Team permissions on private repos are not merged correctly

[KimonHoffmann]

Description

In releases prior to 1.24.0 any user who is a member of multiple teams with permissions on private repositories received the maximum permissions from all teams.

Since upgrading to 1.24.3 these users are limited by the limited permissions instead.

Example:

• Team X: Write Access to PRs on all repos of an org
• Team Y: No Access to PRs on all repos of an org
• User A: Member of both X and Y

Effects:

• User A can not see or access PRs (404).
• User A is available as a reviewer on PRs in the dropdown list.
• Attempts to assign user A as a reviewer results in no action being taken with the following message in the log:

.../web/repo/pull_review.go:434:UpdatePullReviewRequest() [W] UpdatePullReviewRequest: refusing to add invalid review request for <User USER_ID:USER_NAME> to <Repository REPO_ID:ORG/REPO>#18: Error: Reviewer can't read [...]

The most similar issue I found is #33456, which is supposed to be fixed in 1.24.3, but still might be related.

Gitea Version

1.24.3

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

2.49.1

Operating System

Linux (amd64)

How are you running Gitea?

Prebuilt official OCI image

Database

SQLite

[wxiaoguang]

Team X: Write Access to PRs on all repos of an org

Can you try to edit Team X and save again (even without change)?

[wxiaoguang]

Unable to reproduce:

[KimonHoffmann]

I just tried the following:

1. Add a new user to both teams
2. Verify the reported behavior
3. Editied Team Y (not X), without making any changes
4. Try to re-verify the reported behavior, without success

So Step 3 resolved the issue. Sorry for editing Team Y instead of X, I got the roles mixed up when following the instructions.

[wxiaoguang]

In old Gitea, the team permission were messed up, some members got unrelated permissions, 1.24 corrected the behavior, but some "teams" need to be updated.

So I think the issue could be marked as "resolved"?

[KimonHoffmann]

Yes, in this specific case it has been resolved, and I know what I need to do next time I encounter it.

But since it's not clear which teams are affected is there maybe a possibility to add something to doctor or the DB migration step to fix these messed up team permissions proactively?