1811 Commits

Author	SHA1	Message	Date
jmiller	9d45a767e7	Merge pull request 'feat(issues): make status_id, priority_id, type_id required on create (#598)' (#613) from feature/598-required-issue-metadata into main	2026-06-12 02:59:37 +00:00
Jonathan Miller	e0d4f5fd15	fix: handle SetIssueStatusID/PriorityID/TypeID errors on create ... Explicit caller-provided values now return 500 on failure instead of silently discarding the error. Default auto-assignment still uses best-effort (log and continue) since it's a fallback.	2026-06-11 21:57:39 -05:00
Jonathan Miller	c67e7373fb	fix: move required custom field validation before issue creation ... Validation now runs before NewIssue() to prevent orphaned issues when a required field is missing. Reuses the defs query for both validation and saving.	2026-06-11 21:56:14 -05:00
Jonathan Miller	cbaca15cda	feat(issues): make status_id, priority_id, type_id required on create (#598) ... - Change CreateIssueOption fields from *int64 (optional) to int64 - API auto-assigns org defaults when value is 0 - MCP gitea_issue_create now requires status_id, priority_id, type_id (pass 0 for org default) - Keep optional on gitea_issue_update (partial updates) Co-Authored-By: Moko Consulting <hello@mokoconsulting.tech>	2026-06-11 21:49:37 -05:00
Jonathan Miller	245b5a8e6a	feat(custom-fields): add required flag UI and API validation (#597) ... - Add required checkbox to org custom field settings form - Show red asterisk (*) indicator on required fields in the list - Validate required custom fields on API issue create (return 422) - Add locale strings for required field UI The Required column already exists in the DB (migration v343) and is already validated in the web form. This adds the missing org settings UI checkbox and API-side validation. Co-Authored-By: Moko Consulting <hello@mokoconsulting.tech>	2026-06-11 21:46:24 -05:00
Jonathan Miller	0f1002f3c9	fix: address review findings for wiki API ... - Log warning when wiki blob exceeds max size (was silent empty return) - Fix stale WebPathFromRequest test to match folder-based wiki behavior	2026-06-11 17:03:21 -05:00
Jonathan Miller	3a7b07590f	fix: wiki API sub-page support and content response (#606, #607) ... - Change wiki API routes from {pageName} to wildcard (*) to support pages with path separators (e.g. mcp/fleet-overview) - Use ListEntriesRecursiveFast() in ListWikiPages to include pages in subdirectories, not just root-level files - Add error logging in wikiContentsByEntry for diagnosing empty content_base64 responses - Fix pagination to count only regular files, not directories Co-Authored-By: Moko Consulting <hello@mokoconsulting.tech>	2026-06-11 16:56:10 -05:00
Jonathan Miller	7ed335e6c3	feat(api): add /metadata API route alongside /manifest for backward compat	2026-06-10 04:33:58 -05:00
Jonathan Miller	704d9d10be	feat(issues): status/priority/type dropdowns on new issue form (#598) ... - Add type, priority, status dropdowns to new issue sidebar - Pre-select org defaults (is_default for type/priority, first open status) - Auto-assign defaults on API create when not provided - Required indicators (*) on dropdowns and custom fields - Validate required custom fields on submit (#597) - Add feed_visibility to update server settings on manifest page	2026-06-09 23:19:19 -05:00
Jonathan Miller	549e890cd0	refactor: rename models/licenses to models/updateserver ... Rename the licensing/update server model package to better reflect its purpose. All imports updated from licenses_model to updateserver_model. License key management UI files kept (only imports updated).	2026-06-09 20:29:03 -05:00
Jonathan Miller	1caf26453f	feat: issue metadata API + org wiki tab with internal/external mode ... Issue Status/Priority/Type API: - Expose status_id, priority_id, type_id (with resolved names) on Issue API struct - New endpoints: GET /orgs/{org}/issue-statuses, /issue-priorities, /issue-types - CreateIssue and EditIssue handlers accept status_id, priority_id, type_id - MCP tools: 5 new tools + updated create/update with metadata params Org Wiki Tab: - Convention repos: wiki (public) and wiki-private (members-only) - Inline wiki rendering with markdown pipeline, sidebar, footer, page list - Public/private view dropdown (same UX as org profile README selector) - External wiki mode: link to outside URL from wiki tab - Wiki mode setting in org settings (internal vs external with URL field) - Migration 354: add wiki_mode and wiki_url to user table	2026-06-09 10:20:54 -05:00
