Cannot add read-only users to the Pull Request Whitelist

[worthy7]

Problem:
People's names/teams other than the first team I'm in (Owners, alone) do not appear in the settings area for whitelisting things. So I cannot set anything up as the owner. The only solution I can see it put everyone (me, support, admins, approvers) into one big team with full permission (since I need full permission)

I can already bet that this is because the autocomplete is ignoring anything other than the first team it finds that I am in (which is Owners), but of course I am also part of the developers team - which it is just ignoring.

This is also an issue when writing an issue and trying to @ mention someone - no autocomplete appears so I have to write them manually. Perhaps a UserService of some sort on the front end needs to be abstracted out, that can be used by different modules in Gitea: UserService.GetAllUsersInOrg() UserService.GetAllUsersInTeam() UserService.GetAllMyTeams()

[worthy7]

@lunny Am I using this the right way?
I have this problem right now at work, where I want my boss to be able to approve PR's, but not have full admin permission over the repo (that's for me) so we are in separate teams, but I cannot set up the settings for the branch protection.

[guillep2k]

I have this problem right now at work, where I want my boss to be able to approve PR's, but not have full admin permission over the repo (that's for me) so we are in separate teams, but I cannot set up the settings for the branch protection.

I've just checked. Gitea in fact doesn't let you add a user to whitelisted reviewers unless they have write access to the repository.

------------------------------------------------

The open question is: should this be allowed?

@worthy7 I understand your use case. I think I'd like something like that too. Let's see what others think.

[guillep2k]

@worthy7 You can actually do this if you add your boss to a team with read-only access to the repository (you must include PR in the team permissions, as well as code).
Your boss will be able to approve your PRs but not merge them (perhaps this can be done with the mergers whitelist as well, I didin't try that).

[guillep2k]

Anyway, there's a PR now to allow that action for individual uses, but it (if accepted) may take some time to see light.
EDIT: or not.... it just got tagged for 1.10.0

[worthy7]

Thanks, the reason why I haven't separated teams for my boss is because of the annoying autocomplete issue where @mentions only work for those in your team.

My boss and the others are new to things like git and I'm trying to ease them in as simply as possible...

[guillep2k]

Mmm......... never heard of that @mentions limitation. I'm browsing through the code and I don't see anything like you describe.

[worthy7]

#3443

[guillep2k]

Oh, but teams and organizations are different things.
Besides, I've just tested in my server (I've got latest 1.10.0-dev) and mentions do send notifications for users in or outside the org; it's only that the user is not shown in the "autocomplete" feature.

[worthy7]

@guillep2k ? Yea my issue is not with notifications... it's with the fact that autocomplete doesn't show other people outside of your "first" assigned team.
For me that means i see nobody because I'm in the admin team, alone, and in the other teams. But I just deal with it. I don't want it to be difficult for my colleagues though.

Anyway this issue is just about what we said above

[lunny]

@worthy7 which version are you using?
@guillep2k Maybe we need a back port.

[guillep2k]

@lunny if this issue is about the autocomplete, then @worthy7 is right in that it's not showing every user in the autocomplete (not even in master). About the @mentions permissions.... I filed #8303 ... also present in master. I'll see if I can PR for that, then we can backport.

@worthy7 The list of users available in the autocomplete is sent in full to the browser every time a comment box appears (even if the user don't write a comment) so the list shows up with no delay the moment you type in @. It's a performance issue not to show every possible user every time. Imagine a site with hundreds of users (not unheard of) in a public repo.

[worthy7]

@lunny 1.9 I think
@guillep2k Yea, the mentions feature in general shouldn't have been accepted as a PR IMO, it barely fulfills the feature requirement really. It needs to be pinging an API for the results.