You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@devlake.apache.org by "lrf-nitro (via GitHub)" <gi...@apache.org> on 2026/06/08 12:15:32 UTC
[PR] fix(auth): preserve API-key user across RequireAuth re-dispatch [devlake]
lrf-nitro opened a new pull request, #8913:
URL: https://github.com/apache/devlake/pull/8913
Open-API (/rest) requests authenticated with a valid API key were rejected with 401 "unauthorized" whenever AUTH_ENABLED is on (the default - unless explicitly disabled via env var). The API-key middleware authenticates the request and sets common.USER via c.Set, then re-dispatches the rewritten path through router.HandleContext. gin's HandleContext calls Context.reset(), which sets c.Keys = nil and destroys the user, so the terminal RequireAuth gate sees no user and 401s.
Carry the authenticated user on the request's context.Context, which survives HandleContext (only gin Keys are reset). GetUser now falls back to the request context when gin Keys are empty. This fixes every /rest endpoint (webhooks, push, etc.) at once without disabling auth.
Add regression coverage:
- shared: user set via SetUserOnRequest survives a HandleContext re-dispatch while gin Keys do not.
- api: the full RestAuthentication -> OIDCAuthentication -> RequireAuth chain with AUTH_ENABLED=true returns 200 for a valid key, 401 for missing token, 403 for an invalid key, and 401 for a userless protected route.
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
### ⚠️ Pre Checklist
> Please complete _ALL_ items in this checklist, and remove before submitting
- [x] I have read through the [Contributing Documentation](https://devlake.apache.org/community/).
- [x] I have added relevant tests.
- [x] I have added relevant documentation.
- [x] I will add labels to the PR, such as `pr-type/bug-fix`, `pr-type/feature-development`, etc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): preserve API-key user across RequireAuth re-dispatch [devlake]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #8913: fix(auth): preserve API-key user across RequireAuth re-dispatch
URL: https://github.com/apache/devlake/pull/8913
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): preserve API-key user across RequireAuth re-dispatch [devlake]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #8913:
URL: https://github.com/apache/devlake/pull/8913#issuecomment-6049771181
This pull request has been automatically marked as stale because it has not had recent activity for 120 days. It will be closed in 7 days if no further activity occurs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): preserve API-key user across RequireAuth re-dispatch [devlake]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #8913:
URL: https://github.com/apache/devlake/pull/8913#issuecomment-6205278636
This pull request has been closed because it has not had recent activity. You could reopen it if you try to continue your work, and anyone who are interested in it are encouraged to continue work on this pull request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org