feat: update gitea vendor

package/gitea/source/tests/integration/api_packages_generic_test.go

@@ -12,12 +12,13 @@ import (
 	neturl "net/url"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -262,3 +263,31 @@ func TestPackageGeneric(t *testing.T) {
 		})
 	})
 }
+
+// TestPackageGenericPublicOnlyTokenLimitedOwner ensures a public-only token cannot
+// access packages owned by a limited-visibility owner (only genuinely public owners).
+func TestPackageGenericPublicOnlyTokenLimitedOwner(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// user33 has limited visibility (visible only to authenticated users, not public)
+	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 33})
+	base := fmt.Sprintf("/api/packages/%s/generic/pkg/1.0.0", owner.Name)
+
+	// upload a package into the limited owner's namespace
+	req := NewRequestWithBody(t, "PUT", base+"/file.bin", bytes.NewReader([]byte{1, 2, 3})).
+		AddBasicAuth(owner.Name)
+	MakeRequest(t, req, http.StatusCreated)
+
+	// a public-only read:package token (even the owner's own) must be refused
+	publicOnlyToken := getUserToken(t, owner.Name, auth_model.AccessTokenScopeReadPackage, auth_model.AccessTokenScopePublicOnly)
+	req = NewRequest(t, "GET", base+"/file.bin").AddTokenAuth(publicOnlyToken)
+	MakeRequest(t, req, http.StatusForbidden)
+	// same via the v1 package API surface (checkTokenPublicOnly)
+	req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/packages/%s/generic/pkg/1.0.0", owner.Name)).AddTokenAuth(publicOnlyToken)
+	MakeRequest(t, req, http.StatusForbidden)
+
+	// a normal read:package token still works, proving only public-only is restricted
+	token := getUserToken(t, owner.Name, auth_model.AccessTokenScopeReadPackage)
+	req = NewRequest(t, "GET", base+"/file.bin").AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusOK)
+}