fix: hide edit button on tag releases, improve ghost user display, fix tag signature banner (#7703)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7703
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>

options/locale_next/locale_en-US.json

@@ -124,6 +124,7 @@
     "settings.must_enable_2fa": "This Forgejo instance requires users to enable two-factor authentication before they can access their accounts.",
     "error.must_enable_2fa": "This Forgejo instance requires users to enable two-factor authentication before they can access their accounts. Enable it at: %s",
     "avatar.constraints_hint": "Custom avatar may not exceed %[1]s in size or be larger than %[2]dx%[3]d pixels",
+    "user.ghost.tooltip": "This user has been deleted, or cannot be matched.",
     "og.repo.summary_card.alt_description": "Summary card of repository %[1]s, described as: %[2]s",
     "repo.commit.load_tags_failed": "Load tags failed because of internal error",
     "compare.branches.title": "Compare branches",

templates/repo/release/list.tmpl

@@ -29,7 +29,7 @@
 								{{end}}
 							</h4>
 							<div>
-								{{if $.CanCreateRelease}}
+								{{if and $.CanCreateRelease (not $release.IsTag)}}
 									<a class="muted" data-tooltip-content="{{ctx.Locale.Tr "repo.release.edit"}}" href="{{$.RepoLink}}/releases/edit/{{$release.TagName | PathEscapeSegments}}" rel="nofollow">
 										{{svg "octicon-pencil"}}
 									</a>
@@ -42,9 +42,10 @@
 								{{svg (MigrationIcon $release.Repo.GetOriginalURLHostname) 20 "tw-mr-1"}}{{$release.OriginalAuthor}}
 							{{else if $release.Publisher}}
 								{{ctx.AvatarUtils.Avatar $release.Publisher 20 "tw-mr-1"}}
-								<a href="{{$release.Publisher.HomeLink}}">{{$release.Publisher.GetDisplayName}}</a>
+								{{template "shared/user/authorlink" $release.Publisher}}
 							{{else}}
-								Ghost
+								<!-- Fake the Ghost user -->
+								{{template "shared/user/authorlink" (dict "ID" -1)}}
 							{{end}}
 							</span>
 							<span class="released">

templates/repo/tag/verification_line.tmpl

@@ -9,7 +9,7 @@
 		{{$class = (print $class " isWarning")}}
 	{{end}}
 
-	<div class="ui attached message tw-text-left tw-flex tw-mb-4 tw-content-center tw-justify-between tag-signature-row tw-flex-wrap {{$class}}">
+	<div class="ui bottom attached message tw-text-left tw-flex tw-mb-4 tw-content-center tw-justify-between tag-signature-row tw-flex-wrap {{$class}}">
 		<div class="tw-flex tw-content-center">
 			{{if $v.Verified}}
 				{{if ne $v.SigningUser.ID 0}}
@@ -62,14 +62,14 @@
 			{{else}}
 				{{if $v.SigningKey}}
 					{{if ne $v.SigningKey.KeyID ""}}
-						{{svg "octicon-verified" 16 "tw-mr-2"}}
+						{{svg "octicon-unverified" 16 "tw-mr-2"}}
 						<span class="ui text tw-mr-2">{{ctx.Locale.Tr "repo.commits.gpg_key_id"}}:</span>
 						{{$v.SigningKey.PaddedKeyID}}
 					{{end}}
 				{{end}}
 				{{if $v.SigningSSHKey}}
 					{{if ne $v.SigningSSHKey.Fingerprint ""}}
-						{{svg "octicon-verified" 16 "tw-mr-2"}}
+						{{svg "octicon-unverified" 16 "tw-mr-2"}}
 						<span class="ui text tw-mr-2">{{ctx.Locale.Tr "repo.commits.ssh_key_fingerprint"}}:</span>
 						{{$v.SigningSSHKey.Fingerprint}}
 					{{end}}

templates/shared/user/authorlink.tmpl

@@ -1 +1,7 @@
-<a class="author text black tw-font-semibold muted"{{if gt .ID 0}} href="{{.HomeLink}}"{{end}}>{{.GetDisplayName}}</a>{{if .IsBot}}<span class="ui basic label tw-p-1 tw-align-baseline">bot</span>{{end}}
+{{if eq .ID -1}}
+	<a class="author text black tw-font-semibold muted"
+		data-tooltip-content="{{ctx.Locale.Tr "user.ghost.tooltip"}}">Ghost</a>
+{{else}}
+	<a class="author text black tw-font-semibold muted"{{if gt .ID 0}} href="{{.HomeLink}}"{{end}}>{{.GetDisplayName}}</a>
+	{{if .IsBot}}<span class="ui basic label tw-p-1 tw-align-baseline">bot</span>{{end}}
+{{end}}

tests/integration/repo_tag_test.go

@@ -32,12 +32,14 @@ func TestTagViewWithoutRelease(t *testing.T) {
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
 
+	session := loginUser(t, owner.Name)
+
 	err := release.CreateNewTag(git.DefaultContext, owner, repo, "master", "no-release", "release-less tag")
 	require.NoError(t, err)
 
 	// Test that the page loads
 	req := NewRequestf(t, "GET", "/%s/releases/tag/no-release", repo.FullName())
-	resp := MakeRequest(t, req, http.StatusOK)
+	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	// Test that the tags sub-menu is active and has a counter
 	htmlDoc := NewHTMLParser(t, resp.Body)
@@ -54,6 +56,33 @@ func TestTagViewWithoutRelease(t *testing.T) {
 
 	// Test that there is no "Stable" link
 	htmlDoc.AssertElement(t, "h4.release-list-title > span.ui.green.label", false)
+
+	// Ensure that there is no "Edit" button
+	htmlDoc.AssertElement(t, ".detail a.muted > svg.octicon-pencil", false)
+
+	// Test that the correct user is linked
+	ownerLinkHref, _ := htmlDoc.Find("a.author").Attr("href")
+	assert.Equal(t, "/user2", ownerLinkHref)
+
+	t.Run("Ghost owner", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		ghost := user_model.NewGhostUser()
+		err = release.CreateNewTag(git.DefaultContext, ghost, repo, "master", "ghost-tag", "a spooky tag")
+		require.NoError(t, err)
+
+		req := NewRequestf(t, "GET", "/%s/releases/tag/ghost-tag", repo.FullName())
+		resp := session.MakeRequest(t, req, http.StatusOK)
+
+		htmlDoc := NewHTMLParser(t, resp.Body)
+
+		// Test that the Ghost user does not link anywhere
+		ownerLink := htmlDoc.Find("a.author")
+		_, ok := ownerLink.Attr("href")
+		assert.Equal(t, 1, ownerLink.Length())
+		assert.False(t, ok)
+		assert.Equal(t, "Ghost", ownerLink.Text())
+	})
 }
 
 func TestCreateNewTagProtected(t *testing.T) {