From a8a12241ce0854dff3ea7e084f310eef87334796 Mon Sep 17 00:00:00 2001
From: Beowulf <beowulf@beocode.eu>
Date: Wed, 14 Jan 2026 08:15:39 +0100
Subject: [PATCH] fix(ui): show switch default branch button in branch list
 only for repo admins (#10814)

The default braunch is configured in the repo settings. Only users with
administrator privileges for the repository can access the repo
settings. When the feature was implemented (72e956b79a3b2e055bb5d4d5e20e88eaa2eeec96),
the button in the branch list was only guarded with a check for repo
write permissions. This means the button is shown to too many users.
If no an user with write, but not admin permissions clicks on the button,
they see just a 404 page. Which is bad UX.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10814
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
---
 templates/repo/branch/list.tmpl       |  2 +-
 tests/integration/repo_branch_test.go | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/templates/repo/branch/list.tmpl b/templates/repo/branch/list.tmpl
index 55a7bbcf07..a3a81cccc4 100644
--- a/templates/repo/branch/list.tmpl
+++ b/templates/repo/branch/list.tmpl
@@ -7,7 +7,7 @@
 		{{if .DefaultBranchBranch}}
 			<h4 class="ui top attached header">
 				{{ctx.Locale.Tr "repo.default_branch"}}
-				{{if and $.IsWriter (not $.Repository.IsArchived) (not .IsDeleted)}}
+				{{if and $.Permission.IsAdmin (not $.Repository.IsArchived) (not .IsDeleted)}}
 				<a role="button" class="right" href="{{.RepoLink}}/settings/branches" data-tooltip-content="{{ctx.Locale.Tr "repo.settings.branches.switch_default_branch"}}">
 					{{svg "octicon-arrow-switch"}}
 				</a>
diff --git a/tests/integration/repo_branch_test.go b/tests/integration/repo_branch_test.go
index c9bec7d2fc..68bbbf3f7b 100644
--- a/tests/integration/repo_branch_test.go
+++ b/tests/integration/repo_branch_test.go
@@ -186,6 +186,31 @@ func TestDatabaseMissingABranch(t *testing.T) {
 	})
 }
 
+func TestSwitchDefaultBranchButtonVisibility(t *testing.T) {
+	onApplicationRun(t, func(t *testing.T, u *url.URL) {
+		session := loginUser(t, "user5")
+
+		t.Run("Check switch default branch button", func(t *testing.T) {
+			t.Run("Repo admin", func(t *testing.T) {
+				repo4 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+
+				// Check that the button is present
+				resp := session.MakeRequest(t, NewRequest(t, "GET", "/"+repo4.FullName()+"/branches"), http.StatusOK)
+				htmlDoc := NewHTMLParser(t, resp.Body)
+				assert.Equal(t, 1, htmlDoc.doc.Find("a[href='/"+repo4.FullName()+"/settings/branches']").Length())
+			})
+			t.Run("None repo admin", func(t *testing.T) {
+				repo40 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 40})
+
+				// Check that the button is NOT present
+				resp := session.MakeRequest(t, NewRequest(t, "GET", "/"+repo40.FullName()+"/branches"), http.StatusOK)
+				htmlDoc := NewHTMLParser(t, resp.Body)
+				assert.Equal(t, 0, htmlDoc.doc.Find("a[href='/"+repo40.FullName()+"/settings/branches']").Length())
+			})
+		})
+	})
+}
+
 func TestCreateBranchButtonVisibility(t *testing.T) {
 	onApplicationRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user1")