feat(repo): read-only org push policy and repo defaults views in repo settings (#738)

Surface the owning organization's push policy (GetOrgPushPolicyForRepo) and
repository defaults (GetOrgRepoDefaultsForRepo) as read-only, informational
sections on the repo Branch Protection settings page, mirroring the existing
inherited org branch/tag protection views. Sections only render for org-owned
repos when a policy/defaults row actually exists.

Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

.gitignore

@@ -120,3 +120,6 @@ prime/
 
 # A Makefile for custom make targets
 Makefile.local
+
+# Local clone of the MCP server (separate repo, not a submodule of this project)
+/mcp-mokogitea-api/

.mokogitea/ISSUE_TEMPLATE/feature_request.md

@@ -1,7 +1,7 @@
 ---
 name: Feature Request
 about: Suggest a new feature or enhancement
-title: '[FEATURE] '
+title: '(feat) '
 labels: 'enhancement'
 assignees: ''
 

.mokogitea/workflows/auto-release.yml

@@ -7,7 +7,7 @@
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/auto-release.yml.template
-# VERSION: 05.00.00
+# VERSION: 05.01.00
 # BRIEF: Universal build & release � detects platform from manifest.xml
 #
 # +=======================================================================+
@@ -64,10 +64,14 @@ jobs:
   promote-rc:
     name: Promote to RC
     runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
-      (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
-      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
+        (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+        (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
+        (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
+      )
 
     steps:
       - name: Checkout repository
@@ -75,6 +79,7 @@ jobs:
         with:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
+          submodules: recursive
 
       - name: Setup mokocli tools
         env:
@@ -90,7 +95,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -99,11 +104,39 @@ jobs:
 
       - name: Rename branch to rc
         run: |
-          php ${MOKO_CLI}/branch_rename.php \
-            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --api-base "${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
-            --pr "${{ github.event.pull_request.number }}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
+          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
+          PR="${{ github.event.pull_request.number }}"
+
+          # Resolve the source branch HEAD commit.
+          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
+            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
+          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
+          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
+
+          # Point rc at the source commit. If rc already exists (a protected branch that
+          # cannot be deleted), force-update its ref in place instead of delete+recreate:
+          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
+          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
+            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
+            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
+              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
+          else
+            echo "Creating rc from ${FROM}"
+            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
+              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
+          fi
+
+          # Repoint the PR at rc, then delete the old source branch (non-fatal).
+          if [ -n "$PR" ]; then
+            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
+          fi
+          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
+          echo "Renamed ${FROM} -> rc"
 
       - name: Checkout rc and configure git
         run: |
@@ -163,9 +196,13 @@ jobs:
   release:
     name: Build & Release Pipeline
     runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      github.event.pull_request.merged == true ||
-      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
+        github.event.pull_request.merged == true ||
+        (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
+      )
 
     steps:
       - name: Checkout repository
@@ -173,6 +210,7 @@ jobs:
         with:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 0
+          submodules: recursive
 
       - name: Configure git for bot pushes
         run: |
@@ -208,7 +246,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet

.mokogitea/workflows/branch-cleanup.yml

@@ -33,7 +33,8 @@ jobs:
         run: |
           BRANCH="${{ github.event.pull_request.head.ref }}"
           API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+          # URL-encode the branch name's slashes (no PHP dependency on the runner)
+          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
 
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
             -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \

.mokogitea/workflows/cascade-dev.yml

@@ -0,0 +1,10 @@
+# DISABLED — auto-release Step 11 recreates dev from main after every release.
+# Cascade-dev is redundant and causes version conflicts when both main and dev
+# have different version numbers in templateDetails.xml / manifest.xml.
+name: "Cascade Main → Dev (DISABLED)"
+on: workflow_dispatch
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Cascade disabled — auto-release handles dev recreation"

.mokogitea/workflows/ci-generic.yml

@@ -6,7 +6,7 @@
 # DEFGROUP: Gitea.Workflow
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.gitea/workflows/ci-generic.yml
+# PATH: /.mokogitea/workflows/ci-generic.yml
 # VERSION: 01.00.00
 # BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
 
@@ -32,6 +32,8 @@ jobs:
   lint:
     name: Lint & Validate
     runs-on: ubuntu-latest
+    # Skip on template repos (Template-*) — they hold placeholder scaffolding, not buildable source.
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
@@ -130,6 +132,9 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     needs: lint
+    # Run only when lint succeeded; always() forces evaluation so a skipped
+    # lint (e.g. template repos) skips this job cleanly instead of hanging.
+    if: ${{ always() && needs.lint.result == 'success' }}
 
     steps:
       - name: Checkout

.mokogitea/workflows/cleanup.yml

@@ -6,7 +6,7 @@
 # DEFGROUP: Gitea.Workflow
 # INGROUP: MokoStandards.Maintenance
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.gitea/workflows/cleanup.yml
+# PATH: /.mokogitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
 
@@ -50,7 +50,7 @@ jobs:
           for BRANCH in $BRANCHES; do
             # Skip protected branches
             case "$BRANCH" in
-              main|master|develop|release/*|hotfix/*) continue ;;
+              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
             esac
 
             # Check if branch is merged into main

.mokogitea/workflows/custom/pr-rc-release.yml

@@ -47,6 +47,15 @@ jobs:
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
+          # This RC flow drives a Joomla-style update stream (updates.xml). Repos that don't ship
+          # one (e.g. generic Go/TS) have nothing to package here, so no-op cleanly instead of
+          # aborting under `set -e` when the file is absent.
+          if [ ! -f updates.xml ]; then
+            echo "has_updates=false" >> "$GITHUB_OUTPUT"
+            echo "No updates.xml in this repo — skipping RC update-stream packaging"
+            exit 0
+          fi
+          echo "has_updates=true" >> "$GITHUB_OUTPUT"
           BASE_VERSION=$(sed -n 's/.*<version>\(.*\)<\/version>.*/\1/p' updates.xml | head -1)
           [ -z "$BASE_VERSION" ] && BASE_VERSION="04.00.00"
           RC_VERSION="${BASE_VERSION}-rc.${PR_NUMBER}"
@@ -56,7 +65,7 @@ jobs:
           echo "RC version: $RC_VERSION (tag: $RC_TAG)"
 
       - name: Update updates.xml RC channel
-        if: steps.guard.outputs.skip != 'true'
+        if: steps.guard.outputs.skip != 'true' && steps.version.outputs.has_updates == 'true'
         env:
           RC_VERSION: ${{ steps.version.outputs.version }}
           RC_TAG: ${{ steps.version.outputs.tag }}
@@ -106,7 +115,7 @@ jobs:
           PYEOF
 
       - name: Create RC release
-        if: steps.guard.outputs.skip != 'true'
+        if: steps.guard.outputs.skip != 'true' && steps.version.outputs.has_updates == 'true'
         env:
           GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           RC_TAG: ${{ steps.version.outputs.tag }}
@@ -153,7 +162,7 @@ jobs:
           PYEOF
 
       - name: Commit updates.xml
-        if: steps.guard.outputs.skip != 'true'
+        if: steps.guard.outputs.skip != 'true' && steps.version.outputs.has_updates == 'true'
         env:
           GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}

.mokogitea/workflows/deploy-manual.yml

@@ -1,126 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Deploy
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
-# PATH: /templates/workflows/joomla/deploy-manual.yml.template
-# VERSION: 04.07.00
-# BRIEF: Manual SFTP deploy to dev server for Joomla repos
-
-name: "Universal: Deploy to Dev (Manual)"
-
-on:
-  workflow_dispatch:
-    inputs:
-      clear_remote:
-        description: 'Delete all remote files before uploading'
-        required: false
-        default: 'false'
-        type: boolean
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-permissions:
-  contents: read
-
-jobs:
-  deploy:
-    name: SFTP Deploy to Dev
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Setup PHP
-        run: |
-          php -v && composer --version
-
-      - name: Setup MokoStandards tools
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
-          MOKO_CLONE_HOST: ${{ secrets.MOKOGITEA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.MOKOGITEA_TOKEN || github.token }}"}}'
-        run: |
-          git clone --depth 1 --branch main --quiet \
-            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
-            /tmp/mokostandards-api 2>/dev/null || true
-          if [ -d "/tmp/mokostandards-api" ] && [ -f "/tmp/mokostandards-api/composer.json" ]; then
-            cd /tmp/mokostandards-api && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-          fi
-
-      - name: Check FTP configuration
-        id: check
-        env:
-          HOST: ${{ vars.DEV_FTP_HOST }}
-          PATH_VAR: ${{ vars.DEV_FTP_PATH }}
-          PORT: ${{ vars.DEV_FTP_PORT }}
-        run: |
-          if [ -z "$HOST" ] || [ -z "$PATH_VAR" ]; then
-            echo "DEV_FTP_HOST or DEV_FTP_PATH not configured -- cannot deploy"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-          echo "host=$HOST" >> "$GITHUB_OUTPUT"
-
-          REMOTE="${PATH_VAR%/}"
-          echo "remote=$REMOTE" >> "$GITHUB_OUTPUT"
-
-          [ -z "$PORT" ] && PORT="22"
-          echo "port=$PORT" >> "$GITHUB_OUTPUT"
-
-      - name: Deploy via SFTP
-        if: steps.check.outputs.skip != 'true'
-        env:
-          SFTP_KEY: ${{ secrets.DEV_FTP_KEY }}
-          SFTP_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
-          SFTP_USER: ${{ vars.DEV_FTP_USERNAME }}
-        run: |
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
-          [ ! -d "$SOURCE_DIR" ] && { echo "No src/ or htdocs/ -- nothing to deploy"; exit 0; }
-
-          printf '{"host":"%s","port":%s,"username":"%s","remotePath":"%s"' \
-            "${{ steps.check.outputs.host }}" "${{ steps.check.outputs.port }}" "$SFTP_USER" "${{ steps.check.outputs.remote }}" \
-            > /tmp/sftp-config.json
-
-          if [ -n "$SFTP_KEY" ]; then
-            echo "$SFTP_KEY" > /tmp/deploy_key
-            chmod 600 /tmp/deploy_key
-            printf ',"privateKeyPath":"/tmp/deploy_key"}' >> /tmp/sftp-config.json
-          else
-            printf ',"password":"%s"}' "$SFTP_PASS" >> /tmp/sftp-config.json
-          fi
-
-          DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
-          [ "${{ inputs.clear_remote }}" = "true" ] && DEPLOY_ARGS+=(--clear-remote)
-
-          PLATFORM=$(php /tmp/mokostandards-api/cli/platform_detect.php --path . 2>/dev/null || true)
-          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/mokostandards-api/deploy/deploy-joomla.php" ]; then
-            php /tmp/mokostandards-api/deploy/deploy-joomla.php "${DEPLOY_ARGS[@]}"
-          else
-            php /tmp/mokostandards-api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
-          fi
-
-          rm -f /tmp/deploy_key /tmp/sftp-config.json
-
-      - name: Summary
-        if: always()
-        run: |
-          if [ "${{ steps.check.outputs.skip }}" = "true" ]; then
-            echo "### Deploy Skipped -- FTP not configured" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "### Manual Dev Deploy Complete" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
-            echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
-            echo "| Host | \`${{ steps.check.outputs.host }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Remote | \`${{ steps.check.outputs.remote }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Clear | ${{ inputs.clear_remote }} |" >> $GITHUB_STEP_SUMMARY
-          fi

.mokogitea/workflows/notify.yml

@@ -6,7 +6,7 @@
 # DEFGROUP: Gitea.Workflow
 # INGROUP: MokoStandards.Notifications
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.gitea/workflows/notify.yml
+# PATH: /.mokogitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
 
@@ -15,9 +15,9 @@ name: "Universal: Notifications"
 on:
   workflow_run:
     workflows:
-      - "Joomla Build & Release"
-      - "Joomla Extension CI"
-      - "Deploy"
+      - "Universal: Build & Release"
+      - "Joomla: Extension CI"
+      - "Generic: Project CI"
     types:
       - completed
 

.mokogitea/workflows/pr-check.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: moko-platform.CI
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
+# INGROUP: mokocli.CI
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/pr-check.yml.template
 # VERSION: 09.23.00
 # BRIEF: PR gate — branch policy + code validation before merge
@@ -47,15 +47,15 @@ jobs:
               fi
               ;;
             fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
                 ALLOWED=false
-                REASON="Fix branches must target 'dev', not '${BASE}'"
+                REASON="Fix branches must target 'dev' or 'main', not '${BASE}'"
               fi
               ;;
             patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ] && [ "$BASE" != "main" ]; then
                 ALLOWED=false
-                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+                REASON="Patch branches must target 'dev', 'rc', or 'main', not '${BASE}'"
               fi
               ;;
             hotfix/*)
@@ -86,7 +86,8 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
             echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`patch/*\` → \`dev\`, \`rc\`, or \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
@@ -126,6 +127,8 @@ jobs:
   validate:
     name: Validate PR
     runs-on: ubuntu-latest
+    # Skip on template repos (Template-*) — no real manifest/source/changelog to validate.
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
@@ -147,11 +150,12 @@ jobs:
       - name: Detect platform
         id: platform
         run: |
-          # Read platform from XML manifest (<platform> tag) or plain text fallback
-          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
-          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          # Platform comes from the MokoGitea metadata API (public GET); manifest.xml is no longer used.
+          API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
+          PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
           [ -z "$PLATFORM" ] && PLATFORM="generic"
           echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Detected platform: $PLATFORM"
 
       - name: Setup PHP
         if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
@@ -492,6 +496,9 @@ jobs:
     name: Build RC Package
     runs-on: ubuntu-latest
     needs: [branch-policy, validate]
+    # Run only when both gates succeeded; always() forces evaluation so a skipped
+    # validate (e.g. template repos) skips this job cleanly instead of hanging.
+    if: ${{ always() && needs.branch-policy.result == 'success' && needs.validate.result == 'success' }}
 
     steps:
       - name: Trigger RC pre-release

.mokogitea/workflows/pre-release.yml

@@ -48,9 +48,13 @@ jobs:
   build:
     name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
     runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      github.event_name == 'workflow_dispatch' ||
-      github.event_name == 'push'
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'push'
+      )
 
     steps:
       - name: Checkout

.mokogitea/workflows/sync-on-merge.yml

@@ -0,0 +1,31 @@
+name: Sync Workflows to Repos
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.mokogitea/workflows/**'
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout mokocli
+        uses: actions/checkout@v4
+        with:
+          repository: MokoConsulting/mokocli
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+
+      - name: Setup PHP
+        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
+        with:
+          php-version: '8.1'
+
+      - name: Install dependencies
+        run: composer install --no-dev --no-interaction
+
+      - name: Sync workflows to generic repos
+        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}

CHANGELOG.md

@@ -3,6 +3,13 @@
 ## [Unreleased]
 
 ### Added
+- Org branch protection: repositories now show the inherited organization rules read-only in their Branch Protection settings, with an expandable detail (direct push, force-push, branch deletion, merge restrictions, required approvals, status checks, protected files, and whitelisted teams) — like GitHub surfaces org rulesets in a repo (#727)
+- Org branch protection: org-level rules can now also protect against branch deletion (`enable_delete` + delete allowlist teams), mirroring the per-repo delete allowlist (#727)
+- Org-level tag protection: protect tag patterns org-wide (e.g. `v*`) with a team allowlist, layered on top of each repo's own protected tags — a tag is controllable only if allowed at both levels (fail-closed). API at `/orgs/{org}/tag_protections`; enforced at the git push/delete hook and the release create/delete paths; shown read-only in the repo Tag settings (#727)
+- Org-level push policy: one policy per org, enforced in the pre-receive hook across all its repositories — branch/tag name conventions (glob), a mandatory secret-scanning block-on-push that repos cannot disable, a max pushed-file size, and blocked file-path patterns. API at `/orgs/{org}/push_policy`. Naming is fail-closed; the content checks (blocked paths, max size) fail open on error so a policy bug can never block every push (#727)
+- Org-level repository defaults: an org can force new/transferred repositories private and set default pull-request settings (allowed merge styles, default merge style, auto-delete branch after merge), applied via a notifier when a repo is created in or transferred into the org (best-effort — never blocks repo creation). API at `/orgs/{org}/repo_defaults` (#727)
+- Org-level email domain policy: restrict which email domains an organization's members may have — a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership-add choke point (`AddTeamMember`); API at `/orgs/{org}/email_domain_policy` (#727)
+- Code security scanner: pattern-based detection of SQL injection, XSS, command injection, path traversal, insecure deserialization, hardcoded credentials, and weak cryptography across Go/PHP/Python/JS/TS (#552)
 - Cascade merge: auto-create PRs to downstream branches after merge with configurable rules per repo (#460)
 - Issue status presets: 4 built-in templates (default, software-development, support-tickets, bug-tracking) with API + web UI (#507)
 - Cross-org status migration: copy status definitions from one org to another via API (#507)
@@ -40,7 +47,31 @@
 - Wiki recent changes page: cross-page edit activity with pagination (#670)
 - Wiki page rename with automatic redirects via YAML frontmatter (#672)
 
+### Security
+- Cherry-pick upstream v1.26.3: LFS reject unknown SSH sub-verbs to prevent auth bypass (#38015)
+- Cherry-pick upstream v1.26.3: bound CODEOWNERS regex match time — ReDoS prevention (#38025)
+- Cherry-pick upstream v1.26.3: require merged PR to bypass fork PR approval gate (#38041)
+- Cherry-pick upstream v1.26.3: LFS require Code-unit access for cross-repo object reuse (#38050)
+- Cherry-pick upstream v1.26.3: hostmatcher block reserved IP ranges — SSRF prevention (#38059)
+- Cherry-pick upstream v1.26.3: bound debian ParseControlFile — DoS prevention (#38055)
+- Cherry-pick upstream v1.26.3: feed token scope, migration SSRF, notification redaction (#38147)
+- Cherry-pick upstream v1.26.3: OIDC ignore stale external login links to organizations (#38141)
+- Cherry-pick upstream v1.26.3: 2FA timing, branch delete auth, org labels visibility, merge upstream auth (#38151)
+- Cherry-pick upstream v1.26.3: allow git clone of private repos with anonymous code access (#38146)
+- Cherry-pick upstream v1.26.3: hostmatcher patch incorrect private IP list (#38173)
+- Cherry-pick upstream v1.26.4: do not auto-reactivate disabled users on OAuth2 callback (#38183)
+- Cherry-pick upstream v1.26.4: walk git log context error handling — regression fix (#38185)
+
 ### Fixed
+- Org-level branch protection now **layers** with per-repo rules instead of being ignored whenever a repo rule exists. When both an org rule and a repo rule match a branch, the effective rule is the most-restrictive (fail-closed) combination — the org rule is a mandatory floor a repo cannot weaken: allow flags AND'd, gate/require/block flags OR'd, required approvals max'd, status checks and protected-file patterns unioned, whitelists intersected. Previously a repo rule shadowed the org rule entirely at the enforcement choke point (`GetFirstMatchProtectedBranchRule`), letting a repo opt out of org protection (#727)
+- Org Teams page: list now renders — the handler wrote `ctx.Data["OrgListTeams"]` but the template reads `.Teams`, so the page showed header/nav but no teams (#720)
+- Issue type: now editable after creation for users with issue write permission — the sidebar gated editing on a `FieldEditFlags` data key that was never populated (always read-only); now uses `HasIssuesOrPullsWritePermission` like the priority field (#721)
+- Admin config form: radio inputs (e.g. instance landing page Mode) no longer throw "Unsupported config form value mapping", which had aborted all JS init on the admin settings page
+- PR check branch policy: allow `fix/*` → `main` and `patch/*` → `main` to match documented policy (was rejecting fix/patch PRs to main)
+- PR check platform detection: guard for missing `.mokogitea/manifest.xml` so the Validate PR job no longer aborts under `set -e` (manifest replaced by metadata API)
+- Remove dangling `mcp-mokogitea-api` submodule gitlink (no `.gitmodules` entry) that broke `submodule update --init` at checkout, failing all PR build/release jobs; ignore the local clone path
+- PR RC Release workflow: no-op cleanly when `updates.xml` is absent (generic repos) instead of aborting the "Determine RC version" step under `set -e`
+- PR check: platform detection now queries metadata API instead of removed manifest.xml
 - Cherry-pick upstream v1.26.2: handle empty pull request files view to allow reviews (#37783)
 - Cherry-pick upstream v1.26.2: fix "run as root" check with snap container detection (#37622)
 - Cherry-pick upstream: ack re-sent UpdateLog finalize idempotently (#37885)

README.md

@@ -1,6 +1,6 @@
 # MokoGitea
 
-Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, org metadata, CI standardization, and project board API.
+Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cascade merge, security scanning, org metadata, CI standardization, and project board API.
 
 ![Language](https://img.shields.io/badge/Go-00ADD8?style=flat-square&logo=go&logoColor=white) ![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green?style=flat-square)
 
@@ -11,8 +11,12 @@ Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, org
 - **Wiki System** -- wikilinks, categories, backlinks, template transclusion, revision diffs, rename redirects, folder ACL, enhanced ToC, print view, ZIP export ([details](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/standards/Wiki-Features))
 - **DLID Licensing** -- license management, entitlements, domain activations, ed25519-signed downloads
 - **API Token Scope Editing** -- edit token scopes via API (PATCH) or web UI after creation
-- **Issue Statuses** -- custom workflow statuses per org with required baseline protection
+- **Issue Statuses** -- custom workflow statuses per org with required baseline protection, presets, cross-org migration
+- **Cascade Merge** -- auto-create PRs to downstream branches after merge with configurable rules per repo
+- **Security Scanning** -- secret detection (pre-receive blocking) + code analysis (SQL injection, XSS, command injection, path traversal, and more) with REST API for alerts, config, and on-demand scans
+- **Default Org Teams** -- auto-create Developers, Reviewers, and CI/CD teams on org creation
 - **Org Metadata** -- per-repo metadata API (public GET, admin PUT), platform detection for versioning
+- **Branch Protection** -- delete allowlist for protected branches (per-user/team/deploy-key)
 - **Project Board API** -- REST endpoints for project columns and cards
 - **CI Infrastructure** -- reusable workflows, centralized ci-issue-reporter, standardized MOKOGITEA_TOKEN naming
 - **Dev Deploy Gate** -- builds deploy to dev environment first, production checks dev health

cmd/serv.go

@@ -113,23 +113,25 @@ func handleCliResponseExtra(extra private.ResponseExtra) error {
 	return nil
 }
 
-func getAccessMode(verb, lfsVerb string) perm.AccessMode {
+// getAccessMode maps an SSH git/LFS verb to the access mode it requires, with
+// ok=false for an unrecognised verb. Callers MUST reject the request when ok is
+// false: AccessModeNone would otherwise pass the `userMode < mode` permission
+// check in routers/private/serv.go and grant access.
+func getAccessMode(verb, lfsVerb string) (mode perm.AccessMode, ok bool) {
 	switch verb {
 	case git.CmdVerbUploadPack, git.CmdVerbUploadArchive:
-		return perm.AccessModeRead
+		return perm.AccessModeRead, true
 	case git.CmdVerbReceivePack:
-		return perm.AccessModeWrite
+		return perm.AccessModeWrite, true
 	case git.CmdVerbLfsAuthenticate, git.CmdVerbLfsTransfer:
 		switch lfsVerb {
 		case git.CmdSubVerbLfsUpload:
-			return perm.AccessModeWrite
+			return perm.AccessModeWrite, true
 		case git.CmdSubVerbLfsDownload:
-			return perm.AccessModeRead
+			return perm.AccessModeRead, true
 		}
 	}
-	// should be unreachable
-	setting.PanicInDevOrTesting("unknown verb: %s %s", verb, lfsVerb)
-	return perm.AccessModeNone
+	return perm.AccessModeNone, false
 }
 
 func runServ(ctx context.Context, c *cli.Command) error {
@@ -247,7 +249,10 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		}
 	}
 
-	requestedMode := getAccessMode(verb, lfsVerb)
+	requestedMode, ok := getAccessMode(verb, lfsVerb)
+	if !ok {
+		return fail(ctx, "Unknown git command", "Unknown git command %s %s", verb, lfsVerb)
+	}
 
 	results, extra := private.ServCommand(ctx, keyID, username, reponame, requestedMode, verb, lfsVerb)
 	if extra.HasError() {

cmd/serv_test.go

@@ -0,0 +1,56 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"testing"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetAccessMode(t *testing.T) {
+	cases := []struct {
+		verb, lfsVerb string
+		expected      perm.AccessMode
+	}{
+		{git.CmdVerbUploadPack, "", perm.AccessModeRead},
+		{git.CmdVerbUploadArchive, "", perm.AccessModeRead},
+		{git.CmdVerbReceivePack, "", perm.AccessModeWrite},
+		{git.CmdVerbLfsAuthenticate, git.CmdSubVerbLfsUpload, perm.AccessModeWrite},
+		{git.CmdVerbLfsAuthenticate, git.CmdSubVerbLfsDownload, perm.AccessModeRead},
+		{git.CmdVerbLfsTransfer, git.CmdSubVerbLfsUpload, perm.AccessModeWrite},
+		{git.CmdVerbLfsTransfer, git.CmdSubVerbLfsDownload, perm.AccessModeRead},
+	}
+	for _, tc := range cases {
+		t.Run(tc.verb+"/"+tc.lfsVerb, func(t *testing.T) {
+			mode, ok := getAccessMode(tc.verb, tc.lfsVerb)
+			assert.True(t, ok)
+			assert.Equal(t, tc.expected, mode)
+		})
+	}
+}
+
+// TestGetAccessModeUnknownVerb locks in the invariant that getAccessMode reports
+// ok=false for unrecognised verbs and LFS sub-verbs, so runServ rejects them. An
+// unknown verb has no valid access mode; if it were treated as AccessModeNone (0)
+// it would pass the `userMode < mode` permission check in routers/private/serv.go
+// and hand out valid LFS JWTs for any private repository.
+func TestGetAccessModeUnknownVerb(t *testing.T) {
+	cases := []struct{ verb, lfsVerb string }{
+		{git.CmdVerbLfsAuthenticate, ""},
+		{git.CmdVerbLfsAuthenticate, "badverb"},
+		{git.CmdVerbLfsTransfer, "badverb"},
+		{"git-unknown-verb", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.verb+"/"+tc.lfsVerb, func(t *testing.T) {
+			mode, ok := getAccessMode(tc.verb, tc.lfsVerb)
+			assert.False(t, ok)
+			assert.Equal(t, perm.AccessModeNone, mode)
+		})
+	}
+}

docker/root/etc/templates/app.ini

@@ -51,8 +51,6 @@ ROOT_PATH = /data/gitea/log
 [security]
 INSTALL_LOCK = $INSTALL_LOCK
 SECRET_KEY   = $SECRET_KEY
-REVERSE_PROXY_LIMIT = 1
-REVERSE_PROXY_TRUSTED_PROXIES = *
 
