User in team which has read perm to issues can create issue in a private org repo

[yp05327]

Description

team permission settings:

private org and private repo:

It shows that the user in this team only have read permission to issues

But the user in this team can create issues in this repo

PR can not be created, and this is right.

Gitea Version

1.19.0+dev-403-gb6b8feb3d

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

gitea.com

Database

None

[lunny]

This is by design.

[delvh]

I mean…
I can understand that if you declare write permissions as editing issues that are not their own.
Intuitively, I agree with @yp05327.
However, I can also see why teams with read permission should still be able to create (but not edit) issues.

[yp05327]

It seems that the permission controll and the definitions are confusion and hard to understand.

---

I tested some of them in gitea.com as following: (with a private repo in a private org and the repo is added to the team, so the permissions should be controlled by team permission settings I think ):

Issues:

Actions	No Access	Read	Write
Read	x	○	○
Create	x	○	○
Edit	x	-(only their own)	○

Nothing strange but teams with Read permission can Create issues. This is what I mentioned in this issue.

PR:

Actions	No Access	Read	Write
Read	x	○	○
Create	x	-(depends on Code)	-(depends on Code)
Edit	x	-(only their own)	○
Code Review(Approve)	x	○	○

The description of PR permission is:

Enable pull requests and code reviews.

But Create a PR depends on Code permission actually, and Approve a PR is partly depends on PR permission.
And teams with No Access permission of Code and Read permission of PR can also Review the changes in this PR and Approve it.

---

I don't know whether this is the correct design, but it looks confusion.

@delvh

However, I can also see why teams with read permission should still be able to create (but not edit) issues.

So is it possible to separate Create and Edit from Write in some units.
Create means you can create a new issue/PR/wiki/projects/package and edit your own.
Edit means you can edit all the existed issue/PR/wiki/projects/package (and codereview?)
Code is special, maybe can only have Read and Write?

[lunny]

The design is the same as GH, I think it's not a bug.

[yp05327]

The design is the same as GH, I think it's not a bug.

GH doesn't have private org, where does the same design come from?

[lunny]

The design is the same as GH, I think it's not a bug.

GH doesn't have private org, where does the same design come from?

I mean for public org.

[GiteaBot]

We close issues that need feedback from the author if there were no new comments for a month. 🍵