refactor(actions): pass secret and variable scope as a struct (#39719)

Secret and variable functions took an adjacent `ownerID, repoID int64`
pair, so swapping the two compiled and only failed at runtime. They now
take a `BelongingScope` value instead.

`BelongingScope` also replaces the "drop OwnerID when RepoID is set"
step that `InsertEncryptedSecret` and `InsertVariable` each implemented
separately

No behaviour change. It also makes adding another scope dimension, such
as the environment ID in https://github.com/go-gitea/gitea/pull/38149, a
one-field change.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>

routers/web/shared/actions/variables.go

@@ -27,8 +27,7 @@ const (
 )
 
 type variablesCtx struct {
-	OwnerID           int64
-	RepoID            int64
+	BelongingScope    actions_model.BelongingScope
 	IsRepo            bool
 	IsOrg             bool
 	IsUser            bool
@@ -40,8 +39,7 @@ type variablesCtx struct {
 func getVariablesCtx(ctx *context.Context) (*variablesCtx, error) {
 	if ctx.Data["PageIsRepoSettings"] == true {
 		return &variablesCtx{
-			OwnerID:           0,
-			RepoID:            ctx.Repo.Repository.ID,
+			BelongingScope:    actions_model.BelongingScopeRepo(ctx.Repo.Repository.ID),
 			IsRepo:            true,
 			VariablesTemplate: tplRepoVariables,
 			RedirectLink:      ctx.Repo.RepoLink + "/settings/actions/variables",
@@ -54,8 +52,7 @@ func getVariablesCtx(ctx *context.Context) (*variablesCtx, error) {
 			return nil, nil //nolint:nilnil // error is already handled by ctx.ServerError
 		}
 		return &variablesCtx{
-			OwnerID:           ctx.ContextUser.ID,
-			RepoID:            0,
+			BelongingScope:    actions_model.BelongingScopeOwner(ctx.Org.Organization.ID),
 			IsOrg:             true,
 			VariablesTemplate: tplOrgVariables,
 			RedirectLink:      ctx.Org.OrgLink + "/settings/actions/variables",
@@ -64,8 +61,7 @@ func getVariablesCtx(ctx *context.Context) (*variablesCtx, error) {
 
 	if ctx.Data["PageIsUserSettings"] == true {
 		return &variablesCtx{
-			OwnerID:           ctx.Doer.ID,
-			RepoID:            0,
+			BelongingScope:    actions_model.BelongingScopeOwner(ctx.Doer.ID),
 			IsUser:            true,
 			VariablesTemplate: tplUserVariables,
 			RedirectLink:      setting.AppSubURL + "/user/settings/actions/variables",
@@ -74,8 +70,7 @@ func getVariablesCtx(ctx *context.Context) (*variablesCtx, error) {
 
 	if ctx.Data["PageIsAdmin"] == true {
 		return &variablesCtx{
-			OwnerID:           0,
-			RepoID:            0,
+			BelongingScope:    actions_model.BelongingScopeGlobal(),
 			IsGlobal:          true,
 			VariablesTemplate: tplAdminVariables,
 			RedirectLink:      setting.AppSubURL + "/-/admin/actions/variables",
@@ -97,8 +92,7 @@ func Variables(ctx *context.Context) {
 	}
 
 	variables, err := db.Find[actions_model.ActionVariable](ctx, actions_model.FindVariablesOpts{
-		OwnerID: vCtx.OwnerID,
-		RepoID:  vCtx.RepoID,
+		BelongingScope: vCtx.BelongingScope,
 	})
 	if err != nil {
 		ctx.ServerError("FindVariables", err)
@@ -124,7 +118,7 @@ func VariableCreate(ctx *context.Context) {
 
 	form := web.GetForm[*forms.EditVariableForm](ctx)
 
