mirror of https://github.com/go-gitea/gitea.git
feat(ui): add repository permissions settings page
Three permission modes with individual toggles. UI could use some polish but functional. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>pull/36113/head
SBALAVIGNESH123
parent
242053648a
commit
03b3af4579
@ -0,0 +1,242 @@
|
||||
{{template "base/head" .}}
|
||||
<div class="page-content repository settings options">
|
||||
{{template "repo/header" .}}
|
||||
<div class="ui container">
|
||||
<div class="ui grid">
|
||||
{{template "repo/settings/navbar" .}}
|
||||
<div class="twelve wide column content">
|
||||
{{template "base/alert" .}}
|
||||
|
||||
<h4 class="ui top attached header">
|
||||
{{.locale.Tr "repo.settings.actions.permissions.title"}}
|
||||
</h4>
|
||||
|
||||
<div class="ui attached segment">
|
||||
<p class="help">
|
||||
{{.locale.Tr "repo.settings.actions.permissions.desc"}}
|
||||
<!-- TODO: Add link to documentation once it's written -->
|
||||
<!-- Need to explain this feature clearly for users -->
|
||||
</p>
|
||||
|
||||
<form class="ui form" method="post" action="{{.Link}}">
|
||||
{{.CsrfTokenHtml}}
|
||||
|
||||
<!-- Permission Mode Selector -->
|
||||
<div class="field">
|
||||
<label>{{.locale.Tr "repo.settings.actions.permissions.mode"}}</label>
|
||||
<div class="ui selection dropdown">
|
||||
<input type="hidden" name="permission_mode" value="{{.PermissionMode}}">
|
||||
<i class="dropdown icon"></i>
|
||||
<div class="default text">Select permission mode</div>
|
||||
<div class="menu">
|
||||
<!-- Restricted mode - recommended for most users -->
|
||||
<div class="item" data-value="0" data-text="Restricted (Recommended)">
|
||||
<div class="header">🔒 Restricted (Recommended)</div>
|
||||
<div class="description">
|
||||
Minimal permissions. Actions can only read code. Secure default.
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Permissive mode - for trusted repos -->
|
||||
<div class="item" data-value="1" data-text="Permissive">
|
||||
<div class="header">🔓 Permissive</div>
|
||||
<div class="description">
|
||||
Broad permissions. Actions can read/write most resources. For trusted environments only.
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Custom mode - for advanced users -->
|
||||
<div class="item" data-value="2" data-text="Custom">
|
||||
<div class="header">⚙️ Custom</div>
|
||||
<div class="description">
|
||||
Fine-grained control. Configure each permission individually.
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Custom permissions - only shown when mode is Custom -->
|
||||
<!-- Note: We could use Vue.js here for reactivity, but keeping it simple with vanilla JS -->
|
||||
<!-- If this gets more complex, consider refactoring to use Vue component -->
|
||||
<div id="custom-permissions" class="{{if ne .PermissionMode 2}}hide{{end}}">
|
||||
<div class="ui divider"></div>
|
||||
<h5>Individual Permissions</h5>
|
||||
|
||||
{{/* Actions Permission */}}
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="actions_read" id="actions_read" {{if .ActionsRead}}checked{{end}}>
|
||||
<label for="actions_read">
|
||||
<strong>Actions (Read)</strong> - View workflow runs and logs
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="actions_write" id="actions_write" {{if .ActionsWrite}}checked{{end}}>
|
||||
<label for="actions_write">
|
||||
<strong>Actions (Write)</strong> - Cancel or re-run workflows
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{{/* Contents Permission */}}
|
||||
<div class="ui divider"></div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="contents_read" id="contents_read" {{if .ContentsRead}}checked{{end}}>
|
||||
<label for="contents_read">
|
||||
<strong>Contents (Read)</strong> - Clone and read repository code
|
||||
<span class="text grey">(Recommended: Keep enabled)</span>
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="contents_write" id="contents_write" {{if .ContentsWrite}}checked{{end}}>
|
||||
<label for="contents_write">
|
||||
<strong>Contents (Write)</strong> - Push commits and create branches
|
||||
<span class="text red">(Warning: High risk for fork PRs)</span>
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{{/* Packages Permission */}}
|
||||
<div class="ui divider"></div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="packages_read" id="packages_read" {{if .PackagesRead}}checked{{end}}>
|
||||
<label for="packages_read">
|
||||