Jonathan Miller	c26ad626bd	feat(manifest): add distribution metadata fields (phase 1 consolidation) ... Add DisplayName, Maintainer, MaintainerURL, InfoURL, TargetVersion, and PHPMinimum to RepoManifest. These fields were previously only in UpdateStreamConfig and are now in the manifest as the single source of truth. Distribution section shown conditionally for joomla/wordpress/ dolibarr platforms. Closes #582 phase 1.	2026-06-07 13:36:58 -05:00
Jonathan Miller	09aa8d8201	feat(manifest): add version prefix + fix platform dropdown values ... - Add version_prefix field for fork versioning (e.g., v1.26.1-moko.) - Change platform dropdown from programming languages to deployment targets (Joomla, Dolibarr, WordPress, Generic, etc.) so template repos can be mapped to platforms - Available in settings UI and REST API	2026-06-07 12:24:07 -05:00
Jonathan Miller	33ebcd7726	feat(manifest): add version prefix + fix platform dropdown values ... - Add version_prefix field for fork versioning (e.g., v1.26.1-moko.) - Change platform dropdown from programming languages to deployment targets (Joomla, Dolibarr, WordPress, Generic, etc.) so template repos can be mapped to platforms - Available in settings UI and REST API	2026-06-07 12:11:24 -05:00
Jonathan Miller	34fe0c5934	fix(api): use correct APIContext error methods for manifest endpoint ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:08:23 -05:00
Jonathan Miller	3aaa7c0843	feat(settings): repo manifest settings with auto-migration and API (#315) ... Add a "Manifest" page in repo settings that stores moko-platform manifest fields (identity, governance, build) in the database. Includes: - RepoManifest model with all manifest.xml fields - Migration v347 adding repo_manifest table - Auto-detect and migrate .mokogitea/manifest.xml on first settings visit - Repo settings UI with Identity/Governance/Build sections - REST API: GET/PUT /api/v1/repos/{owner}/{repo}/manifest for Actions workflows and moko-platform CLI Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:02:23 -05:00
Jonathan Miller	33076e4e1b	fix(issues): address review findings for custom field search ... - Clear custom field filters when field definitions fail to load, preventing invisible filtering with no UI to undo - Log malformed options JSON instead of silently dropping fields - Extract parseCustomFieldQueryParams helper (web) and parseAPICustomFieldFilters helper (API) to deduplicate cf_ parsing - API returns 400 for non-numeric or non-positive cf_ field IDs - Validate field IDs are positive in web handler - Add entity_type='issue' to subquery to prevent cross-entity matching Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 06:06:32 -05:00
Jonathan Miller	a3c6f54ad3	feat(issues): advanced search with custom field filters (#496) ... Add the ability to filter issues by custom field values throughout the entire search stack: - DB: applyCustomFieldCondition joins custom_field_value with AND semantics (all specified fields must match) - Indexer: CustomFieldFilters map passed through SearchOptions and ToDBOptions - Web: parse cf_{fieldID}={value} query params, show dropdown filters in the issue list sidebar for org-level fields - API: both SearchIssues and ListIssues accept cf_ query params Closes #496 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 06:06:32 -05:00
Jonathan Miller	cd4c701cb6	fix(custom-fields): address code review findings ... - API: return 500 on GetCustomFieldsByOwner failure instead of silently swallowing the error - resolveExtensionMetadata: add DownloadGating/KeyPrefix to metadata struct instead of mutating the caller's cfg pointer (side effect) - resolveExtensionMetadata: add Description custom field mapping - Composer: use meta.PHPMinimum instead of bypassing the cascade - Web form: flash error on custom field save failure instead of silent log Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 21:59:50 -05:00
Jonathan Miller	9ebe1b26b1	feat(custom-fields): pre-fill custom fields from issue template YAML frontmatter ... Add `custom_fields` map to IssueTemplate struct so templates can specify default values (e.g. `Priority: Medium`). On new issue form, org-level issue-scoped fields appear in the sidebar with template defaults pre-selected. NewIssuePost saves the values after issue creation. The API create issue endpoint also accepts `custom_fields` by name. Closes #493 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 21:47:15 -05:00
