feat(permissions): section-based visibility - public units on private repos #243

2026-05-30T17:29:43Z

jmiller commented

2026-05-30 17:29:43 +00:00

Summary

Fix three gaps preventing per-unit public access on private repos:

Git HTTP - allow anonymous git pull when unit has AnonymousAccessMode >= Read
Permission engine - populate anonymous access modes for private repo visitors
Search/explore - include private repos with public units in results

The existing settings UI at /settings/public_access and home page redirect already work.

Test plan

Set a private repo wiki to anonymous-read via /settings/public_access
Verify anonymous user can see the wiki pages
Verify anonymous git clone of wiki repo works
Verify anonymous user cannot access code
Verify private repo with public wiki appears in explore for anonymous users
Verify home page redirects to wiki when code is not accessible

Closes #238

@MokoBot (Claude Opus 4.6)

## Summary Fix three gaps preventing per-unit public access on private repos: 1. **Git HTTP** - allow anonymous git pull when unit has AnonymousAccessMode >= Read 2. **Permission engine** - populate anonymous access modes for private repo visitors 3. **Search/explore** - include private repos with public units in results The existing settings UI at /settings/public_access and home page redirect already work. ## Test plan - [ ] Set a private repo wiki to anonymous-read via /settings/public_access - [ ] Verify anonymous user can see the wiki pages - [ ] Verify anonymous git clone of wiki repo works - [ ] Verify anonymous user cannot access code - [ ] Verify private repo with public wiki appears in explore for anonymous users - [ ] Verify home page redirects to wiki when code is not accessible Closes #238 @MokoBot (Claude Opus 4.6)

jmiller added 1 commit 2026-05-30 17:29:44 +00:00

feat(permissions): section-based visibility — public units on private repos

Universal: PR Check / Build RC Package (pull_request) Blocked by required conditions

Details

Branch Policy Check / Verify merge target (pull_request) Successful in 1s

Details

Universal: PR Check / Branch Policy (pull_request) Successful in 2s

Details

PR RC Release / Build RC Release (pull_request) Successful in 2s

Details

Universal: PR Check / Validate PR (pull_request) Failing after 6s

Details

Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || 'development' }}) (pull_request) Successful in 1m7s

Details

7884e2f141

Fix three gaps that prevented per-unit public access from working on
private repositories:

1. Git HTTP handler (githttp.go): allow anonymous git pull for private
   repos when the target unit (code or wiki) has AnonymousAccessMode
   set to read. Previously only checked repo.IsPrivate.

2. Permission engine (repo_permission.go): call
   finalProcessRepoUnitPermission for anonymous users on private repos
   so that unit-level anonymous access modes are populated. Previously
   returned early with AccessModeNone, skipping anonymous mode setup.

3. Search/explore (repo_list.go): include private repos that have at
   least one unit with anonymous_access_mode > 0 in search results,
   so anonymous users can discover repos with public sections.

The existing settings UI at /settings/public_access already allows
configuring per-unit visibility. The home page redirect to the first
readable unit (e.g. wiki) also already works via checkHomeCodeViewable.

Closes #238

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

jmiller merged commit c322bfae23 into dev

2026-05-30 17:29:50 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea#243