Fix invalid issues in project boards

models/issues/issue.go

@@ -10,8 +10,12 @@ import (
 	"regexp"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/organization"
+	"code.gitea.io/gitea/models/perm"
+	access_model "code.gitea.io/gitea/models/perm/access"
 	project_model "code.gitea.io/gitea/models/project"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/log"
 	api "code.gitea.io/gitea/modules/structs"
@@ -446,6 +450,59 @@ func (issue *Issue) IsPoster(uid int64) bool {
 	return issue.OriginalAuthorID == 0 && issue.PosterID == uid
 }
 
+func (issues IssueList) FilterValidByDoer(ctx context.Context, doer *user_model.User) (IssueList, error) {
+	repos, err := issues.LoadRepositories(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := repo_model.RepositoryList(repos).LoadOwners(ctx); err != nil {
+		return nil, err
+	}
+
+	issueList := issues[:0]
+	for _, issue := range issues {
+		if isIssueVisibleToDoer, err := issue.isIssueVisibleToDoer(ctx, doer); err != nil {
+			return nil, err
+		} else if isIssueVisibleToDoer {
+			issueList = append(issueList, issue)
+		}
+	}
+	return issueList, nil
+}
+
+// isIssueVisibleToDoer returns whether doer can view the issue
+func (issue *Issue) isIssueVisibleToDoer(ctx context.Context, doer *user_model.User) (bool, error) {
+	if perm, err := access_model.GetUserRepoPermission(ctx, issue.Repo, doer); err != nil {
+		return false, err
+	} else if !perm.HasAccess() {
+		return false, nil
+	}
+
+	if !issue.Repo.UnitEnabled(ctx, unit.TypeIssues) {
+		return false, nil
+	}
+	// TODO: what about Mirror repo
+
+	if issue.Repo.Owner.IsOrganization() && issue.Repo.IsPrivate {
+		collaboration, err := repo_model.GetCollaboration(ctx, issue.Repo.ID, doer.ID)
+		if err != nil {
+			return false, fmt.Errorf("GetCollaboration: %w", err)
+		}
+		if collaboration == nil {
+			if (*organization.Organization)(issue.Repo.Owner).UnitPermission(ctx, doer, unit.TypeIssues) < perm.AccessModeRead {
+				return false, nil
+			}
+		} else {
+			if collaboration.Mode < perm.AccessModeRead {
+				return false, nil
+			}
+		}
+	}
+
+	return true, nil
+}
+
 // GetTasks returns the amount of tasks in the issues content
 func (issue *Issue) GetTasks() int {
 	return len(issueTasksPat.FindAllStringIndex(issue.Content, -1))

models/issues/issue_project.go

@@ -9,7 +9,9 @@ import (
 
 	"code.gitea.io/gitea/models/db"
 	project_model "code.gitea.io/gitea/models/project"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/util"
 )
 
 // LoadProject load the project the issue was assigned to
@@ -56,53 +58,97 @@ func (issue *Issue) projectBoardID(ctx context.Context) int64 {
 }
 
 // LoadIssuesFromBoard load issues assigned to this board
-func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board) (IssueList, error) {
-	issueList := make([]*Issue, 0, 10)
+func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board, doer *user_model.User, isClosed util.OptionalBool) (IssueList, error) {
+	if unit.TypeIssues.UnitGlobalDisabled() {
+		return nil, nil
+	}
 
+	var issueList IssueList
 	if b.ID != 0 {
 		issues, err := Issues(ctx, &IssuesOptions{
 			ProjectBoardID: b.ID,
 			ProjectID:      b.ProjectID,
 			SortType:       "project-column-sorting",
+			IsClosed:       isClosed,
 		})
 		if err != nil {
 			return nil, err
 		}
-		issueList = issues
+		issues, err = IssueList(issues).FilterValidByDoer(ctx, doer)
+		if err != nil {
+			return nil, err
+		}
+		issueList = append(issueList, issues...)
 	}
 
 	if b.Default {
 		issues, err := Issues(ctx, &IssuesOptions{
 			ProjectBoardID: -1, // Issues without ProjectBoardID
 			ProjectID:      b.ProjectID,
 			SortType:       "project-column-sorting",
+			IsClosed:       isClosed,
 		})
 		if err != nil {
 			return nil, err
 		}
+		issues, err = IssueList(issues).FilterValidByDoer(ctx, doer)
+		if err != nil {
+			return nil, err
+		}
 		issueList = append(issueList, issues...)
 	}
 