Jonathan Miller	539619be2f	feat(api): custom fields API for org definitions, repo metadata, and issue values ... API endpoints: - GET/POST/DELETE /api/v1/orgs/{org}/custom-fields — org field definitions - GET/PUT /api/v1/repos/{owner}/{repo}/metadata — repo-scoped field values - GET/PUT /api/v1/repos/{owner}/{repo}/issues/{index}/custom-fields — issue values All endpoints use field names as keys (not IDs) for ergonomic access. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 19:20:21 -05:00
Jonathan Miller	fb5002d317	fix(build): replace invalid UTF-8 character in API comment ... The em dash in the TODO comment was encoded as invalid UTF-8, causing a Go compiler error. Replace with ASCII hyphen. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 07:37:42 -05:00
Jonathan Miller	c15582aa64	fix(build): remove stale custom field API routes, structs, and migration ... Comment out custom-fields API routes in api.go that referenced handler functions from the deleted routers/api/v1/repo/custom_field.go. Remove the unreferenced modules/structs/custom_field.go and the duplicate v1_25/v323 migration (superseded by v1_27/v343). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 07:26:16 -05:00
Jonathan Miller	877f39d4f4	fix(build): remove stale custom field API file from prior session ... The old API file references non-existent struct names and fields. Will be rebuilt properly after the web UI is complete. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 07:02:40 -05:00
Jonathan Miller	75f05e1c80	fix(build): update custom field API to match renamed model functions ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-04 06:52:56 -05:00
Jonathan Miller	0e7d3c4a34	fix(security): ownership guards, RepoScope parsing, CSRF tokens, XSS escaping ... SECURITY: Add verifyPackageOwnership/verifyKeyOwnership checks to all API handlers that accept ID parameters. Prevents cross-org access where an admin of org A could modify org B's license data. FIX: RepoScope validation now properly parses JSON arrays using json.Unmarshal instead of strings.Contains. The old approach matched substrings (repo ID "2" matched inside "12"). Now uses typed int64 comparison. FIX: Add {{$.CsrfTokenHtml}} to both delete confirmation modal forms (package and key) in repo and org templates. Without CSRF tokens, the form-fetch-action POST requests would be rejected. FIX: HTML-escape release notes in WordPress changelog to prevent XSS via malicious release note content reaching WP admin dashboards. FIX: Parse AllowedChannels JSON format before comma-split fallback to avoid garbage values from splitting JSON arrays by comma. FIX: Add missing third return value (false) on error path in validateUpdateKey to prevent compile error. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-02 06:59:29 -05:00
Jonathan Miller	d204ecb9f0	fix(licenses): enforce RepoScope validation and add API revoke endpoint ... SECURITY: ValidateLicenseKeyForRepo() now checks the package's RepoScope field against the requesting repo ID. A package scoped to repo A will reject keys when accessed from repo B's update feed. Update server and download gating both use the new function. Master/internal keys bypass repo scope checks. RepoScope supports: "all" (any repo), single repo ID string, or JSON array of repo IDs like ["1","5","12"]. Also adds POST /license-keys/{id}/revoke API endpoint that was missing from the API but existed in web handlers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-01 05:33:26 -05:00
Jonathan Miller	3e8124a2b7	feat(licenses): API package CRUD, settings API, and repo scope UI ... API package endpoints (#388): - PATCH /license-packages/{id} — edit package (master protected) - DELETE /license-packages/{id} — delete package (master protected) - POST /license-packages/{id}/archive — archive package - POST /license-packages/{id}/unarchive — restore package Settings API (#349): - GET /license-settings — read licensing/update stream config - PUT /license-settings — update config (all metadata fields) - New LicenseSettings struct in API types Repo scope UI (#395): - Dropdown in create/edit package forms listing org repos - "All repositories" default option - RepoScope read from form in both repo and org handlers - OrgRepos loaded via GetOrgRepositories in Licenses handlers Refs #341, #346, #349, #388, #395 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-01 05:21:09 -05:00
