feat(repo): allow deleting protected branches (#39243)

This adds a Branch Deletion setting with three modes: disabled by
default, anyone with push access, or a restricted user/team/deploy-key
allowlist. The policy applies to Git pushes, API/UI deletion, and
post-merge cleanup; the default branch and the pull request target
branch remain undeletable.

Closes https://github.com/go-gitea/gitea/issues/33305

---------

Co-authored-by: Enoque Duarte <12515551+enoquefcd@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

models/git/protected_branch_test.go

@@ -7,7 +7,10 @@ import (
 	"testing"
 
 	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 
@@ -210,6 +213,8 @@ func TestProtectedBranchConfig(t *testing.T) {
 	pb := &ProtectedBranch{
 		RepoID: 1, RuleName: "config-test",
 		ProtectedBranchConfig: ProtectedBranchConfig{
+			CanDelete: true, EnableDeletionAllowlist: true,
+			DeletionAllowlistUserIDs: []int64{2, 4, user_model.ActionsUserID, user_model.DeployKeyUserID}, DeletionAllowlistTeamIDs: []int64{1, 2},
 			CanPush: true, WhitelistUserIDs: []int64{2, 4}, WhitelistTeamIDs: []int64{1, 2}, StatusCheckContexts: []string{},
 		},
 	}
@@ -222,9 +227,52 @@ func TestProtectedBranchConfig(t *testing.T) {
 	assert.Equal(t, []int64{4}, loaded.WhitelistUserIDs)
 	assert.Equal(t, []int64{2}, loaded.WhitelistTeamIDs)
 	assert.True(t, loaded.CanPush)
+	assert.True(t, loaded.CanDelete)
+	assert.True(t, loaded.EnableDeletionAllowlist)
+	assert.Equal(t, []int64{4, user_model.ActionsUserID, user_model.DeployKeyUserID}, loaded.DeletionAllowlistUserIDs)
+	assert.Equal(t, []int64{2}, loaded.DeletionAllowlistTeamIDs)
 	loaded.ProtectedBranchConfig = ProtectedBranchConfig{}
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 	require.NoError(t, UpdateProtectBranch(ctx, repo, loaded, WhitelistOptions{}))
 	loaded = unittest.AssertExistsAndLoadBean(t, &ProtectedBranch{ID: pb.ID})
 	assert.Equal(t, ProtectedBranchConfig{}, loaded.ProtectedBranchConfig)
 }
+
+func TestProtectedBranchCanUserDelete(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	writePermission := access_model.Permission{}
+	writePermission.SetUnitsWithDefaultAccessMode([]*repo_model.RepoUnit{{Type: unit.TypeCode}}, perm.AccessModeWrite)
+	readPermission := access_model.Permission{}
+	readPermission.SetUnitsWithDefaultAccessMode([]*repo_model.RepoUnit{{Type: unit.TypeCode}}, perm.AccessModeRead)
+
+	for _, user := range []*user_model.User{{ID: 2, Name: "user2"}, user_model.NewActionsUser(), user_model.NewDeployKeyUser()} {
+		t.Run(user.GetDisplayName(), func(t *testing.T) {
+			for _, tt := range []struct {
+				name   string
+				config ProtectedBranchConfig
+				want   bool
+			}{
+				{name: "disabled by default", config: ProtectedBranchConfig{CanPush: true}},
+				{name: "push disabled", config: ProtectedBranchConfig{CanDelete: true}},
+				{name: "unrestricted", config: ProtectedBranchConfig{CanPush: true, CanDelete: true}, want: true},
+				{name: "empty push allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true}},
+				{name: "not in push allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, WhitelistUserIDs: []int64{1}}},
+				{name: "empty deletion allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true}},
+				{name: "not in deletion allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{1}}},
+				{name: "in both allowlists", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, WhitelistUserIDs: []int64{user.ID}, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{user.ID}}, want: true},
+				{name: "deletion allowlist does not grant push", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{user.ID}}},
+				{name: "team member", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistTeamIDs: []int64{1}}, want: user.ID == 2},
+				{name: "push team member", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, WhitelistTeamIDs: []int64{1}}, want: user.ID == 2},
+				{name: "not in team", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistTeamIDs: []int64{3}}},
+				{name: "user or team", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{user.ID}, DeletionAllowlistTeamIDs: []int64{3}}, want: true},
+			} {
+				t.Run(tt.name, func(t *testing.T) {
+					pb := &ProtectedBranch{ProtectedBranchConfig: tt.config}
+					assert.Equal(t, tt.want, pb.CanUserDelete(t.Context(), user, writePermission))
+					assert.False(t, pb.CanUserDelete(t.Context(), user, readPermission))
+					assert.False(t, pb.CanUserDelete(t.Context(), nil, writePermission))
+				})
+			}
+		})
+	}
+}