fix(org,team): guard the owner team rename, show permission-only team access and tidy member lookups

Signed-off-by: bircni <bircni@icloud.com>

internal/services/teams.go

@@ -67,8 +67,8 @@ func (t Team) Access() string {
 	var level string
 	var granted []string
 	for _, unit := range TeamUnits {
-		access := t.Units[unit]
-		if access == "" || access == "none" {
+		access := t.UnitLevel(unit)
+		if access == "none" {
 			continue
 		}
 		if level != "" && access != level {
@@ -86,6 +86,22 @@ func (t Team) Access() string {
 	return level + " (" + strings.Join(granted, ", ") + ")"
 }
 
+// UnitLevel is the access the team has to unit: the higher of the unit's own level and the team
+// permission, which Gitea grants on every unit, capped at the levels the unit allows.
+func (t Team) UnitLevel(unit string) string {
+	levels := UnitAccess(unit)
+	level := "none"
+	for _, candidate := range []string{t.Units[unit], t.Permission} {
+		if candidate == "write" && !slices.Contains(levels, "write") {
+			candidate = "read"
+		}
+		if slices.Index(levels, candidate) > slices.Index(levels, level) {
+			level = candidate
+		}
+	}
+	return level
+}
+
 // Slug names the team as ORG/TEAM, or by name alone when its organization is unknown.
 func (t Team) Slug() string {
 	if t.Organization == "" {
@@ -273,12 +289,23 @@ func (s Teams) Delete(ctx context.Context, id int64) error {
 	})
 }
 
+// TeamMember identifies a team member without exposing private profile fields.
+type TeamMember struct {
+	ID       int64  `json:"id"`
+	Username string `json:"username"`
+	FullName string `json:"full_name"`
+}
+
+func teamMemberFrom(user *gitea.User) TeamMember {
+	return TeamMember{ID: user.ID, Username: user.UserName, FullName: user.FullName}
+}
+
 // Members lists members of a team.
-func (s Teams) Members(ctx context.Context, id int64, limit, page int) (Page[OrganizationMember], error) {
+func (s Teams) Members(ctx context.Context, id int64, limit, page int) (Page[TeamMember], error) {
 	users, err := callPage(ctx, s.Client, limit, page, func(ctx context.Context, c *gitea.Client, list gitea.ListOptions) ([]*gitea.User, *gitea.Response, error) {
 		return c.Organizations.ListTeamMembers(ctx, id, gitea.ListTeamMembersOptions{ListOptions: list})
 	})
-	return convertPage(users, memberFrom), err
+	return convertPage(users, teamMemberFrom), err
 }
 
 // SetMember adds or removes one team membership.