-	v, err := actions_service.CreateVariable(ctx, vCtx.OwnerID, vCtx.RepoID, form.Name, form.Data, form.Description)
+	v, err := actions_service.CreateVariable(ctx, vCtx.BelongingScope, form.Name, form.Data, form.Description)
 	if err != nil {
 		ctx.JSONErrorAuto(err)
 		return
@@ -168,25 +162,9 @@ func VariableUpdate(ctx *context.Context) {
 
 func findActionsVariable(ctx *context.Context, id int64, vCtx *variablesCtx) *actions_model.ActionVariable {
 	opts := actions_model.FindVariablesOpts{
-		IDs: []int64{id},
+		IDs:            []int64{id},
+		BelongingScope: vCtx.BelongingScope,
 	}
-	switch {
-	case vCtx.IsRepo:
-		opts.RepoID = vCtx.RepoID
-		if opts.RepoID == 0 {
-			panic("RepoID is 0")
-		}
-	case vCtx.IsOrg, vCtx.IsUser:
-		opts.OwnerID = vCtx.OwnerID
-		if opts.OwnerID == 0 {
-			panic("OwnerID is 0")
-		}
-	case vCtx.IsGlobal:
-		// do nothing
-	default:
-		panic("invalid actions variable")
-	}
-
 	got, err := actions_model.FindVariables(ctx, opts)
 	if err != nil {
 		ctx.ServerError("FindVariables", err)

routers/web/shared/secrets/secrets.go

@@ -4,6 +4,7 @@
 package secrets
 
 import (
+	actions_model "gitea.dev/models/actions"
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	secret_model "gitea.dev/models/secret"
@@ -17,8 +18,8 @@ import (
 	secret_service "gitea.dev/services/secrets"
 )
 
-func SetSecretsContext(ctx *context.Context, ownerID, repoID int64) {
-	secrets, err := db.Find[secret_model.Secret](ctx, secret_model.FindSecretsOptions{OwnerID: ownerID, RepoID: repoID})
+func SetSecretsContext(ctx *context.Context, scope actions_model.BelongingScope) {
+	secrets, err := db.Find[secret_model.Secret](ctx, secret_model.FindSecretsOptions{BelongingScope: scope})
 	if err != nil {
 		ctx.ServerError("FindSecrets", err)
 		return
@@ -29,21 +30,10 @@ func SetSecretsContext(ctx *context.Context, ownerID, repoID int64) {
 	ctx.Data["DescriptionMaxLength"] = secret_model.SecretDescriptionMaxLength
 }
 
-func secretOwnerRepoIDs(owner *user_model.User, repo *repo_model.Repository) (ownerID, repoID int64) {
-	if owner != nil {
-		ownerID = owner.ID
-	}
-	if repo != nil {
-		repoID = repo.ID
-	}
-	return ownerID, repoID
-}
-
-func PerformSecretsPost(ctx *context.Context, owner *user_model.User, repo *repo_model.Repository, redirectURL string) {
+func PerformSecretsPost(ctx *context.Context, scope actions_model.BelongingScope, owner *user_model.User, repo *repo_model.Repository, redirectURL string) {
 	form := web.GetForm[*forms.AddSecretForm](ctx)
-	ownerID, repoID := secretOwnerRepoIDs(owner, repo)
 
-	s, created, err := secret_service.CreateOrUpdateSecret(ctx, ownerID, repoID, form.Name, util.NormalizeStringEOL(form.Data), form.Description)
+	s, created, err := secret_service.CreateOrUpdateSecret(ctx, scope, form.Name, util.NormalizeStringEOL(form.Data), form.Description)
 	if err != nil {
 		ctx.JSONErrorAuto(err)
 		return
@@ -59,11 +49,10 @@ func PerformSecretsPost(ctx *context.Context, owner *user_model.User, repo *repo
 	ctx.JSONRedirect(redirectURL)
 }
 
-func PerformSecretsDelete(ctx *context.Context, owner *user_model.User, repo *repo_model.Repository, redirectURL string) {
+func PerformSecretsDelete(ctx *context.Context, scope actions_model.BelongingScope, owner *user_model.User, repo *repo_model.Repository, redirectURL string) {
 	id := ctx.FormInt64("id")
-	ownerID, repoID := secretOwnerRepoIDs(owner, repo)
 
-	s, err := secret_service.DeleteSecretByID(ctx, ownerID, repoID, id)
+	s, err := secret_service.DeleteSecretByID(ctx, scope, id)
 	if err != nil {
 		log.Error("DeleteSecretByID(%d) failed: %v", id, err)
 		ctx.JSONError(ctx.Tr("secrets.deletion.failed"))