Jonathan Miller	448b7d3ab0	feat(licenses): archive, search, download gating, changelog XML, and expanded permissions ... Migration v340: sync all missing columns (key_raw, payment_ref, last_heartbeat_unix, is_archived, licensing_enabled, download_gating, support_url, and all extension metadata fields). Package archiving (#384): add IsArchived field with archive/unarchive handlers and collapsible "Archived Packages" section in templates. Existing keys from archived packages continue to work. Expanded delete permissions (#385): org owners and site admins can permanently delete packages and keys (previously site admin only). Search (#392): server-side search across key_prefix, key_raw, licensee_name, licensee_email, domain_restriction, and payment_ref via ?q= query parameter on both repo and org licenses pages. Sortable tables (#390): Fomantic UI sortable class on keys table with new Domain column showing DomainRestriction per key. Download gating (#347): three modes — none, prerelease-only, and all downloads. CheckDownloadGating() intercepts both release attachment and git archive download handlers. Support URL (#393): configurable SupportURL field on UpdateStreamConfig for wiki or external site links. Changelog XML (#343): ServeChangelogXML endpoint at /changelog.xml generates Joomla-compatible changelog from release notes. Parses Keep-a-Changelog markdown sections into <security>, <fix>, <addition>, <change>, <remove>, <note> XML elements. API renew (#387): POST /license-keys/{id}/renew endpoint extends key expiration by package duration. Closes #384, #385, #386, #387, #389, #390, #392, #393 Refs #343, #346, #347 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-01 04:45:20 -05:00
Jonathan Miller	e998c494b2	fix: resolve tech-debt batch 7 — dead routes, stale FIXMEs, feed revision ... - chore: remove stale mustNotBeArchived FIXME (CanEnableEditor no longer exists) - fix(routes): remove dead /cherry-pick/{sha} route — replaced by /_cherrypick/ - fix(feed): use full ref name instead of ShortName for file feed revision Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-31 13:46:06 -05:00
Jonathan Miller	b9b3026122	fix: resolve tech-debt batch 3 — remove deprecated functions, use stdlib ... - refactor(go): replace ValuesRepository with maps.Values (Go 1.21+) - refactor(go): remove CanEnableEditor wrapper, use CanContentChange directly - chore: remove stale TODO comments about project column route naming Refs #311, #317 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-31 11:03:42 -05:00
Jonathan Miller	d74ae92e5b	fix: resolve tech-debt batch 2 — dropdown validation, editor cleanup, rename ... - fix(templates): add required validation to issue dropdown fields - refactor(ts): remove redundant `handled` field from MarkdownHandleIndentionResult - refactor(go): rename HasOrgOrUserVisible to IsOwnerVisibleToDoer for clarity Refs #311, #334 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-31 10:50:33 -05:00
Jonathan Miller	9a5720e8ad	chore: rename Go module from git. to code.mokoconsulting.tech (#336) ... Full namespace migration: update the Go module path and all import statements from git.mokoconsulting.tech to code.mokoconsulting.tech. Also updates all URL references in templates, workflows, configs, tests, and documentation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-31 10:28:25 -05:00
Jonathan Miller	b77da17f38	feat(licenses): implement full commercial license management system ... Add key editing, domain enforcement, purchase webhooks, public validation API, channels multiselect, Joomla downloadkey element, licensing feature toggle, unified update system, release tag enforcement, heartbeat tracking, and improved settings UX. Phase 1: Full key display with AbsoluteShort dates, master package protection (hide edit/delete in UI, reject in handlers). Phase 2: Key edit page with template, handlers, and routes for both repo and org levels. Master keys redirect away. Phase 3: Domain restriction checking against CSV allowlist, MaxSites enforcement via CountUniqueDomainsByKey and IsDomainKnownForKey, dlid query param support for Joomla. Phase 4: Purchase webhook (POST /license-keys/purchase) with PaymentRef idempotency. Public validation endpoint (POST /license-keys/validate) outside auth middleware. PATCH /license-keys/{id} for API key editing. Phase 5: Channels multiselect using org UpdateStreamConfig streams rendered as checkboxes, stored as JSON arrays. Additional: downloadkey XML element, LicensingEnabled toggle on UpdateStreamConfig, Dolibarr endpoint unified with key validation, release tag suffix enforcement, LastHeartbeatUnix field with TouchHeartbeat, and cleaned-up settings pages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-31 01:31:51 -05:00
