fix: only admins, repo, and pr owners can change status

commit: c44fec8
parent: 4b46070
author: Eric Bower
date: 2026-02-23 07:43:07 -0500 EST

fix: only admins, repo, and pr owners can change status

I'm not sure why I made it so anyone could change the status but it impacts where the PR goes in the UI which I thin k we want to be exclusive to contributors.

1 files changed, +3, -3

M backend.go

+3, -3

 1@@ -141,7 +141,7 @@ func (be *Backend) GetPatchRequestAcl(repo *Repo, prq *PatchRequest, requester *
 2 		return acl
 3 	}
 4 
 5-	// pr creator have special priv
 6+	// pr creator has special priv
 7 	if be.IsPrOwner(prq.UserID, requester.ID) {
 8 		acl.CanModify = true
 9 		acl.CanReview = false
10@@ -153,8 +153,8 @@ func (be *Backend) GetPatchRequestAcl(repo *Repo, prq *PatchRequest, requester *
11 	// otherwise no perms
12 	acl.CanModify = false
13 	acl.CanDelete = false
14-	// anyone can review or add a patchset
15-	acl.CanReview = true
16+	acl.CanReview = false
17+	// anyone can add a patchset
18 	acl.CanAddPatchset = true
19 
20 	return acl