review comment

routers/api/packages/api.go

@@ -82,7 +82,7 @@ func reqPackageAccess(accessMode perm.AccessMode) func(ctx *context.Context) {
 		}
 
 		isActionsToken, _ := ctx.Data["IsActionsToken"].(bool)
-		if isActionsToken && ctx.Package != nil && ctx.Package.Owner != nil && ctx.Package.Owner.Visibility.IsPrivate() {
+		if isActionsToken && ctx.Package != nil && ctx.Package.Owner != nil && ctx.Package.Owner.IsOrganization() {
 			// Actions rules:
 			// 1. If the package key matches the task repo, allow.
 			// 2. If not, check cross-repo policy.

tests/integration/actions_job_token_test.go

@@ -371,19 +371,33 @@ func TestActionsCrossRepoAccess(t *testing.T) {
 			fileName := "test-file.bin"
 			content := []byte{1, 2, 3, 4, 5}
 
-			// First, upload a package to repo-B using basic auth (user2 is org owner)
+			// First, upload a package to the org using basic auth (user2 is org owner)
 			packageURL := fmt.Sprintf("/api/packages/%s/generic/%s/%s/%s", orgName, packageName, packageVersion, fileName)
 			uploadReq := NewRequestWithBody(t, "PUT", packageURL, bytes.NewReader(content)).AddBasicAuth("user2")
 			MakeRequest(t, uploadReq, http.StatusCreated)
 
-			// Try to download the package with task token from repo-A (cross-repo read)
-			// Cross-repo access should allow read
+			// Disable cross-repo access to test denied state
+			require.NoError(t, actions_model.SetOrgActionsConfig(t.Context(), org.ID, &repo_model.ActionsConfig{
+				AllowCrossRepoAccess: false,
+			}))
+
+			// Try to download with cross-repo disabled - should fail
+			downloadReqDenied := NewRequest(t, "GET", packageURL)
+			downloadReqDenied.Header.Set("Authorization", "Bearer "+task.Token)
+			MakeRequest(t, downloadReqDenied, http.StatusForbidden)
+
+			// Re-enable cross-repo access
+			require.NoError(t, actions_model.SetOrgActionsConfig(t.Context(), org.ID, &repo_model.ActionsConfig{
+				AllowCrossRepoAccess: true,
+			}))
+
+			// Try to download with cross-repo enabled - should succeed
 			downloadReq := NewRequest(t, "GET", packageURL)
 			downloadReq.Header.Set("Authorization", "Bearer "+task.Token)
 			resp := MakeRequest(t, downloadReq, http.StatusOK)
 			assert.Equal(t, content, resp.Body.Bytes(), "Should be able to read package from other repo in same org")
 
-			// Try to upload a package to org with task token from repo-A (cross-repo write)
+			// Try to upload a package with task token (cross-repo write)
 			// Cross-repo access should be read-only, write attempts return 401 Unauthorized
 			writePackageURL := fmt.Sprintf("/api/packages/%s/generic/%s/%s/write-test.bin", orgName, packageName, packageVersion)
 			writeReq := NewRequestWithBody(t, "PUT", writePackageURL, bytes.NewReader(content))