fix(team): take team repositories as arguments and address teams by name

team repo add 5 org/repo was rejected, and team repo add 5 silently used
the repository of the current directory and failed with an internal
error. team repo add and remove now take the repositories as arguments,
resolve bare names inside the team's organization, refuse repositories of
other owners and --repo, and never discover a repository.

Teams can be addressed as ORG/TEAM by name or ID as well as by their
global ID. team list drops the always-empty ORG column and shows the
derived access ("write (code, issues, pulls)" instead of none), member
and repository counts; team view shows units, members and repositories.
--permission read or write now grants every repository unit on both
create and edit, and edit no longer shows the create default. team
create takes the name as ORG/NAME or a second argument. Member and
repository changes skip users and repositories already in the wanted
state with a warning, name them in confirmations and print ✓ lines. Every
command has examples, and teams, members, users, repositories and --unit
values complete.

Signed-off-by: bircni <bircni@icloud.com>

internal/app/teams_test.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
+	"strings"
 	"testing"
 
 	"gitea.dev/tea/internal/clierr"
@@ -78,3 +79,133 @@ func TestTeamEditMergesUnitsIntoTheCurrentPolicy(t *testing.T) {
 	require.ErrorContains(t, err, "--unit-replace requires --unit")
 	require.Len(t, sent, 2)
 }
+
+func TestTeamRepoAddTakesRepositoriesAsArguments(t *testing.T) {
+	var granted []string
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method + " " + r.URL.Path {
+		case "GET /api/v1/teams/5":
+			_, _ = w.Write([]byte(`{"id":5,"name":"devs","permission":"none","organization":{"username":"acme"}}`))
+		case "GET /api/v1/teams/5/repos/acme/service", "GET /api/v1/teams/5/repos/acme/website":
+			w.WriteHeader(http.StatusNotFound)
+		case "PUT /api/v1/teams/5/repos/acme/service", "PUT /api/v1/teams/5/repos/acme/website":
+			granted = append(granted, r.URL.Path)
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Errorf("unexpected request %s %s", r.Method, r.URL.Path)
+			w.WriteHeader(http.StatusTeapot)
+		}
+	}))
+	defer server.Close()
+	deps, _, _ := testDeps(t)
+	deps.Getenv = serverEnv(server.URL, map[string]string{"TEA_REPO": "alice/project"})
+	require.NoError(t, Execute(context.Background(), deps, []string{"team", "repo", "add", "5", "service", "acme/website"}))
+	require.Equal(t, []string{"/api/v1/teams/5/repos/acme/service", "/api/v1/teams/5/repos/acme/website"}, granted)
+	for args, want := range map[string]string{
+		"alice/project":           "alice/project is not owned by organization acme; teams can only be granted repositories of their organization",
+		"service -R acme/service": "--repo is not used by tea team repo add; name the repositories as arguments",
+	} {
+		err := Execute(context.Background(), deps, append([]string{"team", "repo", "add", "5"}, strings.Fields(args)...))
+		require.Equal(t, clierr.Usage, clierr.ExitCode(err), "%v", err)
+		require.ErrorContains(t, err, want)
+	}
+	require.Len(t, granted, 2)
+}
+
+func TestTeamsAreAddressedAsOrganizationAndName(t *testing.T) {
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		require.Equal(t, "/api/v1/orgs/acme/teams/search", r.URL.Path)
+		if r.URL.Query().Get("page") != "1" {
+			_, _ = w.Write([]byte(`{"ok":true,"data":[]}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{"ok":true,"data":[{"id":2,"name":"developers","permission":"none","units_map":{"repo.code":"write"}},{"id":7,"name":"developers-old","permission":"none"}]}`))
+	}))
+	defer server.Close()
+	deps, out, _ := serverDeps(t, server.URL)
+	for _, ref := range []string{"acme/Developers", "acme/developers", "acme/2"} {
+		out.Reset()
+		require.NoError(t, Execute(context.Background(), deps, []string{"team", "view", ref, "--json", "id,name,organization"}))
