Fix invalid issues in project boards

models/issues/issue.go

@@ -12,8 +12,10 @@ import (
 	"slices"
 
 	"code.gitea.io/gitea/models/db"
+	access_model "code.gitea.io/gitea/models/perm/access"
 	project_model "code.gitea.io/gitea/models/project"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
@@ -442,6 +444,28 @@ func (issue *Issue) IsPoster(uid int64) bool {
 	return issue.OriginalAuthorID == 0 && issue.PosterID == uid
 }
 
+func (issues IssueList) FilterValidByDoer(ctx context.Context, doer *user_model.User) (IssueList, error) {
+	repos, err := issues.LoadRepositories(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	validRepoIDs := make(container.Set[int64], len(repos))
+	for _, repo := range repos {
+		if access_model.CheckRepoUnitUser(ctx, repo, doer, unit.TypeIssues) {
+			validRepoIDs.Add(repo.ID)
+		}
+	}
+
+	issueList := issues[:0]
+	for _, issue := range issues {
+		if validRepoIDs.Contains(issue.RepoID) {
+			issueList = append(issueList, issue)
+		}
+	}
+	return issueList, nil
+}
+
 // GetTasks returns the amount of tasks in the issues content
 func (issue *Issue) GetTasks() int {
 	return len(issueTasksPat.FindAllStringIndex(issue.Content, -1))

models/issues/issue_project.go

@@ -9,7 +9,9 @@ import (
 
 	"code.gitea.io/gitea/models/db"
 	project_model "code.gitea.io/gitea/models/project"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/optional"
 )
 
 // LoadProject load the project the issue was assigned to
@@ -48,30 +50,40 @@ func (issue *Issue) ProjectBoardID(ctx context.Context) int64 {
 }
 
 // LoadIssuesFromBoard load issues assigned to this board
-func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board) (IssueList, error) {
+func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board, doer *user_model.User, isClosed optional.Option[bool]) (IssueList, error) {
 	issueList := make(IssueList, 0, 10)
 
 	if b.ID > 0 {
 		issues, err := Issues(ctx, &IssuesOptions{
 			ProjectBoardID: b.ID,
 			ProjectID:      b.ProjectID,
 			SortType:       "project-column-sorting",
+			IsClosed:       isClosed,
 		})
 		if err != nil {
 			return nil, err
 		}
-		issueList = issues
+		issues, err = issues.FilterValidByDoer(ctx, doer)
+		if err != nil {
+			return nil, err
+		}
+		issueList = append(issueList, issues...)
 	}
 
 	if b.Default {
 		issues, err := Issues(ctx, &IssuesOptions{
 			ProjectBoardID: db.NoConditionID,
 			ProjectID:      b.ProjectID,
 			SortType:       "project-column-sorting",
+			IsClosed:       isClosed,
 		})
 		if err != nil {
 			return nil, err
 		}
+		issues, err = issues.FilterValidByDoer(ctx, doer)
+		if err != nil {
+			return nil, err
+		}
 		issueList = append(issueList, issues...)
 	}
 
@@ -83,18 +95,52 @@ func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board) (IssueList
 }
 
 // LoadIssuesFromBoardList load issues assigned to the boards
-func LoadIssuesFromBoardList(ctx context.Context, bs project_model.BoardList) (map[int64]IssueList, error) {
+func LoadIssuesFromBoardList(ctx context.Context, bs project_model.BoardList, doer *user_model.User, isClosed optional.Option[bool]) (map[int64]IssueList, error) {
+	if unit.TypeIssues.UnitGlobalDisabled() {
+		return nil, nil
+	}
 	issuesMap := make(map[int64]IssueList, len(bs))
-	for i := range bs {
-		il, err := LoadIssuesFromBoard(ctx, bs[i])
+	for _, b := range bs {
+		il, err := LoadIssuesFromBoard(ctx, b, doer, isClosed)
 		if err != nil {
 			return nil, err
 		}
-		issuesMap[bs[i].ID] = il
+		issuesMap[b.ID] = il
 	}
 	return issuesMap, nil
 }
 