-	if err := IssueList(issueList).LoadComments(ctx); err != nil {
+	if err := issueList.LoadComments(ctx); err != nil {
 		return nil, err
 	}
 
 	return issueList, nil
 }
 
 // LoadIssuesFromBoardList load issues assigned to the boards
-func LoadIssuesFromBoardList(ctx context.Context, bs project_model.BoardList) (map[int64]IssueList, error) {
+func LoadIssuesFromBoardList(ctx context.Context, bs project_model.BoardList, doer *user_model.User, isClosed util.OptionalBool) (map[int64]IssueList, error) {
 	issuesMap := make(map[int64]IssueList, len(bs))
-	for i := range bs {
-		il, err := LoadIssuesFromBoard(ctx, bs[i])
+	for _, b := range bs {
+		il, err := LoadIssuesFromBoard(ctx, b, doer, isClosed)
 		if err != nil {
 			return nil, err
 		}
-		issuesMap[bs[i].ID] = il
+		issuesMap[b.ID] = il
 	}
 	return issuesMap, nil
 }
 
+// NumIssuesInProjects returns counter of all issues assigned to a project list which doer can access
+func NumIssuesInProjects(ctx context.Context, pl project_model.ProjectList, doer *user_model.User, isClosed util.OptionalBool) (map[int64]int, error) {
+	numMap := make(map[int64]int, len(pl))
+	for _, p := range pl {
+		num, err := NumIssuesInProject(ctx, p, doer, isClosed)
+		if err != nil {
+			return nil, err
+		}
+		numMap[p.ID] = num
+	}
+
+	return numMap, nil
+}
+
+// NumIssuesInProject returns counter of all issues assigned to a project which doer can access
+func NumIssuesInProject(ctx context.Context, p *project_model.Project, doer *user_model.User, isClosed util.OptionalBool) (int, error) {
+	numIssuesInProject := int(0)
+	bs, err := p.GetBoards(ctx)
+	if err != nil {
+		return 0, err
+	}
+	im, err := LoadIssuesFromBoardList(ctx, bs, doer, isClosed)
+	if err != nil {
+		return 0, err
+	}
+	for _, il := range im {
+		numIssuesInProject += len(il)
+	}
+	return numIssuesInProject, nil
+}
+
 // ChangeProjectAssign changes the project associated with an issue
 func ChangeProjectAssign(issue *Issue, doer *user_model.User, newProjectID int64) error {
 	ctx, committer, err := db.TxContext(db.DefaultContext)
@@ -131,8 +177,11 @@ func addUpdateIssueProject(ctx context.Context, issue *Issue, doer *user_model.U
 		if err != nil {
 			return err
 		}
-		if newProject.RepoID != issue.RepoID && newProject.OwnerID != issue.Repo.OwnerID {
-			return fmt.Errorf("issue's repository is not the same as project's repository")
+
+		if canWriteByDoer, err := newProject.CanWriteByDoer(ctx, issue.Repo, doer); err != nil {
+			return err
+		} else if !canWriteByDoer {
+			return fmt.Errorf("doer have no write permission to project [id:%d]", newProjectID)
 		}
 	}
 

models/project/board.go

@@ -59,6 +59,8 @@ type Board struct {
 	ProjectID int64 `xorm:"INDEX NOT NULL"`
 	CreatorID int64 `xorm:"NOT NULL"`
 
+	Project *Project `xorm:"-"`
+
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
 }

models/project/project.go

@@ -8,8 +8,13 @@ import (
 	"fmt"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/organization"
+	"code.gitea.io/gitea/models/perm"
+	access_model "code.gitea.io/gitea/models/perm/access"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
@@ -33,6 +38,9 @@ type (
 
 	// Type is used to identify the type of project in question and ownership
 	Type uint8
+
+	// List is used to identify a list of projects
+	ProjectList []*Project //nolint
 )
 
 const (
@@ -126,16 +134,14 @@ func (p *Project) LoadRepo(ctx context.Context) (err error) {
 // Link returns the project's relative URL.
 func (p *Project) Link() string {
 	if p.OwnerID > 0 {
-		err := p.LoadOwner(db.DefaultContext)
-		if err != nil {
+		if err := p.LoadOwner(db.DefaultContext); err != nil {
 			log.Error("LoadOwner: %v", err)
 			return ""
 		}
 		return fmt.Sprintf("%s/-/projects/%d", p.Owner.HomeLink(), p.ID)
 	}
 	if p.RepoID > 0 {
-		err := p.LoadRepo(db.DefaultContext)
-		if err != nil {
+		if err := p.LoadRepo(db.DefaultContext); err != nil {
 			log.Error("LoadRepo: %v", err)
 			return ""
 		}
@@ -151,14 +157,125 @@ func (p *Project) IconName() string {
 	return "octicon-project-symlink"
 }
 