 [service]
 DISABLE_REGISTRATION = $DISABLE_REGISTRATION

docker/rootless/etc/templates/app.ini

@@ -48,8 +48,6 @@ ROOT_PATH = $GITEA_WORK_DIR/data/log
 [security]
 INSTALL_LOCK = $INSTALL_LOCK
 SECRET_KEY   = $SECRET_KEY
-REVERSE_PROXY_LIMIT = 1
-REVERSE_PROXY_TRUSTED_PROXIES = *
 
 [service]
 DISABLE_REGISTRATION = $DISABLE_REGISTRATION

models/actions/run_list.go

@@ -64,7 +64,6 @@ type FindRunOptions struct {
 	Ref              string // the commit/tag/… that caused this workflow
 	TriggerUserID    int64
 	TriggerEvent     webhook_module.HookEventType
-	Approved         bool // not util.OptionalBool, it works only when it's true
 	Status           []Status
 	ConcurrencyGroup string
 	CommitSHA        string
@@ -81,9 +80,6 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.TriggerUserID > 0 {
 		cond = cond.And(builder.Eq{"`action_run`.trigger_user_id": opts.TriggerUserID})
 	}
-	if opts.Approved {
-		cond = cond.And(builder.Gt{"`action_run`.approved_by": 0})
-	}
 	if len(opts.Status) > 0 {
 		cond = cond.And(builder.In("`action_run`.status", opts.Status))
 	}

models/auth/twofactor.go

@@ -21,6 +21,7 @@ import (
 
 	"github.com/pquerna/otp/totp"
 	"golang.org/x/crypto/pbkdf2"
+	"xorm.io/builder"
 )
 
 //
@@ -104,20 +105,43 @@ func (t *TwoFactor) SetSecret(secretString string) error {
 	return nil
 }
 
-// ValidateTOTP validates the provided passcode.
-func (t *TwoFactor) ValidateTOTP(passcode string) (bool, error) {
+// validateTOTP validates the provided passcode. It does not consume the passcode; all login
+// surfaces must go through ValidateAndConsumeTOTP so that a passcode cannot be redeemed twice.
+func (t *TwoFactor) validateTOTP(passcode string) (bool, error) {
 	decodedStoredSecret, err := base64.StdEncoding.DecodeString(t.Secret)
 	if err != nil {
-		return false, fmt.Errorf("ValidateTOTP invalid base64: %w", err)
+		return false, fmt.Errorf("validateTOTP invalid base64: %w", err)
 	}
 	secretBytes, err := secret.AesDecrypt(t.getEncryptionKey(), decodedStoredSecret)
 	if err != nil {
-		return false, fmt.Errorf("ValidateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
+		return false, fmt.Errorf("validateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
 	}
 	secretStr := string(secretBytes)
 	return totp.Validate(passcode, secretStr), nil
 }
 
+// ValidateAndConsumeTOTP validates the passcode and atomically records it as used so that the
+// same passcode cannot be redeemed more than once (RFC 6238 §5.2). It returns false for an
+// invalid passcode as well as for a replay, including the case where a concurrent request with
+// the same passcode won the race first. All TOTP login surfaces must go through this helper.
+func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (bool, error) {
+	ok, err := t.validateTOTP(passcode)
+	if err != nil || !ok {
+		return false, err
+	}
+	// Conditional update: only a row whose stored passcode differs from this one is updated, so a
+	// replay (or a concurrent duplicate) matches zero rows and is rejected. The row lock taken by
+	// the UPDATE serializes racing requests, closing the read-validate-write TOCTOU window.
+	t.LastUsedPasscode = passcode
+	n, err := db.GetEngine(ctx).ID(t.ID).
+		Where(builder.Or(builder.IsNull{"last_used_passcode"}, builder.Neq{"last_used_passcode": passcode})).
+		Cols("last_used_passcode").Update(t)
+	if err != nil {
+		return false, err
+	}
+	return n == 1, nil
+}
+
 // NewTwoFactor creates a new two-factor authentication token.
 func NewTwoFactor(ctx context.Context, t *TwoFactor) error {
 	_, err := db.GetEngine(ctx).Insert(t)

models/auth/twofactor_test.go

@@ -0,0 +1,47 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package auth_test
+
+import (
+	"testing"
+	"time"
+
+	auth_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/auth"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unittest"
+
+	"github.com/pquerna/otp/totp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	key, err := totp.Generate(totp.GenerateOpts{SecretSize: 40, Issuer: "gitea-test", AccountName: "consume"})
+	require.NoError(t, err)
+
+	tfa := &auth_model.TwoFactor{UID: 1}
+	require.NoError(t, tfa.SetSecret(key.Secret()))
+	require.NoError(t, auth_model.NewTwoFactor(t.Context(), tfa))
+
+	passcode, err := totp.GenerateCode(key.Secret(), time.Now())
+	require.NoError(t, err)
+
+	// first use of a valid passcode succeeds
+	ok, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
+	require.NoError(t, err)
+	assert.True(t, ok)
+
+	// replaying the same passcode is refused, even when still inside the TOTP validity window
+	reloaded, err := auth_model.GetTwoFactorByUID(t.Context(), tfa.UID)
+	require.NoError(t, err)
+	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
+	require.NoError(t, err)
+	assert.False(t, ok)
+
+	// an invalid passcode is rejected without consuming anything
+	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), "000000")
+	require.NoError(t, err)
+	assert.False(t, ok)
+}

models/git/lfs.go

@@ -196,7 +196,10 @@ func LFSObjectAccessible(ctx context.Context, user *user_model.User, oid string)
 		count, err := db.GetEngine(ctx).Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
 		return count > 0, err
 	}
-	cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)
+	// LFS objects are repository code content, so authorization must require
+	// Code-unit access; other unit accesses (e.g. Issues) must not authorize
+	// reuse of an existing LFS object across repositories.
+	cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeCode)
 	count, err := db.GetEngine(ctx).Where(cond).Join("INNER", "repository", "`lfs_meta_object`.repository_id = `repository`.id").Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
 	return count > 0, err
 }
@@ -220,7 +223,7 @@ func LFSAutoAssociate(ctx context.Context, metas []*LFSMetaObject, user *user_mo
 			newMetas := make([]*LFSMetaObject, 0, len(metas))
 			cond := builder.In(
 				"`lfs_meta_object`.repository_id",
-				builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)),
+				builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeCode)),
 			)
 			if err := db.GetEngine(ctx).Cols("oid").Where(cond).In("oid", oids...).GroupBy("oid").Find(&newMetas); err != nil {
 				return err

models/git/org_email_domain.go

@@ -0,0 +1,134 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/glob"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgEmailDomainPolicy restricts which email domains an organization's members may
+// have. When configured, a user can only be added to the org if their primary email
+// matches one of the allowed domain globs. At most one row per org. See issue #727.
+type OrgEmailDomainPolicy struct {
+	ID             int64              `xorm:"pk autoincr"`
+	OrgID          int64              `xorm:"UNIQUE NOT NULL"`
+	AllowedDomains string             `xorm:"TEXT"`
+	CreatedUnix    timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix    timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgEmailDomainPolicy))
+}
+
+// ErrEmailDomainNotAllowed is returned when a user's email domain is not permitted
+// by the organization's email domain policy.
+type ErrEmailDomainNotAllowed struct {
+	Email string
+	OrgID int64
+}
+
+func (e ErrEmailDomainNotAllowed) Error() string {
+	return fmt.Sprintf("email %q is not in an allowed domain for organization %d", e.Email, e.OrgID)
+}
+
+// IsErrEmailDomainNotAllowed reports whether err is an ErrEmailDomainNotAllowed.
+func IsErrEmailDomainNotAllowed(err error) bool {
+	_, ok := err.(ErrEmailDomainNotAllowed)
+	return ok
+}
+
+func (p *OrgEmailDomainPolicy) domainGlobs() []glob.Glob {
+	var out []glob.Glob
+	for _, d := range strings.Split(p.AllowedDomains, ";") {
+		d = strings.TrimSpace(strings.ToLower(d))
+		if d == "" {
+			continue
+		}
+		if g, err := glob.Compile(d); err == nil {
+			out = append(out, g)
+		} else {
+			log.Warn("Invalid org email domain glob %q: %v", d, err)
+		}
+	}
+	return out
+}
+
+// EmailAllowed reports whether email's domain satisfies the policy. An empty policy
+// (no configured domains) allows any email.
+func (p *OrgEmailDomainPolicy) EmailAllowed(email string) bool {
+	globs := p.domainGlobs()
+	if len(globs) == 0 {
+		return true
+	}
+	at := strings.LastIndexByte(email, '@')
+	if at < 0 {
+		return false
+	}
+	domain := strings.ToLower(email[at+1:])
+	for _, g := range globs {
+		if g.Match(domain) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetOrgEmailDomainPolicy returns the org's email domain policy, or nil if none.
+func GetOrgEmailDomainPolicy(ctx context.Context, orgID int64) (*OrgEmailDomainPolicy, error) {
+	policy, exist, err := db.Get[OrgEmailDomainPolicy](ctx, builder.Eq{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return policy, nil
+}
+
+// OrgEmailDomainAllowed reports whether email is permitted for the org. It returns
+// true when the org has no policy configured.
+func OrgEmailDomainAllowed(ctx context.Context, orgID int64, email string) (bool, error) {
+	policy, err := GetOrgEmailDomainPolicy(ctx, orgID)
+	if err != nil {
+		return false, err
+	}
+	if policy == nil {
+		return true, nil
+	}
+	return policy.EmailAllowed(email), nil
+}
+
+// UpsertOrgEmailDomainPolicy creates or updates the single policy row for an org.
+func UpsertOrgEmailDomainPolicy(ctx context.Context, policy *OrgEmailDomainPolicy) error {
+	existing, err := GetOrgEmailDomainPolicy(ctx, policy.OrgID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		if _, err := db.GetEngine(ctx).Insert(policy); err != nil {
+			return fmt.Errorf("Insert OrgEmailDomainPolicy: %v", err)
+		}
+		return nil
+	}
+	policy.ID = existing.ID
+	if _, err := db.GetEngine(ctx).ID(existing.ID).AllCols().Update(policy); err != nil {
+		return fmt.Errorf("Update OrgEmailDomainPolicy: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgEmailDomainPolicy removes an org's email domain policy.
+func DeleteOrgEmailDomainPolicy(ctx context.Context, orgID int64) error {
+	_, err := db.GetEngine(ctx).Where("org_id = ?", orgID).Delete(new(OrgEmailDomainPolicy))
+	return err
+}

models/git/org_protected_branch.go

@@ -33,6 +33,9 @@ type OrgProtectedBranch struct {
 	CanForcePush                  bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableForcePushAllowlist      bool               `xorm:"NOT NULL DEFAULT false"`
 	ForcePushAllowlistTeamIDs     []int64            `xorm:"JSON TEXT"`
+	CanDelete                     bool               `xorm:"NOT NULL DEFAULT false"`
+	EnableDeleteAllowlist         bool               `xorm:"NOT NULL DEFAULT false"`
+	DeleteAllowlistTeamIDs        []int64            `xorm:"JSON TEXT"`
 	EnableStatusCheck             bool               `xorm:"NOT NULL DEFAULT false"`
 	StatusCheckContexts           []string           `xorm:"JSON TEXT"`
 	RequiredApprovals             int64              `xorm:"NOT NULL DEFAULT 0"`
@@ -96,6 +99,9 @@ func (o *OrgProtectedBranch) ToProtectedBranch() *ProtectedBranch {
 		CanForcePush:                  o.CanForcePush,
 		EnableForcePushAllowlist:      o.EnableForcePushAllowlist,
 		ForcePushAllowlistTeamIDs:     o.ForcePushAllowlistTeamIDs,
+		CanDelete:                     o.CanDelete,
+		EnableDeleteAllowlist:         o.EnableDeleteAllowlist,
+		DeleteAllowlistTeamIDs:        o.DeleteAllowlistTeamIDs,
 		EnableStatusCheck:             o.EnableStatusCheck,
 		StatusCheckContexts:           o.StatusCheckContexts,
 		RequiredApprovals:             o.RequiredApprovals,

models/git/org_protected_tag.go

@@ -0,0 +1,133 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgProtectedTag represents an org-level tag protection rule. It cascades to all
+// repositories in the organization and layers on top of each repo's own protected
+// tags (a tag is controllable only if allowed at both levels). Org rules reference
+// teams only (like OrgProtectedBranch). See issue #727.
+type OrgProtectedTag struct {
+	ID               int64              `xorm:"pk autoincr"`
+	OrgID            int64              `xorm:"UNIQUE(s) index"`
+	NamePattern      string             `xorm:"UNIQUE(s)"`
+	AllowlistTeamIDs []int64            `xorm:"JSON TEXT"`
+	CreatedUnix      timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix      timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgProtectedTag))
+}
+
+// ToProtectedTag converts an org-level tag rule into a repo-scoped ProtectedTag so
+// the standard name-matching and allowlist logic can be reused. Org rules are
+// team-only, so the user allowlist is left empty.
+func (o *OrgProtectedTag) ToProtectedTag() *ProtectedTag {
+	return &ProtectedTag{
+		NamePattern:      o.NamePattern,
+		AllowlistTeamIDs: o.AllowlistTeamIDs,
+	}
+}
+
+// GetOrgProtectedTagByID retrieves a single org tag rule by org ID and rule ID.
+func GetOrgProtectedTagByID(ctx context.Context, orgID, id int64) (*OrgProtectedTag, error) {
+	rule, exist, err := db.Get[OrgProtectedTag](ctx, builder.Eq{"org_id": orgID, "id": id})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return rule, nil
+}
+
+// GetOrgProtectedTagByNamePattern retrieves a single org tag rule by its pattern.
+func GetOrgProtectedTagByNamePattern(ctx context.Context, orgID int64, pattern string) (*OrgProtectedTag, error) {
+	rule, exist, err := db.Get[OrgProtectedTag](ctx, builder.Eq{"org_id": orgID, "name_pattern": pattern})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return rule, nil
+}
+
+// FindOrgProtectedTags loads all org-level tag protection rules for an organization.
+func FindOrgProtectedTags(ctx context.Context, orgID int64) ([]*OrgProtectedTag, error) {
+	var rules []*OrgProtectedTag
+	err := db.GetEngine(ctx).Where("org_id = ?", orgID).Asc("created_unix").Find(&rules)
+	return rules, err
+}
+
+// CreateOrgProtectedTag creates a new org-level tag protection rule.
+func CreateOrgProtectedTag(ctx context.Context, rule *OrgProtectedTag) error {
+	if _, err := db.GetEngine(ctx).Insert(rule); err != nil {
+		return fmt.Errorf("Insert OrgProtectedTag: %v", err)
+	}
+	return nil
+}
+
+// UpdateOrgProtectedTag updates an existing org-level tag protection rule.
+func UpdateOrgProtectedTag(ctx context.Context, rule *OrgProtectedTag) error {
+	if _, err := db.GetEngine(ctx).ID(rule.ID).AllCols().Update(rule); err != nil {
+		return fmt.Errorf("Update OrgProtectedTag: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgProtectedTag deletes an org-level tag protection rule.
+func DeleteOrgProtectedTag(ctx context.Context, orgID, id int64) error {
+	affected, err := db.GetEngine(ctx).Where("org_id = ? AND id = ?", orgID, id).Delete(new(OrgProtectedTag))
+	if err != nil {
+		return err
+	}
+	if affected == 0 {
+		return fmt.Errorf("org tag protection rule ID(%d) not found", id)
+	}
+	return nil
+}
+
+// IsUserAllowedToControlTagInRepo layers org-level tag rules on top of a repo's own
+// protected tags: the user must be allowed by BOTH levels (most-restrictive). The
+// repo decision is evaluated first (using the already-loaded repoTags); if it
+// allows and the owner is an organization, the org-level rules must also allow.
+func IsUserAllowedToControlTagInRepo(ctx context.Context, repoTags []*ProtectedTag, repo *repo_model.Repository, tagName string, userID int64) (bool, error) {
+	allowed, err := IsUserAllowedToControlTag(ctx, repoTags, tagName, userID)
+	if err != nil || !allowed {
+		return allowed, err
+	}
+
+	owner, err := user_model.GetUserByID(ctx, repo.OwnerID)
+	if err != nil {
+		return false, err
+	}
+	if !owner.IsOrganization() {
+		return true, nil
+	}
+
+	orgRules, err := FindOrgProtectedTags(ctx, owner.ID)
+	if err != nil {
+		return false, err
+	}
+	if len(orgRules) == 0 {
+		return true, nil
+	}
+
+	orgTags := make([]*ProtectedTag, len(orgRules))
+	for i, r := range orgRules {
+		orgTags[i] = r.ToProtectedTag()
+	}
+	return IsUserAllowedToControlTag(ctx, orgTags, tagName, userID)
+}

models/git/org_push_policy.go

@@ -0,0 +1,130 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/glob"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgPushPolicy is a single org-wide policy enforced in the pre-receive hook on
+// every repository of the organization. Unlike the branch/tag rulesets there is at
+// most one policy per org. Empty pattern / zero fields mean "no constraint". See #727.
+type OrgPushPolicy struct {
+	ID                  int64              `xorm:"pk autoincr"`
+	OrgID               int64              `xorm:"UNIQUE NOT NULL"`
+	BranchNamePattern   string             `xorm:"TEXT"`
+	TagNamePattern      string             `xorm:"TEXT"`
+	RequireSecretBlock  bool               `xorm:"NOT NULL DEFAULT false"`
+	MaxFileSize         int64              `xorm:"NOT NULL DEFAULT 0"`
+	BlockedFilePatterns string             `xorm:"TEXT"`
+	CreatedUnix         timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix         timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgPushPolicy))
+}
+
+// nameMatchesPattern reports whether name satisfies a glob pattern. An empty pattern
+// imposes no constraint; an invalid pattern fails open (no constraint) so a
+// misconfigured policy never blocks all pushes.
+func nameMatchesPattern(pattern, name string) bool {
+	pattern = strings.TrimSpace(pattern)
+	if pattern == "" {
+		return true
+	}
+	g, err := glob.Compile(pattern, '/')
+	if err != nil {
+		log.Warn("Invalid org push policy name pattern %q: %v", pattern, err)
+		return true
+	}
+	return g.Match(name)
+}
+
+// BranchNameAllowed reports whether a branch name satisfies the naming policy.
+func (p *OrgPushPolicy) BranchNameAllowed(name string) bool {
+	return nameMatchesPattern(p.BranchNamePattern, name)
+}
+
+// TagNameAllowed reports whether a tag name satisfies the naming policy.
+func (p *OrgPushPolicy) TagNameAllowed(name string) bool {
+	return nameMatchesPattern(p.TagNamePattern, name)
+}
+
+// BlockedFileGlobs parses the ';'-separated blocked file pattern list.
+func (p *OrgPushPolicy) BlockedFileGlobs() []glob.Glob {
+	var out []glob.Glob
+	for _, expr := range strings.Split(p.BlockedFilePatterns, ";") {
+		expr = strings.TrimSpace(strings.ToLower(expr))
+		if expr == "" {
+			continue
+		}
+		if g, err := glob.Compile(expr, '.', '/'); err == nil {
+			out = append(out, g)
+		} else {
+			log.Warn("Invalid org push policy blocked file pattern %q: %v", expr, err)
+		}
+	}
+	return out
+}
+
+// GetOrgPushPolicy returns the org's push policy, or nil if none is configured.
+func GetOrgPushPolicy(ctx context.Context, orgID int64) (*OrgPushPolicy, error) {
+	policy, exist, err := db.Get[OrgPushPolicy](ctx, builder.Eq{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return policy, nil
+}
+
+// GetOrgPushPolicyForRepo returns the push policy of the repo's owning organization,
+// or nil if the owner is not an organization or has no policy.
+func GetOrgPushPolicyForRepo(ctx context.Context, repo *repo_model.Repository) (*OrgPushPolicy, error) {
+	owner, err := user_model.GetUserByID(ctx, repo.OwnerID)
+	if err != nil {
+		return nil, err
+	}
+	if !owner.IsOrganization() {
+		return nil, nil //nolint:nilnil
+	}
+	return GetOrgPushPolicy(ctx, owner.ID)
+}
+
+// UpsertOrgPushPolicy creates or updates the single push policy for an org.
+func UpsertOrgPushPolicy(ctx context.Context, policy *OrgPushPolicy) error {
+	existing, err := GetOrgPushPolicy(ctx, policy.OrgID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		if _, err := db.GetEngine(ctx).Insert(policy); err != nil {
+			return fmt.Errorf("Insert OrgPushPolicy: %v", err)
+		}
+		return nil
+	}
+	policy.ID = existing.ID
+	if _, err := db.GetEngine(ctx).ID(existing.ID).AllCols().Update(policy); err != nil {
+		return fmt.Errorf("Update OrgPushPolicy: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgPushPolicy removes an org's push policy.
+func DeleteOrgPushPolicy(ctx context.Context, orgID int64) error {
+	_, err := db.GetEngine(ctx).Where("org_id = ?", orgID).Delete(new(OrgPushPolicy))
+	return err
+}

models/git/org_repo_defaults.go

@@ -0,0 +1,88 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgRepoDefaults holds an organization's default repository settings, applied to a
+// repository when it is created in or transferred into the org (via a notifier).
+// There is at most one row per org. See issue #727.
+type OrgRepoDefaults struct {
+	ID                     int64              `xorm:"pk autoincr"`
+	OrgID                  int64              `xorm:"UNIQUE NOT NULL"`
+	ForcePrivate           bool               `xorm:"NOT NULL DEFAULT false"`
+	ApplyPRDefaults        bool               `xorm:"NOT NULL DEFAULT false"`
+	AllowMerge             bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowRebase            bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowRebaseMerge       bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowSquash            bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowFastForwardOnly   bool               `xorm:"NOT NULL DEFAULT true"`
+	DefaultMergeStyle      string             `xorm:"TEXT"`
+	DeleteBranchAfterMerge bool               `xorm:"NOT NULL DEFAULT false"`
+	CreatedUnix            timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix            timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgRepoDefaults))
+}
+
+// GetOrgRepoDefaults returns the org's repo defaults, or nil if none are configured.
+func GetOrgRepoDefaults(ctx context.Context, orgID int64) (*OrgRepoDefaults, error) {
+	defaults, exist, err := db.Get[OrgRepoDefaults](ctx, builder.Eq{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return defaults, nil
+}
+
+// GetOrgRepoDefaultsForRepo returns the repo-defaults of the repo's owning org, or
+// nil if the owner is not an organization or has none configured.
+func GetOrgRepoDefaultsForRepo(ctx context.Context, repo *repo_model.Repository) (*OrgRepoDefaults, error) {
+	owner, err := user_model.GetUserByID(ctx, repo.OwnerID)
+	if err != nil {
+		return nil, err
+	}
+	if !owner.IsOrganization() {
+		return nil, nil //nolint:nilnil
+	}
+	return GetOrgRepoDefaults(ctx, owner.ID)
+}
+
+// UpsertOrgRepoDefaults creates or updates the single repo-defaults row for an org.
+func UpsertOrgRepoDefaults(ctx context.Context, defaults *OrgRepoDefaults) error {
+	existing, err := GetOrgRepoDefaults(ctx, defaults.OrgID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		if _, err := db.GetEngine(ctx).Insert(defaults); err != nil {
+			return fmt.Errorf("Insert OrgRepoDefaults: %v", err)
+		}
+		return nil
+	}
+	defaults.ID = existing.ID
+	if _, err := db.GetEngine(ctx).ID(existing.ID).AllCols().Update(defaults); err != nil {
+		return fmt.Errorf("Update OrgRepoDefaults: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgRepoDefaults removes an org's repo defaults.
+func DeleteOrgRepoDefaults(ctx context.Context, orgID int64) error {
+	_, err := db.GetEngine(ctx).Where("org_id = ?", orgID).Delete(new(OrgRepoDefaults))
+	return err
+}

models/git/protected_branch_list.go

@@ -85,19 +85,40 @@ func FindAllMatchedBranches(ctx context.Context, repoID int64, ruleName string)
 	return results, nil
 }
 
-// GetFirstMatchProtectedBranchRule returns the first matched rule.
-// It checks repo-level rules first; if none match, it falls back to org-level rules
-// (if the repo belongs to an organization).
+// GetFirstMatchProtectedBranchRule returns the effective protected-branch rule for a
+// branch. It combines the matching repo-level rule with the matching org-level rule
+// (when the repo belongs to an organization): if both match they are layered with
+// mergeMostRestrictive so the org rule acts as a floor the repo cannot weaken; if
+// only one matches that one is returned; if neither matches, nil.
 func GetFirstMatchProtectedBranchRule(ctx context.Context, repoID int64, branchName string) (*ProtectedBranch, error) {
 	rules, err := FindRepoProtectedBranchRules(ctx, repoID)
 	if err != nil {
 		return nil, err
 	}
-	if matched := rules.GetFirstMatched(branchName); matched != nil {
-		return matched, nil
+	repoRule := rules.GetFirstMatched(branchName)
+
+	orgRule, err := getFirstMatchOrgProtectedBranchRule(ctx, repoID, branchName)
+	if err != nil {
+		return nil, err
 	}
 
-	// Fall back to org-level rules
+	switch {
+	case repoRule == nil && orgRule == nil:
+		return nil, nil
+	case orgRule == nil:
+		return repoRule, nil
+	case repoRule == nil:
+		return orgRule, nil
+	default:
+		return mergeMostRestrictive(repoRule, orgRule), nil
+	}
+}
+
+// getFirstMatchOrgProtectedBranchRule returns the matching org-level rule for a
+// branch expressed as a repo-scoped ProtectedBranch (RepoID set so downstream
+// permission checks work), or nil if the repo's owner is not an organization or no
+// org rule matches.
+func getFirstMatchOrgProtectedBranchRule(ctx context.Context, repoID int64, branchName string) (*ProtectedBranch, error) {
 	repo, err := repo_model.GetRepositoryByID(ctx, repoID)
 	if err != nil {
 		return nil, err
@@ -119,7 +140,7 @@ func GetFirstMatchProtectedBranchRule(ctx context.Context, repoID int64, branchN
 		return nil, nil
 	}
 