+// NumIssuesInProjects returns counter of all issues assigned to a project list which doer can access
+func NumIssuesInProjects(ctx context.Context, pl project_model.ProjectList, doer *user_model.User, isClosed optional.Option[bool]) (map[int64]int, error) {
+	numMap := make(map[int64]int, len(pl))
+	for _, p := range pl {
+		num, err := NumIssuesInProject(ctx, p, doer, isClosed)
+		if err != nil {
+			return nil, err
+		}
+		numMap[p.ID] = num
+	}
+
+	return numMap, nil
+}
+
+// NumIssuesInProject returns counter of all issues assigned to a project which doer can access
+func NumIssuesInProject(ctx context.Context, p *project_model.Project, doer *user_model.User, isClosed optional.Option[bool]) (int, error) {
+	numIssuesInProject := int(0)
+	bs, err := p.GetBoards(ctx)
+	if err != nil {
+		return 0, err
+	}
+	im, err := LoadIssuesFromBoardList(ctx, bs, doer, isClosed)
+	if err != nil {
+		return 0, err
+	}
+	for _, il := range im {
+		numIssuesInProject += len(il)
+	}
+	return numIssuesInProject, nil
+}
+
 // ChangeProjectAssign changes the project associated with an issue
 func ChangeProjectAssign(ctx context.Context, issue *Issue, doer *user_model.User, newProjectID int64) error {
 	ctx, committer, err := db.TxContext(ctx)
@@ -123,8 +169,11 @@ func addUpdateIssueProject(ctx context.Context, issue *Issue, doer *user_model.U
 		if err != nil {
 			return err
 		}
-		if newProject.RepoID != issue.RepoID && newProject.OwnerID != issue.Repo.OwnerID {
-			return fmt.Errorf("issue's repository is not the same as project's repository")
+
+		if canWriteByDoer, err := newProject.CanWriteByDoer(ctx, issue.Repo, doer); err != nil {
+			return err
+		} else if !canWriteByDoer {
+			return fmt.Errorf("doer have no write permission to project [id:%d]", newProjectID)
 		}
 	}
 

models/perm/access/repo_permission.go

@@ -424,3 +424,17 @@ func CheckRepoUnitUser(ctx context.Context, repo *repo_model.Repository, user *u
 
 	return perm.CanRead(unitType)
 }
+
+// CheckRepoUnitWriteUser check whether user could write the unit of this repository
+func CheckRepoUnitWriteUser(ctx context.Context, repo *repo_model.Repository, user *user_model.User, unitType unit.Type) bool {
+	if user != nil && user.IsAdmin {
+		return true
+	}
+	perm, err := GetUserRepoPermission(ctx, repo, user)
+	if err != nil {
+		log.Error("GetUserRepoPermission: %w", err)
+		return false
+	}
+
+	return perm.CanWrite(unitType)
+}

models/project/board.go

@@ -59,6 +59,8 @@ type Board struct {
 	ProjectID int64 `xorm:"INDEX NOT NULL"`
 	CreatorID int64 `xorm:"NOT NULL"`
 
+	Project *Project `xorm:"-"`
+
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
 }

models/project/project.go

@@ -9,8 +9,13 @@ import (
 	"html/template"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/organization"
+	"code.gitea.io/gitea/models/perm"
+	access_model "code.gitea.io/gitea/models/perm/access"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/setting"
@@ -35,6 +40,9 @@ type (
 
 	// Type is used to identify the type of project in question and ownership
 	Type uint8
+
+	// List is used to identify a list of projects
+	ProjectList []*Project //nolint
 )
 
 const (
@@ -153,14 +161,155 @@ func (p *Project) IconName() string {
 	return "octicon-project-symlink"
 }
 
-func (p *Project) IsOrganizationProject() bool {
-	return p.Type == TypeOrganization
+func (p *Project) IsIndividualProject() bool {
+	return p.Type == TypeIndividual
 }
 
 func (p *Project) IsRepositoryProject() bool {
 	return p.Type == TypeRepository
 }
 
