Receiving release notifications for unavailable repositories.

[tsvetiligo]

Description

I still receive email notifications for repositories which I don't have access anymore (links in email show me 404).
I believe I don't suppose to get this notifications because release notes I see in email for private repositories may contain private information.

Gitea Version

1.22.3

How are you running Gitea?

docker

[yp05327]

Can you provide more details/information to help us reproduce this issue?

• the owner type of these repos (organization/individual)

• I don't have access anymore

For organization repos, removed from teams? For individual repos, removed from the contributor list?

[tsvetiligo]

The owner type of these repos in organization. I was removed from team.

[hiifong]

I used the main branch for testing, and I can continue to access the organization's private repository after being removed by the organization.

I forgot, I am using the super administrator account.

[hiifong]

The owner type of these repos in organization. I was removed from team.

Could you provide detailed steps to reproduce?

[yp05327]

Related to the watch list? When user leave the org, but the watch list not updated, then he can also receive the notification mails.

[tsvetiligo]

Related to the watch list? When user leave the org, but the watch list not updated, then he can also receive the notification mails.

Yes. Before I was removed from org, this repository was in my watch list. Now my watch list is empty.

[yp05327]

I check the code and tested in my local server. The watch list will be updated when user was remove from org. 🤔

[hiifong]

I check the code and tested in my local server. The watch list will be updated when user was remove from org. 🤔

If you are a super admin, watch list will not be updated. But it seems to have nothing to do with this issue.

[yp05327]

something is wrong in func (env *accessibleReposEnv) RepoIDs(page, pageSize int) ([]int64, error), I will take a look.

[yp05327]

The root problem is that we are using ReconsiderWatches to remove watches, and it will check whether user can access these repos anymore. If not then remove the watch. But global admin has the top permission, so he can always access these repos. Then watch will not be removed.

And why this check is necessary: sometimes the user maybe a collaborator. So even we remove the user from the org, he will not lose the access to the repo.