Org admin users can not access org project

[yp05327]

Description

Thanks @kerwin612 for reporting this issue.

In some special cases, org admin users can not access org level project unit.
I also noticed this issue several month ago, but I can't reproduce this issue again, so I didn't report this bug.

But @kerwin612 also reported this issue today, so it seems that this is a reproducible issue.

This issue can be fixed by some magic operations:

• convert the permission into General Access, you will see the permission of project unit is No Access.
• convert it into Write, and save.
• convert the permission into Administrator Access, and save.
• Now the team will become a real admin team :)
• Then no matter what permission you set in General Access, Administrator Access would work well.

ps: I also can't reproduce this issue now in a new 1.19.3 Gitea instance or an old 1.18.5 instance update to 1.19.3

Edit:
I misunderstand this issue, admin users can not access org level project unit, not repo level project unit.
I can reproduce this issue now, let's fix it. 😄

Gitea Version

1.19.3

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

self host

Database

None

[yp05327]

I know what happened...

There are two problems:

• For 1.19.3, there's a logic problem in func UnitPermission:
  In old version, Gitea will not insert new records for admin team in team_unit table.
  
  But in UnitPermission, we check the records in team_unit table unless it is an owner team in func UnitMaxAccess.
  
  (come from Support org/user level projects #22235)
  So admin team will return perm.AccessModeNone in 1.19.3.
  This code comes from https://github.com/go-gitea/gitea/pull/17811/files#diff-3d84110fa93e421c3875fcd87a4732305131fc42b65d34d06a1b8e453bee3d80R263
  This issue has been fixed in Fix admin team access mode value in team_unit table #24012, so it will not happen in new versions.

• Update from 1.19.3 to 1.20.0 will not fix this issue:
  In Fix admin team access mode value in team_unit table #24012, the migration only updated the recent records which is not existing. We should also insert new records if they are not existing.

So we need a migration to add unit permission record in for admin teams in team_unit table.
But we have no way to make a migration backport, so this issue can not be fixed in old versions, or we need to rewrite the logic of UnitMaxAccess in old versions. Which is better?

[lunny]

If team.IsAdminTeam() {
return perm.AccessModeAdmin
}

[kerwin612]

I know what happened...

There are two problems:

• For 1.19.3, there's a logic problem in func UnitPermission:
  In old version, Gitea will not insert new records for admin team in team_unit table.
  
  But in UnitPermission, we check the records in team_unit table unless it is an owner team in func UnitMaxAccess.
  
  (come from Support org/user level projects #22235)
  So admin team will return perm.AccessModeNone in 1.19.3.
  This code comes from https://github.com/go-gitea/gitea/pull/17811/files#diff-3d84110fa93e421c3875fcd87a4732305131fc42b65d34d06a1b8e453bee3d80R263
  This issue has been fixed in Fix admin team access mode value in team_unit table #24012, so it will not happen in new versions.
• Update from 1.19.3 to 1.20.0 will not fix this issue:
  In Fix admin team access mode value in team_unit table #24012, the migration only updated the recent records which is not existing. We should also insert new records if they are not existing.

So we need a migration to add unit permission record in for admin teams in team_unit table. But we have no way to make a migration backport, so this issue can not be fixed in old versions, or we need to rewrite the logic of UnitMaxAccess in old versions. Which is better?