Pull Request access requires code access #13592

New Issue

GiteaMirror · 2025-11-02T10:47:23-06:00

GiteaMirror commented

2025-11-02 10:47:23 -06:00

Originally created by @hakito on GitHub (Oct 14, 2024).

Description

Our Product Owner needs access to Pull Requests to review completed feature branches.

I gave him Write Access to Pull Requests on /org/company/teams/po/edit

However, when he tried to go to PR page he got a 404 error (If I recall correctly). I also tried with Read access, but it also did not work.

I had to give him Code read access as well. The expecation would be, that with PR permission it would be possible to comment on the PR, but without access to the other tabs (code).

Gitea Version

1.22.3

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Docker

Database

None

Originally created by @hakito on GitHub (Oct 14, 2024). ### Description Our Product Owner needs access to Pull Requests to review completed feature branches. I gave him _Write_ Access to Pull Requests on `/org/company/teams/po/edit` However, when he tried to go to PR page he got a 404 error (If I recall correctly). I also tried with _Read_ access, but it also did not work. I had to give him _Code_ read access as well. The expecation would be, that with PR permission it would be possible to comment on the PR, but without access to the other tabs (code). ### Gitea Version 1.22.3 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Docker ### Database None

GiteaMirror added the type/bug label 2025-11-02 10:47:23 -06:00

GiteaMirror closed this issue

2025-11-02 10:47:24 -06:00

GiteaMirror commented

2025-11-02 10:47:24 -06:00

@wxiaoguang commented on GitHub (Oct 14, 2024):

-> Make owner/repo/pulls handlers use "PR reader" permission #32254

@wxiaoguang commented on GitHub (Oct 14, 2024): -> Make owner/repo/pulls handlers use "PR reader" permission #32254

GiteaMirror commented

2025-11-02 10:47:25 -06:00

@yp05327 commented on GitHub (Oct 15, 2024):

IIRC, I have asked this question before, but no responses. I will try to find it. 🤔

@yp05327 commented on GitHub (Oct 15, 2024): IIRC, I have asked this question before, but no responses. I will try to find it. 🤔

GiteaMirror commented

2025-11-02 10:47:25 -06:00

@yp05327 commented on GitHub (Oct 15, 2024):

It is here:
https://github.com/go-gitea/gitea/issues/22985#issuecomment-1436222437
And the answer is:
https://github.com/go-gitea/gitea/issues/22985#issuecomment-1652861623

ps: maybe this is outdated. But actually some operations of PR still depends on code unit permission. and it is not documented, so users may confused about it.

@yp05327 commented on GitHub (Oct 15, 2024): It is here: https://github.com/go-gitea/gitea/issues/22985#issuecomment-1436222437 And the answer is: https://github.com/go-gitea/gitea/issues/22985#issuecomment-1652861623 ps: maybe this is outdated. But actually some operations of PR still depends on code unit permission. and it is not documented, so users may confused about it.

GiteaMirror commented

2025-11-02 10:47:25 -06:00

@wxiaoguang commented on GitHub (Oct 15, 2024):

It is here: #22985 (comment) And the answer is: #22985 (comment)

ps: maybe this is outdated. But actually some operations of PR still depends on code unit permission. and it is not documented, so users may confused about it.

That's not related. By design "reader" could always create issues and edit their own issues. "writer" could manage issues. It is not that intuitive but it was indeed designed as that. Just like any GitHub user (reader) could open issues in Gitea's repo.

@wxiaoguang commented on GitHub (Oct 15, 2024): > It is here: [#22985 (comment)](https://github.com/go-gitea/gitea/issues/22985#issuecomment-1436222437) And the answer is: [#22985 (comment)](https://github.com/go-gitea/gitea/issues/22985#issuecomment-1652861623) > > ps: maybe this is outdated. But actually some operations of PR still depends on code unit permission. and it is not documented, so users may confused about it. That's not related. By design "reader" could always create issues and edit their own issues. "writer" could manage issues. It is not that intuitive but it was indeed designed as that. Just like any GitHub user (reader) could open issues in Gitea's repo.

GiteaMirror commented

2025-11-02 10:47:25 -06:00

@yp05327 commented on GitHub (Oct 15, 2024):

I'm not talking about issues, but the PRs below.
About issues, I have already understood. Thanks for your explanation.

At that time, user without code permission but have PR read permission can access the PR, and the problem is that they can also review and approve it even they have no access to the code. This is what I want to say, as @hakito has mentioned it:

but without access to the other tabs (code)

And it seems that it is related to this change:
https://github.com/go-gitea/gitea/pull/30519/files#diff-3f5521b3af1ddd518b1958e0799d7ab00254d39af04eb96dc00d59d2644eb30fR1564
All reqRepoCodeReader was moved to the parent group, but actually pull request does not have it. So the logic changed since this change I think.

@yp05327 commented on GitHub (Oct 15, 2024): I'm not talking about issues, but the PRs below. About issues, I have already understood. Thanks for your explanation. At that time, user without code permission but have PR read permission can access the PR, and the problem is that they can also review and approve it even they have no access to the code. This is what I want to say, as @hakito has mentioned it: > but without access to the other tabs (code) And it seems that it is related to this change: https://github.com/go-gitea/gitea/pull/30519/files#diff-3f5521b3af1ddd518b1958e0799d7ab00254d39af04eb96dc00d59d2644eb30fR1564 All `reqRepoCodeReader` was moved to the parent group, but actually pull request does not have it. So the logic changed since this change I think. ![image](https://github.com/user-attachments/assets/c2fc49cb-6bca-4511-bf46-ccd80a38bb6a)

GiteaMirror commented

2025-11-02 10:47:26 -06:00

@wxiaoguang commented on GitHub (Oct 15, 2024):

Yes, it is related to #30519, I made that change which is not ideal (or buggy), that's why I proposed a quick fix

@wxiaoguang commented on GitHub (Oct 15, 2024): Yes, it is related to #30519, I made that change which is not ideal (or buggy), that's why I proposed a quick fix

GiteaMirror commented

2025-11-02 10:47:26 -06:00

@yp05327 commented on GitHub (Oct 15, 2024):

I have created a new issue about whether user can access to the other tabs if they have no code permission: #32264

@yp05327 commented on GitHub (Oct 15, 2024): I have created a new issue about whether user can access to the other tabs if they have no code permission: #32264

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13592