-	// Convert org rule to a ProtectedBranch with RepoID set so callers work correctly
+	// Convert org rule to a ProtectedBranch with RepoID set so callers work correctly.
 	pb := orgRule.ToProtectedBranch()
 	pb.RepoID = repoID
 	return pb, nil

models/git/protected_branch_merge.go

@@ -0,0 +1,178 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import "strings"
+
+// mergeMostRestrictive combines a repo-level and an org-level protected-branch rule
+// that both match the same branch into a single effective rule, always applying the
+// STRICTER constraint from each side (fail-closed). This makes an org-level rule a
+// mandatory floor that a repo rule can only tighten, never weaken. See issue #727.
+//
+// Combination directions:
+//   - "Can*" / allow booleans   -> AND  (an action is allowed only if both allow it)
+//   - "Enable*/Block*/Require*"  -> OR   (a gate is on if either side turns it on)
+//   - RequiredApprovals          -> max
+//   - required-set lists         -> union        (status contexts, protected files)
+//   - allow-set lists            -> intersection (whitelists, unprotected files)
+//
+// Identity (ID, RepoID, RuleName, Priority) is taken from the repo rule so that
+// downstream permission checks (which LoadRepo via RepoID) keep working.
+func mergeMostRestrictive(repoRule, orgRule *ProtectedBranch) *ProtectedBranch {
+	eff := *repoRule
+
+	// Direct push.
+	eff.CanPush = repoRule.CanPush && orgRule.CanPush
+	eff.EnableWhitelist, eff.WhitelistUserIDs = mergeAllowlist(repoRule.EnableWhitelist, repoRule.WhitelistUserIDs, orgRule.EnableWhitelist, orgRule.WhitelistUserIDs)
+	_, eff.WhitelistTeamIDs = mergeAllowlist(repoRule.EnableWhitelist, repoRule.WhitelistTeamIDs, orgRule.EnableWhitelist, orgRule.WhitelistTeamIDs)
+	eff.WhitelistDeployKeys = repoRule.WhitelistDeployKeys && orgRule.WhitelistDeployKeys
+	eff.WhitelistActionsUser = repoRule.WhitelistActionsUser && orgRule.WhitelistActionsUser
+
+	// Force push.
+	eff.CanForcePush = repoRule.CanForcePush && orgRule.CanForcePush
+	eff.EnableForcePushAllowlist, eff.ForcePushAllowlistUserIDs = mergeAllowlist(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistUserIDs, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistUserIDs)
+	_, eff.ForcePushAllowlistTeamIDs = mergeAllowlist(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistTeamIDs, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistTeamIDs)
+	eff.ForcePushAllowlistDeployKeys = repoRule.ForcePushAllowlistDeployKeys && orgRule.ForcePushAllowlistDeployKeys
+	eff.ForcePushAllowlistActionsUser = repoRule.ForcePushAllowlistActionsUser && orgRule.ForcePushAllowlistActionsUser
+
+	// Delete.
+	eff.CanDelete = repoRule.CanDelete && orgRule.CanDelete
+	eff.EnableDeleteAllowlist, eff.DeleteAllowlistUserIDs = mergeAllowlist(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistUserIDs, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistUserIDs)
+	_, eff.DeleteAllowlistTeamIDs = mergeAllowlist(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistTeamIDs, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistTeamIDs)
+	eff.DeleteAllowlistDeployKeys = repoRule.DeleteAllowlistDeployKeys && orgRule.DeleteAllowlistDeployKeys
+	eff.DeleteAllowlistActionsUser = repoRule.DeleteAllowlistActionsUser && orgRule.DeleteAllowlistActionsUser
+
+	// Merge whitelist.
+	eff.EnableMergeWhitelist, eff.MergeWhitelistUserIDs = mergeAllowlist(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistUserIDs, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistUserIDs)
+	_, eff.MergeWhitelistTeamIDs = mergeAllowlist(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistTeamIDs, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistTeamIDs)
+	eff.MergeWhitelistActionsUser = repoRule.MergeWhitelistActionsUser && orgRule.MergeWhitelistActionsUser
+
+	// Status checks.
+	eff.EnableStatusCheck = repoRule.EnableStatusCheck || orgRule.EnableStatusCheck
+	eff.StatusCheckContexts = unionStrings(repoRule.StatusCheckContexts, orgRule.StatusCheckContexts)
+
+	// Approvals and reviews.
+	eff.RequiredApprovals = maxInt64(repoRule.RequiredApprovals, orgRule.RequiredApprovals)
+	eff.EnableApprovalsWhitelist, eff.ApprovalsWhitelistUserIDs = mergeAllowlist(repoRule.EnableApprovalsWhitelist, repoRule.ApprovalsWhitelistUserIDs, orgRule.EnableApprovalsWhitelist, orgRule.ApprovalsWhitelistUserIDs)
+	_, eff.ApprovalsWhitelistTeamIDs = mergeAllowlist(repoRule.EnableApprovalsWhitelist, repoRule.ApprovalsWhitelistTeamIDs, orgRule.EnableApprovalsWhitelist, orgRule.ApprovalsWhitelistTeamIDs)
+	eff.BlockOnRejectedReviews = repoRule.BlockOnRejectedReviews || orgRule.BlockOnRejectedReviews
+	eff.BlockOnOfficialReviewRequests = repoRule.BlockOnOfficialReviewRequests || orgRule.BlockOnOfficialReviewRequests
+	eff.BlockOnOutdatedBranch = repoRule.BlockOnOutdatedBranch || orgRule.BlockOnOutdatedBranch
+	eff.DismissStaleApprovals = repoRule.DismissStaleApprovals || orgRule.DismissStaleApprovals
+	eff.IgnoreStaleApprovals = repoRule.IgnoreStaleApprovals || orgRule.IgnoreStaleApprovals
+
+	// Commits, files, admin override.
+	eff.RequireSignedCommits = repoRule.RequireSignedCommits || orgRule.RequireSignedCommits
+	eff.ProtectedFilePatterns = unionPatterns(repoRule.ProtectedFilePatterns, orgRule.ProtectedFilePatterns)
+	eff.UnprotectedFilePatterns = intersectPatterns(repoRule.UnprotectedFilePatterns, orgRule.UnprotectedFilePatterns)
+	eff.BlockAdminMergeOverride = repoRule.BlockAdminMergeOverride || orgRule.BlockAdminMergeOverride
+
+	return &eff
+}
+
+// mergeAllowlist combines two allow-lists under most-restrictive semantics. An
+// allow-list only narrows access when its Enable flag is set; a disabled list means
+// "everyone", so it imposes no constraint. Therefore: if both are enabled the result
+// is the intersection (a principal must be allowed by both); if only one is enabled
+// its list is used as-is; if neither is enabled the list is irrelevant.
+func mergeAllowlist(aEnabled bool, aIDs []int64, bEnabled bool, bIDs []int64) (bool, []int64) {
+	switch {
+	case aEnabled && bEnabled:
+		return true, intersectInt64(aIDs, bIDs)
+	case aEnabled:
+		return true, aIDs
+	case bEnabled:
+		return true, bIDs
+	default:
+		return false, nil
+	}
+}
+
+func intersectInt64(a, b []int64) []int64 {
+	if len(a) == 0 || len(b) == 0 {
+		return nil
+	}
+	set := make(map[int64]struct{}, len(a))
+	for _, x := range a {
+		set[x] = struct{}{}
+	}
+	var out []int64
+	for _, x := range b {
+		if _, ok := set[x]; ok {
+			out = append(out, x)
+		}
+	}
+	return out
+}
+
+func unionStrings(a, b []string) []string {
+	if len(a) == 0 {
+		return b
+	}
+	if len(b) == 0 {
+		return a
+	}
+	seen := make(map[string]struct{}, len(a)+len(b))
+	out := make([]string, 0, len(a)+len(b))
+	for _, s := range a {
+		if _, ok := seen[s]; !ok {
+			seen[s] = struct{}{}
+			out = append(out, s)
+		}
+	}
+	for _, s := range b {
+		if _, ok := seen[s]; !ok {
+			seen[s] = struct{}{}
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// unionPatterns unions two ';'-separated file-pattern lists (more patterns protected
+// = more restrictive).
+func unionPatterns(a, b string) string {
+	return strings.Join(unionStrings(splitPatterns(a), splitPatterns(b)), ";")
+}
+
+// intersectPatterns intersects two ';'-separated file-pattern lists. Unprotected
+// patterns are carve-outs that REDUCE protection, so the restrictive combination
+// keeps only the exemptions present in both.
+func intersectPatterns(a, b string) string {
+	as, bs := splitPatterns(a), splitPatterns(b)
+	set := make(map[string]struct{}, len(as))
+	for _, s := range as {
+		set[s] = struct{}{}
+	}
+	seen := make(map[string]struct{}, len(bs))
+	var out []string
+	for _, s := range bs {
+		if _, ok := set[s]; !ok {
+			continue
+		}
+		if _, dup := seen[s]; dup {
+			continue
+		}
+		seen[s] = struct{}{}
+		out = append(out, s)
+	}
+	return strings.Join(out, ";")
+}
+
+func splitPatterns(s string) []string {
+	var out []string
+	for _, p := range strings.Split(s, ";") {
+		if p = strings.TrimSpace(p); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func maxInt64(a, b int64) int64 {
+	if a > b {
+		return a
+	}
+	return b
+}

models/issues/pull.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
@@ -860,6 +861,11 @@ func GetCodeOwnersFromContent(ctx context.Context, data string) ([]*CodeOwnerRul
 	return rules, warnings
 }
 
+// codeOwnerMatchTimeout bounds a single pattern match so a crafted pattern
+// cannot stall via catastrophic backtracking. See also the aggregate budget
+// enforced by the caller across the whole rules×files match loop.
+const codeOwnerMatchTimeout = 150 * time.Millisecond
+
 type CodeOwnerRule struct {
 	Rule     *regexp2.Regexp // it supports negative lookahead, does better for end users
 	Negative bool
@@ -888,6 +894,8 @@ func ParseCodeOwnersLine(ctx context.Context, tokens []string) (*CodeOwnerRule,
 		warnings = append(warnings, fmt.Sprintf("incorrect codeowner regexp: %s", err))
 		return nil, warnings
 	}
+	// Bound matching time so user-supplied patterns cannot stall PR creation via catastrophic backtracking.
+	rule.Rule.MatchTimeout = codeOwnerMatchTimeout
 
 	for _, user := range tokens[1:] {
 		user = strings.TrimPrefix(user, "@")

models/issues/pull_test.go

@@ -4,7 +4,9 @@
 package issues_test
 
 import (
+	"strings"
 	"testing"
+	"time"
 
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
@@ -39,6 +41,7 @@ func TestPullRequest(t *testing.T) {
 	t.Run("DeleteOrphanedObjects", testDeleteOrphanedObjects)
 	t.Run("ParseCodeOwnersLine", testParseCodeOwnersLine)
 	t.Run("CodeOwnerAbsolutePathPatterns", testCodeOwnerAbsolutePathPatterns)
+	t.Run("CodeOwnerPatternMatchTimeout", testCodeOwnerPatternMatchTimeout)
 	t.Run("GetApprovers", testGetApprovers)
 	t.Run("GetPullRequestByMergedCommit", testGetPullRequestByMergedCommit)
 	t.Run("Migrate_InsertPullRequests", testMigrateInsertPullRequests)
@@ -370,6 +373,22 @@ func testCodeOwnerAbsolutePathPatterns(t *testing.T) {
 	}
 }
 
+// testCodeOwnerPatternMatchTimeout ensures user-supplied CODEOWNERS patterns
+// cannot stall pull request processing through catastrophic regex backtracking:
+// each compiled rule must enforce a bounded match time.
+func testCodeOwnerPatternMatchTimeout(t *testing.T) {
+	rules, _ := issues_model.GetCodeOwnersFromContent(t.Context(), "(a+)+ @user5\n")
+	require.Len(t, rules, 1)
+
+	maliciousInput := strings.Repeat("a", 30) + "X"
+	start := time.Now()
+	_, err := rules[0].Rule.MatchString(maliciousInput)
+	elapsed := time.Since(start)
+
+	require.Error(t, err, "expected MatchTimeout error on pathological input")
+	assert.Less(t, elapsed, time.Second, "match timeout did not bound regex evaluation; took %s", elapsed)
+}
+
 func testGetApprovers(t *testing.T) {
 	pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 5})
 	// Official reviews are already deduplicated. Allow unofficial reviews

models/migrations/migrations.go

@@ -439,6 +439,11 @@ func prepareMigrationTasks() []*migration {
 		newMigration(359, "Add deploy fields to repo manifest", v1_27.AddDeployFieldsToRepoManifest),
 		newMigration(360, "Add delete allowlist to protected branch", v1_27.AddDeleteAllowlistToProtectedBranch),
 		newMigration(361, "Add cascade merge rule table", v1_27.AddCascadeMergeRuleTable),
+		newMigration(362, "Add delete allowlist to org protected branch", v1_27.AddDeleteAllowlistToOrgProtectedBranch),
+		newMigration(363, "Add org protected tag table", v1_27.AddOrgProtectedTagTable),
+		newMigration(364, "Add org push policy table", v1_27.AddOrgPushPolicyTable),
+		newMigration(365, "Add org repo defaults table", v1_27.AddOrgRepoDefaultsTable),
+		newMigration(366, "Add org email domain policy table", v1_27.AddOrgEmailDomainPolicyTable),
 	}
 	return preparedMigrations
 }

models/migrations/v1_27/v363.go

@@ -0,0 +1,18 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import "xorm.io/xorm"
+
+// AddDeleteAllowlistToOrgProtectedBranch adds branch-deletion protection columns to
+// org-level branch protection rules, mirroring the per-repo delete allowlist so an
+// org rule can also protect branches from deletion. See issue #727.
+func AddDeleteAllowlistToOrgProtectedBranch(x *xorm.Engine) error {
+	type OrgProtectedBranch struct {
+		CanDelete              bool    `xorm:"NOT NULL DEFAULT false"`
+		EnableDeleteAllowlist  bool    `xorm:"NOT NULL DEFAULT false"`
+		DeleteAllowlistTeamIDs []int64 `xorm:"JSON TEXT"`
+	}
+	return x.Sync(new(OrgProtectedBranch))
+}

models/migrations/v1_27/v364.go

@@ -0,0 +1,25 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgProtectedTagTable creates the org-level tag protection table. Org tag rules
+// cascade to all repositories in the organization and layer on top of each repo's
+// own protected tags. See issue #727.
+func AddOrgProtectedTagTable(x *xorm.Engine) error {
+	type OrgProtectedTag struct {
+		ID               int64              `xorm:"pk autoincr"`
+		OrgID            int64              `xorm:"UNIQUE(s) index"`
+		NamePattern      string             `xorm:"UNIQUE(s)"`
+		AllowlistTeamIDs []int64            `xorm:"JSON TEXT"`
+		CreatedUnix      timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix      timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgProtectedTag))
+}

models/migrations/v1_27/v365.go

@@ -0,0 +1,27 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgPushPolicyTable creates the org-level push policy table (one row per org),
+// enforced in the pre-receive hook across all repositories of the org. See #727.
+func AddOrgPushPolicyTable(x *xorm.Engine) error {
+	type OrgPushPolicy struct {
+		ID                  int64              `xorm:"pk autoincr"`
+		OrgID               int64              `xorm:"UNIQUE NOT NULL"`
+		BranchNamePattern   string             `xorm:"TEXT"`
+		TagNamePattern      string             `xorm:"TEXT"`
+		RequireSecretBlock  bool               `xorm:"NOT NULL DEFAULT false"`
+		MaxFileSize         int64              `xorm:"NOT NULL DEFAULT 0"`
+		BlockedFilePatterns string             `xorm:"TEXT"`
+		CreatedUnix         timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix         timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgPushPolicy))
+}

models/migrations/v1_27/v366.go

@@ -0,0 +1,31 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgRepoDefaultsTable creates the org repository-defaults table (one row per
+// org), applied to repositories created in or transferred into the org. See #727.
+func AddOrgRepoDefaultsTable(x *xorm.Engine) error {
+	type OrgRepoDefaults struct {
+		ID                     int64              `xorm:"pk autoincr"`
+		OrgID                  int64              `xorm:"UNIQUE NOT NULL"`
+		ForcePrivate           bool               `xorm:"NOT NULL DEFAULT false"`
+		ApplyPRDefaults        bool               `xorm:"NOT NULL DEFAULT false"`
+		AllowMerge             bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowRebase            bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowRebaseMerge       bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowSquash            bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowFastForwardOnly   bool               `xorm:"NOT NULL DEFAULT true"`
+		DefaultMergeStyle      string             `xorm:"TEXT"`
+		DeleteBranchAfterMerge bool               `xorm:"NOT NULL DEFAULT false"`
+		CreatedUnix            timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix            timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgRepoDefaults))
+}

models/migrations/v1_27/v367.go

@@ -0,0 +1,23 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgEmailDomainPolicyTable creates the org email-domain policy table (one row
+// per org) restricting the email domains of members added to the org. See #727.
+func AddOrgEmailDomainPolicyTable(x *xorm.Engine) error {
+	type OrgEmailDomainPolicy struct {
+		ID             int64              `xorm:"pk autoincr"`
+		OrgID          int64              `xorm:"UNIQUE NOT NULL"`
+		AllowedDomains string             `xorm:"TEXT"`
+		CreatedUnix    timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix    timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgEmailDomainPolicy))
+}

models/unittest/unit_tests.go

@@ -47,7 +47,7 @@ func OrderBy(orderBy string) any {
 }
 
 func whereOrderConditions(e db.Engine, conditions []any) db.Engine {
-	orderBy := "id" // query must have the "ORDER BY", otherwise the result is not deterministic
+	orderBy := "id" // query must have the "ORDER BY", otherwise the result is not deterministic. FIXME: some tables do not have "id" column
 	for _, condition := range conditions {
 		switch cond := condition.(type) {
 		case *testCond:

models/user/external_login_user.go

@@ -80,8 +80,11 @@ func init() {
 }
 
 // GetExternalLogin checks if a externalID in loginSourceID scope already exists
-func GetExternalLogin(ctx context.Context, externalLoginUser *ExternalLoginUser) (bool, error) {
-	return db.GetEngine(ctx).Get(externalLoginUser)
+func GetExternalLogin(ctx context.Context, loginSourceID int64, externalID string) (*ExternalLoginUser, bool, error) {
+	return db.Get[ExternalLoginUser](ctx, builder.Eq{
+		"external_id":     externalID,
+		"login_source_id": loginSourceID,
+	})
 }
 
 // LinkExternalToUser link the external user to the user
@@ -118,6 +121,12 @@ func RemoveAllAccountLinks(ctx context.Context, user *User) error {
 	return err
 }
 
+// RemoveExternalLoginByExternalID removes a specific external login link by its provider-side identifier.
+func RemoveExternalLoginByExternalID(ctx context.Context, loginSourceID int64, externalID string) error {
+	_, err := db.GetEngine(ctx).Where("external_id=? AND login_source_id=?", externalID, loginSourceID).Delete(new(ExternalLoginUser))
+	return err
+}
+
 // GetUserIDByExternalUserID get user id according to provider and userID
 func GetUserIDByExternalUserID(ctx context.Context, provider, userID string) (int64, error) {
 	var id int64

modules/git/commit_info_nogogit.go

@@ -106,7 +106,7 @@ func getLastCommitForPathsByCache(commitID, treePath string, paths []string, cac
 // GetLastCommitForPaths returns last commit information
 func GetLastCommitForPaths(ctx context.Context, commit *Commit, treePath string, paths []string) (map[string]*Commit, error) {
 	// We read backwards from the commit to obtain all of the commits
-	revs, err := WalkGitLog(ctx, commit.repo, commit, treePath, paths...)
+	revs, err := walkGitLog(ctx, commit.repo, commit, treePath, paths...)
 	if err != nil {
 		return nil, err
 	}

modules/git/commit_info_nogogit_test.go

@@ -0,0 +1,54 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build !gogit
+
+package git
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/test"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/util"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEntries_GetCommitsInfo_ContextErr(t *testing.T) {
+	repo, err := OpenRepository(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
+	require.NoError(t, err)
+	defer repo.Close()
+
+	commit, err := repo.GetCommit("feaf4ba6bc635fec442f46ddd4512416ec43c2c2")
+	require.NoError(t, err)
+	entries, err := commit.Tree.ListEntries()
+	require.NoError(t, err)
+
+	countCommitInfosCommit := func(infos []CommitInfo) (nilCommits, nonNilCommits int) {
+		for _, info := range infos {
+			nilCommits += util.Iif(info.Commit == nil, 1, 0)
+			nonNilCommits += util.Iif(info.Commit != nil, 1, 0)
+		}
+		return nilCommits, nonNilCommits
+	}
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer test.MockVariableValue(&walkGitLogDebugBeforeNext)()
+
+	walkGitLogDebugBeforeNext = cancel
+	commitInfos, _, err := entries.GetCommitsInfo(ctx, "/any/repo-link", commit, "")
+	assert.NoError(t, err)
+	nilCommits, nonNilCommits := countCommitInfosCommit(commitInfos)
+	assert.Equal(t, 0, nonNilCommits) // no commit info due to canceled (or deadline-exceeded) context
+	assert.Equal(t, 3, nilCommits)
+
+	walkGitLogDebugBeforeNext = nil
+	commitInfos, _, err = entries.GetCommitsInfo(t.Context(), "/any/repo-link", commit, "")
+	assert.NoError(t, err)
+	nilCommits, nonNilCommits = countCommitInfosCommit(commitInfos)
+	assert.Equal(t, 3, nonNilCommits)
+	assert.Equal(t, 0, nilCommits)
+}

modules/git/last_commit_cache_nogogit.go

@@ -32,7 +32,7 @@ func (c *Commit) recursiveCache(ctx context.Context, tree *Tree, treePath string
 		entryPaths[i] = entry.Name()
 	}
 
-	_, err = WalkGitLog(ctx, c.repo, c, treePath, entryPaths...)
+	_, err = walkGitLog(ctx, c.repo, c, treePath, entryPaths...)
 	if err != nil {
 		return err
 	}

modules/git/log_name_status_nogogit.go

@@ -1,6 +1,8 @@
 // Copyright 2021 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build !gogit
+
 package git
 
 import (
@@ -18,10 +20,8 @@ import (
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
 )
 
-// LogNameStatusRepo opens git log --raw in the provided repo and returns a stdin pipe, a stdout reader and cancel function
-func LogNameStatusRepo(ctx context.Context, repository, head, treepath string, paths ...string) (*bufio.Reader, func()) {
-	// Lets also create a context so that we can absolutely ensure that the command should die when we're done
-
+// logNameStatusRepo opens git log --raw in the provided repo and returns a parser
+func logNameStatusRepo(ctx context.Context, repository, head, treepath string, paths ...string) *logNameStatusRepoParser {
 	cmd := gitcmd.NewCommand()
 	cmd.AddArguments("log", "--name-status", "-c", "--format=commit%x00%H %P%x00", "--parents", "--no-renames", "-t", "-z").AddDynamicArguments(head)
 
@@ -54,77 +54,62 @@ func LogNameStatusRepo(ctx context.Context, repository, head, treepath string, p
 	ctx, ctxCancel := context.WithCancel(ctx)
 	go func() {
 		err := cmd.WithDir(repository).RunWithStderr(ctx)
-		if err != nil && !errors.Is(err, context.Canceled) {
+		if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, context.DeadlineExceeded) {
 			log.Error("Unable to run git command %v: %v", cmd.LogString(), err)
 		}
 	}()
 
 	bufReader := bufio.NewReaderSize(stdoutReader, 32*1024)
-
-	return bufReader, func() {
-		ctxCancel()
-		stdoutReaderClose()
+	return &logNameStatusRepoParser{
+		treepath: treepath,
+		paths:    paths,
+		rd:       bufReader,
+		close: func() {
+			ctxCancel()
+			stdoutReaderClose()
+		},
 	}
 }
 
-// LogNameStatusRepoParser parses a git log raw output from LogRawRepo
-type LogNameStatusRepoParser struct {
+// logNameStatusRepoParser parses a git log raw output from LogRawRepo
+type logNameStatusRepoParser struct {
 	treepath string
 	paths    []string
 	next     []byte
 	buffull  bool
 	rd       *bufio.Reader
-	cancel   func()
+	close    func()
 }
 
-// NewLogNameStatusRepoParser returns a new parser for a git log raw output
-func NewLogNameStatusRepoParser(ctx context.Context, repository, head, treepath string, paths ...string) *LogNameStatusRepoParser {
-	rd, cancel := LogNameStatusRepo(ctx, repository, head, treepath, paths...)
-	return &LogNameStatusRepoParser{
-		treepath: treepath,
-		paths:    paths,
-		rd:       rd,
-		cancel:   cancel,
-	}
-}
-
-// LogNameStatusCommitData represents a commit artefact from git log raw
-type LogNameStatusCommitData struct {
+// logNameStatusCommitData represents a commit artifact from git log raw
+type logNameStatusCommitData struct {
 	CommitID  string
 	ParentIDs []string
 	Paths     []bool
 }
 
-// Next returns the next LogStatusCommitData
-func (g *LogNameStatusRepoParser) Next(treepath string, paths2ids map[string]int, changed []bool, maxpathlen int) (*LogNameStatusCommitData, error) {
+// walkNext returns the next LogStatusCommitData
+func (g *logNameStatusRepoParser) walkNext(treepath string, paths2ids map[string]int, changed []bool, maxpathlen int) (*logNameStatusCommitData, error) {
 	var err error
 	if len(g.next) == 0 {
 		g.buffull = false
 		g.next, err = g.rd.ReadSlice('\x00')
-		if err != nil {
-			switch err {
-			case bufio.ErrBufferFull:
-				g.buffull = true
-			case io.EOF:
-				return nil, nil //nolint:nilnil // return nil to signal EOF
-			default:
-				return nil, err
-			}
+		switch {
+		case errors.Is(err, bufio.ErrBufferFull):
+			g.buffull = true
+		case err != nil:
+			return nil, err
 		}
 	}
 
-	ret := LogNameStatusCommitData{}
+	ret := logNameStatusCommitData{}
 	if bytes.Equal(g.next, []byte("commit\000")) {
 		g.next, err = g.rd.ReadSlice('\x00')
-		if err != nil {
-			switch err {
-			case bufio.ErrBufferFull:
-				g.buffull = true
-			case io.EOF:
-				return nil, nil //nolint:nilnil // return nil to signal EOF
-			default:
-				return nil, err
-			}
+		switch {
+		case errors.Is(err, bufio.ErrBufferFull):
+			g.buffull = true
+		case err != nil:
+			return nil, err
 		}
 	}
 
@@ -273,13 +258,10 @@ diffloop:
 	}
 }
 
-// Close closes the parser
-func (g *LogNameStatusRepoParser) Close() {
-	g.cancel()
-}
+var walkGitLogDebugBeforeNext func() // is used to simulate various edge git process cases
 
