Fix #6234 : Check organization visibility before everything else

[gzsombor]

Fixing #6234

[zeripath]

Hmm... I think we need to formally specify what the authorisation and permission regime should be. We're getting a lot of these little fixes and although I don't think they're ending up inconsistent, I suspect edge cases are likely to be missed and we may end up with security holes.

[zeripath]

repo.Owner may not be loaded - therefore you need to load the owner before dereferencing it.

That is:

repo.MustOwner()

Or use:

err:=repo.GetOwner()

And handle the error.

[gzsombor]

I hope I get it right.

Having a well defined permission model would be nice - for example, it's not clear for me, if having public repositories in a private organization would make any sense. But an organization can freely switch between it's visibility settings, their repository should behave consistently after switching back and forth.

[codecov-io]

Codecov Report

Merging #6235 into master will decrease coverage by <.01%.
The diff coverage is 11.11%.

@@            Coverage Diff             @@
##           master    #6235      +/-   ##
==========================================
- Coverage   38.84%   38.83%   -0.01%     
==========================================
  Files         355      355              
  Lines       50247    50256       +9     
==========================================
+ Hits        19518    19519       +1     
- Misses      27900    27907       +7     
- Partials     2829     2830       +1

Impacted Files	Coverage Δ
modules/context/repo.go	58.4% <11.11%> (-0.89%)	⬇️
models/unit.go	0% <0%> (-14.29%)	⬇️
models/repo_list.go	67.89% <0%> (+1.05%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b257e04...e8f41b9. Read the comment docs.

[lunny]

I like @zeripath 's idea. I think maybe someone could add that on the docs.

[lunny]

But that's for another PR. @zeripath please review again.