MokoConsulting/MokoGitea-APP
1
0
Fork 0
Code Issues 158 Pull Requests 3 Releases 96 Wiki Activity

fix(licenses): expand delete permissions to org owners (not just site admins) #385

New Issue
Closed
opened 2026-06-01 09:18:44 +00:00 by jmiller · 2 comments
jmiller commented 2026-06-01 09:18:44 +00:00
Owner
Copy Link
Copy Source

Summary

Currently, only site admins can permanently delete license packages and keys. Org owners should also have this capability since they own the licensing data.

Current Behavior

  • LicensesDeletePackage checks ctx.IsUserSiteAdmin() only
  • LicensesDeleteKey checks ctx.IsUserSiteAdmin() only
  • Templates show delete buttons only when $.IsSiteAdmin

Expected Behavior

  • Site admins AND org owners can delete packages and keys
  • Repo-level: repo owner equivalent check
  • Org-level: ctx.Org.IsOwner check
  • Templates show delete buttons when $.IsSiteAdmin OR $.IsOrganizationOwner

Test Plan

  • Site admin can delete package
  • Org owner can delete package
  • Regular member cannot delete package
  • Site admin can delete key
  • Org owner can delete key
  • Regular member cannot see delete buttons

🤖 Generated with Claude Code

## Summary Currently, only site admins can permanently delete license packages and keys. Org owners should also have this capability since they own the licensing data. ## Current Behavior - `LicensesDeletePackage` checks `ctx.IsUserSiteAdmin()` only - `LicensesDeleteKey` checks `ctx.IsUserSiteAdmin()` only - Templates show delete buttons only when `$.IsSiteAdmin` ## Expected Behavior - Site admins AND org owners can delete packages and keys - Repo-level: repo owner equivalent check - Org-level: `ctx.Org.IsOwner` check - Templates show delete buttons when `$.IsSiteAdmin` OR `$.IsOrganizationOwner` ## Test Plan - [ ] Site admin can delete package - [ ] Org owner can delete package - [ ] Regular member cannot delete package - [ ] Site admin can delete key - [ ] Org owner can delete key - [ ] Regular member cannot see delete buttons 🤖 Generated with [Claude Code](https://claude.com/claude-code)
jmiller commented 2026-06-01 10:10:53 +00:00
Author
Owner
Copy Link
Copy Source

Testing Plan — Expanded Delete Permissions

API

  • Site admin can DELETE package → 204
  • Org owner can DELETE package → 204
  • Regular write member DELETE → 404
  • Site admin can DELETE key → 204
  • Org owner can DELETE key → 204

GUI

  • Delete (trash) buttons visible for site admins
  • Delete buttons visible for org owners
  • Delete buttons hidden for regular write-access members
  • Modal confirmation on all delete clicks

🤖 Generated with Claude Code

## Testing Plan — Expanded Delete Permissions ### API - [ ] Site admin can DELETE package → 204 - [ ] Org owner can DELETE package → 204 - [ ] Regular write member DELETE → 404 - [ ] Site admin can DELETE key → 204 - [ ] Org owner can DELETE key → 204 ### GUI - [ ] Delete (trash) buttons visible for site admins - [ ] Delete buttons visible for org owners - [ ] Delete buttons hidden for regular write-access members - [ ] Modal confirmation on all delete clicks 🤖 Generated with [Claude Code](https://claude.com/claude-code)
jmiller reopened this issue 2026-06-02 11:21:41 +00:00
jmiller commented 2026-06-03 00:39:44 +00:00
Author
Owner
Copy Link
Copy Source

Tested and verified in production on MokoWaaS. All three download gating modes (none/prerelease/all), feed visibility, XML metadata, download URLs, and access control confirmed working.

Tested and verified in production on MokoWaaS. All three download gating modes (none/prerelease/all), feed visibility, XML metadata, download URLs, and access control confirmed working.
Sign in to join this conversation.
Labels
Clear labels
breaking-change
Breaking API or behavior change
 ci-cd
CI/CD pipeline changes
 config
Configuration changes
 dependencies
Dependency updates
 deploy-failure
Deployment failed
 docker
Docker/container changes
 documentation
Documentation changes
 good first issue
Good for newcomers
 health-check
Repo health check result
 help wanted
Extra attention needed
 mokostandards
Related to MokoStandards framework
 push-failure
Git push operation failed
 security
Security vulnerability or hardening
 size/l
200-500 lines changed
 size/m
50-200 lines changed
 size/s
10-50 lines changed
 size/xl
500+ lines changed
 size/xs
< 10 lines changed
 standards-drift
Deviates from MokoStandards
 standards-update
MokoStandards compliance update
 sync-failure
Sync or mirror failed
 tech-debt
Technical debt and TODO/FIXME items
 upstream
upstream
Inherited from upstream Gitea
 work-in-progress
Draft or incomplete work
No labels
Priority High
Type Bug
Milestone
No items
No Milestone
Assignees
Clear assignees
jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-APP#385
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?