-// WalkGitLog walks the git log --name-status for the head commit in the provided treepath and files
-func WalkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath string, paths ...string) (map[string]string, error) {
+// walkGitLog walks the git log --name-status for the head commit in the provided treepath and files
+func walkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath string, paths ...string) (map[string]string, error) {
 	headRef := head.ID.String()
 
 	tree, err := head.SubTree(treepath)
@@ -322,11 +304,9 @@ func WalkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath st
 		}
 	}
 
-	g := NewLogNameStatusRepoParser(ctx, repo.Path, head.ID.String(), treepath, paths...)
-	// don't use defer g.Close() here as g may change its value - instead wrap in a func
-	defer func() {
-		g.Close()
-	}()
+	g := logNameStatusRepo(ctx, repo.Path, head.ID.String(), treepath, paths...)
+	// don't use defer g.cancel() here as g may change its value - instead wrap in a func
+	defer func() { g.close() }()
 
 	results := make([]string, len(paths))
 	remaining := len(paths)
@@ -340,25 +320,16 @@ func WalkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath st
 
 heaploop:
 	for {
-		select {
-		case <-ctx.Done():
-			if ctx.Err() == context.DeadlineExceeded {
-				break heaploop
-			}
-			g.Close()
-			return nil, ctx.Err()
-		default:
+		if walkGitLogDebugBeforeNext != nil {
+			walkGitLogDebugBeforeNext()
 		}
-		current, err := g.Next(treepath, path2idx, changed, maxpathlen)
-		if err != nil {
-			if errors.Is(err, context.DeadlineExceeded) {
-				break heaploop
-			}
-			g.Close()
-			return nil, err
-		}
-		if current == nil {
-			break heaploop
+		current, err := g.walkNext(treepath, path2idx, changed, maxpathlen)
+		if ctx.Err() != nil {
+			break heaploop // context is either canceled or deadline exceeded - break the loop and return what we have so far
+		} else if errors.Is(err, io.EOF) {
+			break heaploop // reached to the end of log output
+		} else if err != nil {
+			return nil, err // other unknown errors
 		}
 		parentRemaining.Remove(current.CommitID)
 		for i, found := range current.Paths {
@@ -395,14 +366,14 @@ heaploop:
 		if remaining <= nextRestart {
 			commitSinceNextRestart++
 			if 4*commitSinceNextRestart > 3*commitSinceLastEmptyParent {
-				g.Close()
 				remainingPaths := make([]string, 0, len(paths))
 				for i, pth := range paths {
 					if results[i] == "" {
 						remainingPaths = append(remainingPaths, pth)
 					}
 				}
-				g = NewLogNameStatusRepoParser(ctx, repo.Path, lastEmptyParent, treepath, remainingPaths...)
+				g.close()
+				g = logNameStatusRepo(ctx, repo.Path, lastEmptyParent, treepath, remainingPaths...)
 				parentRemaining = make(container.Set[string])
 				nextRestart = (remaining * 3) / 4
 				continue heaploop
@@ -410,7 +381,6 @@ heaploop:
 		}
 		parentRemaining.AddMultiple(current.ParentIDs...)
 	}
-	g.Close()
 
 	resultsMap := map[string]string{}
 	for i, pth := range paths {

modules/git/repo.go

@@ -121,6 +121,9 @@ func Clone(ctx context.Context, from, to string, opts CloneRepoOptions) error {
 	}
 
 	cmd := gitcmd.NewCommand().AddArguments("clone")
+	// Never follow HTTP redirects: no clone caller needs them, and a remote redirecting to an
+	// otherwise-blocked address would be an SSRF vector (e.g. migrating from an attacker URL).
+	cmd.AddArguments("-c", "http.followRedirects=false")
 	if opts.SkipTLSVerify {
 		cmd.AddArguments("-c", "http.sslVerify=false")
 	}

modules/git/repo_test.go

@@ -4,7 +4,10 @@
 package git
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
+	"sync/atomic"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -19,3 +22,23 @@ func TestRepoIsEmpty(t *testing.T) {
 	assert.NoError(t, err)
 	assert.True(t, isEmpty)
 }
+
+// TestCloneRefusesRedirects ensures Clone never follows HTTP redirects, so a remote
+// cannot redirect to an otherwise-blocked address (SSRF, e.g. during migration).
+func TestCloneRefusesRedirects(t *testing.T) {
+	var targetHit atomic.Bool
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		targetHit.Store(true)
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer target.Close()
+
+	redirect := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, target.URL+r.URL.Path, http.StatusFound)
+	}))
+	defer redirect.Close()
+
+	err := Clone(t.Context(), redirect.URL, filepath.Join(t.TempDir(), "dst"), CloneRepoOptions{})
+	assert.Error(t, err)
+	assert.False(t, targetHit.Load(), "git must not follow the redirect to the target")
+}

modules/hostmatcher/hostmatcher.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"sync"
 )
 
 // HostMatchList is used to check if a host or IP is in a list.
@@ -23,10 +24,61 @@ type HostMatchList struct {
 	ipNets []*net.IPNet
 }
 
-// MatchBuiltinExternal A valid non-private unicast IP, all hosts on public internet are matched
+// MatchBuiltinExternal A valid global-unicast IP that is neither private (see MatchBuiltinPrivate)
+// nor a reserved special-purpose range (see reservedIPNets); i.e. a routable host on the public internet.
 const MatchBuiltinExternal = "external"
 
-// MatchBuiltinPrivate RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7). Also called LAN/Intranet.
+// reservedIPNets are special-purpose ranges that net.IP.IsPrivate omits but that must not be
+// treated as public/external destinations (CGNAT, cloud metadata, IPv6 transition, etc.). We layer
+// these on top of net.IP.IsPrivate (RFC 1918 / RFC 4193) so future additions to Go's IsPrivate are
+// picked up automatically, while still covering the ranges it leaves out; otherwise the default
+// allow-list would let authenticated users reach cloud metadata, internal, and IPv6 transition
+// endpoints (SSRF), and a "private" block-list would fail to catch them.
+var reservedIPNets = sync.OnceValue(func() []*net.IPNet {
+	var nets []*net.IPNet
+	for _, cidr := range []string{
+		// IPv4
+		"100.64.0.0/10",    // RFC 6598 Carrier-Grade NAT
+		"168.63.129.16/32", // Azure WireServer metadata endpoint
+		"192.0.0.0/24",     // RFC 6890 IETF protocol assignments
+		"192.0.2.0/24",     // RFC 5737 TEST-NET-1
+		"192.88.99.0/24",   // RFC 7526 6to4 relay anycast (deprecated)
+		"198.18.0.0/15",    // RFC 2544 benchmarking
+		"198.51.100.0/24",  // RFC 5737 TEST-NET-2
+		"203.0.113.0/24",   // RFC 5737 TEST-NET-3
+		// IPv6
+		"100::/64",       // RFC 6666 discard-only
+		"64:ff9b::/96",   // RFC 6052 NAT64 (can embed IPv4 such as 169.254.169.254)
+		"64:ff9b:1::/48", // RFC 8215 local-use NAT64
+		"2001::/32",      // RFC 4380 Teredo tunneling (embeds IPv4)
+		"2001:10::/28",   // RFC 4843 ORCHID (deprecated)
+		"2001:20::/28",   // RFC 7343 ORCHIDv2
+		"2001:db8::/32",  // RFC 3849 documentation
+		"2002::/16",      // RFC 3056 6to4 (embeds IPv4)
+	} {
+		_, ipNet, err := net.ParseCIDR(cidr)
+		if err != nil {
+			panic("hostmatcher: invalid reserved CIDR " + cidr + ": " + err.Error())
+		}
+		nets = append(nets, ipNet)
+	}
+	return nets
+})
+
+// isReservedIP reports whether ip falls in reserved special-purpose
+// range (see reservedIPNets) that must not be considered a public/external destination.
+func isReservedIP(ip net.IP) bool {
+	for _, ipNet := range reservedIPNets() {
+		if ipNet.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// MatchBuiltinPrivate RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7),
+// plus the reserved special-purpose ranges in reservedIPNets (CGNAT, NAT64, cloud metadata, etc.).
+// Also called LAN/Intranet.
 const MatchBuiltinPrivate = "private"
 
 // MatchBuiltinLoopback 127.0.0.0/8 for IPv4 and ::1/128 for IPv6, localhost is included.
@@ -93,18 +145,22 @@ func (hl *HostMatchList) checkPattern(host string) bool {
 	return false
 }
 
-func (hl *HostMatchList) checkIP(ip net.IP) bool {
+// matchesIP determines if the given IP matches any of the configured rules
+func (hl *HostMatchList) matchesIP(ip net.IP) bool {
 	if slices.Contains(hl.patterns, "*") {
 		return true
 	}
 	for _, builtin := range hl.builtins {
 		switch builtin {
 		case MatchBuiltinExternal:
-			if ip.IsGlobalUnicast() && !ip.IsPrivate() {
+			// External address must be a global unicast, must not be in reserved range and must not be in private range
+			if ip.IsGlobalUnicast() && !isReservedIP(ip) && !ip.IsPrivate() {
 				return true
 			}
 		case MatchBuiltinPrivate:
-			if ip.IsPrivate() {
+			// Private address must be global unicast, must not be in range we explicitly exclude for security reasons
+			// and must be in private range
+			if ip.IsGlobalUnicast() && !isReservedIP(ip) && ip.IsPrivate() {
 				return true
 			}
 		case MatchBuiltinLoopback:
@@ -135,7 +191,7 @@ func (hl *HostMatchList) MatchHostName(host string) bool {
 		return true
 	}
 	if ip := net.ParseIP(hostname); ip != nil {
-		return hl.checkIP(ip)
+		return hl.matchesIP(ip)
 	}
 	return false
 }
@@ -146,7 +202,7 @@ func (hl *HostMatchList) MatchIPAddr(ip net.IP) bool {
 		return false
 	}
 	host := ip.String() // nil-safe, we will get "<nil>" if ip is nil
-	return hl.checkPattern(host) || hl.checkIP(ip)
+	return hl.checkPattern(host) || hl.matchesIP(ip)
 }
 
 // MatchHostOrIP checks if the host or IP matches an allow/deny(block) list

modules/hostmatcher/hostmatcher_test.go

@@ -159,3 +159,60 @@ func TestHostOrIPMatchesList(t *testing.T) {
 	}
 	test(cases)
 }
+
+// TestReservedRanges ensures special-purpose ranges that net.IP.IsPrivate misses are kept out of the
+// "external" allow-list (the default for webhook delivery and repository migrations) and folded into
+// the "private" block-list, so they cannot be used for SSRF to metadata/internal endpoints.
+func TestReservedRanges(t *testing.T) {
+	external := ParseHostMatchList("", "external")
+	private := ParseHostMatchList("", "private")
+
+	// legitimate public destinations: external, not private
+	for _, ip := range []string{"8.8.8.8", "1.1.1.1", "2001:4860:4860::8888", "1000::1"} {
+		addr := net.ParseIP(ip)
+		assert.Truef(t, external.MatchIPAddr(addr), "public ip %s should be external", ip)
+		assert.Falsef(t, private.MatchIPAddr(addr), "public ip %s should not be private", ip)
+	}
+
+	// RFC 1918 / RFC 4193 private ranges (now folded into privateIPNets instead of net.IP.IsPrivate):
+	// not external, blockable as private. Includes range edges to guard the CIDR boundaries.
+	for _, ip := range []string{
+		"10.0.0.0", "10.255.255.255", // 10.0.0.0/8
+		"172.16.0.0", "172.31.255.255", // 172.16.0.0/12
+		"192.168.0.0", "192.168.255.255", // 192.168.0.0/16
+		"fc00::", "fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", // fc00::/7
+	} {
+		addr := net.ParseIP(ip)
+		assert.Falsef(t, external.MatchIPAddr(addr), "private ip %s must not be external", ip)
+		assert.Truef(t, private.MatchIPAddr(addr), "private ip %s should match private block-list", ip)
+	}
+
+	// 172.32.0.0 is just outside 172.16.0.0/12: a public destination, not private
+	if addr := net.ParseIP("172.32.0.0"); assert.NotNil(t, addr) {
+		assert.True(t, external.MatchIPAddr(addr), "172.32.0.0 should be external")
+		assert.False(t, private.MatchIPAddr(addr), "172.32.0.0 should not be private")
+	}
+
+	// reserved ranges that IsPrivate does not cover: not external, but blockable as private
+	for _, ip := range []string{
+		"100.64.0.1",         // CGNAT
+		"100.127.255.254",    // CGNAT
+		"168.63.129.16",      // Azure WireServer
+		"192.0.2.1",          // TEST-NET-1
+		"198.18.0.1",         // benchmarking
+		"198.51.100.1",       // TEST-NET-2
+		"203.0.113.1",        // TEST-NET-3
+		"169.254.169.254",    // Cloud metadata
+		"192.88.99.1",        // 6to4 relay anycast
+		"64:ff9b::1",         // NAT64
+		"64:ff9b::a9fe:a9fe", // NAT64 embedding 169.254.169.254
+		"2001::1",            // Teredo
+		"2002::1",            // 6to4
+		"2001:db8::1",        // documentation
+		"fe80::1",            // link local address
+	} {
+		addr := net.ParseIP(ip)
+		assert.Falsef(t, external.MatchIPAddr(addr), "reserved ip %s must not be external", ip)
+		assert.Falsef(t, private.MatchIPAddr(addr), "reserved ip %s should match private block-list", ip)
+	}
+}

modules/packages/debian/metadata.go

@@ -146,15 +146,26 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 	var depends strings.Builder
 	var control strings.Builder
 
-	s := bufio.NewScanner(io.TeeReader(r, &control))
+	// https://www.debian.org/doc/debian-policy/ch-controlfields.html#syntax-of-control-files
+	s := bufio.NewScanner(r)
 	for s.Scan() {
 		line := s.Text()
 
 		trimmed := strings.TrimSpace(line)
 		if trimmed == "" {
-			continue
+			// A binary package control file holds exactly one stanza. Stop at the
+			// blank line that terminates it, otherwise a crafted control file could
+			// smuggle additional stanzas (with attacker-chosen Filename/Package
+			// fields) into the generated repository "Packages" index.
+			if control.Len() == 0 {
+				continue
+			}
+			break
 		}
 
+		control.WriteString(line)
+		control.WriteByte('\n')
+
 		if line[0] == ' ' || line[0] == '\t' {
 			switch key {
 			case "Description":

modules/packages/debian/metadata_test.go

@@ -184,4 +184,19 @@ func TestParseControlFile(t *testing.T) {
 			assert.NotNil(t, p)
 		}
 	})
+
+	t.Run("SingleStanzaOnly", func(t *testing.T) {
+		// A control file with a trailing stanza must not leak the extra fields into
+		// p.Control, otherwise buildPackagesIndices would emit a second package entry
+		// with an attacker-chosen Filename into the repository "Packages" index.
+		content := bytes.NewBufferString("Package: realpkg\nVersion: 1.0.0\nArchitecture: amd64\nMaintainer: a <a@b.c>\nDescription: real\n\nPackage: openssl\nVersion: 99.0\nArchitecture: amd64\nFilename: pool/main/o/openssl/evil.deb\nDescription: spoofed\n")
+
+		p, err := ParseControlFile(content)
+		assert.NoError(t, err)
+		assert.NotNil(t, p)
+		assert.Equal(t, "realpkg", p.Name)
+		assert.Equal(t, "1.0.0", p.Version)
+		assert.NotContains(t, p.Control, "openssl")
+		assert.NotContains(t, p.Control, "evil.deb")
+	})
 }

modules/structs/org_branch.go

@@ -17,6 +17,9 @@ type OrgBranchProtection struct {
 	EnableForcePush               bool     `json:"enable_force_push"`
 	EnableForcePushAllowlist      bool     `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	EnableDelete                  bool     `json:"enable_delete"`
+	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
+	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
@@ -49,6 +52,9 @@ type CreateOrgBranchProtectionOption struct {
 	EnableForcePush               bool     `json:"enable_force_push"`
 	EnableForcePushAllowlist      bool     `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	EnableDelete                  bool     `json:"enable_delete"`
+	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
+	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
@@ -76,6 +82,9 @@ type EditOrgBranchProtectionOption struct {
 	EnableForcePush               *bool    `json:"enable_force_push"`
 	EnableForcePushAllowlist      *bool    `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	EnableDelete                  *bool    `json:"enable_delete"`
+	EnableDeleteAllowlist         *bool    `json:"enable_delete_allowlist"`
+	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
 	EnableMergeWhitelist          *bool    `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
 	EnableStatusCheck             *bool    `json:"enable_status_check"`

modules/structs/org_email_domain.go

@@ -0,0 +1,15 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+// OrgEmailDomainPolicy represents an organization's email domain policy
+type OrgEmailDomainPolicy struct {
+	OrgID          int64  `json:"org_id"`
+	AllowedDomains string `json:"allowed_domains"`
+}
+
+// EditOrgEmailDomainPolicyOption options for editing an org's email domain policy
+type EditOrgEmailDomainPolicyOption struct {
+	AllowedDomains *string `json:"allowed_domains"`
+}

modules/structs/org_push_policy.go

@@ -0,0 +1,30 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+import "time"
+
+// OrgPushPolicy represents an organization's push policy (one per org)
+type OrgPushPolicy struct {
+	OrgID               int64  `json:"org_id"`
+	BranchNamePattern   string `json:"branch_name_pattern"`
+	TagNamePattern      string `json:"tag_name_pattern"`
+	RequireSecretBlock  bool   `json:"require_secret_block"`
+	MaxFileSize         int64  `json:"max_file_size"`
+	BlockedFilePatterns string `json:"blocked_file_patterns"`
+	// swagger:strfmt date-time
+	Created time.Time `json:"created_at"`
+	// swagger:strfmt date-time
+	Updated time.Time `json:"updated_at"`
+}
+
+// EditOrgPushPolicyOption options for editing an organization's push policy. Only
+// fields that are set will be changed.
+type EditOrgPushPolicyOption struct {
+	BranchNamePattern   *string `json:"branch_name_pattern"`
+	TagNamePattern      *string `json:"tag_name_pattern"`
+	RequireSecretBlock  *bool   `json:"require_secret_block"`
+	MaxFileSize         *int64  `json:"max_file_size"`
+	BlockedFilePatterns *string `json:"blocked_file_patterns"`
+}

modules/structs/org_repo_defaults.go

@@ -0,0 +1,32 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+// OrgRepoDefaults represents an organization's default repository settings
+type OrgRepoDefaults struct {
+	OrgID                  int64  `json:"org_id"`
+	ForcePrivate           bool   `json:"force_private"`
+	ApplyPRDefaults        bool   `json:"apply_pr_defaults"`
+	AllowMerge             bool   `json:"allow_merge"`
+	AllowRebase            bool   `json:"allow_rebase"`
+	AllowRebaseMerge       bool   `json:"allow_rebase_merge"`
+	AllowSquash            bool   `json:"allow_squash"`
+	AllowFastForwardOnly   bool   `json:"allow_fast_forward_only"`
+	DefaultMergeStyle      string `json:"default_merge_style"`
+	DeleteBranchAfterMerge bool   `json:"delete_branch_after_merge"`
+}
+
+// EditOrgRepoDefaultsOption options for editing an org's repo defaults. Only fields
+// that are set will be changed.
+type EditOrgRepoDefaultsOption struct {
+	ForcePrivate           *bool   `json:"force_private"`
+	ApplyPRDefaults        *bool   `json:"apply_pr_defaults"`
+	AllowMerge             *bool   `json:"allow_merge"`
+	AllowRebase            *bool   `json:"allow_rebase"`
+	AllowRebaseMerge       *bool   `json:"allow_rebase_merge"`
+	AllowSquash            *bool   `json:"allow_squash"`
+	AllowFastForwardOnly   *bool   `json:"allow_fast_forward_only"`
+	DefaultMergeStyle      *string `json:"default_merge_style"`
+	DeleteBranchAfterMerge *bool   `json:"delete_branch_after_merge"`
+}

modules/structs/org_tag.go

@@ -0,0 +1,30 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+import "time"
+
+// OrgTagProtection represents an org-level tag protection rule
+type OrgTagProtection struct {
+	ID             int64    `json:"id"`
+	OrgID          int64    `json:"org_id"`
+	NamePattern    string   `json:"name_pattern"`
+	WhitelistTeams []string `json:"whitelist_teams"`
+	// swagger:strfmt date-time
+	Created time.Time `json:"created_at"`
+	// swagger:strfmt date-time
+	Updated time.Time `json:"updated_at"`
+}
+
+// CreateOrgTagProtectionOption options for creating an org-level tag protection
+type CreateOrgTagProtectionOption struct {
+	NamePattern    string   `json:"name_pattern" binding:"Required"`
+	WhitelistTeams []string `json:"whitelist_teams"`
+}
+
+// EditOrgTagProtectionOption options for editing an org-level tag protection
+type EditOrgTagProtectionOption struct {
+	NamePattern    *string  `json:"name_pattern"`
+	WhitelistTeams []string `json:"whitelist_teams"`
+}

options/locale/locale_en-US.json

@@ -2411,6 +2411,56 @@
   "repo.settings.protected_branch": "Branch Protection",
   "repo.settings.protected_branch.save_rule": "Save Rule",
   "repo.settings.protected_branch.delete_rule": "Delete Rule",
+  "repo.settings.org_protected_branch": "Organization Branch Protection",
+  "repo.settings.org_protected_branch_desc": "These rules are defined by the organization and are enforced on top of this repository's own rules — the stricter of the two applies. They cannot be edited here.",
+  "repo.settings.org_protected_branch.inherited": "Organization",
+  "repo.settings.org_protected_branch.read_only": "Read-only",
+  "repo.settings.org_protected_branch.approvals": "Required approvals",
+  "repo.settings.org_protected_branch.signed": "Signed commits",
+  "repo.settings.org_protected_branch.status_check": "Required status checks",
+  "repo.settings.org_protected_branch.direct_push": "Direct push",
+  "repo.settings.org_protected_branch.force_push": "Force push",
+  "repo.settings.org_protected_branch.deletion": "Branch deletion",
+  "repo.settings.org_protected_branch.merge": "Merge restricted to",
+  "repo.settings.org_protected_branch.protected_files": "Protected files",
+  "repo.settings.org_protected_branch.also": "Also enforces",
+  "repo.settings.org_protected_branch.blocked": "Blocked",
+  "repo.settings.org_protected_branch.allowed": "Allowed",
+  "repo.settings.org_protected_branch.restricted": "Restricted to specific teams",
+  "repo.settings.org_protected_branch.write_access": "Anyone with write access",
+  "repo.settings.org_protected_branch.teams": "Teams: %s",
+  "repo.settings.org_protected_branch.any": "Any configured checks",
+  "repo.settings.org_protected_branch.block_outdated": "Block on outdated branch",
+  "repo.settings.org_protected_branch.block_rejected": "Block on rejected reviews",
+  "repo.settings.org_protected_branch.block_admin": "Block admin merge override",
+  "repo.settings.org_protected_tag": "Organization Tag Protection",
+  "repo.settings.org_protected_tag_desc": "These tag protection rules are defined by the organization and are enforced on top of this repository's own rules. They cannot be edited here.",
+  "repo.settings.org_protected_tag.read_only": "Read-only",
+  "repo.settings.org_push_policy": "Organization Push Policy",
+  "repo.settings.org_push_policy_desc": "This push policy is defined by the organization and enforced on every push to this repository. It cannot be edited here.",
+  "repo.settings.org_push_policy.inherited": "Organization",
+  "repo.settings.org_push_policy.read_only": "Read-only",
+  "repo.settings.org_push_policy.branch_pattern": "Allowed branch names",
+  "repo.settings.org_push_policy.tag_pattern": "Allowed tag names",
+  "repo.settings.org_push_policy.require_secret_block": "Block pushes containing secrets",
+  "repo.settings.org_push_policy.max_file_size": "Maximum file size",
+  "repo.settings.org_push_policy.blocked_files": "Blocked file paths",
+  "repo.settings.org_push_policy.enabled": "Enabled",
+  "repo.settings.org_repo_defaults": "Organization Repository Defaults",
+  "repo.settings.org_repo_defaults_desc": "These defaults are defined by the organization and were applied to this repository when it was created or transferred into the organization. They are shown for reference and cannot be edited here.",
+  "repo.settings.org_repo_defaults.inherited": "Organization",
+  "repo.settings.org_repo_defaults.read_only": "Read-only",
+  "repo.settings.org_repo_defaults.force_private": "Force private repositories",
+  "repo.settings.org_repo_defaults.merge_styles": "Allowed merge styles",
+  "repo.settings.org_repo_defaults.default_merge_style": "Default merge style",
+  "repo.settings.org_repo_defaults.delete_branch_after_merge": "Delete branch after merge",
+  "repo.settings.org_repo_defaults.style_merge": "Merge commits",
+  "repo.settings.org_repo_defaults.style_rebase": "Rebase",
+  "repo.settings.org_repo_defaults.style_rebase_merge": "Rebase with merge commit",
+  "repo.settings.org_repo_defaults.style_squash": "Squash",
+  "repo.settings.org_repo_defaults.style_fast_forward_only": "Fast-forward only",
+  "repo.settings.org_repo_defaults.enabled": "Enabled",
+  "repo.settings.org_repo_defaults.disabled": "Disabled",
   "repo.settings.protected_branch_can_push": "Allow push?",
   "repo.settings.protected_branch_can_push_yes": "You can push",
   "repo.settings.protected_branch_can_push_no": "You cannot push",

routers/api/v1/api.go

@@ -508,41 +508,79 @@ func reqOrgOwnership() func(ctx *context.APIContext) {
 	}
 }
 
