Files
Jonathan Miller 1a4d0739db fix(permissions): admin teams implicitly inherit access to all unit types
Admin-level teams (team.authorize >= Admin) now implicitly get admin
access to all unit types in UnitMaxAccess(), even without explicit
TeamUnit records. This resolves the long-standing TEAM-UNIT-PERMISSION
issue where adding new units (like TypeLicenses) left existing admin
teams without access.

Resolves: #304

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-05-31 09:00:49 -05:00

97 lines
3.7 KiB
Handlebars

<div class="ui six wide column">
<h4 class="ui top attached header">
<strong>{{.Team.Name}}</strong>
<div class="ui right">
{{if .Team.IsMember ctx $.SignedUser.ID}}
<form>
<button class="ui red mini compact button delete-button" data-modal-id="leave-team-sidebar"
data-url="{{.OrgLink}}/teams/{{.Team.LowerName | PathEscape}}/action/leave" data-datauid="{{$.SignedUser.ID}}"
data-name="{{.Team.Name}}">{{ctx.Locale.Tr "org.teams.leave"}}</button>
</form>
{{else if .IsOrganizationOwner}}
<form method="post" action="{{.OrgLink}}/teams/{{.Team.LowerName | PathEscape}}/action/join">
<input type="hidden" name="page" value="team">
<button type="submit" class="ui primary mini compact button" name="uid" value="{{$.SignedUser.ID}}">{{ctx.Locale.Tr "org.teams.join"}}</button>
</form>
{{end}}
</div>
</h4>
<div class="ui attached table segment detail">
<div class="item">
{{if .Team.Description}}
{{.Team.Description}}
{{else}}
<span class="tw-text-text-light tw-italic">{{ctx.Locale.Tr "org.teams.no_desc"}}</span>
{{end}}
</div>
{{if eq .Team.LowerName "owners"}}
<div class="item">
<p>{{ctx.Locale.Tr "org.teams.owners_permission_desc"}}</p>
<p>{{ctx.Locale.Tr "org.teams.owners_permission_suggestion"}}</p>
</div>
{{else}}
<div class="item">
<h3>{{ctx.Locale.Tr "org.team_access_desc"}}</h3>
<ul>
{{if .Team.IncludesAllRepositories}}
<li>{{ctx.Locale.Tr "org.teams.all_repositories"}}</li>
{{else}}
<li>{{ctx.Locale.Tr "org.teams.specific_repositories"}}</li>
{{end}}
{{if .Team.CanCreateOrgRepo}}
<li>{{ctx.Locale.Tr "org.teams.can_create_org_repo"}}</li>
{{end}}
</ul>
{{/* the AccessMode should be either none or admin/owner, the real permissions are provided by each team unit */}}
{{if false}}{{/*(eq .Team.AccessMode 2)*/}}
<h3>{{ctx.Locale.Tr "org.settings.permission"}}</h3>
{{ctx.Locale.Tr "org.teams.write_permission_desc"}}
{{else if (eq .Team.AccessMode 3)}}
{{/* Admin teams implicitly have admin access to all units (including newly added ones) */}}
<h3>{{ctx.Locale.Tr "org.settings.permission"}}</h3>
{{ctx.Locale.Tr "org.teams.admin_permission_desc"}}
{{else}}
<table class="ui table">
<thead>
<tr>
<th>{{ctx.Locale.Tr "units.unit"}}</th>
<th>{{ctx.Locale.Tr "org.team_permission_desc"}}</th>
</tr>
</thead>
<tbody>
{{range $t, $unit := $.Units}}
{{if (not $unit.Type.UnitGlobalDisabled)}}
<tr>
<td><strong>{{ctx.Locale.Tr $unit.NameKey}}</strong></td>
<td>{{if eq ($.Team.UnitAccessMode ctx $unit.Type) 0 -}}
{{ctx.Locale.Tr "org.teams.none_access"}}
{{- else if or (eq $.Team.ID 0) (eq ($.Team.UnitAccessMode ctx $unit.Type) 1) -}}
{{ctx.Locale.Tr "org.teams.read_access"}}
{{- else if eq ($.Team.UnitAccessMode ctx $unit.Type) 2 -}}
{{ctx.Locale.Tr "org.teams.write_access"}}
{{- end}}</td>
</tr>
{{end}}
{{end}}
</tbody>
</table>
{{end}}
</div>
{{end}}
</div>
{{if .IsOrganizationOwner}}
<div class="ui bottom attached segment">
<a class="ui small button" href="{{.OrgLink}}/teams/{{.Team.LowerName | PathEscape}}/edit">{{svg "octicon-gear"}} {{ctx.Locale.Tr "org.teams.settings"}}</a>
</div>
{{end}}
</div>
<div class="ui g-modal-confirm delete modal" id="leave-team-sidebar">
<div class="header">
{{ctx.Locale.Tr "org.teams.leave"}}
</div>
<div class="content">
<p>{{ctx.Locale.Tr "org.teams.leave.detail" (HTMLFormat `<span class="%s"></span>` "name")}}</p>
</div>
{{template "base/modal_actions_confirm" .}}
</div>