kamphaus opened a new issue, #9007: URL: https://github.com/apache/devlake/issues/9007
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/incubator-devlake/issues?q=is%3Aissue) and found no similar issues. ### What happened When `AUTH_ENABLED=true`, requests to REST-style webhook endpoints (e.g. /rest/plugins/webhook/connections/:id/deployments) with a valid `Authorization: Bearer <key>` are rejected with `401 Unauthorized`, even though the key is valid and authorized for the path. Root cause: RestAuthentication (backend/server/api/middlewares.go) validates the key and sets the user on the gin context via `c.Set(common.USER, ...)`, then reroutes /rest/... → /plugins/... via gin's HandleContext. That call resets c.Keys internally, wiping the just-set user, so the downstream RequireAuth middleware finds no user and returns 401. ### What do you expect to happen A valid, authorized REST API key request should reach the handler and get 200, regardless of `AUTH_ENABLED`. The authenticated user should survive gin's context reset during the /rest/... → /plugins/... reroute. ### How to reproduce 1. Set `AUTH_ENABLED=true`, start DevLake. 2. Create an API key with AllowedPath covering a webhook endpoint, e.g. /plugins/webhook/connections/1/.*. 3. POST /rest/plugins/webhook/connections/1/deployments with Authorization: Bearer <api-key>. 4. Observe 401 instead of 200. ### Anything else Only affects the /rest/... alias path (rerouted via HandleContext) when an auth-gating middleware like RequireAuth is active; direct /plugins/... requests are unaffected. ### Version v1.0.3-beta15 ### Are you willing to submit PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