-// reqTeamMembership user should be an team member, or a site admin
+// reqOrgVisible requires the organization to be visible to the doer, or a site admin
+func reqOrgVisible() func(ctx *context.APIContext) {
+	return func(ctx *context.APIContext) {
+		if ctx.Org.Organization == nil {
+			setting.PanicInDevOrTesting("reqOrgVisible: unprepared context")
+			ctx.APIErrorInternal(errors.New("reqOrgVisible: unprepared context"))
+			return
+		}
+		if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
+			ctx.APIErrorNotFound()
+			return
+		}
+	}
+}
+
+func teamAccessPrivileged(ctx *context.APIContext) (orgID int64, privileged, ok bool) {
+	if ctx.IsUserSiteAdmin() {
+		return 0, true, true
+	}
+	if ctx.Org.Team == nil {
+		setting.PanicInDevOrTesting("teamAccess: unprepared context")
+		ctx.APIErrorInternal(errors.New("teamAccess: unprepared context"))
+		return 0, false, false
+	}
+
+	orgID = ctx.Org.Team.OrgID
+	isOwner, err := organization.IsOrganizationOwner(ctx, orgID, ctx.Doer.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return 0, false, false
+	} else if isOwner {
+		return orgID, true, true
+	}
+
+	isTeamMember, err := organization.IsTeamMember(ctx, orgID, ctx.Org.Team.ID, ctx.Doer.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return 0, false, false
+	}
+	return orgID, isTeamMember, true
+}
+
+func denyNonTeamMember(ctx *context.APIContext, orgID int64) {
+	isOrgMember, err := organization.IsOrganizationMember(ctx, orgID, ctx.Doer.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+	} else if isOrgMember {
+		ctx.APIError(http.StatusForbidden, "Must be a team member")
+	} else {
+		ctx.APIErrorNotFound()
+	}
+}
+
+// reqTeamReadAccess allows callers who can list the team to read its metadata.
+// Not sufficient for mutations — use reqOrgOwnership() or reqTeamMembership() for those.
+func reqTeamReadAccess() func(ctx *context.APIContext) {
+	return func(ctx *context.APIContext) {
+		orgID, privileged, ok := teamAccessPrivileged(ctx)
+		if !ok || privileged {
+			return
+		}
+		denyNonTeamMember(ctx, orgID)
+	}
+}
+
+// reqTeamMembership user should be a team member, or a site admin
 func reqTeamMembership() func(ctx *context.APIContext) {
 	return func(ctx *context.APIContext) {
-		if ctx.IsUserSiteAdmin() {
-			return
-		}
-		if ctx.Org.Team == nil {
-			setting.PanicInDevOrTesting("reqTeamMembership: unprepared context")
-			ctx.APIErrorInternal(errors.New("reqTeamMembership: unprepared context"))
-			return
-		}
-
-		orgID := ctx.Org.Team.OrgID
-		isOwner, err := organization.IsOrganizationOwner(ctx, orgID, ctx.Doer.ID)
-		if err != nil {
-			ctx.APIErrorInternal(err)
-			return
-		} else if isOwner {
-			return
-		}
-
-		if isTeamMember, err := organization.IsTeamMember(ctx, orgID, ctx.Org.Team.ID, ctx.Doer.ID); err != nil {
-			ctx.APIErrorInternal(err)
-			return
-		} else if !isTeamMember {
-			isOrgMember, err := organization.IsOrganizationMember(ctx, orgID, ctx.Doer.ID)
-			if err != nil {
-				ctx.APIErrorInternal(err)
-			} else if isOrgMember {
-				ctx.APIError(http.StatusForbidden, "Must be a team member")
-			} else {
-				ctx.APIErrorNotFound()
-			}
+		orgID, privileged, ok := teamAccessPrivileged(ctx)
+		if !ok || privileged {
 			return
 		}
+		denyNonTeamMember(ctx, orgID)
 	}
 }
 
@@ -1762,7 +1800,7 @@ func Routes() *web.Router {
 				m.Combo("/{id}").Get(reqToken(), org.GetLabel).
 					Patch(reqToken(), reqOrgOwnership(), bind(api.EditLabelOption{}), org.EditLabel).
 					Delete(reqToken(), reqOrgOwnership(), org.DeleteLabel)
-			})
+			}, reqOrgVisible())
 			m.Group("/hooks", func() {
 				m.Combo("").Get(org.ListHooks).
 					Post(bind(api.CreateHookOption{}), org.CreateHook)
@@ -1785,6 +1823,34 @@ func Routes() *web.Router {
 				})
 			}, reqToken(), reqOrgOwnership())
 
+			m.Group("/tag_protections", func() {
+				m.Combo("").Get(org.ListOrgTagProtections).
+					Post(bind(api.CreateOrgTagProtectionOption{}), org.CreateOrgTagProtection)
+				m.Group("/{id}", func() {
+					m.Get("", org.GetOrgTagProtection)
+					m.Patch("", bind(api.EditOrgTagProtectionOption{}), org.EditOrgTagProtection)
+					m.Delete("", org.DeleteOrgTagProtection)
+				})
+			}, reqToken(), reqOrgOwnership())
+
+			m.Group("/push_policy", func() {
+				m.Combo("").Get(org.GetOrgPushPolicy).
+					Patch(bind(api.EditOrgPushPolicyOption{}), org.EditOrgPushPolicy).
+					Delete(org.DeleteOrgPushPolicy)
+			}, reqToken(), reqOrgOwnership())
+
+			m.Group("/repo_defaults", func() {
+				m.Combo("").Get(org.GetOrgRepoDefaults).
+					Patch(bind(api.EditOrgRepoDefaultsOption{}), org.EditOrgRepoDefaults).
+					Delete(org.DeleteOrgRepoDefaults)
+			}, reqToken(), reqOrgOwnership())
+
+			m.Group("/email_domain_policy", func() {
+				m.Combo("").Get(org.GetOrgEmailDomainPolicy).
+					Patch(bind(api.EditOrgEmailDomainPolicyOption{}), org.EditOrgEmailDomainPolicy).
+					Delete(org.DeleteOrgEmailDomainPolicy)
+			}, reqToken(), reqOrgOwnership())
+
 			m.Group("/blocks", func() {
 				m.Get("", org.ListBlocks)
 				m.Group("/{username}", func() {
@@ -1821,12 +1887,12 @@ func Routes() *web.Router {
 			m.Group("/repos", func() {
 				m.Get("", reqToken(), org.GetTeamRepos)
 				m.Combo("/{org}/{reponame}").
-					Put(reqToken(), org.AddTeamRepository).
-					Delete(reqToken(), org.RemoveTeamRepository).
+					Put(reqToken(), reqTeamMembership(), org.AddTeamRepository).
+					Delete(reqToken(), reqTeamMembership(), org.RemoveTeamRepository).
 					Get(reqToken(), org.GetTeamRepo)
 			})
 			m.Get("/activities/feeds", org.ListTeamActivityFeeds)
-		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(false, true), reqToken(), reqTeamMembership(), checkTokenPublicOnly())
+		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(false, true), reqToken(), reqTeamReadAccess(), checkTokenPublicOnly())
 
 		m.Group("/admin", func() {
 			m.Group("/cron", func() {

routers/api/v1/org/branch_protection.go

@@ -47,6 +47,9 @@ func toAPIOrgBranchProtection(ctx *context.APIContext, rule *git_model.OrgProtec
 		EnableForcePush:               rule.CanForcePush,
 		EnableForcePushAllowlist:      rule.EnableForcePushAllowlist,
 		ForcePushAllowlistTeams:       resolveTeamNames(rule.ForcePushAllowlistTeamIDs),
+		EnableDelete:                  rule.CanDelete,
+		EnableDeleteAllowlist:         rule.EnableDeleteAllowlist,
+		DeleteAllowlistTeams:          resolveTeamNames(rule.DeleteAllowlistTeamIDs),
 		EnableMergeWhitelist:          rule.EnableMergeWhitelist,
 		MergeWhitelistTeams:           resolveTeamNames(rule.MergeWhitelistTeamIDs),
 		EnableStatusCheck:             rule.EnableStatusCheck,
@@ -211,6 +214,10 @@ func CreateOrgBranchProtection(ctx *context.APIContext) {
 	if !ok {
 		return
 	}
+	deleteTeams, ok := resolveTeamIDs(ctx, orgID, form.DeleteAllowlistTeams)
+	if !ok {
+		return
+	}
 
 	rule := &git_model.OrgProtectedBranch{
 		OrgID:                         orgID,
@@ -222,6 +229,9 @@ func CreateOrgBranchProtection(ctx *context.APIContext) {
 		CanForcePush:                  form.EnablePush && form.EnableForcePush,
 		EnableForcePushAllowlist:      form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist,
 		ForcePushAllowlistTeamIDs:     forcePushTeams,
+		CanDelete:                     form.EnableDelete,
+		EnableDeleteAllowlist:         form.EnableDelete && form.EnableDeleteAllowlist,
+		DeleteAllowlistTeamIDs:        deleteTeams,
 		EnableMergeWhitelist:          form.EnableMergeWhitelist,
 		MergeWhitelistTeamIDs:         mergeTeams,
 		EnableStatusCheck:             form.EnableStatusCheck,
@@ -323,6 +333,19 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.ForcePushAllowlistTeamIDs = ids
 	}
+	if form.EnableDelete != nil {
+		rule.CanDelete = *form.EnableDelete
+	}
+	if form.EnableDeleteAllowlist != nil {
+		rule.EnableDeleteAllowlist = *form.EnableDeleteAllowlist
+	}
+	if form.DeleteAllowlistTeams != nil {
+		ids, ok := resolveTeamIDs(ctx, orgID, form.DeleteAllowlistTeams)
+		if !ok {
+			return
+		}
+		rule.DeleteAllowlistTeamIDs = ids
+	}
 	if form.EnableMergeWhitelist != nil {
 		rule.EnableMergeWhitelist = *form.EnableMergeWhitelist
 	}

routers/api/v1/org/email_domain.go

@@ -0,0 +1,67 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package org
+
+import (
+	"net/http"
+
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+func toAPIOrgEmailDomainPolicy(policy *git_model.OrgEmailDomainPolicy, orgID int64) *api.OrgEmailDomainPolicy {
+	if policy == nil {
+		return &api.OrgEmailDomainPolicy{OrgID: orgID}
+	}
+	return &api.OrgEmailDomainPolicy{
+		OrgID:          policy.OrgID,
+		AllowedDomains: policy.AllowedDomains,
+	}
+}
+
+// GetOrgEmailDomainPolicy get the organization's email domain policy
+func GetOrgEmailDomainPolicy(ctx *context.APIContext) {
+	orgID := ctx.Org.Organization.ID
+	policy, err := git_model.GetOrgEmailDomainPolicy(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgEmailDomainPolicy(policy, orgID))
+}
+
+// EditOrgEmailDomainPolicy create or update the organization's email domain policy
+func EditOrgEmailDomainPolicy(ctx *context.APIContext) {
+	form := web.GetForm(ctx).(*api.EditOrgEmailDomainPolicyOption)
+	orgID := ctx.Org.Organization.ID
+
+	policy, err := git_model.GetOrgEmailDomainPolicy(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if policy == nil {
+		policy = &git_model.OrgEmailDomainPolicy{OrgID: orgID}
+	}
+	if form.AllowedDomains != nil {
+		policy.AllowedDomains = *form.AllowedDomains
+	}
+
+	if err := git_model.UpsertOrgEmailDomainPolicy(ctx, policy); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgEmailDomainPolicy(policy, orgID))
+}
+
+// DeleteOrgEmailDomainPolicy remove the organization's email domain policy
+func DeleteOrgEmailDomainPolicy(ctx *context.APIContext) {
+	if err := git_model.DeleteOrgEmailDomainPolicy(ctx, ctx.Org.Organization.ID); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.Status(http.StatusNoContent)
+}

routers/api/v1/org/issue_metadata.go

@@ -6,6 +6,7 @@ package org
 import (
 	"net/http"
 
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
 	org_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/organization"
 	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
@@ -227,7 +228,11 @@ func ApplyIssueStatusPreset(ctx *context.APIContext) {
 
 	presetName := ctx.PathParam("preset")
 	if err := issues_model.ApplyStatusPreset(ctx, ctx.Org.Organization.ID, presetName); err != nil {
-		ctx.APIErrorNotFound()
+		if db.IsErrNotExist(err) {
+			ctx.APIErrorNotFound()
+		} else {
+			ctx.APIErrorInternal(err)
+		}
 		return
 	}
 	ctx.Status(http.StatusNoContent)
@@ -261,6 +266,19 @@ func CopyIssueStatusesFromOrg(ctx *context.APIContext) {
 		ctx.APIErrorNotFound()
 		return
 	}
+
+	if sourceOrg.Visibility != api.VisibleTypePublic && !ctx.Doer.IsAdmin {
+		isMember, err := org_model.IsOrganizationMember(ctx, sourceOrg.ID, ctx.Doer.ID)
+		if err != nil {
+			ctx.APIErrorInternal(err)
+			return
+		}
+		if !isMember {
+			ctx.APIErrorNotFound()
+			return
+		}
+	}
+
 	if err := issues_model.CopyStatusesFromOrg(ctx, sourceOrg.ID, ctx.Org.Organization.ID); err != nil {
 		ctx.APIErrorInternal(err)
 		return

routers/api/v1/org/push_policy.go

@@ -0,0 +1,88 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package org
+
+import (
+	"net/http"
+
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// toAPIOrgPushPolicy converts the model to its API representation. A nil policy is
+// rendered as an all-empty policy so clients always get a consistent shape.
+func toAPIOrgPushPolicy(policy *git_model.OrgPushPolicy, orgID int64) *api.OrgPushPolicy {
+	if policy == nil {
+		return &api.OrgPushPolicy{OrgID: orgID}
+	}
+	return &api.OrgPushPolicy{
+		OrgID:               policy.OrgID,
+		BranchNamePattern:   policy.BranchNamePattern,
+		TagNamePattern:      policy.TagNamePattern,
+		RequireSecretBlock:  policy.RequireSecretBlock,
+		MaxFileSize:         policy.MaxFileSize,
+		BlockedFilePatterns: policy.BlockedFilePatterns,
+		Created:             policy.CreatedUnix.AsTime(),
+		Updated:             policy.UpdatedUnix.AsTime(),
+	}
+}
+
+// GetOrgPushPolicy get the organization's push policy
+func GetOrgPushPolicy(ctx *context.APIContext) {
+	orgID := ctx.Org.Organization.ID
+	policy, err := git_model.GetOrgPushPolicy(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgPushPolicy(policy, orgID))
+}
+
+// EditOrgPushPolicy create or update the organization's push policy
+func EditOrgPushPolicy(ctx *context.APIContext) {
+	form := web.GetForm(ctx).(*api.EditOrgPushPolicyOption)
+	orgID := ctx.Org.Organization.ID
+
+	policy, err := git_model.GetOrgPushPolicy(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if policy == nil {
+		policy = &git_model.OrgPushPolicy{OrgID: orgID}
+	}
+
+	if form.BranchNamePattern != nil {
+		policy.BranchNamePattern = *form.BranchNamePattern
+	}
+	if form.TagNamePattern != nil {
+		policy.TagNamePattern = *form.TagNamePattern
+	}
+	if form.RequireSecretBlock != nil {
+		policy.RequireSecretBlock = *form.RequireSecretBlock
+	}
+	if form.MaxFileSize != nil {
+		policy.MaxFileSize = *form.MaxFileSize
+	}
+	if form.BlockedFilePatterns != nil {
+		policy.BlockedFilePatterns = *form.BlockedFilePatterns
+	}
+
+	if err := git_model.UpsertOrgPushPolicy(ctx, policy); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgPushPolicy(policy, orgID))
+}
+
+// DeleteOrgPushPolicy remove the organization's push policy
+func DeleteOrgPushPolicy(ctx *context.APIContext) {
+	if err := git_model.DeleteOrgPushPolicy(ctx, ctx.Org.Organization.ID); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.Status(http.StatusNoContent)
+}

routers/api/v1/org/repo_defaults.go

@@ -0,0 +1,117 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package org
+
+import (
+	"net/http"
+
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// toAPIOrgRepoDefaults converts the model to its API representation. A nil value is
+// rendered as the effective defaults (all merge styles allowed) so clients always
+// get a consistent shape.
+func toAPIOrgRepoDefaults(d *git_model.OrgRepoDefaults, orgID int64) *api.OrgRepoDefaults {
+	if d == nil {
+		return &api.OrgRepoDefaults{
+			OrgID:                orgID,
+			AllowMerge:           true,
+			AllowRebase:          true,
+			AllowRebaseMerge:     true,
+			AllowSquash:          true,
+			AllowFastForwardOnly: true,
+		}
+	}
+	return &api.OrgRepoDefaults{
+		OrgID:                  d.OrgID,
+		ForcePrivate:           d.ForcePrivate,
+		ApplyPRDefaults:        d.ApplyPRDefaults,
+		AllowMerge:             d.AllowMerge,
+		AllowRebase:            d.AllowRebase,
+		AllowRebaseMerge:       d.AllowRebaseMerge,
+		AllowSquash:            d.AllowSquash,
+		AllowFastForwardOnly:   d.AllowFastForwardOnly,
+		DefaultMergeStyle:      d.DefaultMergeStyle,
+		DeleteBranchAfterMerge: d.DeleteBranchAfterMerge,
+	}
+}
+
+// GetOrgRepoDefaults get the organization's default repository settings
+func GetOrgRepoDefaults(ctx *context.APIContext) {
+	orgID := ctx.Org.Organization.ID
+	defaults, err := git_model.GetOrgRepoDefaults(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgRepoDefaults(defaults, orgID))
+}
+
+// EditOrgRepoDefaults create or update the organization's default repository settings
+func EditOrgRepoDefaults(ctx *context.APIContext) {
+	form := web.GetForm(ctx).(*api.EditOrgRepoDefaultsOption)
+	orgID := ctx.Org.Organization.ID
+
+	defaults, err := git_model.GetOrgRepoDefaults(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if defaults == nil {
+		defaults = &git_model.OrgRepoDefaults{
+			OrgID:                orgID,
+			AllowMerge:           true,
+			AllowRebase:          true,
+			AllowRebaseMerge:     true,
+			AllowSquash:          true,
+			AllowFastForwardOnly: true,
+		}
+	}
+
+	if form.ForcePrivate != nil {
+		defaults.ForcePrivate = *form.ForcePrivate
+	}
+	if form.ApplyPRDefaults != nil {
+		defaults.ApplyPRDefaults = *form.ApplyPRDefaults
+	}
+	if form.AllowMerge != nil {
+		defaults.AllowMerge = *form.AllowMerge
+	}
+	if form.AllowRebase != nil {
+		defaults.AllowRebase = *form.AllowRebase
+	}
+	if form.AllowRebaseMerge != nil {
+		defaults.AllowRebaseMerge = *form.AllowRebaseMerge
+	}
+	if form.AllowSquash != nil {
+		defaults.AllowSquash = *form.AllowSquash
+	}
+	if form.AllowFastForwardOnly != nil {
+		defaults.AllowFastForwardOnly = *form.AllowFastForwardOnly
+	}
+	if form.DefaultMergeStyle != nil {
+		defaults.DefaultMergeStyle = *form.DefaultMergeStyle
+	}
+	if form.DeleteBranchAfterMerge != nil {
+		defaults.DeleteBranchAfterMerge = *form.DeleteBranchAfterMerge
+	}
+
+	if err := git_model.UpsertOrgRepoDefaults(ctx, defaults); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgRepoDefaults(defaults, orgID))
+}
+
+// DeleteOrgRepoDefaults remove the organization's default repository settings
+func DeleteOrgRepoDefaults(ctx *context.APIContext) {
+	if err := git_model.DeleteOrgRepoDefaults(ctx, ctx.Org.Organization.ID); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.Status(http.StatusNoContent)
+}

routers/api/v1/org/tag_protection.go

@@ -0,0 +1,152 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package org
+
+import (
+	"net/http"
+
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/organization"
+	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// toAPIOrgTagProtection converts an org tag rule to its API representation.
+func toAPIOrgTagProtection(ctx *context.APIContext, rule *git_model.OrgProtectedTag) *api.OrgTagProtection {
+	teams, err := organization.FindOrgTeams(ctx, rule.OrgID)
+	if err != nil {
+		teams = nil
+	}
+	teamNamesByID := make(map[int64]string, len(teams))
+	for _, t := range teams {
+		teamNamesByID[t.ID] = t.Name
+	}
+	names := make([]string, 0, len(rule.AllowlistTeamIDs))
+	for _, id := range rule.AllowlistTeamIDs {
+		if name, ok := teamNamesByID[id]; ok {
+			names = append(names, name)
+		}
+	}
+	return &api.OrgTagProtection{
+		ID:             rule.ID,
+		OrgID:          rule.OrgID,
+		NamePattern:    rule.NamePattern,
+		WhitelistTeams: names,
+		Created:        rule.CreatedUnix.AsTime(),
+		Updated:        rule.UpdatedUnix.AsTime(),
+	}
+}
+
+// ListOrgTagProtections list org-level tag protection rules
+func ListOrgTagProtections(ctx *context.APIContext) {
+	rules, err := git_model.FindOrgProtectedTags(ctx, ctx.Org.Organization.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	apiRules := make([]*api.OrgTagProtection, len(rules))
+	for i, rule := range rules {
+		apiRules[i] = toAPIOrgTagProtection(ctx, rule)
+	}
+	ctx.JSON(http.StatusOK, apiRules)
+}
+
+// GetOrgTagProtection get a specific org-level tag protection rule
+func GetOrgTagProtection(ctx *context.APIContext) {
+	rule, err := git_model.GetOrgProtectedTagByID(ctx, ctx.Org.Organization.ID, ctx.PathParamInt64("id"))
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if rule == nil {
+		ctx.APIErrorNotFound()
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgTagProtection(ctx, rule))
+}
+
+// CreateOrgTagProtection create an org-level tag protection rule
+func CreateOrgTagProtection(ctx *context.APIContext) {
+	form := web.GetForm(ctx).(*api.CreateOrgTagProtectionOption)
+	orgID := ctx.Org.Organization.ID
+
+	existing, err := git_model.GetOrgProtectedTagByNamePattern(ctx, orgID, form.NamePattern)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if existing != nil {
+		ctx.APIError(http.StatusForbidden, "org tag protection rule already exists for this pattern")
+		return
+	}
+
+	teams, ok := resolveTeamIDs(ctx, orgID, form.WhitelistTeams)
+	if !ok {
+		return
+	}
+
+	rule := &git_model.OrgProtectedTag{
+		OrgID:            orgID,
+		NamePattern:      form.NamePattern,
+		AllowlistTeamIDs: teams,
+	}
+	if err := git_model.CreateOrgProtectedTag(ctx, rule); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusCreated, toAPIOrgTagProtection(ctx, rule))
+}
+
+// EditOrgTagProtection edit an org-level tag protection rule
+func EditOrgTagProtection(ctx *context.APIContext) {
+	form := web.GetForm(ctx).(*api.EditOrgTagProtectionOption)
+	orgID := ctx.Org.Organization.ID
+
+	rule, err := git_model.GetOrgProtectedTagByID(ctx, orgID, ctx.PathParamInt64("id"))
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if rule == nil {
+		ctx.APIErrorNotFound()
+		return
+	}
+
+	if form.NamePattern != nil {
+		rule.NamePattern = *form.NamePattern
+	}
+	if form.WhitelistTeams != nil {
+		ids, ok := resolveTeamIDs(ctx, orgID, form.WhitelistTeams)
+		if !ok {
+			return
+		}
+		rule.AllowlistTeamIDs = ids
+	}
+
+	if err := git_model.UpdateOrgProtectedTag(ctx, rule); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgTagProtection(ctx, rule))
+}
+
+// DeleteOrgTagProtection delete an org-level tag protection rule
+func DeleteOrgTagProtection(ctx *context.APIContext) {
+	orgID := ctx.Org.Organization.ID
+	rule, err := git_model.GetOrgProtectedTagByID(ctx, orgID, ctx.PathParamInt64("id"))
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if rule == nil {
+		ctx.APIErrorNotFound()
+		return
+	}
+	if err := git_model.DeleteOrgProtectedTag(ctx, orgID, rule.ID); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.Status(http.StatusNoContent)
+}

routers/api/v1/org/team.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	activities_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/activities"
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/organization"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm"
 	access_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm/access"
@@ -491,6 +492,8 @@ func AddTeamMember(ctx *context.APIContext) {
 	if err := org_service.AddTeamMember(ctx, ctx.Org.Team, u); err != nil {
 		if errors.Is(err, user_model.ErrBlockedUser) {
 			ctx.APIError(http.StatusForbidden, err)
+		} else if git_model.IsErrEmailDomainNotAllowed(err) {
+			ctx.APIError(http.StatusUnprocessableEntity, err)
 		} else {
 			ctx.APIErrorInternal(err)
 		}

routers/api/v1/repo/branch.go

@@ -1365,6 +1365,9 @@ func MergeUpstream(ctx *context.APIContext) {
 		} else if errors.Is(err, util.ErrNotExist) {
 			ctx.APIError(http.StatusNotFound, err)
 			return
+		} else if errors.Is(err, util.ErrPermissionDenied) {
+			ctx.APIError(http.StatusForbidden, err.Error())
+			return
 		}
 		ctx.APIErrorInternal(err)
 		return

routers/api/v1/repo/security.go

@@ -34,6 +34,7 @@ type apiSecurityConfig struct {
 	BlockOnPush   bool `json:"block_on_push"`
 	SecretScanner bool `json:"secret_scanner"`
 	DependScanner bool `json:"depend_scanner"`
+	CodeScanner   bool `json:"code_scanner"`
 }
 
 // ListSecurityAlerts returns all security alerts for a repo.
@@ -153,6 +154,7 @@ func UpdateSecurityConfig(ctx *context.APIContext) {
 		BlockOnPush   *bool `json:"block_on_push"`
 		SecretScanner *bool `json:"secret_scanner"`
 		DependScanner *bool `json:"depend_scanner"`
+		CodeScanner   *bool `json:"code_scanner"`
 	}
 	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
 		ctx.APIError(http.StatusUnprocessableEntity, err)
@@ -177,6 +179,9 @@ func UpdateSecurityConfig(ctx *context.APIContext) {
 	if req.DependScanner != nil {
 		cfg.DependScanner = *req.DependScanner
 	}
+	if req.CodeScanner != nil {
+		cfg.CodeScanner = *req.CodeScanner
+	}
 
 	if err := security_model.SaveScannerConfig(ctx, cfg); err != nil {
 		ctx.APIErrorInternal(err)
@@ -210,5 +215,6 @@ func toAPISecurityConfig(cfg *security_model.SecurityScannerConfig) *apiSecurity
 		BlockOnPush:   cfg.BlockOnPush,
 		SecretScanner: cfg.SecretScanner,
 		DependScanner: cfg.DependScanner,
+		CodeScanner:   cfg.CodeScanner,
 	}
 }

routers/init.go

@@ -48,6 +48,7 @@ import (
 	repo_migrations "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/migrations"
 	mirror_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/mirror"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/oauth2_provider"
+	org_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/org"
 	packages_spec "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/packages/pkgspec"
 	pull_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/pull"
 	release_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/release"
@@ -155,6 +156,7 @@ func InitWebInstalled(ctx context.Context) {
 	mustInit(pull_service.Init)
 	mustInit(automerge.Init)
 	cascade.Init()
+	org_service.Init()
 	mustInit(task.Init)
 	mustInit(repo_migrations.Init)
 	eventsource.GetManager().Init()

routers/private/hook_pre_receive.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"strconv"
+	"strings"
 
 	asymkey_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/asymkey"
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
@@ -41,9 +43,6 @@ type preReceiveContext struct {
 	canCreatePullRequest        bool
 	checkedCanCreatePullRequest bool
 
