WOODPECKER_REPO_OWNERS is not working

[xoxys]

Component

server

Describe the bug

I am looking for a way to limit which orgs can be activated in Woodpecker. According to the description in the documentation, WOODPECKER_REPO_OWNERS should do this, but it doesn't work. Even if WOODPECKER_REPO_OWNERS=myorg is set, I can still enable repos of myorg and otherorg in Woodpecker.

Looking at the code, it looks like the variable is no longer used:

❯ grep -ri "OwnersWhitelist"
server/model/settings.go:	OwnersWhitelist map[string]bool // Owners whitelist
server/router/middleware/config.go:		OwnersWhitelist: sliceToMap2(c.StringSlice("repo-owners")),

Based on the Git history, it looks like the code was removed in #1658

❯ git log -SOwnersWhitelist
commit 0970f35df5034633a40b8d9f1a2ab901963aebee
Author: qwerty287 <80460567+qwerty287@users.noreply.github.com>
Date:   Tue Mar 21 23:01:59 2023 +0100

    Do not store inactive repos (#1658)
    
    Do not sync repos with forge if the repo is not necessary in DB.
    
    In the DB, only repos that were active once or repos that are currently
    active are stored. When trying to enable new repos, the repos list is
    fetched from the forge instead and displayed directly. In addition to
    this, the forge func `Perm` was removed and is now merged with `Repo`.
    
    Solves a TODO on RepoBatch.
    
    ---------
    
    Co-authored-by: Anbraten <anton@ju60.de>

Was it removed by accident or is there now another way to limit organizations in Woodpecker and WOODPECKER_REPO_OWNERS is just a leftover?

\cc @qwerty287

System Info

next

Additional context

No response

Validations

• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Checked that the bug isn't fixed in the next version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]
• Check that this is a concrete bug. For Q&A join our Discord Chat Server or the Matrix room.

[anbraten]

Do you search for https://woodpecker-ci.org/docs/next/administration/server-config#woodpecker_orgs?

[xoxys]

No, at least from the docs WOODPECKER_ORGS allows users of those organizations to login to woodpecker. It does not limit repos that can be activated.

[xoxys]

The documentation of the env var itself is IMO confusing and could be improved, but after reading the PR that introduced the WOODPECKER_ORGS env var and this docs page https://woodpecker-ci.org/docs/next/administration/server-config#user-registration it becomes clearer.