kamphaus opened a new pull request, #9008:
URL: https://github.com/apache/devlake/pull/9008
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
### ⚠️ Pre Checklist
> Please complete _ALL_ items in this checklist, and remove before submitting
- [x] I have read through the [Contributing
Documentation](https://devlake.apache.org/community/).
- [x] I have added relevant tests.
- I have added relevant documentation. → NA
- [x] I will add labels to the PR, such as `pr-type/bug-fix`,
`pr-type/feature-development`, etc.
<!--
Thanks for submitting a pull request!
We appreciate you spending the time to work on these changes.
Please fill out as many sections below as possible.
-->
### Summary
When AUTH_ENABLED=true, requests to REST-style webhook endpoints (e.g.
/rest/plugins/webhook/connections/:id/deployments) were incorrectly rejected
with 401 Unauthorized even when a valid, authorized API key was supplied. The
root cause is in RestAuthentication: it validates the API key and stores the
resulting user on the gin context, then reroutes the request from /rest/... to
/plugins/... via gin's HandleContext. That call internally resets c.Keys,
wiping the user that was just set, so the downstream RequireAuth middleware
sees no authenticated user and rejects the request.
The fix stores the authenticated user in the underlying http.Request's
context as well, since c.Request survives gin's context reset during the
reroute. shared.GetUser now falls back to this request-context value when the
gin context key is missing. A regression test spins up a real router with
RestAuthentication + a RequireAuth-style gate + a webhook handler, and confirms
a valid bearer-token request now reaches the handler (200) instead of being
rejected (401).
### Does this close any open issues?
Closes #9007
### Other Information
- [x] Disclose AI usage: AI-assisted
- [x] I have verified that the regression test fails without the fix and
passes with the fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
