Private Issues: Issue-level access control and DB queries #418

New issue

Closed

opened 2026-02-23 16:08:50 +00:00 by nphilipp · 2 comments

nphilipp commented

2026-02-23 16:08:50 +00:00

Member

Story

As a user of Forgejo,
I want to view and list public and private issues via the REST API,
so I can work with private issues using the web API.

Acceptance Criteria

An Issue.CanAccess() method exists which determines if the current user is allowed to access an issue. For public issues (IsPrivate == false), this always returns true, for private issues it will check if the current user created the issue or owns the repository (directly or via organization) and return true in this case, otherwise false.
~~A function (name and place TBD) exists to~~ Forgejo can query the DB for private issues, filtering them for the perspective of the current user (see above).
- The functions Issues() and IssueIDs() (of models/issues/issues_search.go) as well as their building blocks ~~(and their users elsewhere)~~ are updated so they can deal with both public and private issues.
- These functions are adapted so they can appropriately filter out private issues depending on the user.

Background

Various ~~to be implemented~~ functions will need know if a certain issue should be shown to the user. Some might need to decide this on a one by one basis (e.g. viewing one issue), some might need to query private issues and filter in bulk.

Beware, .OriginalAuthorID must be considered, see models/issues/issue.go:

// IsPoster returns true if given user by ID is the poster.
func (issue *Issue) IsPoster(uid int64) bool {
	return issue.OriginalAuthorID == 0 && issue.PosterID == uid
}

# Story As a user of Forgejo, I want to view and list public and private issues via the REST API, so I can work with private issues using the web API. # Acceptance Criteria - [x] An `Issue.CanAccess()` method exists which determines if the current user is allowed to access an issue. For public issues (`IsPrivate == false`), this always returns true, for private issues it will check if the current user created the issue or owns the repository (directly or via organization) and return true in this case, otherwise false. - [x] _~~A function (name and place TBD) exists to~~_ Forgejo can query the DB for private issues, filtering them for the perspective of the current user (see above). - [x] The functions `Issues()` and `IssueIDs()` (of `models/issues/issues_search.go`) as well as their building blocks _~~(and their users elsewhere)~~_ are updated so they can deal with both public and private issues. - [x] These functions are adapted so they can appropriately filter out private issues depending on the user. # Background Various _~~to be implemented~~_ functions will need know if a certain issue should be shown to the user. Some might need to decide this on a one by one basis (e.g. viewing one issue), some might need to query private issues and filter in bulk. Beware, `.OriginalAuthorID` must be considered, see `models/issues/issue.go`: ``` // IsPoster returns true if given user by ID is the poster. func (issue *Issue) IsPoster(uid int64) bool { return issue.OriginalAuthorID == 0 && issue.PosterID == uid } ```

nphilipp added the

Rows
Columns