-func (p *Project) IsOrganizationProject() bool {
-	return p.Type == TypeOrganization
+func (p *Project) IsIndividualProject() bool {
+	return p.Type == TypeIndividual
 }
 
 func (p *Project) IsRepositoryProject() bool {
 	return p.Type == TypeRepository
 }
 
+func (p *Project) IsOrganizationProject() bool {
+	return p.Type == TypeOrganization
+}
+
+func (pl ProjectList) GetOwnerIDs() []int64 {
+	ids := make(container.Set[int64], len(pl))
+	for _, p := range pl {
+		if p.OwnerID == 0 {
+			continue
+		}
+		ids.Add(p.OwnerID)
+	}
+	return ids.Values()
+}
+
+func (pl ProjectList) LoadOwners(ctx context.Context) error {
+	userIDs := pl.GetOwnerIDs()
+	users := make(map[int64]*user_model.User, len(userIDs))
+	if err := db.GetEngine(ctx).
+		Where("id > 0").
+		In("id", userIDs).
+		Find(&users); err != nil {
+		return fmt.Errorf("find users: %w", err)
+	}
+	for _, p := range pl {
+		if p.OwnerID > 0 && p.Owner == nil {
+			p.Owner = users[p.OwnerID]
+		}
+	}
+	return nil
+}
+
+func (pl ProjectList) FilterWritableByDoer(ctx context.Context, repo *repo_model.Repository, doer *user_model.User) (ProjectList, error) {
+	if err := pl.LoadOwners(ctx); err != nil {
+		return nil, err
+	}
+
+	projectList := pl[:0]
+	for _, p := range pl {
+		if canWriteByDoer, err := p.CanWriteByDoer(ctx, repo, doer); err != nil {
+			return nil, err
+		} else if canWriteByDoer {
+			projectList = append(projectList, p)
+		}
+	}
+	return projectList, nil
+}
+
+// CanWriteByDoer return whether doer have write permission to the project in a repo
+func (p *Project) CanWriteByDoer(ctx context.Context, repo *repo_model.Repository, doer *user_model.User) (bool, error) {
+	if unit.TypeProjects.UnitGlobalDisabled() {
+		return false, nil
+	}
+
+	// non-login user have no write permission
+	if doer == nil {
+		return false, nil
+	}
+
+	if err := repo.LoadOwner(ctx); err != nil {
+		return false, fmt.Errorf("LoadOwner: %w", err)
+	}
+
+	if p.RepoID > 0 {
+		// repo projects
+		if p.RepoID != repo.ID {
+			return false, nil
+		}
+
+		if err := p.LoadRepo(ctx); err != nil {
+			return false, fmt.Errorf("LoadRepo: %w", err)
+		}
+		if perm, err := access_model.GetUserRepoPermission(ctx, p.Repo, doer); err != nil {
+			return false, err
+		} else if !perm.HasAccess() {
+			return false, nil
+		}
+
+		if !repo.UnitEnabled(ctx, unit.TypeProjects) {
+			return false, nil
+		}
+	} else {
+		// individual/org's project
+		if p.OwnerID != repo.OwnerID {
+			return false, nil
+		}
+
+		if repo.Owner.IsIndividual() && repo.Owner.ID != doer.ID {
+			return false, nil
+		}
+
+		if repo.Owner.IsOrganization() && repo.IsPrivate {
+			collaboration, err := repo_model.GetCollaboration(ctx, repo.ID, doer.ID)
+			if err != nil {
+				return false, fmt.Errorf("GetCollaboration: %w", err)
+			}
+			if collaboration == nil {
+				if (*organization.Organization)(repo.Owner).UnitPermission(ctx, doer, unit.TypeIssues) < perm.AccessModeWrite {
+					return false, nil
+				}
+			} else {
+				if collaboration.Mode < perm.AccessModeWrite {
+					return false, nil
+				}
+			}
+		}
+	}
+
+	return true, nil
+}
+
 func init() {
 	db.RegisterModel(new(Project))
 }
@@ -227,9 +344,9 @@ func CountProjects(ctx context.Context, opts SearchOptions) (int64, error) {
 }
 
 // FindProjects returns a list of all projects that have been created in the repository
-func FindProjects(ctx context.Context, opts SearchOptions) ([]*Project, int64, error) {
+func FindProjects(ctx context.Context, opts SearchOptions) (ProjectList, int64, error) {
 	e := db.GetEngine(ctx).Where(opts.toConds())
-	projects := make([]*Project, 0, setting.UI.IssuePagingNum)
+	projects := make(ProjectList, 0, setting.UI.IssuePagingNum)
 
 	if opts.Page > 0 {
 		e = e.Limit(setting.UI.IssuePagingNum, (opts.Page-1)*setting.UI.IssuePagingNum)