resolve todo

routers/api/packages/api.go

@@ -136,6 +136,11 @@ func reqPackageAccess(accessMode perm.AccessMode) func(ctx *context.Context) {
 						return
 					}
 				}
+
+				// If we have passed all checks, grant the requested access to the context
+				if ctx.Package.AccessMode < accessMode {
+					ctx.Package.AccessMode = accessMode
+				}
 			}
 		}
 

services/context/package.go

@@ -101,7 +101,7 @@ func determineAccessMode(ctx *Base, pkg *Package, doer *user_model.User) (perm.A
 		return perm.AccessModeNone, nil
 	}
 
-	// TODO: ActionUser permission check
+	// ActionUser permission check is handled in reqPackageAccess to allow for repo-specific checks
 	accessMode := perm.AccessModeNone
 	if pkg.Owner.IsOrganization() {
 		org := organization.OrgFromUser(pkg.Owner)