Teams shown as "Undefined" after added by API, can'be used as branch protection rule

[smoslinux]

Description

After upgrading to 1.24.0, I encountered the following issue:

Creating teams via API:

teamXXX
Undefined

teamXXX-leads
Undefined

These teams are appearing with "Undefined" options under their names. Even though they are added to the project later, I can't select them for any branch rules.

Gitea Version

1.24.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

{"id":1252,"name":"xxx-leads","description":"xxx-leads","organization":{"id":6,"name":"projects","full_name":" Projects","email":"","avatar_url":"https://git.xxx.com/avatars/5b873fd5cf586727f01c4e36774f0a99","description":"All xxx development projects","website":"","location":"","visibility":"limited","repo_admin_change_team_access":true,"username":"projects"},"includes_all_repositories":false,"permission":"none","units":["repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"],"units_map":{"repo.code":"write","repo.ext_issues":"write","repo.ext_wiki":"write","repo.issues":"write","repo.projects":"write","repo.pulls":"write","repo.releases":"write","repo.wiki":"write"},"can_create_org_repo":false} % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed {"id":1253,"name":"xxx","description":"xxx","organization":{"id":6,"name":"projects","full_name":" Projects","email":"","avatar_url":"https://git.xxx.com/avatars/5b873fd5cf586727f01c4e36774f0a99","description":"All xxx development projects","website":"","location":"","visibility":"limited","repo_admin_change_team_access":true,"username":"projects"},"includes_all_repositories":false,"permission":"none","units":["repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"],"units_map":{"repo.code":"write","repo.ext_issues":"write","repo.ext_wiki":"write","repo.issues":"write","repo.projects":"write","repo.pulls":"write","repo.releases":"write","repo.wiki":"write"},"can_create_org_repo":false}

Screenshots

Git Version

2.25.1

Operating System

Ubuntu 24

How are you running Gitea?

Docker container

Database

PostgreSQL

[wxiaoguang]

After upgrading to 1.24.0, I encountered the following issue:

What's the old version?

Creating teams via API:

teamXXX Undefined

teamXXX-leads Undefined

What's the API call, especially the payload?

These teams are appearing with "Undefined" options under their names.

On which page? Especially for the screenshot.

Log Gist

The JSON doesn't seem to be "log". API request or API response? Which API?

[ara-arowana]

I am encountering the same problem, but not using the API but the Web UI. I can only add a team to a branch protection rule, if I gave it "Administrator Access". Granting "General Access" and ticking "write" for every row in the permission table is not enough.

I guess, either "Code" or "Projects" write access should be enough to add a team to a branch protection rule.

The issue seems to be, that the branch protection looks for the "authorize" field in the team database table. Changing the permission table does not mutate that field, only granting the team Administrator access sets the value to 4.

One can "upgrade" a team by executing update team set authorize=2 where id=<id>; (2 is sufficient, 3 or 4 work as well).

This seems undocumented or buggy to me, but should be an easy fix.

[smoslinux]

  # Add teams to repo
  curl -X 'PUT' \
    "https://git..com/api/v1/repos/projects/${REPO_NAME}/teams/${REPO_NAME}-leads?access_token=${API_TOKEN}" \
    -H 'accept: application/json'

  curl -X 'PUT' \
    "https://git..com/api/v1/repos/projects/${REPO_NAME}/teams/${REPO_NAME}?access_token=${API_TOKEN}" \
    -H 'accept: application/json'


  curl -X 'POST' \
    "https://git..com/api/v1/orgs/projects/teams?token=${API_TOKEN}" \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -d '{
    "can_create_org_repo": false,
    "description": "'${REPO_NAME}'-leads",
    "includes_all_repositories": false,
    "name": "'${REPO_NAME}'-leads",
    "permission": "write",
    "units": [
      "repo.code",
      "repo.issues",
      "repo.ext_issues",
      "repo.wiki",
      "repo.pulls",
      "repo.releases",
      "repo.projects",
      "repo.ext_wiki"
    ]
  }'

    curl -X 'POST' \
    "https://git.dsstaging1.com/api/v1/orgs/projects/teams?token=${API_TOKEN}" \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -d '{
    "can_create_org_repo": false,
    "description": "'${REPO_NAME}'",
    "includes_all_repositories": false,
    "name": "'${REPO_NAME}'",
    "permission": "write",
    "units": [
      "repo.code",
      "repo.issues",
      "repo.ext_issues",
      "repo.wiki",
      "repo.pulls",
      "repo.releases",
      "repo.projects",
      "repo.ext_wiki"
    ]
  }'

[wxiaoguang]

Which page is it from?

[wxiaoguang]

I think I know the problem now, will take a look.

One can "upgrade" a team by executing update team set authorize=2 where id=<id>; (2 is sufficient, 3 or 4 work as well).

Curious: according to my test, setting it to 1 (read) works. But I think it shouldn't be 3 (admin) or 4 (owner)

[wxiaoguang]

I think this fix will make the result right: Fix querying teams by permission #34827

(A temp workaround can be update the "team.authorize=1" in database .....)

[smoslinux]

I am encountering the same problem, but not using the API but the Web UI. I can only add a team to a branch protection rule, if I gave it "Administrator Access". Granting "General Access" and ticking "write" for every row in the permission table is not enough.

I guess, either "Code" or "Projects" write access should be enough to add a team to a branch protection rule.

The issue seems to be, that the branch protection looks for the "authorize" field in the team database table. Changing the permission table does not mutate that field, only granting the team Administrator access sets the value to 4.

One can "upgrade" a team by executing update team set authorize=2 where id=<id>; (2 is sufficient, 3 or 4 work as well).

This seems undocumented or buggy to me, but should be an easy fix.

It was version 1.23.X, not the latest. After I upgraded to the latest version quickly, I had a similar issue like this one haha.

[wxiaoguang]

Sorry for the regression ... the "team permission" system has some legacy problems.

By the way, do you know which page is it ? #34793 (comment) I can't remember or find it ..... I'd like to double-check it to see whether #34827 fixes the "Undefined" problem.

[lunny]

I can reproduce it.

2025/06/23 16:45:54 HTTPRequest [I] router: completed GET /repo/search?sort=updated&order=desc&uid=1&team_id=undefined&q=&page=1&limit=15&mode=&archived=false for [::1]:58545, 200 OK in 3.7ms @ repo/repo.go:459(repo.SearchRepo)

[wxiaoguang]

I can reproduce it.

2025/06/23 16:45:54 HTTPRequest [I] router: completed GET /repo/search?sort=updated&order=desc&uid=1&team_id=undefined&q=&page=1&limit=15&mode=&archived=false for [::1]:58545, 200 OK in 3.7ms @ repo/repo.go:459(repo.SearchRepo)

@lunny I don't understand how could it be related. I am asking about the UI, the "Undefined" teams list UI #34793 (comment) . Your comment is just a backend URL which returns JSON response.