-	canWriteCode        bool
-	checkedCanWriteCode bool
-
 	protectedTags    []*git_model.ProtectedTag
 	gotProtectedTags bool
 
@@ -51,24 +50,36 @@ type preReceiveContext struct {
 
 	opts *private.HookOptions
 
-	branchName string
+	// this context should only contain shared variables, mutable variables like "current branch name" shouldn't be put here
+	canWriteCodeUnitCached *bool
 }
 
-// CanWriteCode returns true if pusher can write code
-func (ctx *preReceiveContext) CanWriteCode() bool {
-	if !ctx.checkedCanWriteCode {
-		if !ctx.loadPusherAndPermission() {
-			return false
+func (ctx *preReceiveContext) canWriteCodeUnit() bool {
+	if ctx.canWriteCodeUnitCached == nil {
+		var canWrite bool
+		if ctx.loadPusherAndPermission() {
+			canWrite = ctx.userPerm.CanWrite(unit.TypeCode) || ctx.deployKeyAccessMode >= perm_model.AccessModeWrite
 		}
-		ctx.canWriteCode = issues_model.CanMaintainerWriteToBranch(ctx, ctx.userPerm, ctx.branchName, ctx.user) || ctx.deployKeyAccessMode >= perm_model.AccessModeWrite
-		ctx.checkedCanWriteCode = true
+		ctx.canWriteCodeUnitCached = &canWrite
 	}
-	return ctx.canWriteCode
+	return *ctx.canWriteCodeUnitCached
 }
 
-// AssertCanWriteCode returns true if pusher can write code
-func (ctx *preReceiveContext) AssertCanWriteCode() bool {
-	if !ctx.CanWriteCode() {
+// canWriteCodeRef returns true if pusher can write to the code ref (branch/tag/commit)
+func (ctx *preReceiveContext) canWriteCodeRef(refFullName git.RefName) bool {
+	if ctx.canWriteCodeUnit() {
+		return true
+	}
+	// then check whether if the pusher is a maintainer who can write the PR author's head repo branch
+	if !refFullName.IsBranch() {
+		return false
+	}
+	return issues_model.CanMaintainerWriteToBranch(ctx, ctx.userPerm, refFullName.BranchName(), ctx.user)
+}
+
+// assertCanWriteRef returns true if pusher can write to the code ref, otherwise it responds with 403 Forbidden and returns false
+func (ctx *preReceiveContext) assertCanWriteRef(refFullName git.RefName) bool {
+	if !ctx.canWriteCodeRef(refFullName) {
 		if ctx.Written() {
 			return false
 		}
@@ -130,7 +141,7 @@ func HookPreReceive(ctx *gitea_context.PrivateContext) {
 		case git.DefaultFeatures().SupportProcReceive && refFullName.IsFor():
 			preReceiveFor(ourCtx, refFullName)
 		default:
-			ourCtx.AssertCanWriteCode()
+			ourCtx.assertCanWriteRef(refFullName)
 		}
 		if ctx.Written() {
 			return
@@ -142,9 +153,8 @@ func HookPreReceive(ctx *gitea_context.PrivateContext) {
 
 func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, refFullName git.RefName) {
 	branchName := refFullName.BranchName()
-	ctx.branchName = branchName
 
-	if !ctx.AssertCanWriteCode() {
+	if !ctx.assertCanWriteRef(refFullName) {
 		return
 	}
 
@@ -152,9 +162,15 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 	gitRepo := ctx.Repo.GitRepo
 	objectFormat := ctx.Repo.GetObjectFormat()
 
+	if ctx.checkOrgPushPolicyBranch(oldCommitID, newCommitID, branchName) {
+		return
+	}
+
 	if newCommitID != objectFormat.EmptyObjectID().String() {
 		newCommit, err := gitRepo.GetCommit(newCommitID)
-		if err == nil {
+		if err != nil {
+			log.Error("Secret scan: failed to get commit %s in %-v: %v", newCommitID[:12], repo, err)
+		} else {
 			if findings := security_service.ScanPushForSecrets(ctx, repo.ID, newCommit); len(findings) > 0 {
 				msg := fmt.Sprintf("Push rejected: %d secret(s) detected in commit %s", len(findings), newCommitID[:12])
 				for _, f := range findings {
@@ -439,12 +455,16 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 }
 
 func preReceiveTag(ctx *preReceiveContext, refFullName git.RefName) {
-	if !ctx.AssertCanWriteCode() {
+	if !ctx.assertCanWriteRef(refFullName) {
 		return
 	}
 
 	tagName := refFullName.TagName()
 
+	if ctx.checkOrgPushPolicyTag(tagName) {
+		return
+	}
+
 	if !ctx.gotProtectedTags {
 		var err error
 		ctx.protectedTags, err = git_model.GetProtectedTags(ctx, ctx.Repo.Repository.ID)
@@ -458,7 +478,7 @@ func preReceiveTag(ctx *preReceiveContext, refFullName git.RefName) {
 		ctx.gotProtectedTags = true
 	}
 
-	isAllowed, err := git_model.IsUserAllowedToControlTag(ctx, ctx.protectedTags, tagName, ctx.opts.UserID)
+	isAllowed, err := git_model.IsUserAllowedToControlTagInRepo(ctx, ctx.protectedTags, ctx.Repo.Repository, tagName, ctx.opts.UserID)
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, private.Response{
 			Err: err.Error(),
@@ -586,3 +606,102 @@ func (ctx *preReceiveContext) loadPusherAndPermission() bool {
 	ctx.loadedPusher = true
 	return true
 }
+
+// checkOrgPushPolicyBranch enforces the owning organization's push policy on a
+// branch push. It writes a 403 response and returns true when the push is rejected.
+// Content checks (blocked paths, max file size) fail open on unexpected errors so a
+// policy or parsing bug can never block every push in the organization.
+func (ctx *preReceiveContext) checkOrgPushPolicyBranch(oldCommitID, newCommitID, branchName string) bool {
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		log.Error("GetOrgPushPolicyForRepo for %-v: %v", ctx.Repo.Repository, err)
+		return false
+	}
+	if policy == nil {
+		return false
+	}
+
+	if !policy.BranchNameAllowed(branchName) {
+		ctx.JSON(http.StatusForbidden, private.Response{
+			UserMsg: fmt.Sprintf("Branch name %q is not allowed by the organization push policy (pattern: %s)", branchName, policy.BranchNamePattern),
+		})
+		return true
+	}
+
+	// Deletions have no content to inspect.
+	if newCommitID == ctx.Repo.GetObjectFormat().EmptyObjectID().String() {
+		return false
+	}
+
+	if globs := policy.BlockedFileGlobs(); len(globs) > 0 {
+		if _, err := pull_service.CheckFileProtection(ctx.Repo.GitRepo, branchName, oldCommitID, newCommitID, globs, 10, ctx.env); err != nil {
+			if pull_service.IsErrFilePathProtected(err) {
+				ctx.JSON(http.StatusForbidden, private.Response{
+					UserMsg: "Push rejected by the organization push policy: a changed file matches a blocked path pattern",
+				})
+				return true
+			}
+			log.Error("org push policy blocked-path check for %-v: %v", ctx.Repo.Repository, err) // fail open
+		}
+	}
+
+	if policy.MaxFileSize > 0 {
+		if path, size := ctx.largestBlobOverLimit(newCommitID, policy.MaxFileSize); path != "" {
+			ctx.JSON(http.StatusForbidden, private.Response{
+				UserMsg: fmt.Sprintf("Push rejected by the organization push policy: %q is %d bytes, over the %d-byte limit", path, size, policy.MaxFileSize),
+			})
+			return true
+		}
+	}
+	return false
+}
+
+// checkOrgPushPolicyTag enforces the organization tag naming policy. Returns true
+// (with a 403 written) when the tag name is rejected.
+func (ctx *preReceiveContext) checkOrgPushPolicyTag(tagName string) bool {
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		log.Error("GetOrgPushPolicyForRepo for %-v: %v", ctx.Repo.Repository, err)
+		return false
+	}
+	if policy == nil || policy.TagNameAllowed(tagName) {
+		return false
+	}
+	ctx.JSON(http.StatusForbidden, private.Response{
+		UserMsg: fmt.Sprintf("Tag name %q is not allowed by the organization push policy (pattern: %s)", tagName, policy.TagNamePattern),
+	})
+	return true
+}
+
+// largestBlobOverLimit returns the first file (and its size) in the pushed tip tree
+// that exceeds limit bytes, or ("", 0) if none — or on any error (fail open).
+func (ctx *preReceiveContext) largestBlobOverLimit(commitID string, limit int64) (string, int64) {
+	output, _, err := gitrepo.RunCmdString(ctx,
+		ctx.Repo.Repository,
+		gitcmd.NewCommand("ls-tree", "-r", "--long").
+			AddDynamicArguments(commitID).
+			WithEnv(ctx.env),
+	)
+	if err != nil {
+		log.Error("org push policy ls-tree for %-v: %v", ctx.Repo.Repository, err)
+		return "", 0
+	}
+	for _, line := range strings.Split(output, "\n") {
+		tab := strings.IndexByte(line, '\t')
+		if tab < 0 {
+			continue
+		}
+		fields := strings.Fields(line[:tab]) // mode, type, hash, size
+		if len(fields) < 4 || fields[1] != "blob" {
+			continue
+		}
+		size, perr := strconv.ParseInt(fields[3], 10, 64)
+		if perr != nil {
+			continue
+		}
+		if size > limit {
+			return line[tab+1:], size
+		}
+	}
+	return "", 0
+}

routers/private/hook_pre_receive_test.go

@@ -0,0 +1,70 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package private
+
+import (
+	"testing"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm/access"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unittest"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/contexttest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPreReceiveCanWriteCodePerBranch ensures the maintainer-edit write grant is evaluated against
+// the exact ref being pushed on every call, derived from that ref rather than shared mutable state.
+// Otherwise a per-branch grant (an open PR with "allow edits from maintainers") could be batched
+// together with a protected branch or a tag to escalate into full repository write.
+func TestPreReceiveCanWriteCodePerBranch(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	baseRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 10})
+	headRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 11})
+	require.NoError(t, baseRepo.LoadOwner(t.Context()))
+	require.NoError(t, headRepo.LoadOwner(t.Context()))
+
+	// An open PR from the head repo owner, with maintainer edits allowed: this grants the base
+	// repo owner write access to exactly this head branch and nothing else.
+	pr := &issues_model.PullRequest{
+		Issue: &issues_model.Issue{
+			RepoID:   baseRepo.ID,
+			PosterID: headRepo.OwnerID,
+		},
+		HeadRepoID:          headRepo.ID,
+		BaseRepoID:          baseRepo.ID,
+		HeadBranch:          "granted-branch",
+		BaseBranch:          "master",
+		AllowMaintainerEdit: true,
+	}
+	require.NoError(t, issues_model.NewPullRequest(t.Context(), baseRepo, pr.Issue, nil, nil, pr))
+
+	// The pusher is the base repo owner (the maintainer) with only read access on the head repo.
+	maintainer := baseRepo.Owner
+	headPerm, err := access.GetIndividualUserRepoPermission(t.Context(), headRepo, maintainer)
+	require.NoError(t, err)
+
+	mockCtx, _ := contexttest.MockPrivateContext(t, "/")
+	ctx := &preReceiveContext{
+		PrivateContext: mockCtx,
+		loadedPusher:   true,
+		user:           maintainer,
+		userPerm:       headPerm,
+	}
+
+	// The granted branch must be writable...
+	assert.True(t, ctx.canWriteCodeRef(git.RefNameFromBranch("granted-branch")))
+
+	// ...but another branch in the same push must NOT inherit that grant.
+	assert.False(t, ctx.canWriteCodeRef(git.RefNameFromBranch("master")))
+
+	// ...and a tag sharing the granted branch's name must NOT inherit it either: the grant is
+	// scoped to PR head branches, so a non-branch ref can never match it. (A tag ref already
+	// yields an empty branch name, so this guards the per-ref evaluation, not the IsBranch check.)
+	assert.False(t, ctx.canWriteCodeRef(git.RefNameFromTag("granted-branch")))
+}

routers/web/auth/2fa.go

@@ -58,14 +58,14 @@ func TwoFactorPost(ctx *context.Context) {
 		return
 	}
 
-	// Validate the passcode with the stored TOTP secret.
-	ok, err := twofa.ValidateTOTP(form.Passcode)
+	// Validate the passcode and atomically consume it to prevent reuse/replay.
+	ok, err := twofa.ValidateAndConsumeTOTP(ctx, form.Passcode)
 	if err != nil {
 		ctx.ServerError("UserSignIn", err)
 		return
 	}
 
-	if ok && twofa.LastUsedPasscode != form.Passcode {
+	if ok {
 		remember := ctx.Session.Get("twofaRemember").(bool)
 		u, err := user_model.GetUserByID(ctx, id)
 		if err != nil {
@@ -81,12 +81,6 @@ func TwoFactorPost(ctx *context.Context) {
 			}
 		}
 
-		twofa.LastUsedPasscode = form.Passcode
-		if err = auth.UpdateTwoFactor(ctx, twofa); err != nil {
-			ctx.ServerError("UserSignIn", err)
-			return
-		}
-
 		_ = ctx.Session.Set(session.KeyUserHasTwoFactorAuth, true)
 		handleSignIn(ctx, u, remember)
 		return

routers/web/auth/oauth.go

@@ -368,9 +368,21 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m
 
 	opts := &user_service.UpdateOptions{}
 
-	// Reactivate user if they are deactivated
+	// HINT: OAUTH-AUTO-SYNC-USER-ACTIVATION: see services/auth/source/oauth2/source_sync.go
+	// Reactivate user only if they were disabled by the OAuth2 auto sync cron (invalid_grant),
+	// which clears AccessToken/RefreshToken/ExpiresAt on the ExternalLoginUser row
+	// An admin-disabled user has no such signature, so we leave IsActive alone
+	// and let verifyAuthWithOptions route them through the prohibit-login / activate page.
 	if !u.IsActive {
-		opts.IsActive = optional.Some(true)
+		extLogin, hasExt, err := user_model.GetExternalLogin(ctx, authSource.ID, gothUser.UserID)
+		if err != nil {
+			ctx.ServerError("GetExternalLogin", err)
+			return
+		}
+		isDisabledByAutoSync := hasExt && extLogin.RefreshToken == ""
+		if isDisabledByAutoSync {
+			opts.IsActive = optional.Some(true)
+		}
 	}
 
 	// Update GroupClaims
@@ -514,17 +526,33 @@ func oAuth2UserLoginCallback(ctx *context.Context, authSource *auth.Source, requ
 	}
 
 	// search in external linked users
-	externalLoginUser := &user_model.ExternalLoginUser{
-		ExternalID:    gothUser.UserID,
-		LoginSourceID: authSource.ID,
-	}
-	hasUser, err = user_model.GetExternalLogin(request.Context(), externalLoginUser)
+	externalLoginUser, hasUser, err := user_model.GetExternalLogin(ctx, authSource.ID, gothUser.UserID)
 	if err != nil {
 		return nil, goth.User{}, err
 	}
 	if hasUser {
-		user, err = user_model.GetUserByID(request.Context(), externalLoginUser.UserID)
-		return user, gothUser, err
+		user, err = user_model.GetUserByID(ctx, externalLoginUser.UserID)
+		if err != nil && !user_model.IsErrUserNotExist(err) {
+			return nil, goth.User{}, err
+		}
+		if err == nil && user.IsIndividual() {
+			return user, gothUser, nil
+		}
+
+		// The external login record is stale: the linked user no longer exists, or it exists but is
+		// not an individual user (only individual users can sign in, so a link pointing at an
+		// organization, bot or remote user can never resolve). Remove it so the next sign-in can
+		// relink the external account to the correct user. Nothing is lost, because the link is
+		// recreated automatically on the next sign-in.
+		reason := "linked user does not exist"
+		if err == nil {
+			reason = fmt.Sprintf("linked user type is %d", user.Type)
+		}
+		log.Warn("Ignoring stale external login link [external-id=%s login-source-id=%d user-id=%d]: %s", externalLoginUser.ExternalID, externalLoginUser.LoginSourceID, externalLoginUser.UserID, reason)
+
+		if err := user_model.RemoveExternalLoginByExternalID(ctx, externalLoginUser.LoginSourceID, externalLoginUser.ExternalID); err != nil {
+			return nil, goth.User{}, err
+		}
 	}
 
 	// no user found to login

routers/web/auth/password.go

@@ -177,23 +177,17 @@ func ResetPasswdPost(ctx *context.Context) {
 			regenerateScratchToken = true
 		} else {
 			passcode := ctx.FormString("passcode")
-			ok, err := twofa.ValidateTOTP(passcode)
+			ok, err := twofa.ValidateAndConsumeTOTP(ctx, passcode)
 			if err != nil {
-				ctx.HTTPError(http.StatusInternalServerError, "ValidateTOTP", err.Error())
+				ctx.HTTPError(http.StatusInternalServerError, "ValidateAndConsumeTOTP", err.Error())
 				return
 			}
-			if !ok || twofa.LastUsedPasscode == passcode {
+			if !ok {
 				ctx.Data["IsResetForm"] = true
 				ctx.Data["Err_Passcode"] = true
 				ctx.RenderWithErrDeprecated(ctx.Tr("auth.twofa_passcode_incorrect"), tplResetPassword, nil)
 				return
 			}
-
-			twofa.LastUsedPasscode = passcode
-			if err = auth.UpdateTwoFactor(ctx, twofa); err != nil {
-				ctx.ServerError("ResetPasswdPost: UpdateTwoFactor", err)
-				return
-			}
 		}
 	}
 

routers/web/feed/branch.go

@@ -15,6 +15,9 @@ import (
 
 // ShowBranchFeed shows tags and/or releases on the repo as RSS / Atom feed
 func ShowBranchFeed(ctx *context.Context, repo *repo.Repository, formatType string) {
+	if !checkRepoFeedTokenScope(ctx) {
+		return
+	}
 	var commits []*git.Commit
 	var err error
 	if ctx.Repo.Commit != nil {

routers/web/feed/file.go

@@ -16,6 +16,9 @@ import (
 
 // ShowFileFeed shows tags and/or releases on the repo as RSS / Atom feed
 func ShowFileFeed(ctx *context.Context, repo *repo.Repository, formatType string) {
+	if !checkRepoFeedTokenScope(ctx) {
+		return
+	}
 	fileName := ctx.Repo.TreePath
 	if len(fileName) == 0 {
 		return

routers/web/feed/release.go

@@ -15,6 +15,9 @@ import (
 
 // shows tags and/or releases on the repo as RSS / Atom feed
 func ShowReleaseFeed(ctx *context.Context, repo *repo_model.Repository, isReleasesOnly bool, formatType string) {
+	if !checkRepoFeedTokenScope(ctx) {
+		return
+	}
 	releases, err := db.Find[repo_model.Release](ctx, repo_model.FindReleasesOptions{
 		IncludeTags: !isReleasesOnly,
 		RepoID:      ctx.Repo.Repository.ID,

routers/web/feed/render.go

@@ -4,9 +4,18 @@
 package feed
 
 import (
+	auth_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/auth"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
 )
 
+// checkRepoFeedTokenScope ensures an API token has repository read scope before a
+// feed serves private repository content, mirroring checkDownloadTokenScope for
+// downloads. Returns false (and writes the response) when the token is denied.
+func checkRepoFeedTokenScope(ctx *context.Context) bool {
+	context.CheckRepoScopedToken(ctx, ctx.Repo.Repository, auth_model.Read)
+	return !ctx.Written()
+}
+
 // RenderBranchFeed render format for branch or file
 func RenderBranchFeed(ctx *context.Context, feedType string) {
 	if ctx.Repo.TreePath == "" {

routers/web/feed/repo.go

@@ -16,6 +16,9 @@ import (
 
 // ShowRepoFeed shows user activity on the repo as RSS / Atom feed
 func ShowRepoFeed(ctx *context.Context, repo *repo_model.Repository, formatType string) {
+	if !checkRepoFeedTokenScope(ctx) {
+		return
+	}
 	actions, _, err := feed_service.GetFeeds(ctx, activities_model.GetFeedsOptions{
 		RequestedRepo:  repo,
 		Actor:          ctx.Doer,

routers/web/org/teams.go

@@ -98,7 +98,7 @@ func Teams(ctx *context.Context) {
 		}
 	}
 
-	ctx.Data["OrgListTeams"] = teams
+	ctx.Data["Teams"] = teams
 	ctx.Data["Keyword"] = keyword
 	pager := context.NewPagination(count, setting.UI.MembersPagingNum, page, 5)
 	pager.AddParamFromRequest(ctx.Req)

routers/web/repo/branch.go

@@ -261,7 +261,7 @@ func MergeUpstream(ctx *context.Context) {
 	branchName := ctx.FormString("branch")
 	_, err := repo_service.MergeUpstream(ctx, ctx.Doer, ctx.Repo.Repository, branchName, false)
 	if err != nil {
-		if errors.Is(err, util.ErrNotExist) {
+		if errors.Is(err, util.ErrNotExist) || errors.Is(err, util.ErrPermissionDenied) {
 			ctx.JSONErrorNotFound()
 			return
 		} else if pull_service.IsErrMergeConflicts(err) {

routers/web/repo/githttp.go

@@ -58,8 +58,6 @@ func CorsHandler() func(next http.Handler) http.Handler {
 // httpBase does the common work for git http services,
 // including early response, authentication, repository lookup and permission check.
 func httpBase(ctx *context.Context, optGitService ...string) *serviceHandler {
-	reponame := strings.TrimSuffix(ctx.PathParam("reponame"), ".git")
-
 	if ctx.FormString("go-get") == "1" {
 		context.EarlyResponseForGoGetMeta(ctx)
 		return nil
@@ -93,11 +91,11 @@ func httpBase(ctx *context.Context, optGitService ...string) *serviceHandler {
 
 	isWiki := false
 	unitType := unit.TypeCode
-
-	if strings.HasSuffix(reponame, ".wiki") {
+	repoName := strings.TrimSuffix(ctx.PathParam("reponame"), ".git")
+	if strings.HasSuffix(repoName, ".wiki") {
 		isWiki = true
 		unitType = unit.TypeWiki
-		reponame = reponame[:len(reponame)-5]
+		repoName = repoName[:len(repoName)-5]
 	}
 
 	owner := ctx.ContextUser
@@ -107,14 +105,14 @@ func httpBase(ctx *context.Context, optGitService ...string) *serviceHandler {
 	}
 
 	repoExist := true
-	repo, err := repo_model.GetRepositoryByName(ctx, owner.ID, reponame)
+	repo, err := repo_model.GetRepositoryByName(ctx, owner.ID, repoName)
 	if err != nil {
 		if !repo_model.IsErrRepoNotExist(err) {
 			ctx.ServerError("GetRepositoryByName", err)
 			return nil
 		}
 
-		if redirectRepoID, err := repo_model.LookupRedirect(ctx, owner.ID, reponame); err == nil {
+		if redirectRepoID, err := repo_model.LookupRedirect(ctx, owner.ID, repoName); err == nil {
 			context.RedirectToRepo(ctx.Base, redirectRepoID)
 			return nil
 		}
@@ -127,31 +125,24 @@ func httpBase(ctx *context.Context, optGitService ...string) *serviceHandler {
 		return nil
 	}
 
-	// Only public pull don't need auth.
-	// For private repos, also allow anonymous pull if the specific unit
-	// (code or wiki) has AnonymousAccessMode >= Read.
-	isPublicPull := repoExist && isPull && !repo.IsPrivate
-	if repoExist && isPull && repo.IsPrivate {
-		repoUnit := repo.MustGetUnit(ctx, unitType)
-		if repoUnit.AnonymousAccessMode >= perm.AccessModeRead {
-			isPublicPull = true
+	// Only public pulls don't need auth: repo must exist, not require-sign-in
+	canAnonymousPull := false
+	if isPull && repoExist && !setting.Service.RequireSignInViewStrict {
+		if owner.Visibility == structs.VisibleTypePublic && !repo.IsPrivate {
+			canAnonymousPull = true
 		}
-	}
-	askAuth := !isPublicPull || setting.Service.RequireSignInViewStrict
-
-	// don't allow anonymous pulls if organization is not public
-	if isPublicPull {
-		if err := repo.LoadOwner(ctx); err != nil {
-			ctx.ServerError("LoadOwner", err)
-			return nil
+		if !canAnonymousPull && ctx.Doer == nil {
+			anonPerm, err := access_model.GetDoerRepoPermission(ctx, repo, nil)
+			if err != nil {
+				ctx.ServerError("GetDoerRepoPermission", err)
+				return nil
+			}
+			canAnonymousPull = anonPerm.CanAccess(accessMode, unitType)
 		}
-
-		askAuth = askAuth || (repo.Owner.Visibility != structs.VisibleTypePublic)
 	}
 
 	// check access
-	if askAuth {
-		// rely on the results of Contexter
+	if !canAnonymousPull { // not public pull, then either the pull needs auth, or the push needs "write" permission, so ask auth
 		if !ctx.IsSigned {
 			// TODO: support digit auth - which would be Authorization header with digit
 			if setting.OAuth2.Enabled {
@@ -237,7 +228,7 @@ func httpBase(ctx *context.Context, optGitService ...string) *serviceHandler {
 			return nil
 		}
 
-		repo, err = repo_service.PushCreateRepo(ctx, ctx.Doer, owner, reponame)
+		repo, err = repo_service.PushCreateRepo(ctx, ctx.Doer, owner, repoName)
 		if err != nil {
 			log.Error("pushCreateRepo: %v", err)
 			ctx.Status(http.StatusNotFound)

routers/web/repo/setting/org_inherited_settings.go

@@ -0,0 +1,51 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package setting
+
+import (
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// prepareOrgPushPolicyView surfaces the owning organization's push policy (if any)
+// as a read-only informational section on the repo's branch protection settings page.
+// The policy is enforced org-wide in the pre-receive hook and cannot be edited from
+// the repository. Template data is only populated when the repo is owned by an
+// organization that has a push policy configured (nil policy renders nothing).
+// See issue #738.
+func prepareOrgPushPolicyView(ctx *context.Context) error {
+	if !ctx.Repo.Owner.IsOrganization() {
+		return nil
+	}
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		return err
+	}
+	if policy == nil {
+		return nil
+	}
+	ctx.Data["OrgPushPolicy"] = policy
+	return nil
+}
+
+// prepareOrgRepoDefaultsView surfaces the owning organization's repository defaults
+// (if any) as a read-only informational section. These defaults are applied when a
+// repository is created in, or transferred into, the organization; they are shown
+// for reference only and are not editable here. Template data is only populated when
+// the repo is owned by an organization that has repo defaults configured (nil renders
+// nothing). See issue #738.
+func prepareOrgRepoDefaultsView(ctx *context.Context) error {
+	if !ctx.Repo.Owner.IsOrganization() {
+		return nil
+	}
+	defaults, err := git_model.GetOrgRepoDefaultsForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		return err
+	}
+	if defaults == nil {
+		return nil
+	}
+	ctx.Data["OrgRepoDefaults"] = defaults
+	return nil
+}

routers/web/repo/setting/protected_branch.go

@@ -34,6 +34,64 @@ const (
 	tplProtectedBranch templates.TplName = "repo/settings/protected_branch"
 )
 
