Repository: go-gitea/gitea
File: routers/api/v1/notify/threads.go (Go)

Code before:

func getThread(ctx *context.APIContext) *activities_model.Notification {
	n, err := activities_model.GetNotificationByID(ctx, ctx.PathParamInt64("id"))
	if err != nil {
		if db.IsErrNotExist(err) {
			ctx.APIError(http.StatusNotFound, err)
		} else {
			ctx.APIErrorInternal(err)
		}
		return nil
	}
	if n.UserID != ctx.Doer.ID && !ctx.Doer.IsAdmin {
		ctx.APIError(http.StatusForbidden, fmt.Errorf("only user itself and admin are allowed to read/change this thread %d", n.ID))
		return nil
	}

	// Check if the user has access to the repository/unit
	if n.UserID == ctx.Doer.ID {
		if _, err := n.GetRepo(ctx); err != nil {
			ctx.APIErrorInternal(err)
			return nil
		}

		switch n.Source {
		case activities_model.NotificationSourceIssue:
			if !access_model.CheckRepoUnitUser(ctx, n.Repository, ctx.Doer, unit.TypeIssues) {
				ctx.APIError(http.StatusForbidden, "no permission to access issues")
				return nil
			}
		case activities_model.NotificationSourcePullRequest:
			if !access_model.CheckRepoUnitUser(ctx, n.Repository, ctx.Doer, unit.TypePullRequests) {
				ctx.APIError(http.StatusForbidden, "no permission to access pull requests")
				return nil
			}
		case activities_model.NotificationSourceCommit, activities_model.NotificationSourceRepository:
			if !access_model.CheckRepoUnitUser(ctx, n.Repository, ctx.Doer, unit.TypeCode) {
				ctx.APIError(http.StatusForbidden, "no permission to access code")
				return nil
			}
		}
	}

	return n
}


Review comment (security):
Is it right?

Suppose the user has an issue notification , but then they loses the "issue unit" access.

Then, they can never manage the issue notification, then there will be always a "unread" tip?

----

The root question is: why "notification" permission is mixed with other permissions?

Code after:
// Copyright 2020 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package notify

import (
	"fmt"
	"net/http"

	activities_model "code.gitea.io/gitea/models/activities"
	"code.gitea.io/gitea/models/db"
	issues_model "code.gitea.io/gitea/models/issues"
	"code.gitea.io/gitea/services/context"
	"code.gitea.io/gitea/services/convert"
)

// GetThread get notification by ID
func GetThread(ctx *context.APIContext) {
	// swagger:operation GET /notifications/threads/{id} notification notifyGetThread
	// ---
	// summary: Get notification thread by ID
	// consumes:
	// - application/json
	// produces:
	// - application/json
	// parameters:
	// - name: id
	//   in: path
	//   description: id of notification thread
	//   type: string
	//   required: true
	// responses:
	//   "200":
	//     "$ref": "#/responses/NotificationThread"
	//   "403":
	//     "$ref": "#/responses/forbidden"
	//   "404":
	//     "$ref": "#/responses/notFound"

	n := getThread(ctx)
	if n == nil {
		return
	}
	if err := n.LoadAttributes(ctx); err != nil && !issues_model.IsErrCommentNotExist(err) {
		ctx.APIErrorInternal(err)
		return
	}

	ctx.JSON(http.StatusOK, convert.ToNotificationThread(ctx, n))
}

// ReadThread mark notification as read by ID
func ReadThread(ctx *context.APIContext) {
	// swagger:operation PATCH /notifications/threads/{id} notification notifyReadThread
	// ---
	// summary: Mark notification thread as read by ID
	// consumes:
	// - application/json
	// produces:
	// - application/json
	// parameters:
	// - name: id
	//   in: path
	//   description: id of notification thread
	//   type: string
	//   required: true
	// - name: to-status
	//   in: query
	//   description: Status to mark notifications as
	//   type: string
	//   default: read
	//   required: false
	// responses:
	//   "205":
	//     "$ref": "#/responses/NotificationThread"
	//   "403":
	//     "$ref": "#/responses/forbidden"
	//   "404":
	//     "$ref": "#/responses/notFound"

	n := getThread(ctx)
	if n == nil {
		return
	}

	targetStatus := statusStringToNotificationStatus(ctx.FormString("to-status"))
	if targetStatus == 0 {
		targetStatus = activities_model.NotificationStatusRead
	}

	notif, err := activities_model.SetNotificationStatus(ctx, n.ID, ctx.Doer, targetStatus)
	if err != nil {
		ctx.APIErrorInternal(err)
		return
	}
	if err = notif.LoadAttributes(ctx); err != nil && !issues_model.IsErrCommentNotExist(err) {
		ctx.APIErrorInternal(err)
		return
	}
	ctx.JSON(http.StatusResetContent, convert.ToNotificationThread(ctx, notif))
}

func getThread(ctx *context.APIContext) *activities_model.Notification {
	n, err := activities_model.GetNotificationByID(ctx, ctx.PathParamInt64("id"))
	if err != nil {
		if db.IsErrNotExist(err) {
			ctx.APIError(http.StatusNotFound, err)
		} else {
			ctx.APIErrorInternal(err)
		}
		return nil
	}
	if n.UserID != ctx.Doer.ID && !ctx.Doer.IsAdmin {
		ctx.APIError(http.StatusForbidden, fmt.Errorf("only user itself and admin are allowed to read/change this thread %d", n.ID))
		return nil
	}
	return n
}