+		require.JSONEq(t, `{"id":2,"name":"developers","organization":"acme"}`, out.String(), ref)
+	}
+	err := Execute(context.Background(), deps, []string{"team", "view", "acme/ops"})
+	require.EqualError(t, err, `team "ops" not found in acme`)
+}
+
+func TestTeamListShowsAccessAndSizes(t *testing.T) {
+	totals := map[string]string{"/api/v1/teams/1/members": "1", "/api/v1/teams/1/repos": "4", "/api/v1/teams/2/members": "3", "/api/v1/teams/2/repos": "2"}
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/v1/orgs/acme/teams" {
+			_, _ = w.Write([]byte(`[{"id":1,"name":"Owners","permission":"owner","includes_all_repositories":true},
+				{"id":2,"name":"developers","permission":"none","units_map":{"repo.code":"write","repo.issues":"write","repo.pulls":"write"}}]`))
+			return
+		}
+		total, ok := totals[r.URL.Path]
+		if !ok {
+			t.Errorf("unexpected request %s", r.URL.Path)
+		}
+		w.Header().Set("X-Total-Count", total)
+		_, _ = w.Write([]byte(`[]`))
+	}))
+	defer server.Close()
+	deps, out, _ := serverDeps(t, server.URL)
+	require.NoError(t, Execute(context.Background(), deps, []string{"team", "list", "acme"}))
+	require.Equal(t, "1\tOwners\towner\t1\tall\n2\tdevelopers\twrite (code, issues, pulls)\t3\t2\n", out.String())
+}
+
+func TestTeamPermissionSetsEveryUnit(t *testing.T) {
+	var sent []map[string]any
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			var body map[string]any
+			require.NoError(t, json.NewDecoder(r.Body).Decode(&body))
+			sent = append(sent, body)
+		}
+		_, _ = w.Write([]byte(`{"id":5,"name":"devs","permission":"none","organization":{"username":"acme"}}`))
+	}))
+	defer server.Close()
+	deps, _, _ := serverDeps(t, server.URL)
+	every := func(access string) map[string]any {
+		units := map[string]any{"repo.ext_issues": "read", "repo.ext_wiki": "read"}
+		for _, unit := range []string{"repo.code", "repo.issues", "repo.pulls", "repo.releases", "repo.wiki", "repo.projects", "repo.packages", "repo.actions"} {
+			units[unit] = access
+		}
+		return units
+	}
+	require.NoError(t, Execute(context.Background(), deps, []string{"team", "create", "acme/devs", "--permission", "write"}))
+	require.NoError(t, Execute(context.Background(), deps, []string{"team", "edit", "5", "--permission", "read", "--unit", "repo.wiki=write"}))
+	require.Len(t, sent, 2)
+	require.Equal(t, "devs", sent[0]["name"])
+	require.Equal(t, every("write"), sent[0]["units_map"])
+	wikiWrite := every("read")
+	wikiWrite["repo.wiki"] = "write"
+	require.Equal(t, map[string]any{"permission": "read", "units_map": wikiWrite}, sent[1])
+}
+
+func TestTeamMemberRemoveNamesMembersAndSkipsOthers(t *testing.T) {
+	var removed []string
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method + " " + r.URL.Path {
+		case "GET /api/v1/teams/5":
+			_, _ = w.Write([]byte(`{"id":5,"name":"devs","organization":{"username":"acme"}}`))
+		case "GET /api/v1/teams/5/members/carol":
+			_, _ = w.Write([]byte(`{"login":"carol"}`))
+		case "GET /api/v1/teams/5/members/dave":
+			w.WriteHeader(http.StatusNotFound)
+		case "DELETE /api/v1/teams/5/members/carol":
+			removed = append(removed, "carol")
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			t.Errorf("unexpected request %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer server.Close()
+	deps, _, diagnostics := serverDeps(t, server.URL)
+	deps.Streams.InTTY, deps.Streams.ErrTTY, deps.Streams.OutTTY = true, true, true
+	prompt := &scriptedPrompter{accept: true}
+	deps.Prompter = prompt
+	require.NoError(t, Execute(context.Background(), deps, []string{"team", "member", "remove", "5", "carol", "dave"}))
+	require.Equal(t, []string{"Remove carol from team acme/devs?"}, prompt.confirmations)
+	require.Equal(t, []string{"carol"}, removed)
+	require.Equal(t, "! dave is not a member of team acme/devs\n✓ Removed carol from team acme/devs\n", withoutANSI(diagnostics.String()))
+}