(p.MergeWhitelistTeamIDs) {
- if _, err = sess.ID(p.ID).Cols(
- "whitelist_team_i_ds",
- "merge_whitelist_team_i_ds",
- "approvals_whitelist_team_i_ds",
- ).Update(p); err != nil {
- return fmt.Errorf("updateProtectedBranches: %w", err)
- }
- }
- }
- }
-
- if !t.IncludesAllRepositories {
- if err := removeAllRepositories(ctx, t); err != nil {
- return err
- }
- }
-
- if err := db.DeleteBeans(ctx,
- &organization.Team{ID: t.ID},
- &organization.TeamUser{OrgID: t.OrgID, TeamID: t.ID},
- &organization.TeamUnit{TeamID: t.ID},
- &organization.TeamInvite{TeamID: t.ID},
- ); err != nil {
- return err
- }
-
- // Update organization number of teams.
- if _, err := sess.Exec("UPDATE `user` SET num_teams=num_teams-1 WHERE id=?", t.OrgID); err != nil {
- return err
- }
-
- return committer.Commit()
- }
-
- // AddTeamMember adds new membership of given team to given organization,
- // the user will have membership to given organization automatically when needed.
- func AddTeamMember(team *organization.Team, userID int64) error {
- isAlreadyMember, err := organization.IsTeamMember(db.DefaultContext, team.OrgID, team.ID, userID)
- if err != nil || isAlreadyMember {
- return err
- }
-
- if err := organization.AddOrgUser(team.OrgID, userID); err != nil {
- return err
- }
-
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
-
- // check in transaction
- isAlreadyMember, err = organization.IsTeamMember(ctx, team.OrgID, team.ID, userID)
- if err != nil || isAlreadyMember {
- return err
- }
-
- sess := db.GetEngine(ctx)
-
- if err := db.Insert(ctx, &organization.TeamUser{
- UID: userID,
- OrgID: team.OrgID,
- TeamID: team.ID,
- }); err != nil {
- return err
- } else if _, err := sess.Incr("num_members").ID(team.ID).Update(new(organization.Team)); err != nil {
- return err
- }
-
- team.NumMembers++
-
- // Give access to team repositories.
- // update exist access if mode become bigger
- subQuery := builder.Select("repo_id").From("team_repo").
- Where(builder.Eq{"team_id": team.ID})
-
- if _, err := sess.Where("user_id=?", userID).
- In("repo_id", subQuery).
- And("mode < ?", team.AccessMode).
- SetExpr("mode", team.AccessMode).
- Update(new(access_model.Access)); err != nil {
- return fmt.Errorf("update user accesses: %w", err)
- }
-
- // for not exist access
- var repoIDs []int64
- accessSubQuery := builder.Select("repo_id").From("access").Where(builder.Eq{"user_id": userID})
- if err := sess.SQL(subQuery.And(builder.NotIn("repo_id", accessSubQuery))).Find(&repoIDs); err != nil {
- return fmt.Errorf("select id accesses: %w", err)
- }
-
- accesses := make([]*access_model.Access, 0, 100)
- for i, repoID := range repoIDs {
- accesses = append(accesses, &access_model.Access{RepoID: repoID, UserID: userID, Mode: team.AccessMode})
- if (i%100 == 0 || i == len(repoIDs)-1) && len(accesses) > 0 {
- if err = db.Insert(ctx, accesses); err != nil {
- return fmt.Errorf("insert new user accesses: %w", err)
- }
- accesses = accesses[:0]
- }
- }
-
- if err := committer.Commit(); err != nil {
- return err
- }
- committer.Close()
-
- // this behaviour may spend much time so run it in a goroutine
- // FIXME: Update watch repos batchly
- if setting.Service.AutoWatchNewRepos {
- // Get team and its repositories.
- if err := team.LoadRepositories(db.DefaultContext); err != nil {
- log.Error("getRepositories failed: %v", err)
- }
- go func(repos []*repo_model.Repository) {
- for _, repo := range repos {
- if err = repo_model.WatchRepo(db.DefaultContext, userID, repo.ID, true); err != nil {
- log.Error("watch repo failed: %v", err)
- }
- }
- }(team.Repos)
- }
-
- return nil
- }
-
- func removeTeamMember(ctx context.Context, team *organization.Team, userID int64) error {
- e := db.GetEngine(ctx)
- isMember, err := organization.IsTeamMember(ctx, team.OrgID, team.ID, userID)
- if err != nil || !isMember {
- return err
- }
-
- // Check if the user to delete is the last member in owner team.
- if team.IsOwnerTeam() && team.NumMembers == 1 {
- return organization.ErrLastOrgOwner{UID: userID}
- }
-
- team.NumMembers--
-
- if err := team.LoadRepositories(ctx); err != nil {
- return err
- }
-
- if _, err := e.Delete(&organization.TeamUser{
- UID: userID,
- OrgID: team.OrgID,
- TeamID: team.ID,
- }); err != nil {
- return err
- } else if _, err = e.
- ID(team.ID).
- Cols("num_members").
- Update(team); err != nil {
- return err
- }
-
- // Delete access to team repositories.
- for _, repo := range team.Repos {
- if err := access_model.RecalculateUserAccess(ctx, repo, userID); err != nil {
- return err
- }
-
- // Remove watches from now unaccessible
- if err := reconsiderWatches(ctx, repo, userID); err != nil {
- return err
- }
-
- // Remove issue assignments from now unaccessible
- if err := reconsiderRepoIssuesAssignee(ctx, repo, userID); err != nil {
- return err
- }
- }
-
- // Check if the user is a member of any team in the organization.
- if count, err := e.Count(&organization.TeamUser{
- UID: userID,
- OrgID: team.OrgID,
- }); err != nil {
- return err
- } else if count == 0 {
- return removeOrgUser(ctx, team.OrgID, userID)
- }
-
- return nil
- }
-
- // RemoveTeamMember removes member from given team of given organization.
- func RemoveTeamMember(team *organization.Team, userID int64) error {
- ctx, committer, err := db.TxContext(db.DefaultContext)
- if err != nil {
- return err
- }
- defer committer.Close()
- if err := removeTeamMember(ctx, team, userID); err != nil {
- return err
- }
- return committer.Commit()
- }
|