feat(ui): display repositories accessible by repo-specific access tokens (#11604)

When an access token is repository specific, display the repositories that it can access when expanded in the UI (token **test** in this screenshot):

![image](/attachments/6d2d539c-7781-4a4f-ba90-a28b7c365c6c)

Default, collapsed view is unchanged:

![image](/attachments/a4f0a36d-2f2b-46af-8fa6-c8d445f707e4)

Bulk loading of repositories is refactored out of the access token API endpoint into a `BulkGetRepositoriesForAccessTokens` method that can be used in both this UI, and the original API location.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11604
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>

models/repo/repo.go

@@ -15,10 +15,12 @@ import (
 	"strconv"
 	"strings"
 
+	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/db"
 	"forgejo.org/models/unit"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/cache"
+	"forgejo.org/modules/container"
 	"forgejo.org/modules/git"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/markup"
@@ -1001,3 +1003,55 @@ func UpdateRepoIssueNumbers(ctx context.Context, repoID int64, isPull, isClosed
 	})
 	return nil
 }
+
+// Bulk load of all the repo_model.Repository objects for the repository resources that can be accessed by the given
+// access tokens.  Any access tokens which are not repository-specific tokens will not be present in the map.  An
+// optional filter function can be used to remove repositories (based upon a user visibility check, for example) before
+// the map is constructed -- return `true` for repos to include.
+func BulkGetRepositoriesForAccessTokens(ctx context.Context, tokens []*auth_model.AccessToken, filter func(*Repository) (bool, error)) (map[int64][]*Repository, error) {
+	// Load all the AccessTokenResourceRepo for the tokens that we're returning:
+	allRepoIDs := container.Set[int64]{}
+	repoResourcesByTokenID, err := auth_model.GetRepositoriesAccessibleWithTokens(ctx, tokens)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch repositories for tokens: %w", err)
+	}
+
+	// Load all the Repository models that are referenced by the AccessTokenResourceRepo's:
+	for _, repoResources := range repoResourcesByTokenID {
+		for _, repoResource := range repoResources {
+			allRepoIDs.Add(repoResource.RepoID)
+		}
+	}
+	reposByID, err := GetRepositoriesMapByIDs(ctx, allRepoIDs.Slice())
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch repositories: %w", err)
+	}
+
+	if filter != nil {
+		// Rebuild reposByID, filtering it with the provided filter function.  It's more efficient to do this here,
+		// rather than returning the data and allowing the caller to filter it, because this guarantees one invocation
+		// per repository.  `reposByTokenID` could have the same repository referenced by multiple access tokens.
+		tmp := reposByID
+		reposByID = make(map[int64]*Repository, len(tmp))
+		for id, repo := range tmp {
+			if ok, err := filter(repo); err != nil {
+				return nil, fmt.Errorf("error filtering repo %d: %w", repo.ID, err)
+			} else if ok {
+				reposByID[id] = repo
+			}
+		}
+	}
+
+	// Prepare a lookup map to access the repositories by token ID:
+	reposByTokenID := make(map[int64][]*Repository)
+	for tokenID, repoResources := range repoResourcesByTokenID {
+		for _, repoResource := range repoResources {
+			repo, ok := reposByID[repoResource.RepoID]
+			if ok {
+				reposByTokenID[tokenID] = append(reposByTokenID[tokenID], repo)
+			}
+		}
+	}
+
+	return reposByTokenID, nil
+}