<strong>Packages (Read)</strong> - Pull packages from registry
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="packages_write" id="packages_write" {{if .PackagesWrite}}checked{{end}}>
|
||||
<label for="packages_write">
|
||||
<strong>Packages (Write)</strong> - Publish and update packages
|
||||
<!-- Note: Requires package-repository linking (see org settings) -->
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{{/* Issues Permission */}}
|
||||
<div class="ui divider"></div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="issues_read" id="issues_read" {{if .IssuesRead}}checked{{end}}>
|
||||
<label for="issues_read">
|
||||
<strong>Issues (Read)</strong> - View issues
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="issues_write" id="issues_write" {{if .IssuesWrite}}checked{{end}}>
|
||||
<label for="issues_write">
|
||||
<strong>Issues (Write)</strong> - Create, comment, and close issues
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{{/* Pull Requests Permission */}}
|
||||
<div class="ui divider"></div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="pull_requests_read" id="pull_requests_read" {{if .PullRequestsRead}}checked{{end}}>
|
||||
<label for="pull_requests_read">
|
||||
<strong>Pull Requests (Read)</strong> - View pull requests
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui toggle checkbox">
|
||||
<input type="checkbox" name="pull_requests_write" id="pull_requests_write" {{if .PullRequestsWrite}}checked{{end}}>
|
||||
<label for="pull_requests_write">
|
||||
<strong>Pull Requests (Write)</strong> - Create and merge pull requests
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Warning Message for fork PRs -->
|
||||
<!-- This is important - users need to understand that fork PRs are always restricted -->
|
||||
<div class="ui warning message">
|
||||
<div class="header">
|
||||
<i class="shield icon"></i>
|
||||
Security Notice: Fork Pull Requests
|
||||
</div>
|
||||
<p>
|
||||
For security reasons, workflows triggered by pull requests from forked repositories
|
||||
are <strong>always restricted</strong> to read-only access, regardless of the settings above.
|
||||
This prevents malicious forks from accessing secrets or modifying your repository.
|
||||
</p>
|
||||
<!-- Reference the security discussion that led to this decision -->
|
||||
<!-- https://github.com/go-gitea/gitea/pull/24554#issuecomment-1537040811 -->
|
||||
</div>
|
||||
|
||||
<!-- Organization Cap Notice (if applicable) -->
|
||||
{{if .OrgID}}
|
||||
{{if .OrgHasRestrictions}}
|
||||
<div class="ui info message">
|
||||
<div class="header">
|
||||
<i class="building icon"></i>
|
||||
Organization Restrictions Apply
|
||||
</div>
|
||||
<p>
|
||||
This repository belongs to an organization with permission restrictions.
|
||||
The settings above cannot exceed the organization's maximum permissions.
|
||||
Contact your organization admin to grant additional permissions.
|
||||
</p>
|
||||
</div>
|
||||
{{end}}
|
||||
{{end}}
|
||||
|
||||
<!-- Submit Buttons -->
|
||||
<div class="field">
|
||||
<button class="ui green button" type="submit">
|
||||
{{.locale.Tr "repo.settings.actions.permissions.save"}}
|
||||
</button>
|
||||
<a class="ui button" href="{{.Link}}">
|
||||
{{.locale.Tr "repo.settings.cancel"}}
|
||||
</a>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- JavaScript for UI interactions -->
|
||||
<script>
|
||||
// Show/hide custom permissions based on mode selection
|
||||
// TODO: Could move this to a separate JS file if it gets more complex
|
||||
$(document).ready(function() {
|
||||
// Drop down initialization
|
||||
$('.ui.dropdown').dropdown({
|
||||
onChange: function(value) {
|
||||
// Show custom options only when Custom mode is selected
|
||||
if (value === '2') {
|
||||
$('#custom-permissions').removeClass('hide');
|
||||
} else {
|
||||
$('#custom-permissions').addClass('hide');
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Warning when enabling write permissions
|
||||
// Helps prevent accidental security issues
|
||||
$('#contents_write, #packages_write').change(function() {
|
||||
if ($(this).is(':checked')) {
|
||||
// Maybe add a confirmation dialog here?
|
||||
// For now, just the inline warning text is probably enough
|
||||
console.log('Write permission enabled - ensure this is intentional');
|
||||
}
|
||||
});
|
||||
});
|
||||
</script>
|
||||
|
||||
{{template "base/footer" .}}
|
||||
Loading…
Reference in New Issue