tech-debt: Refactor permission checking across codebase #311
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Permission checking is scattered and inconsistent with multiple TODO/FIXME markers.
Locations
models/perm/access/repo_permission.go:50- most calls should use HasAnyUnitAccessOrPublicAccessmodels/perm/access/repo_permission.go:430- rename to IsOwnerVisibleToDoermodels/perm/access/repo_permission.go:448- should only check collaborator access modemodels/repo/repo.go:638- most CanEnableEditor calls should be CanContentChangerouters/api/v1/api.go:734- mustNotBeArchived vs mustEnableEditor inconsistencyrouters/web/web.go:1319,1394,1420- pulls/issues endpoint permission mixingAction Required
Consolidate permission checks into clear, well-named methods. Replace scattered checks with canonical implementations.
Created by Claude Opus 4.6