+func (p *Project) IsOrganizationProject() bool {
+	return p.Type == TypeOrganization
+}
+
+func (pl ProjectList) getOwnerIDs() []int64 {
+	ids := make(container.Set[int64], len(pl))
+	for _, p := range pl {
+		if p.OwnerID == 0 {
+			continue
+		}
+		ids.Add(p.OwnerID)
+	}
+	return ids.Values()
+}
+
+func (pl ProjectList) getRepoIDs() []int64 {
+	ids := make(container.Set[int64], len(pl))
+	for _, p := range pl {
+		if p.RepoID == 0 {
+			continue
+		}
+		ids.Add(p.RepoID)
+	}
+	return ids.Values()
+}
+
+func (pl ProjectList) LoadOwners(ctx context.Context) ([]*user_model.User, error) {
+	if len(pl) == 0 {
+		return nil, nil
+	}
+
+	userIDs := pl.getOwnerIDs()
+	usersMap := make(map[int64]*user_model.User, len(userIDs))
+	if err := db.GetEngine(ctx).
+		Where("id > 0").
+		In("id", userIDs).
+		Find(&usersMap); err != nil {
+		return nil, fmt.Errorf("find users: %w", err)
+	}
+	for _, p := range pl {
+		if p.OwnerID > 0 && p.Owner == nil {
+			p.Owner = usersMap[p.OwnerID]
+		}
+	}
+	users := make([]*user_model.User, 0, len(usersMap))
+	for _, u := range usersMap {
+		if u != nil {
+			users = append(users, u)
+		}
+	}
+	return users, nil
+}
+
+func (pl ProjectList) LoadRepositories(ctx context.Context) (repo_model.RepositoryList, error) {
+	if len(pl) == 0 {
+		return nil, nil
+	}
+
+	repoIDs := pl.getRepoIDs()
+	repos := make(map[int64]*repo_model.Repository, len(repoIDs))
+	if err := db.GetEngine(ctx).
+		In("id", repoIDs).
+		Find(&repos); err != nil {
+		return nil, fmt.Errorf("find repository: %w", err)
+	}
+	for _, p := range pl {
+		if p.RepoID > 0 && p.Repo == nil {
+			p.Repo = repos[p.RepoID]
+		}
+	}
+	return repo_model.ValuesRepository(repos), nil
+}
+
+func (pl ProjectList) FilterWritableByDoer(ctx context.Context, repo *repo_model.Repository, doer *user_model.User) (ProjectList, error) {
+	// non-login user have no write permission
+	if doer == nil {
+		return nil, nil
+	}
+
+	// Check valid individual/organization projects
+	owners, err := pl.LoadOwners(ctx)
+	if err != nil {
+		return nil, err
+	}
+	validOwnerIDs := make(container.Set[int64], len(owners))
+	for _, owner := range owners {
+		if CheckUserUnitWriteDoer(ctx, owner, doer, unit.TypeProjects) {
+			validOwnerIDs.Add(owner.ID)
+		}
+	}
+
+	// Check valid repo projects
+	repos, err := pl.LoadRepositories(ctx)
+	if err != nil {
+		return nil, err
+	}
+	validRepoIDs := make(container.Set[int64], len(repos))
+	for _, repo := range repos {
+		if access_model.CheckRepoUnitWriteUser(ctx, repo, doer, unit.TypeProjects) {
+			validRepoIDs.Add(repo.ID)
+		}
+	}
+
+	projectList := pl[:0]
+	for _, p := range pl {
+		if (p.RepoID > 0 && p.RepoID == repo.ID && validRepoIDs.Contains(p.RepoID)) ||
+			(p.OwnerID > 0 && p.OwnerID == repo.OwnerID && validOwnerIDs.Contains(p.OwnerID)) {
+			projectList = append(projectList, p)
+		}
+	}
+	return projectList, nil
+}
+
+// CheckUserUnitWriteDoer return whether doer have write permission to the individual/organization project
+func CheckUserUnitWriteDoer(ctx context.Context, user, doer *user_model.User, unitType unit.Type) bool {
+	if user == nil {
+		return false
+	}
+	if user.IsIndividual() && user.ID != doer.ID {
+		return false
+	}
+	if user.IsOrganization() && (*organization.Organization)(user).UnitPermission(ctx, doer, unitType) < perm.AccessModeWrite {
+		return false
+	}
+	return true
+}
+
+// CanWriteByDoer return whether doer have write permission to the project
+func (p Project) CanWriteByDoer(ctx context.Context, repo *repo_model.Repository, doer *user_model.User) (bool, error) {
+	var err error
+	projectList := ProjectList{&p}
+	projectList, err = projectList.FilterWritableByDoer(ctx, repo, doer)
+	if err != nil {
+		return false, err
+	}
+	if len(projectList) == 0 {
+		return false, nil
+	}
+	return true, nil
+}
+
 func init() {
 	db.RegisterModel(new(Project))
 }