feat: update gitea vendor

package/gitea/source/services/context/permission.go

@@ -4,14 +4,48 @@
 package context
 
 import (
+	"context"
 	"net/http"
 	"slices"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 )
 
+// isOwnerHidden reports whether repo's owner is not publicly visible (a limited or private owner), so
+// the owner's repositories must be hidden from callers that may only reach genuinely public resources.
+func isOwnerHidden(ctx context.Context, repo *repo_model.Repository) bool {
+	if err := repo.LoadOwner(ctx); err != nil || repo.Owner == nil {
+		return true // fail closed if the owner visibility can't be determined
+	}
+	return !repo.Owner.Visibility.IsPublic()
+}
+
+// publicOnlyTokenDeniedRepo reports whether a public-only API token must be denied access to
+// repo. A public-only token may only reach genuinely public resources, so it is denied for
+// private repos and for repos owned by a non-public (limited or private) owner.
+func publicOnlyTokenDeniedRepo(ctx context.Context, repo *repo_model.Repository) bool {
+	if repo == nil {
+		return false
+	}
+	return repo.IsPrivate || isOwnerHidden(ctx, repo)
+}
+
+// TokenIsPublicOnly reports whether the request is authenticated by a public-only API token. A
+// non-token request, or a token with no recorded scope, is not public-only.
+func TokenIsPublicOnly(ctx *Context) bool {
+	if ctx.Data["IsApiToken"] != true {
+		return false
+	}
+	scope, ok := ctx.Data["ApiTokenScope"].(auth_model.AccessTokenScope)
+	if !ok {
+		return false
+	}
+	publicOnly, _ := scope.PublicOnly()
+	return publicOnly
+}
+
 // CheckTokenScopes checks whether the authenticated API token contains any of the given scopes.
 func CheckTokenScopes(ctx *Context, repo *repo_model.Repository, scopes ...auth_model.AccessTokenScope) {
 	if ctx.Data["IsApiToken"] != true {
@@ -29,7 +63,7 @@ func CheckTokenScopes(ctx *Context, repo *repo_model.Repository, scopes ...auth_
 		return
 	}
 
-	if publicOnly && repo != nil && repo.IsPrivate {
+	if publicOnly && publicOnlyTokenDeniedRepo(ctx, repo) {
 		ctx.HTTPError(http.StatusForbidden)
 		return
 	}
@@ -48,7 +82,7 @@ func CheckTokenScopes(ctx *Context, repo *repo_model.Repository, scopes ...auth_
 // RequireRepoAdmin returns a middleware for requiring repository admin permission
 func RequireRepoAdmin() func(ctx *Context) {
 	return func(ctx *Context) {
-		if !ctx.IsSigned || !ctx.Repo.IsAdmin() {
+		if !ctx.IsSigned || !ctx.Repo.Permission.IsAdmin() {
 			ctx.NotFound(nil)
 			return
 		}
@@ -68,7 +102,7 @@ func CanWriteToBranch() func(ctx *Context) {
 // RequireUnitWriter returns a middleware for requiring repository write to one of the unit permission
 func RequireUnitWriter(unitTypes ...unit.Type) func(ctx *Context) {
 	return func(ctx *Context) {
-		if slices.ContainsFunc(unitTypes, ctx.Repo.CanWrite) {
+		if slices.ContainsFunc(unitTypes, ctx.Repo.Permission.CanWrite) {
 			return
 		}
 		ctx.NotFound(nil)
@@ -79,7 +113,7 @@ func RequireUnitWriter(unitTypes ...unit.Type) func(ctx *Context) {
 func RequireUnitReader(unitTypes ...unit.Type) func(ctx *Context) {
 	return func(ctx *Context) {
 		for _, unitType := range unitTypes {
-			if ctx.Repo.CanRead(unitType) {
+			if ctx.Repo.Permission.CanRead(unitType) {
 				return
 			}
 			if unitType == unit.TypeCode && canWriteAsMaintainer(ctx) {