+// orgBranchProtectionView is a read-only presentation of an org-level branch
+// protection rule for the repo settings page, with team IDs resolved to names.
+type orgBranchProtectionView struct {
+	Rule           *git_model.OrgProtectedBranch
+	PushTeams      string
+	ForcePushTeams string
+	DeleteTeams    string
+	MergeTeams     string
+	ApprovalTeams  string
+	StatusContexts string
+}
+
+// prepareOrgProtectedBranches loads the owning organization's branch protection
+// rules and exposes them (with team IDs resolved to names) as read-only view models
+// under the "OrgProtectedBranches" template key.
+func prepareOrgProtectedBranches(ctx *context.Context) error {
+	orgRules, err := git_model.FindOrgProtectedBranchRules(ctx, ctx.Repo.Owner.ID)
+	if err != nil {
+		return err
+	}
+	if len(orgRules) == 0 {
+		return nil
+	}
+
+	teams, err := organization.FindOrgTeams(ctx, ctx.Repo.Owner.ID)
+	if err != nil {
+		return err
+	}
+	teamNames := make(map[int64]string, len(teams))
+	for _, t := range teams {
+		teamNames[t.ID] = t.Name
+	}
+	join := func(ids []int64) string {
+		names := make([]string, 0, len(ids))
+		for _, id := range ids {
+			if n, ok := teamNames[id]; ok {
+				names = append(names, n)
+			}
+		}
+		return strings.Join(names, ", ")
+	}
+
+	views := make([]*orgBranchProtectionView, len(orgRules))
+	for i, r := range orgRules {
+		views[i] = &orgBranchProtectionView{
+			Rule:           r,
+			PushTeams:      join(r.WhitelistTeamIDs),
+			ForcePushTeams: join(r.ForcePushAllowlistTeamIDs),
+			DeleteTeams:    join(r.DeleteAllowlistTeamIDs),
+			MergeTeams:     join(r.MergeWhitelistTeamIDs),
+			ApprovalTeams:  join(r.ApprovalsWhitelistTeamIDs),
+			StatusContexts: strings.Join(r.StatusCheckContexts, ", "),
+		}
+	}
+	ctx.Data["OrgProtectedBranches"] = views
+	return nil
+}
+
 // ProtectedBranchRules render the page to protect the repository
 func ProtectedBranchRules(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repo.settings.branches")
@@ -46,6 +104,26 @@ func ProtectedBranchRules(ctx *context.Context) {
 	}
 	ctx.Data["ProtectedBranches"] = rules
 
+	// Surface the organization-level rules that also apply to this repo (read-only),
+	// so admins can see the org "floor" that is layered on top of the repo's own
+	// rules at enforcement time. See issue #727.
+	if ctx.Repo.Owner.IsOrganization() {
+		if err := prepareOrgProtectedBranches(ctx); err != nil {
+			ctx.ServerError("prepareOrgProtectedBranches", err)
+			return
+		}
+		// Surface the org-wide push policy and the org repo defaults that apply to
+		// this repo (read-only, informational). See issue #738.
+		if err := prepareOrgPushPolicyView(ctx); err != nil {
+			ctx.ServerError("prepareOrgPushPolicyView", err)
+			return
+		}
+		if err := prepareOrgRepoDefaultsView(ctx); err != nil {
+			ctx.ServerError("prepareOrgRepoDefaultsView", err)
+			return
+		}
+	}
+
 	repo.PrepareBranchList(ctx)
 	if ctx.Written() {
 		return

routers/web/repo/setting/protected_tag.go

@@ -138,6 +138,13 @@ func DeleteProtectedTagPost(ctx *context.Context) {
 	ctx.Redirect(ctx.Repo.Repository.Link() + "/settings/tags")
 }
 
+// orgProtectedTagView is a read-only presentation of an org-level tag rule for the
+// repo settings page, with allowlist team IDs resolved to names.
+type orgProtectedTagView struct {
+	Rule  *git_model.OrgProtectedTag
+	Teams string
+}
+
 func setTagsContext(ctx *context.Context) error {
 	ctx.Data["Title"] = ctx.Tr("repo.settings.tags")
 	ctx.Data["PageIsSettingsTags"] = true
@@ -163,6 +170,36 @@ func setTagsContext(ctx *context.Context) error {
 			return err
 		}
 		ctx.Data["Teams"] = teams
+
+		// Surface the organization's tag protection rules read-only, so admins can see
+		// the org "floor" layered on top of this repo's own protected tags (#727).
+		orgRules, err := git_model.FindOrgProtectedTags(ctx, ctx.Repo.Owner.ID)
+		if err != nil {
+			ctx.ServerError("FindOrgProtectedTags", err)
+			return err
+		}
+		if len(orgRules) > 0 {
+			allTeams, err := organization.FindOrgTeams(ctx, ctx.Repo.Owner.ID)
+			if err != nil {
+				ctx.ServerError("FindOrgTeams", err)
+				return err
+			}
+			teamNames := make(map[int64]string, len(allTeams))
+			for _, t := range allTeams {
+				teamNames[t.ID] = t.Name
+			}
+			views := make([]*orgProtectedTagView, len(orgRules))
+			for i, r := range orgRules {
+				names := make([]string, 0, len(r.AllowlistTeamIDs))
+				for _, id := range r.AllowlistTeamIDs {
+					if n, ok := teamNames[id]; ok {
+						names = append(names, n)
+					}
+				}
+				views[i] = &orgProtectedTagView{Rule: r, Teams: strings.Join(names, ", ")}
+			}
+			ctx.Data["OrgProtectedTags"] = views
+		}
 	}
 
 	return nil

services/actions/notifier_helper.go

@@ -448,6 +448,24 @@ func notifyPackage(ctx context.Context, sender *user_model.User, pd *packages_mo
 }
 
 func ifNeedApproval(ctx context.Context, run *actions_model.ActionRun, repo *repo_model.Repository, user *user_model.User) (bool, error) {
+	canWrite := func(ctx context.Context, repo *repo_model.Repository, user *user_model.User) (bool, error) {
+		perm, err := access_model.GetDoerRepoPermission(ctx, repo, user)
+		if err != nil {
+			return false, err
+		}
+		return perm.CanWrite(unit_model.TypeActions), nil
+	}
+	return ifNeedApprovalWith(ctx, run, repo, user, canWrite, issues_model.HasMergedPullRequestInRepo)
+}
+
+func ifNeedApprovalWith(
+	ctx context.Context,
+	run *actions_model.ActionRun,
+	repo *repo_model.Repository,
+	user *user_model.User,
+	canWriteActions func(context.Context, *repo_model.Repository, *user_model.User) (bool, error),
+	hasMergedPR func(context.Context, int64, int64) (bool, error),
+) (bool, error) {
 	// 1. don't need approval if it's not a fork PR
 	// 2. don't need approval if the event is `pull_request_target` since the workflow will run in the context of base branch
 	// 		see https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
@@ -462,27 +480,24 @@ func ifNeedApproval(ctx context.Context, run *actions_model.ActionRun, repo *rep
 	}
 
 	// don't need approval if the user can write
-	if perm, err := access_model.GetDoerRepoPermission(ctx, repo, user); err != nil {
+	if ok, err := canWriteActions(ctx, repo, user); err != nil {
 		return false, fmt.Errorf("GetDoerRepoPermission: %w", err)
-	} else if perm.CanWrite(unit_model.TypeActions) {
+	} else if ok {
 		log.Trace("do not need approval because user %d can write", user.ID)
 		return false, nil
 	}
 
-	// don't need approval if the user has been approved before
-	if count, err := db.Count[actions_model.ActionRun](ctx, actions_model.FindRunOptions{
-		RepoID:        repo.ID,
-		TriggerUserID: user.ID,
-		Approved:      true,
-	}); err != nil {
-		return false, fmt.Errorf("CountRuns: %w", err)
-	} else if count > 0 {
-		log.Trace("do not need approval because user %d has been approved before", user.ID)
+	// trust the user only after a merged PR — matching GitHub Actions. Approving one
+	// fork PR's run must not implicitly trust later fork PRs that replace the workflow.
+	if merged, err := hasMergedPR(ctx, repo.ID, user.ID); err != nil {
+		return false, fmt.Errorf("HasMergedPullRequestInRepo: %w", err)
+	} else if merged {
+		log.Trace("do not need approval because user %d has a merged pull request in repo %d", user.ID, repo.ID)
 		return false, nil
 	}
 
 	// otherwise, need approval
-	log.Trace("need approval because it's the first time user %d triggered actions", user.ID)
+	log.Trace("need approval because user %d has no merged pull request in repo %d", user.ID, repo.ID)
 	return true, nil
 }
 

services/actions/notifier_helper_test.go

@@ -0,0 +1,102 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	actions_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/actions"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	actions_module "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/actions"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIfNeedApproval(t *testing.T) {
+	alwaysWrite := func(_ context.Context, _ *repo_model.Repository, _ *user_model.User) (bool, error) {
+		return true, nil
+	}
+	neverWrite := func(_ context.Context, _ *repo_model.Repository, _ *user_model.User) (bool, error) {
+		return false, nil
+	}
+	hasMerged := func(_ context.Context, _, _ int64) (bool, error) { return true, nil }
+	noMerged := func(_ context.Context, _, _ int64) (bool, error) { return false, nil }
+	errPerm := errors.New("perm error")
+	errMerge := errors.New("merge error")
+
+	forkRun := &actions_model.ActionRun{IsForkPullRequest: true, TriggerEvent: actions_module.GithubEventPullRequest}
+	nonForkRun := &actions_model.ActionRun{IsForkPullRequest: false, TriggerEvent: actions_module.GithubEventPullRequest}
+	prTargetRun := &actions_model.ActionRun{IsForkPullRequest: true, TriggerEvent: actions_module.GithubEventPullRequestTarget}
+
+	repo := &repo_model.Repository{ID: 1}
+	normalUser := &user_model.User{ID: 10}
+	restrictedUser := &user_model.User{ID: 11, IsRestricted: true}
+
+	t.Run("not a fork PR never needs approval", func(t *testing.T) {
+		need, err := ifNeedApprovalWith(t.Context(), nonForkRun, repo, normalUser, alwaysWrite, hasMerged)
+		require.NoError(t, err)
+		assert.False(t, need)
+	})
+
+	t.Run("pull_request_target never needs approval even when fork", func(t *testing.T) {
+		need, err := ifNeedApprovalWith(t.Context(), prTargetRun, repo, normalUser, alwaysWrite, hasMerged)
+		require.NoError(t, err)
+		assert.False(t, need)
+	})
+
+	t.Run("restricted user always needs approval", func(t *testing.T) {
+		need, err := ifNeedApprovalWith(t.Context(), forkRun, repo, restrictedUser, alwaysWrite, hasMerged)
+		require.NoError(t, err)
+		assert.True(t, need)
+	})
+
+	t.Run("fork PR with write permission does not need approval", func(t *testing.T) {
+		need, err := ifNeedApprovalWith(t.Context(), forkRun, repo, normalUser, alwaysWrite, noMerged)
+		require.NoError(t, err)
+		assert.False(t, need)
+	})
+
+	t.Run("fork PR with merged PR but no write permission does not need approval", func(t *testing.T) {
+		need, err := ifNeedApprovalWith(t.Context(), forkRun, repo, normalUser, neverWrite, hasMerged)
+		require.NoError(t, err)
+		assert.False(t, need)
+	})
+
+	t.Run("fork PR with no write and no merged PR needs approval", func(t *testing.T) {
+		need, err := ifNeedApprovalWith(t.Context(), forkRun, repo, normalUser, neverWrite, noMerged)
+		require.NoError(t, err)
+		assert.True(t, need)
+	})
+
+	t.Run("canWriteActions error is propagated", func(t *testing.T) {
+		failWrite := func(_ context.Context, _ *repo_model.Repository, _ *user_model.User) (bool, error) {
+			return false, errPerm
+		}
+		_, err := ifNeedApprovalWith(t.Context(), forkRun, repo, normalUser, failWrite, noMerged)
+		require.ErrorIs(t, err, errPerm)
+	})
+
+	t.Run("hasMergedPR error is propagated", func(t *testing.T) {
+		failMerge := func(_ context.Context, _, _ int64) (bool, error) { return false, errMerge }
+		_, err := ifNeedApprovalWith(t.Context(), forkRun, repo, normalUser, neverWrite, failMerge)
+		require.ErrorIs(t, err, errMerge)
+	})
+
+	t.Run("restricted user skips permission check entirely", func(t *testing.T) {
+		// The perm and merge functions must not be called for a restricted user.
+		called := false
+		trackWrite := func(_ context.Context, _ *repo_model.Repository, _ *user_model.User) (bool, error) {
+			called = true
+			return true, nil
+		}
+		need, err := ifNeedApprovalWith(t.Context(), forkRun, repo, restrictedUser, trackWrite, noMerged)
+		require.NoError(t, err)
+		assert.True(t, need)
+		assert.False(t, called, "permission check must not run for restricted user")
+	})
+}

services/auth/basic.go

@@ -176,7 +176,8 @@ func validateTOTP(req *http.Request, u *user_model.User) error {
 		}
 		return err
 	}
-	if ok, err := twofa.ValidateTOTP(req.Header.Get("X-Gitea-OTP")); err != nil {
+	// Consume the passcode atomically so a captured OTP cannot be replayed within its validity window.
+	if ok, err := twofa.ValidateAndConsumeTOTP(req.Context(), req.Header.Get("X-Gitea-OTP")); err != nil {
 		return err
 	} else if !ok {
 		return util.NewInvalidArgumentErrorf("invalid provided OTP")

services/auth/source/oauth2/source_sync.go

@@ -88,8 +88,8 @@ func (source *Source) refresh(ctx context.Context, provider goth.Provider, u *us
 				}
 			}
 
-			// Delete stored tokens, since they are invalid. This
-			// also provents us from checking this in subsequent runs.
+			// HINT: OAUTH-AUTO-SYNC-USER-ACTIVATION
+			// Delete stored tokens, since they are invalid. This also prevents us from checking this in subsequent runs.
 			u.AccessToken = ""
 			u.RefreshToken = ""
 			u.ExpiresAt = time.Time{}

services/auth/source/oauth2/source_sync_test.go

@@ -57,12 +57,7 @@ func TestSource(t *testing.T) {
 			err := source.refresh(t.Context(), provider, e)
 			assert.NoError(t, err)
 
-			e := &user_model.ExternalLoginUser{
-				ExternalID:    e.ExternalID,
-				LoginSourceID: e.LoginSourceID,
-			}
-
-			ok, err := user_model.GetExternalLogin(t.Context(), e)
+			e, ok, err := user_model.GetExternalLogin(t.Context(), e.LoginSourceID, e.ExternalID)
 			assert.NoError(t, err)
 			assert.True(t, ok)
 			assert.Equal(t, "refresh", e.RefreshToken)
@@ -82,12 +77,7 @@ func TestSource(t *testing.T) {
 			})
 			assert.NoError(t, err)
 
-			e := &user_model.ExternalLoginUser{
-				ExternalID:    e.ExternalID,
-				LoginSourceID: e.LoginSourceID,
-			}
-
-			ok, err := user_model.GetExternalLogin(t.Context(), e)
+			e, ok, err := user_model.GetExternalLogin(t.Context(), e.LoginSourceID, e.ExternalID)
 			assert.NoError(t, err)
 			assert.True(t, ok)
 			assert.Empty(t, e.RefreshToken)

services/convert/notification.go

@@ -24,19 +24,22 @@ func ToNotificationThread(ctx context.Context, n *activities_model.Notification)
 	}
 
 	// since user only get notifications when he has access to use minimal access mode
-	if n.Repository != nil {
-		perm, err := access_model.GetIndividualUserRepoPermission(ctx, n.Repository, n.User)
-		if err != nil {
-			log.Error("GetIndividualUserRepoPermission failed: %v", err)
-			return result
-		}
-		if perm.HasAnyUnitAccessOrPublicAccess() { // if user has been revoked access to repo, do not show repo info
-			result.Repository = ToRepo(ctx, n.Repository, perm)
-			// This permission is not correct and we should not be reporting it
-			for repository := result.Repository; repository != nil; repository = repository.Parent {
-				repository.Permissions = nil
-			}
-		}
+	if n.Repository == nil {
+		return result
+	}
+	perm, err := access_model.GetIndividualUserRepoPermission(ctx, n.Repository, n.User)
+	if err != nil {
+		log.Error("GetIndividualUserRepoPermission failed: %v", err)
+		return result
+	}
+	// if the user has been revoked access to the repo, do not leak repo or subject info
+	if !perm.HasAnyUnitAccessOrPublicAccess() {
+		return result
+	}
+	result.Repository = ToRepo(ctx, n.Repository, perm)
+	// This permission is not correct and we should not be reporting it
+	for repository := result.Repository; repository != nil; repository = repository.Parent {
+		repository.Permissions = nil
 	}
 
 	// handle Subject

services/convert/notification_test.go

@@ -39,6 +39,36 @@ func TestToNotificationThreadOmitsRepoWhenAccessRevoked(t *testing.T) {
 	assert.Nil(t, thread.Repository)
 }
 
+func TestToNotificationThreadOmitsSubjectWhenAccessRevoked(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	ctx := t.Context()
+	// repo 2 is private; user 4 has no access to it
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+	assert.NoError(t, repo.LoadOwner(ctx))
+	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 4, RepoID: repo.ID})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+
+	n := &activities_model.Notification{
+		ID:          12345,
+		UserID:      user.ID,
+		RepoID:      repo.ID,
+		Status:      activities_model.NotificationStatusUnread,
+		Source:      activities_model.NotificationSourceIssue,
+		IssueID:     issue.ID,
+		UpdatedUnix: timeutil.TimeStampNow(),
+		Issue:       issue,
+		Repository:  repo,
+		User:        user,
+	}
+
+	thread := ToNotificationThread(ctx, n)
+
+	// must not leak private issue metadata once access is revoked
+	assert.Nil(t, thread.Repository)
+	assert.Nil(t, thread.Subject)
+}
+
 func TestToNotificationThread(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 

services/issue/pull.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"time"
 
 	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
 	org_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/organization"
@@ -26,6 +27,10 @@ type ReviewRequestNotifier struct {
 
 var codeOwnerFiles = []string{"CODEOWNERS", "docs/CODEOWNERS", ".gitea/CODEOWNERS"}
 
+// codeOwnerMatchBudget caps the total wall-clock time spent evaluating all
+// CODEOWNERS rules against all changed files for a single PR.
+const codeOwnerMatchBudget = 2 * time.Second
+
 func IsCodeOwnerFile(f string) bool {
 	return slices.Contains(codeOwnerFiles, f)
 }
@@ -93,8 +98,17 @@ func PullRequestCodeOwnersReview(ctx context.Context, pr *issues_model.PullReque
 
 	uniqUsers := make(map[int64]*user_model.User)
 	uniqTeams := make(map[string]*org_model.Team)
+	// Bound the total time spent matching rules×files. The per-rule MatchTimeout
+	// only caps a single match; without an aggregate budget a crafted CODEOWNERS
+	// plus a PR touching many files could still exhaust CPU inside this loop.
+	matchDeadline := time.Now().Add(codeOwnerMatchBudget)
+ruleLoop:
 	for _, rule := range rules {
 		for _, f := range changedFiles {
+			if time.Now().After(matchDeadline) {
+				log.Warn("CODEOWNERS matching for PR %s#%d exceeded its time budget; some rules were not evaluated", pr.BaseRepo.FullName(), pr.ID)
+				break ruleLoop
+			}
 			shouldMatch := !rule.Negative
 			matched, _ := rule.Rule.MatchString(f) // err only happens when timeouts, any error can be considered as not matched
 			if matched == shouldMatch {

services/org/notifier.go

@@ -0,0 +1,92 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package org
+
+import (
+	"context"
+
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unit"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	notify_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/notify"
+	repo_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/repository"
+)
+
+// Init registers the org notifier so organization repository defaults are applied to
+// repositories as they are created in or transferred into the org. The notifier
+// pattern avoids the services/repository -> services/org import cycle.
+func Init() {
+	notify_service.RegisterNotifier(&repoDefaultsNotifier{})
+}
+
+type repoDefaultsNotifier struct {
+	notify_service.NullNotifier
+}
+
+func (n *repoDefaultsNotifier) CreateRepository(ctx context.Context, doer, u *user_model.User, repo *repo_model.Repository) {
+	applyOrgRepoDefaults(ctx, u, repo)
+}
+
+func (n *repoDefaultsNotifier) TransferRepository(ctx context.Context, doer *user_model.User, repo *repo_model.Repository, oldOwnerName string) {
+	applyOrgRepoDefaults(ctx, nil, repo)
+}
+
+// applyOrgRepoDefaults applies the owning organization's default repository settings
+// to a repo that has just joined the org. Best-effort: errors are logged and never
+// propagated, so a defaults bug can never break repository creation or transfer.
+func applyOrgRepoDefaults(ctx context.Context, owner *user_model.User, repo *repo_model.Repository) {
+	if owner == nil {
+		if err := repo.LoadOwner(ctx); err != nil {
+			log.Error("org repo defaults: load owner of repo %d: %v", repo.ID, err)
+			return
+		}
+		owner = repo.Owner
+	}
+	if owner == nil || !owner.IsOrganization() {
+		return
+	}
+
+	defaults, err := git_model.GetOrgRepoDefaults(ctx, owner.ID)
+	if err != nil {
+		log.Error("org repo defaults: load for org %d: %v", owner.ID, err)
+		return
+	}
+	if defaults == nil {
+		return
+	}
+
+	if defaults.ForcePrivate && !repo.IsPrivate {
+		repo.IsPrivate = true
+		if err := repo_model.UpdateRepositoryColsNoAutoTime(ctx, repo, "is_private"); err != nil {
+			log.Error("org repo defaults: force private on repo %d: %v", repo.ID, err)
+		}
+	}
+
+	if defaults.ApplyPRDefaults {
+		prUnit, err := repo.GetUnit(ctx, unit.TypePullRequests)
+		if err != nil {
+			// The repository may not have pull requests enabled; nothing to apply.
+			return
+		}
+		cfg := prUnit.PullRequestsConfig()
+		cfg.AllowMerge = defaults.AllowMerge
+		cfg.AllowRebase = defaults.AllowRebase
+		cfg.AllowRebaseMerge = defaults.AllowRebaseMerge
+		cfg.AllowSquash = defaults.AllowSquash
+		cfg.AllowFastForwardOnly = defaults.AllowFastForwardOnly
+		cfg.DefaultDeleteBranchAfterMerge = defaults.DeleteBranchAfterMerge
+		if defaults.DefaultMergeStyle != "" {
+			cfg.DefaultMergeStyle = repo_model.MergeStyle(defaults.DefaultMergeStyle)
+		}
+		if err := repo_service.UpdateRepositoryUnits(ctx, repo, []repo_model.RepoUnit{{
+			RepoID: repo.ID,
+			Type:   unit.TypePullRequests,
+			Config: cfg,
+		}}, nil); err != nil {
+			log.Error("org repo defaults: update PR unit on repo %d: %v", repo.ID, err)
+		}
+	}
+}

services/org/team.go

@@ -220,6 +220,13 @@ func AddTeamMember(ctx context.Context, team *organization.Team, user *user_mode
 		return err
 	}
 
+	// Enforce the organization email domain policy for new members.
+	if allowed, err := git_model.OrgEmailDomainAllowed(ctx, team.OrgID, user.Email); err != nil {
+		return err
+	} else if !allowed {
+		return git_model.ErrEmailDomainNotAllowed{Email: user.Email, OrgID: team.OrgID}
+	}
+
 	if err := organization.AddOrgUser(ctx, team.OrgID, user.ID); err != nil {
 		return err
 	}

services/release/release.go

@@ -92,7 +92,7 @@ func createTag(ctx context.Context, gitRepo *git.Repository, rel *repo_model.Rel
 
