feat: update gitea vendor

package/gitea/source/tests/integration/api_user_star_test.go

@@ -8,13 +8,16 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -53,8 +56,7 @@ func TestAPIStar(t *testing.T) {
 
 		assert.Equal(t, "1", resp.Header().Get("X-Total-Count"))
 
-		var repos []api.Repository
-		DecodeJSON(t, resp, &repos)
+		repos := DecodeJSON(t, resp, []api.Repository{})
 		assert.Len(t, repos, 1)
 		assert.Equal(t, repo, repos[0].FullName)
 	})
@@ -68,8 +70,7 @@ func TestAPIStar(t *testing.T) {
 
 		assert.Equal(t, "1", resp.Header().Get("X-Total-Count"))
 
-		var repos []api.Repository
-		DecodeJSON(t, resp, &repos)
+		repos := DecodeJSON(t, resp, []api.Repository{})
 		assert.Len(t, repos, 1)
 		assert.Equal(t, repo, repos[0].FullName)
 	})
@@ -95,6 +96,52 @@ func TestAPIStar(t *testing.T) {
 	})
 }
 
+// TestAPIStarredReposAccessRevoked ensures a private repository disappears from a user's
+// starred list once their access to it has been revoked, so no metadata leaks afterwards.
+func TestAPIStarredReposAccessRevoked(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// user2/repo2 is a private repository owned by user2
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+	collaborator := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+
+	// grant the collaborator read access and star the private repo as them
+	require.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), repo, collaborator, perm.AccessModeRead))
+	require.NoError(t, repo_model.StarRepo(t.Context(), collaborator, repo, true))
+
+	token := getUserToken(t, collaborator.Name, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadRepository)
+
+	// while access is granted, the private repo is visible in the starred list
+	req := NewRequest(t, "GET", "/api/v1/user/starred").AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+	repos := DecodeJSON(t, resp, []api.Repository{})
+	require.Len(t, repos, 1)
+	assert.Equal(t, repo.FullName(), repos[0].FullName)
+
+	// revoke access
+	require.NoError(t, repo_service.DeleteCollaboration(t.Context(), repo, collaborator))
+
+	// the star record still exists, but the repo (and its metadata) must no longer be returned
+	assert.True(t, repo_model.IsStaring(t.Context(), collaborator.ID, repo.ID))
+	req = NewRequest(t, "GET", "/api/v1/user/starred").AddTokenAuth(token)
+	resp = MakeRequest(t, req, http.StatusOK)
+	repos = DecodeJSON(t, resp, []api.Repository{})
+	assert.Empty(t, repos)
+
+	// sanity: the owner still sees their own private repo
+	ownerToken := getUserToken(t, owner.Name, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadRepository)
+	require.NoError(t, repo_model.StarRepo(t.Context(), owner, repo, true))
+	req = NewRequest(t, "GET", "/api/v1/user/starred").AddTokenAuth(ownerToken)
+	resp = MakeRequest(t, req, http.StatusOK)
+	repos = DecodeJSON(t, resp, []api.Repository{})
+	fullNames := make([]string, len(repos))
+	for i, r := range repos {
+		fullNames[i] = r.FullName
+	}
+	assert.Contains(t, fullNames, repo.FullName())
+}
+
 func TestAPIStarDisabled(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
@@ -177,3 +224,23 @@ func TestAPIStarPublicOnly(t *testing.T) {
 	require.Len(t, repos, 1)
 	assert.Equal(t, "user5/repo4", repos[0].FullName)
 }
+
+func TestAPIStarredReposOmitsInaccessiblePrivateRepos(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 40})
+	privateRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
+	assert.True(t, privateRepo.IsPrivate)
+	assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), privateRepo, user, perm.AccessModeRead))
+	assert.NoError(t, repo_model.StarRepo(t.Context(), user, privateRepo, true))
+	assert.NoError(t, repo_service.DeleteCollaboration(t.Context(), privateRepo, user))
+
+	token := getUserToken(t, user.Name, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadRepository)
+	req := NewRequest(t, "GET", "/api/v1/user/starred").AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+
+	repos := DecodeJSON(t, resp, []api.Repository{})
+	for _, repo := range repos {
+		assert.NotEqual(t, privateRepo.FullName(), repo.FullName)
+	}
+}