diff --git a/options/locale/locale_en-US.json b/options/locale/locale_en-US.json
index eeed838803..23353b4272 100644
--- a/options/locale/locale_en-US.json
+++ b/options/locale/locale_en-US.json
@@ -3763,6 +3763,7 @@
"actions.general.token_permissions.actions_scope.description": "Interact with workflow runs.",
"actions.general.token_permissions.maximum": "Maximum Token Permissions",
"actions.general.token_permissions.maximum.description": "The maximum permissions tokens are allowed to have. Workflow-specified permissions cannot exceed these limits.",
+ "actions.general.token_permissions.customize_max_permissions": "Customize maximum permissions",
"actions.general.token_permissions.fork_pr_note": "Note: Pull requests from forks always have read-only permissions.",
"actions.general.token_permissions.max_permissions": "Maximum Permissions",
"actions.general.token_permissions.max_permissions.desc": "Configure better restrictions for the GITEA_TOKEN running in this repository.",
diff --git a/routers/web/org/setting/actions.go b/routers/web/org/setting/actions.go
index 4a835664a3..a0b7c0d4ab 100644
--- a/routers/web/org/setting/actions.go
+++ b/routers/web/org/setting/actions.go
@@ -83,8 +83,9 @@ func UpdateTokenPermissions(ctx *context.Context) {
actionsCfg.TokenPermissionMode = permissionMode
}
+ enableMaxPermissions := ctx.FormBool("enable_max_permissions")
// Update Maximum Permissions (radio buttons: none/read/write)
- if actionsCfg.TokenPermissionMode == repo_model.ActionsTokenPermissionModeCustom {
+ if enableMaxPermissions {
parseMaxPerm := func(name string) perm.AccessMode {
value := ctx.FormString("max_" + name)
switch value {
diff --git a/routers/web/repo/setting/actions.go b/routers/web/repo/setting/actions.go
index 07419dee3a..20afe7df35 100644
--- a/routers/web/repo/setting/actions.go
+++ b/routers/web/repo/setting/actions.go
@@ -168,7 +168,8 @@ func UpdateTokenPermissions(ctx *context.Context) {
}
// Update Maximum Permissions (radio buttons: none/read/write)
- if shouldUpdate && actionsCfg.TokenPermissionMode == repo_model.ActionsTokenPermissionModeCustom {
+ enableMaxPermissions := ctx.FormBool("enable_max_permissions")
+ if shouldUpdate && enableMaxPermissions {
parseMaxPerm := func(name string) perm.AccessMode {
value := ctx.FormString("max_" + name)
switch value {
@@ -191,7 +192,7 @@ func UpdateTokenPermissions(ctx *context.Context) {
Releases: parseMaxPerm("releases"),
Projects: parseMaxPerm("projects"),
}
- } else {
+ } else if shouldUpdate {
actionsCfg.MaxTokenPermissions = nil
}
diff --git a/templates/org/settings/actions_general.tmpl b/templates/org/settings/actions_general.tmpl
index c1d537d29f..3c1692a30f 100644
--- a/templates/org/settings/actions_general.tmpl
+++ b/templates/org/settings/actions_general.tmpl
@@ -97,13 +97,6 @@
{{ctx.Locale.Tr "actions.general.token_permissions.mode.restricted.desc"}}
-
-
-
-
-
-
{{ctx.Locale.Tr "actions.general.token_permissions.mode.custom.desc"}}
-
{{ctx.Locale.Tr "actions.general.token_permissions.max_permissions.desc"}}
+
+
+
+
+
+
+
diff --git a/templates/repo/settings/actions_general.tmpl b/templates/repo/settings/actions_general.tmpl
index efc35e2c50..77c59efb65 100644
--- a/templates/repo/settings/actions_general.tmpl
+++ b/templates/repo/settings/actions_general.tmpl
@@ -63,13 +63,6 @@
{{ctx.Locale.Tr "actions.general.token_permissions.mode.restricted.desc"}}
-
-
-
-
-
{{ctx.Locale.Tr "actions.general.token_permissions.mode.custom.desc"}}
-
-
{{ctx.Locale.Tr "actions.general.token_permissions.maximum.description"}}
+
+
+
+
+
+
+
diff --git a/web_src/js/features/repo-settings-actions.ts b/web_src/js/features/repo-settings-actions.ts
index ade411bd19..5a1a0f38ec 100644
--- a/web_src/js/features/repo-settings-actions.ts
+++ b/web_src/js/features/repo-settings-actions.ts
@@ -4,6 +4,7 @@ export function initActionsPermissionsTable(): void {
const tableSection = document.querySelector('#max-permissions-section');
const overrideOrgCheckbox = document.querySelector('.js-override-org-config');
const modeSection = document.querySelector('.js-permission-mode-section');
+ const enableMaxCheckbox = document.querySelector('.js-enable-max-permissions');
if (!modeRadios.length) return;
@@ -12,9 +13,6 @@ export function initActionsPermissionsTable(): void {
// If the checkbox does not exist (Org settings), we are never disabled by this rule.
const shouldDisable = overrideOrgCheckbox ? !overrideOrgCheckbox.checked : false;
- const selectedMode = document.querySelector('input[name="token_permission_mode"]:checked');
- const isCustom = selectedMode?.value === 'custom';
-
// Disable entire form when following org config (Override unchecked)
for (const radio of modeRadios) {
radio.disabled = shouldDisable;
@@ -24,18 +22,34 @@ export function initActionsPermissionsTable(): void {
modeSection.style.opacity = shouldDisable ? '0.5' : '1';
}
- // Disable table if layout is disabled OR mode is not custom
- const tableDisabled = shouldDisable || !isCustom;
+ if (enableMaxCheckbox) {
+ enableMaxCheckbox.disabled = shouldDisable;
+ }
+
+ if (tableSection) {
+ tableSection.style.opacity = shouldDisable ? '0.5' : '1';
+ }
+
+ // Disable table if layout is disabled OR max permissions not enabled
+ const isMaxEnabled = enableMaxCheckbox ? enableMaxCheckbox.checked : false;
+ const tableDisabled = shouldDisable || !isMaxEnabled;
+
if (permTable) {
const inputs = permTable.querySelectorAll('input[type="radio"]');
for (const input of inputs) {
input.disabled = tableDisabled;
}
- permTable.style.display = tableDisabled ? 'none' : '';
- }
-
- if (tableSection) {
- tableSection.style.display = tableDisabled ? 'none' : '';
+ permTable.style.display = isMaxEnabled ? '' : 'none';
+ if (shouldDisable) {
+ permTable.style.opacity = '0.5';
+ // If disabled, we might want to hide it or just show disabled state?
+ // If following Org config, the Org might have max permissions set.
+ // But here we are configuring the REPO overrides.
+ // If not overriding, we show nothing (or disabled state).
+ // Current logic dims everything.
+ } else {
+ permTable.style.opacity = '1';
+ }
}
}
@@ -44,6 +58,7 @@ export function initActionsPermissionsTable(): void {
}
overrideOrgCheckbox?.addEventListener('change', updateTableState);
+ enableMaxCheckbox?.addEventListener('change', updateTableState);
updateTableState();