 			// Trim '--' prefix to prevent command line argument vulnerability.
 			rel.TagName = strings.TrimPrefix(rel.TagName, "--")
-			isAllowed, err := git_model.IsUserAllowedToControlTag(ctx, protectedTags, rel.TagName, rel.PublisherID)
+			isAllowed, err := git_model.IsUserAllowedToControlTagInRepo(ctx, protectedTags, rel.Repo, rel.TagName, rel.PublisherID)
 			if err != nil {
 				return false, err
 			}
@@ -439,7 +439,7 @@ func DeleteReleaseByID(ctx context.Context, repo *repo_model.Repository, rel *re
 		if err != nil {
 			return fmt.Errorf("GetProtectedTags: %w", err)
 		}
-		isAllowed, err := git_model.IsUserAllowedToControlTag(ctx, protectedTags, rel.TagName, doer.ID)
+		isAllowed, err := git_model.IsUserAllowedToControlTagInRepo(ctx, protectedTags, repo, rel.TagName, doer.ID)
 		if err != nil {
 			return err
 		}

services/repository/merge_upstream.go

@@ -8,7 +8,9 @@ import (
 	"fmt"
 
 	issue_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	access_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm/access"
 	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unit"
 	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/gitrepo"
@@ -26,6 +28,17 @@ func MergeUpstream(ctx reqctx.RequestContext, doer *user_model.User, repo *repo_
 	if err = repo.GetBaseRepo(ctx); err != nil {
 		return "", err
 	}
+
+	// The doer must still be able to read the base repository's code. Otherwise a fork created
+	// while the base repo was public could keep pulling commits after it turned private.
+	basePerm, err := access_model.GetDoerRepoPermission(ctx, repo.BaseRepo, doer)
+	if err != nil {
+		return "", err
+	}
+	if !basePerm.CanRead(unit.TypeCode) {
+		return "", util.NewPermissionDeniedErrorf("permission denied to read base repo %d", repo.BaseRepo.ID)
+	}
+
 	divergingInfo, err := GetUpstreamDivergingInfo(ctx, repo, branch)
 	if err != nil {
 		return "", err

services/security/code_scanner.go

@@ -0,0 +1,335 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package security
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+
+	security_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/security"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+)
+
+// CodeRule defines a pattern to detect insecure code patterns.
+type CodeRule struct {
+	ID          string
+	Title       string
+	Pattern     *regexp.Regexp
+	Severity    security_model.AlertSeverity
+	Description string
+	CWE         string
+	Languages   []string // file extensions this rule applies to (empty = all)
+}
+
+// DefaultCodeRules contains the built-in code security patterns.
+var DefaultCodeRules = []CodeRule{
+	// ── SQL Injection (CWE-89) ──────────────────────────────────────────
+	{
+		ID: "sqli-string-concat-go", Title: "SQL Injection: String Concatenation (Go)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-89",
+		Pattern:     regexp.MustCompile(`(?i)(?:db|tx|sess|engine|orm)\.\s*(?:Exec|Query|QueryRow|Raw|Where|And|Or|Select|SQL)\s*\(\s*(?:"[^"]*\s*\+|fmt\.Sprintf\s*\(\s*"[^"]*(?:%s|%v|%d))`),
+		Description: "SQL query built with string concatenation or fmt.Sprintf — use parameterized queries instead",
+		Languages:   []string{".go"},
+	},
+	{
+		ID: "sqli-string-concat-php", Title: "SQL Injection: String Concatenation (PHP)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-89",
+		Pattern:     regexp.MustCompile(`(?i)(?:mysql_query|mysqli_query|pg_query|\$(?:db|pdo|conn|dbo|mysqli)->(?:query|exec|prepare|execute))\s*\(\s*(?:["'][^"']*\.\s*\$|["'][^"']*\{\$)`),
+		Description: "SQL query built with variable interpolation — use prepared statements instead",
+		Languages:   []string{".php"},
+	},
+	{
+		ID: "sqli-string-concat-py", Title: "SQL Injection: String Concatenation (Python)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-89",
+		Pattern:     regexp.MustCompile(`(?i)(?:cursor|conn|db|engine)\.(?:execute|executemany|raw)\s*\(\s*(?:f["']|["'][^"']*%s|["'][^"']*\s*\+|["'][^"']*\.format\()`),
+		Description: "SQL query built with f-strings, %-formatting, or concatenation — use parameterized queries",
+		Languages:   []string{".py"},
+	},
+	{
+		ID: "sqli-string-concat-js", Title: "SQL Injection: String Concatenation (JS)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-89",
+		Pattern:     regexp.MustCompile("(?i)(?:query|execute|raw|knex\\.raw|sequelize\\.query)\\s*\\(\\s*(?:`[^`]*\\$\\{|[\"'][^\"']*\\s*\\+)"),
+		Description: "SQL query built with template literals or concatenation — use parameterized queries",
+		Languages:   []string{".js", ".ts", ".mjs", ".cjs"},
+	},
+
+	// ── Cross-Site Scripting / XSS (CWE-79) ─────────────────────────────
+	{
+		ID: "xss-innerhtml", Title: "XSS: innerHTML Assignment",
+		Severity: security_model.SeverityMedium, CWE: "CWE-79",
+		Pattern:     regexp.MustCompile(`(?i)\.innerHTML\s*[+]?=\s*(?:[^"'` + "`" + `]|$)`),
+		Description: "Direct innerHTML assignment with non-literal value — use textContent or sanitize first",
+		Languages:   []string{".js", ".ts", ".jsx", ".tsx", ".vue", ".svelte"},
+	},
+	{
+		ID: "xss-document-write", Title: "XSS: document.write()",
+		Severity: security_model.SeverityMedium, CWE: "CWE-79",
+		Pattern:     regexp.MustCompile(`(?i)document\.write(?:ln)?\s*\(`),
+		Description: "document.write() can execute injected scripts — use DOM APIs instead",
+		Languages:   []string{".js", ".ts", ".jsx", ".tsx"},
+	},
+	{
+		ID: "xss-echo-unescaped-php", Title: "XSS: Unescaped Output (PHP)",
+		Severity: security_model.SeverityMedium, CWE: "CWE-79",
+		Pattern:     regexp.MustCompile(`(?:echo|print)\s+\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\s*\[`),
+		Description: "Direct output of superglobal without escaping — use htmlspecialchars()",
+		Languages:   []string{".php"},
+	},
+	{
+		ID: "xss-dangerously-set-html", Title: "XSS: dangerouslySetInnerHTML (React)",
+		Severity: security_model.SeverityMedium, CWE: "CWE-79",
+		Pattern:     regexp.MustCompile(`dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:`),
+		Description: "dangerouslySetInnerHTML bypasses React's XSS protection — ensure input is sanitized",
+		Languages:   []string{".jsx", ".tsx", ".js", ".ts"},
+	},
+
+	// ── Command Injection (CWE-78) ──────────────────────────────────────
+	{
+		ID: "cmdi-exec-go", Title: "Command Injection: exec.Command with Variable (Go)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-78",
+		Pattern:     regexp.MustCompile(`exec\.Command\s*\(\s*(?:fmt\.Sprintf|[a-zA-Z_]+\s*\+|[a-zA-Z_]+\s*,)`),
+		Description: "exec.Command with dynamic arguments — validate and sanitize inputs",
+		Languages:   []string{".go"},
+	},
+	{
+		ID: "cmdi-shell-exec-php", Title: "Command Injection: Shell Execution (PHP)",
+		Severity: security_model.SeverityCritical, CWE: "CWE-78",
+		Pattern:     regexp.MustCompile(`(?i)(?:system|exec|passthru|shell_exec|popen|proc_open)\s*\(\s*\$`),
+		Description: "Shell command with variable input — use escapeshellarg() or avoid shell execution",
+		Languages:   []string{".php"},
+	},
+	{
+		ID: "cmdi-child-process-js", Title: "Command Injection: child_process (Node.js)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-78",
+		Pattern:     regexp.MustCompile("(?i)(?:child_process|exec|execSync|spawn|spawnSync)\\s*\\(\\s*(?:`[^`]*\\$\\{|[\"'][^\"']*\\s*\\+)"),
+		Description: "Shell command built with dynamic input — use array arguments or sanitize",
+		Languages:   []string{".js", ".ts", ".mjs", ".cjs"},
+	},
+	{
+		ID: "cmdi-subprocess-py", Title: "Command Injection: subprocess with shell=True (Python)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-78",
+		Pattern:     regexp.MustCompile(`(?i)subprocess\.(?:call|run|Popen|check_output|check_call)\s*\([^)]*shell\s*=\s*True`),
+		Description: "subprocess with shell=True is vulnerable to injection — use shell=False with list args",
+		Languages:   []string{".py"},
+	},
+	{
+		ID: "cmdi-os-system-py", Title: "Command Injection: os.system() (Python)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-78",
+		Pattern:     regexp.MustCompile(`(?i)os\.(?:system|popen)\s*\(\s*(?:f["']|[a-zA-Z_])`),
+		Description: "os.system/popen with dynamic input — use subprocess with shell=False instead",
+		Languages:   []string{".py"},
+	},
+
+	// ── Path Traversal (CWE-22) ─────────────────────────────────────────
+	{
+		ID: "path-traversal-join", Title: "Path Traversal: Unsanitized Path Join",
+		Severity: security_model.SeverityMedium, CWE: "CWE-22",
+		Pattern:     regexp.MustCompile(`(?i)(?:filepath\.Join|path\.join|os\.path\.join)\s*\([^)]*(?:ctx\.|req\.|r\.|request\.|params\.|query\.)`),
+		Description: "User input in file path join without sanitization — validate against directory traversal",
+		Languages:   []string{".go", ".js", ".ts", ".py"},
+	},
+	{
+		ID: "path-traversal-open", Title: "Path Traversal: File Open with User Input",
+		Severity: security_model.SeverityMedium, CWE: "CWE-22",
+		Pattern:     regexp.MustCompile(`(?i)(?:os\.Open|ioutil\.ReadFile|os\.ReadFile)\s*\(\s*(?:fmt\.Sprintf|[a-zA-Z_]+\s*\+)`),
+		Description: "File operation with dynamic path — sanitize and restrict to safe directories",
+		Languages:   []string{".go"},
+	},
+	{
+		ID: "path-traversal-php", Title: "Path Traversal: File Include/Open (PHP)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-22",
+		Pattern:     regexp.MustCompile(`(?i)(?:include|require|include_once|require_once|file_get_contents|fopen|readfile)\s*\(\s*\$`),
+		Description: "File operation with variable path — validate path against traversal",
+		Languages:   []string{".php"},
+	},
+
+	// ── Insecure Deserialization (CWE-502) ──────────────────────────────
+	{
+		ID: "deserialize-php", Title: "Insecure Deserialization: unserialize() (PHP)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-502",
+		Pattern:     regexp.MustCompile(`(?i)unserialize\s*\(\s*\$`),
+		Description: "unserialize() with untrusted data can lead to remote code execution",
+		Languages:   []string{".php"},
+	},
+	{
+		ID: "deserialize-yaml-py", Title: "Insecure Deserialization: yaml.load() (Python)",
+		Severity: security_model.SeverityHigh, CWE: "CWE-502",
+		Pattern:     regexp.MustCompile(`yaml\.load\s*\([^)]*(?:Loader\s*=\s*yaml\.(?:Unsafe|Full)Loader|[^)]*\)(?!\s*#))`),
+		Description: "yaml.load() without SafeLoader allows arbitrary code execution — use yaml.safe_load()",
+		Languages:   []string{".py"},
+	},
+
+	// ── Hardcoded Credentials in Code (CWE-798) ─────────────────────────
+	{
+		ID: "hardcoded-password-assignment", Title: "Hardcoded Password in Source",
+		Severity: security_model.SeverityHigh, CWE: "CWE-798",
+		Pattern:     regexp.MustCompile(`(?i)(?:password|passwd|pwd)\s*(?::=|=)\s*["'][^"']{8,}["']`),
+		Description: "Hardcoded password in source code — use environment variables or config",
+		Languages:   []string{".go", ".py", ".js", ".ts", ".php", ".rb", ".java"},
+	},
+
+	// ── Weak Cryptography (CWE-327) ─────────────────────────────────────
+	{
+		ID: "weak-crypto-md5", Title: "Weak Cryptography: MD5",
+		Severity: security_model.SeverityLow, CWE: "CWE-327",
+		Pattern:     regexp.MustCompile(`(?i)(?:md5\.New|hashlib\.md5|MD5\.Create|MessageDigest\.getInstance\s*\(\s*["']MD5)`),
+		Description: "MD5 is cryptographically broken — use SHA-256 or stronger for security purposes",
+		Languages:   []string{".go", ".py", ".cs", ".java"},
+	},
+	{
+		ID: "weak-crypto-sha1", Title: "Weak Cryptography: SHA-1 for Security",
+		Severity: security_model.SeverityLow, CWE: "CWE-327",
+		Pattern:     regexp.MustCompile(`(?i)(?:sha1\.New|hashlib\.sha1|SHA1\.Create|MessageDigest\.getInstance\s*\(\s*["']SHA-?1)`),
+		Description: "SHA-1 is deprecated for security — use SHA-256 or stronger",
+		Languages:   []string{".go", ".py", ".cs", ".java"},
+	},
+}
+
+// Language extensions for file filtering.
+var codeFileExtensions = map[string]bool{
+	".go": true, ".py": true, ".js": true, ".ts": true, ".jsx": true, ".tsx": true,
+	".php": true, ".rb": true, ".java": true, ".cs": true, ".rs": true,
+	".vue": true, ".svelte": true, ".mjs": true, ".cjs": true,
+}
+
+// CodeScanner implements the Scanner interface for code pattern analysis.
+type CodeScanner struct {
+	Rules []CodeRule
+}
+
+// NewCodeScanner creates a scanner with default code analysis rules.
+func NewCodeScanner() *CodeScanner {
+	return &CodeScanner{Rules: DefaultCodeRules}
+}
+
+func (s *CodeScanner) Type() security_model.ScannerType {
+	return security_model.ScannerCode
+}
+
+func (s *CodeScanner) ScanCommit(commit *git.Commit) ([]Finding, error) {
+	return s.ScanTree(commit)
+}
+
+func (s *CodeScanner) ScanTree(commit *git.Commit) ([]Finding, error) {
+	if commit == nil {
+		return nil, nil
+	}
+
+	entries, err := commit.ListEntriesRecursiveFast()
+	if err != nil {
+		return nil, fmt.Errorf("ListEntriesRecursiveFast: %w", err)
+	}
+
+	var findings []Finding
+	for _, entry := range entries {
+		if !entry.IsRegular() {
+			continue
+		}
+
+		path := entry.Name()
+		if shouldSkipFile(path) {
+			continue
+		}
+
+		ext := fileExtension(path)
+		if !codeFileExtensions[ext] {
+			continue
+		}
+
+		if entry.Blob().Size() > 1024*1024 {
+			continue
+		}
+
+		applicableRules := s.rulesForExtension(ext)
+		if len(applicableRules) == 0 {
+			continue
+		}
+
+		reader, err := entry.Blob().DataAsync()
+		if err != nil {
+			log.Trace("CodeScanner: skip %s: %v", path, err)
+			continue
+		}
+
+		fileFindings := s.scanReader(reader, path, commit.ID.String(), applicableRules)
+		reader.Close()
+		findings = append(findings, fileFindings...)
+	}
+
+	return findings, nil
+}
+
+func (s *CodeScanner) rulesForExtension(ext string) []CodeRule {
+	var rules []CodeRule
+	for _, rule := range s.Rules {
+		if len(rule.Languages) == 0 {
+			rules = append(rules, rule)
+			continue
+		}
+		for _, lang := range rule.Languages {
+			if lang == ext {
+				rules = append(rules, rule)
+				break
+			}
+		}
+	}
+	return rules
+}
+
+func (s *CodeScanner) scanReader(r io.Reader, filePath, commitSHA string, rules []CodeRule) []Finding {
+	var findings []Finding
+	scanner := bufio.NewScanner(r)
+	lineNum := 0
+
+	for scanner.Scan() {
+		lineNum++
+		line := scanner.Text()
+
+		trimmed := strings.TrimSpace(line)
+		if isCommentLine(trimmed) {
+			continue
+		}
+
+		for _, rule := range rules {
+			if rule.Pattern.MatchString(line) {
+				fingerprint := fmt.Sprintf("%x", sha256.Sum256([]byte(rule.ID+":"+filePath+":"+line)))
+				findings = append(findings, Finding{
+					Scanner:     security_model.ScannerCode,
+					Severity:    rule.Severity,
+					RuleID:      rule.ID,
+					Title:       rule.Title,
+					Description: rule.Description + " [" + rule.CWE + "]",
+					FilePath:    filePath,
+					LineNumber:  lineNum,
+					CommitSHA:   commitSHA,
+					Fingerprint: fingerprint[:32],
+					Metadata:    fmt.Sprintf(`{"cwe":"%s"}`, rule.CWE),
+				})
+				break
+			}
+		}
+	}
+	return findings
+}
+
+func fileExtension(path string) string {
+	lower := strings.ToLower(path)
+	if i := strings.LastIndex(lower, "."); i >= 0 {
+		return lower[i:]
+	}
+	return ""
+}
+
+func isCommentLine(line string) bool {
+	return strings.HasPrefix(line, "//") ||
+		strings.HasPrefix(line, "#") ||
+		strings.HasPrefix(line, "*") ||
+		strings.HasPrefix(line, "/*") ||
+		strings.HasPrefix(line, "<!--")
+}

services/security/orchestrator.go

@@ -6,6 +6,7 @@ package security
 import (
 	"context"
 
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
 	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
 	security_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/security"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
@@ -21,7 +22,11 @@ func ScanPushForSecrets(ctx context.Context, repoID int64, commit *git.Commit) [
 		return nil
 	}
 	if !cfg.Enabled || !cfg.BlockOnPush || !cfg.SecretScanner {
-		return nil
+		// The owning organization may mandate secret blocking regardless of the
+		// repository's own scanner config (org push policy).
+		if !orgRequiresSecretBlock(ctx, repoID) {
+			return nil
+		}
 	}
 
 	scanner := NewSecretScanner()
@@ -33,6 +38,22 @@ func ScanPushForSecrets(ctx context.Context, repoID int64, commit *git.Commit) [
 	return findings
 }
 
+// orgRequiresSecretBlock reports whether the repo's owning organization mandates
+// secret blocking on push via its org push policy.
+func orgRequiresSecretBlock(ctx context.Context, repoID int64) bool {
+	repo, err := repo_model.GetRepositoryByID(ctx, repoID)
+	if err != nil {
+		log.Error("orgRequiresSecretBlock: GetRepositoryByID: %v", err)
+		return false
+	}
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, repo)
+	if err != nil {
+		log.Error("orgRequiresSecretBlock: GetOrgPushPolicyForRepo: %v", err)
+		return false
+	}
+	return policy != nil && policy.RequireSecretBlock
+}
+
 // ScanOnPush runs enabled scanners against a commit pushed to the default branch.
 // Called from services/repository/push.go on default branch pushes.
 func ScanOnPush(ctx context.Context, repo *repo_model.Repository, commit *git.Commit) {
@@ -56,8 +77,9 @@ func ScanOnPush(ctx context.Context, repo *repo_model.Repository, commit *git.Co
 	if cfg.DependScanner {
 		scanners = append(scanners, NewDependencyScanner())
 	}
-	// Future scanners added here:
-	// if cfg.CodeScanner { scanners = append(scanners, NewCodeScanner()) }
+	if cfg.CodeScanner {
+		scanners = append(scanners, NewCodeScanner())
+	}
 
 	if len(scanners) == 0 {
 		return

templates/repo/issue/sidebar/issue_type.tmpl

@@ -2,7 +2,7 @@
 <div class="divider"></div>
 <div class="tw-flex tw-items-center tw-justify-between tw-gap-2">
 	<span class="text grey tw-text-sm">{{ctx.Locale.Tr "repo.issues.type"}}</span>
-	{{$canModify := and .FieldEditFlags .FieldEditFlags.CustomFields}}
+	{{$canModify := .HasIssuesOrPullsWritePermission}}
 	{{if $canModify}}
 		<form method="post" action="{{.RepoLink}}/issues/{{.Issue.ID}}/custom-type" class="tw-inline">
 			{{$.CsrfTokenHtml}}

templates/repo/settings/branches.tmpl

@@ -62,6 +62,180 @@
 					{{end}}
 				</div>
 			</div>
+
+			{{if .OrgProtectedBranches}}
+				<h4 class="ui top attached header">
+					{{ctx.Locale.Tr "repo.settings.org_protected_branch"}}
+				</h4>
+				<div class="ui attached segment">
+					<p class="tw-mb-3">{{ctx.Locale.Tr "repo.settings.org_protected_branch_desc"}}</p>
+					<div class="flex-divided-list items-with-main">
+						{{range .OrgProtectedBranches}}
+							<div class="item">
+								<div class="item-main tw-w-full">
+									<details class="tw-w-full">
+										<summary class="tw-flex tw-items-center tw-gap-2 tw-flex-wrap tw-cursor-pointer">
+											<div class="ui basic label">{{.Rule.RuleName}}</div>
+											<span class="ui tiny label">{{svg "octicon-organization" 12}} {{ctx.Locale.Tr "repo.settings.org_protected_branch.inherited"}}</span>
+											<span class="text grey tw-text-sm">{{svg "octicon-lock" 12}} {{ctx.Locale.Tr "repo.settings.org_protected_branch.read_only"}}</span>
+										</summary>
+										<table class="ui very basic compact table tw-mt-2 tw-w-auto tw-ml-4">
+											<tbody>
+												<tr>
+													<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.direct_push"}}</td>
+													<td>{{if not .Rule.CanPush}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.blocked"}}{{else if .Rule.EnableWhitelist}}{{if .PushTeams}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.teams" .PushTeams}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.restricted"}}{{end}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.write_access"}}{{end}}</td>
+												</tr>
+												<tr>
+													<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.force_push"}}</td>
+													<td>{{if not .Rule.CanForcePush}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.blocked"}}{{else if .Rule.EnableForcePushAllowlist}}{{if .ForcePushTeams}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.teams" .ForcePushTeams}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.restricted"}}{{end}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.allowed"}}{{end}}</td>
+												</tr>
+												<tr>
+													<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.deletion"}}</td>
+													<td>{{if not .Rule.CanDelete}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.blocked"}}{{else if .Rule.EnableDeleteAllowlist}}{{if .DeleteTeams}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.teams" .DeleteTeams}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.restricted"}}{{end}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.allowed"}}{{end}}</td>
+												</tr>
+												{{if gt .Rule.RequiredApprovals 0}}
+													<tr>
+														<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.approvals"}}</td>
+														<td>{{.Rule.RequiredApprovals}}{{if .ApprovalTeams}} ({{.ApprovalTeams}}){{end}}</td>
+													</tr>
+												{{end}}
+												{{if .Rule.EnableMergeWhitelist}}
+													<tr>
+														<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.merge"}}</td>
+														<td>{{if .MergeTeams}}{{.MergeTeams}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.restricted"}}{{end}}</td>
+													</tr>
+												{{end}}
+												{{if .Rule.EnableStatusCheck}}
+													<tr>
+														<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.status_check"}}</td>
+														<td>{{if .StatusContexts}}{{.StatusContexts}}{{else}}{{ctx.Locale.Tr "repo.settings.org_protected_branch.any"}}{{end}}</td>
+													</tr>
+												{{end}}
+												{{if .Rule.RequireSignedCommits}}
+													<tr>
+														<td class="tw-font-semibold">{{ctx.Locale.Tr "repo.settings.org_protected_branch.signed"}}</td>
+														<td>{{svg "octicon-check" 14}}</td>
+													</tr>
+												{{end}}
+												{{if .Rule.ProtectedFilePatterns}}
+													<tr>
+														<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.protected_files"}}</td>
+														<td><code>{{.Rule.ProtectedFilePatterns}}</code></td>
+													</tr>
+												{{end}}
+												{{if or .Rule.BlockOnOutdatedBranch .Rule.BlockOnRejectedReviews .Rule.BlockAdminMergeOverride}}
+													<tr>
+														<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_protected_branch.also"}}</td>
+														<td>
+															<div class="tw-flex tw-gap-1 tw-flex-wrap">
+																{{if .Rule.BlockOnOutdatedBranch}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_protected_branch.block_outdated"}}</span>{{end}}
+																{{if .Rule.BlockOnRejectedReviews}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_protected_branch.block_rejected"}}</span>{{end}}
+																{{if .Rule.BlockAdminMergeOverride}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_protected_branch.block_admin"}}</span>{{end}}
+															</div>
+														</td>
+													</tr>
+												{{end}}
+											</tbody>
+										</table>
+									</details>
+								</div>
+							</div>
+						{{end}}
+					</div>
+				</div>
+			{{end}}
+
+			{{if .OrgPushPolicy}}
+				<h4 class="ui top attached header">
+					{{ctx.Locale.Tr "repo.settings.org_push_policy"}}
+				</h4>
+				<div class="ui attached segment">
+					<p class="tw-mb-3">
+						{{svg "octicon-organization" 12}} {{ctx.Locale.Tr "repo.settings.org_push_policy.inherited"}}
+						<span class="text grey tw-text-sm tw-ml-2">{{svg "octicon-lock" 12}} {{ctx.Locale.Tr "repo.settings.org_push_policy.read_only"}}</span>
+					</p>
+					<p class="tw-mb-3">{{ctx.Locale.Tr "repo.settings.org_push_policy_desc"}}</p>
+					<table class="ui very basic compact table tw-w-auto">
+						<tbody>
+							{{if .OrgPushPolicy.BranchNamePattern}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.branch_pattern"}}</td>
+									<td><code>{{.OrgPushPolicy.BranchNamePattern}}</code></td>
+								</tr>
+							{{end}}
+							{{if .OrgPushPolicy.TagNamePattern}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.tag_pattern"}}</td>
+									<td><code>{{.OrgPushPolicy.TagNamePattern}}</code></td>
+								</tr>
+							{{end}}
+							{{if .OrgPushPolicy.RequireSecretBlock}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.require_secret_block"}}</td>
+									<td>{{svg "octicon-check" 14}} {{ctx.Locale.Tr "repo.settings.org_push_policy.enabled"}}</td>
+								</tr>
+							{{end}}
+							{{if gt .OrgPushPolicy.MaxFileSize 0}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.max_file_size"}}</td>
+									<td>{{FileSize .OrgPushPolicy.MaxFileSize}}</td>
+								</tr>
+							{{end}}
+							{{if .OrgPushPolicy.BlockedFilePatterns}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.blocked_files"}}</td>
+									<td><code>{{.OrgPushPolicy.BlockedFilePatterns}}</code></td>
+								</tr>
+							{{end}}
+						</tbody>
+					</table>
+				</div>
+			{{end}}
+
+			{{if .OrgRepoDefaults}}
+				<h4 class="ui top attached header">
+					{{ctx.Locale.Tr "repo.settings.org_repo_defaults"}}
+				</h4>
+				<div class="ui attached segment">
+					<p class="tw-mb-3">
+						{{svg "octicon-organization" 12}} {{ctx.Locale.Tr "repo.settings.org_repo_defaults.inherited"}}
+						<span class="text grey tw-text-sm tw-ml-2">{{svg "octicon-lock" 12}} {{ctx.Locale.Tr "repo.settings.org_repo_defaults.read_only"}}</span>
+					</p>
+					<p class="tw-mb-3">{{ctx.Locale.Tr "repo.settings.org_repo_defaults_desc"}}</p>
+					<table class="ui very basic compact table tw-w-auto">
+						<tbody>
+							<tr>
+								<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.force_private"}}</td>
+								<td>{{if .OrgRepoDefaults.ForcePrivate}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.enabled"}}{{else}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.disabled"}}{{end}}</td>
+							</tr>
+							{{if .OrgRepoDefaults.ApplyPRDefaults}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.merge_styles"}}</td>
+									<td>
+										<div class="tw-flex tw-gap-1 tw-flex-wrap">
+											{{if .OrgRepoDefaults.AllowMerge}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_merge"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowRebase}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_rebase"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowRebaseMerge}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_rebase_merge"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowSquash}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_squash"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowFastForwardOnly}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_fast_forward_only"}}</span>{{end}}
+										</div>
+									</td>
+								</tr>
+								{{if .OrgRepoDefaults.DefaultMergeStyle}}
+									<tr>
+										<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.default_merge_style"}}</td>
+										<td><code>{{.OrgRepoDefaults.DefaultMergeStyle}}</code></td>
+									</tr>
+								{{end}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.delete_branch_after_merge"}}</td>
+									<td>{{if .OrgRepoDefaults.DeleteBranchAfterMerge}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.enabled"}}{{else}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.disabled"}}{{end}}</td>
+								</tr>
+							{{end}}
+						</tbody>
+					</table>
+				</div>
+			{{end}}
 		{{end}}
 	</div>