Jonathan Miller	426cffc224	fix(api): set IsActive=true when creating license packages ... Same bug as keys — packages were created with is_active=false causing all key validation to reject even valid keys. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-30 20:18:11 -05:00
Jonathan Miller	4e51f48285	fix(api): set IsActive=true when creating license keys ... Keys were created with is_active=false (DB default) because the API handler didn't explicitly set IsActive. This caused all key validation to fail. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-30 20:08:39 -05:00
Jonathan Miller	470364e50c	fix(api): fix route registration — reqAdmin and m.Delete pattern ... Fix two compilation errors in license key API routes: - reqRepoAdmin() does not exist, use reqAdmin() instead - m.Delete(handler) needs route pattern: m.Delete("", handler) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-30 16:42:22 -05:00
Jonathan Miller	d40c8e1b85	fix(api): fix compilation errors in license key API handlers ... Replace ctx.Bind/ctx.APIErrorValidation (which don't exist on APIContext) with web.GetForm() pattern used by all other API handlers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-30 15:56:54 -05:00
Jonathan Miller	68845abd59	feat(updates): license key management API endpoints (Phase 4) ... Add REST API for managing license packages and keys: - GET/POST /api/v1/repos/{owner}/{repo}/license-packages - GET/POST /api/v1/repos/{owner}/{repo}/license-keys - DELETE /api/v1/repos/{owner}/{repo}/license-keys/{id} - GET /api/v1/repos/{owner}/{repo}/license-keys/{id}/usage API structs for create/edit/response, with raw key only returned on creation. Requires repo admin permissions. Ref #239 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-30 14:08:35 -05:00
Jonathan Miller	d4824dc05b	feat(actions): rebrand actions bot user and add branch protection whitelist ... Rebrand the built-in actions bot user from upstream Gitea naming to MokoGitea branding: - Name: gitea-actions → mokogitea-actions - FullName: Gitea Actions → MokoGitea Actions - Email: teabot@gitea.io → mokogitea-actions[bot]@mokoconsulting.tech Add backward-compatible name recognition so all three bot name variants (mokogitea-actions, gitea-actions, github-actions) with optional [bot] suffix resolve to the same system user. Add WhitelistActionsUser, MergeWhitelistActionsUser, and ForcePushAllowlistActionsUser toggles to branch protection rules, allowing CI/CD workflows to push to protected branches when explicitly enabled. Previously the actions bot (virtual user ID -2) could never be added to whitelist because updateUserWhitelist() only validates real database users. Closes #233 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-30 10:37:43 -05:00
Jonathan Miller	a847129f9c	fix: generate checksums on API asset upload, not just CreateRelease ... The API endpoint POST /releases/{id}/assets bypasses CreateRelease and UpdateRelease, so checksums were not generated for API uploads. Added GenerateReleaseChecksums call after successful asset upload. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 19:15:12 -05:00
Jonathan Miller	c572fcfe04	chore(core): rename Go module from code.gitea.io/gitea to MokoGitea namespace ... Rename the Go module path from code.gitea.io/gitea to git.mokoconsulting.tech/MokoConsulting/MokoGitea across the entire codebase. Scope: - go.mod module declaration - 2,235 Go source files (import paths) - Dockerfile WORKDIR and COPY paths - Swagger API templates - golangci.yml linter config External dependencies (code.gitea.io/gitea-vet, code.gitea.io/sdk/gitea, gitea.com/gitea/act, etc.) are intentionally NOT renamed — they are separate upstream modules. Closes #132 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-25 00:22:38 -05:00
Jonathan Miller	e8b2a485fc	fix: remove unused setting import in action.go ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-24 17:47:58 -05:00
Nicolas	43b5a54ffa	fix(actions): make artifact signature payloads unambiguous (#37707) (#37795) ... This PR hardens artifact URL signing by encoding signature inputs in an unambiguous binary payload before computing the HMAC. What it changes: - replace direct concatenation-style signing inputs with explicit payload builders - encode string fields with a length prefix before appending their bytes - encode integer fields as fixed-width binary values instead of decimal text - apply the same hardening to both: - Actions Artifact V4 signing in `routers/api/actions/artifactsv4.go` - artifact download signing in `routers/api/v1/repo/action.go` - add regression tests that verify distinct field combinations produce distinct payloads and signatures Why: The previous signing logic built HMAC inputs by appending multiple fields without a strongly structured representation. That kind of construction can create ambiguity at field boundaries, where different parameter combinations may serialize into the same byte stream for signing. This change removes that ambiguity by constructing a deterministic payload format with explicit boundaries between fields. Backport #37707 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-24 03:49:09 -05:00
Giteabot	b182855fc5	fix(permissions): Fix reading permission (#37769) (#37781)	2026-05-24 03:39:48 -05:00
Lunny Xiao	ca6c8c958c	fix: Unify public-only token filtering in API queries and repo access checks (#37118) (#37773) ... backport #37118 This PR closes remaining `public-only` token gaps in the API by making the restriction apply consistently across repository, organization, activity, notification, and authenticated `/api/v1/user/...` routes. Previously, `public-only` tokens were still able to: - receive private results from some list/search/self endpoints, - access repository data through ID-based lookups, - and reach several authenticated self routes that should remain unavailable for public-only access. This change treats `public-only` as a cross-cutting visibility boundary: - list/search endpoints now filter private resources consistently, - repository lookups enforce the same restriction even when addressed indirectly, - and self routes that inherently expose or mutate private account state now reject `public-only` tokens. --- Generated by a coding agent with Codex 5.2 Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-24 03:38:02 -05:00
Giteabot	738117248d	fix(packages): Add label for private and internal package and fix composor package source permission check (#37610) (#37643) ... Backport #37610 by @lunny - Add permission checks for Composer package source links - Add private/internal visibility labels for packages, similar to repository visibility labels <img width="969" height="571" alt="image" src="https://github.com/user-attachments/assets/8a8ec3a0-bfbd-4dd6-b45b-58eda5db1a2d" /> - Add a link to change package visibility <img width="1309" height="208" alt="image" src="https://github.com/user-attachments/assets/3fa82b23-4c63-4a5e-b3f0-d37a103231ee" /> - Update link package descriptions <img width="1308" height="265" alt="image" src="https://github.com/user-attachments/assets/2c80b50e-5ffe-4d96-aedd-aa15964c4e05" /> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io>	2026-05-24 03:34:47 -05:00
Jonathan Miller	3ec28c7f6a	fix(api): load repo before assignee update in bulk endpoint ... Fixes nil pointer dereference in BulkSetIssueAssignees — the issue's Repo field must be loaded before UpdateAssignees calls CanAssignTo. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-21 22:38:45 -05:00
Jonathan Miller	6f49a9efbe	feat(api): bulk issue operations — labels, state, milestone, assignees (#21) ... Add four new API endpoints under /repos/{owner}/{repo}/issues/bulk/ for performing batch operations across multiple issues in a single request. Each endpoint returns a partial-failure result with per-issue success/failure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-21 21:40:25 -05:00
Jonathan Miller	6e3f9e2cdf	fix: integrate badge presets with existing upstream badge module ... Restore original modules/badge/badge.go (upstream) and adapt our presets to use GenerateBadge() and the existing Badge type. - Rename Generate → GenerateRepoBadge to avoid conflict - Add FormatRepoBadgeSVG for SVG rendering - Add RenderFlat/RenderFlatSquare methods on Badge - Fix API handler to use new function names Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-20 20:27:03 -05:00