[I] [Bug][Webhook] Requests via /rest/... alias return 401 when AUTH_ENABLED=true, even with a valid API key [devlake]

["kamphaus (via GitHub)" <gi...@apache.org>]

kamphaus opened a new issue, #9007:
URL: https://github.com/apache/devlake/issues/9007

   ### Search before asking
   
   - [x] I had searched in the [issues](https://github.com/apache/incubator-devlake/issues?q=is%3Aissue) and found no similar issues.
   
   
   ### What happened
   
   When `AUTH_ENABLED=true`, requests to REST-style webhook endpoints (e.g. /rest/plugins/webhook/connections/:id/deployments) with a valid `Authorization: Bearer <key>` are rejected with `401 Unauthorized`, even though the key is valid and authorized for the path.
   
   Root cause: RestAuthentication (backend/server/api/middlewares.go) validates the key and sets the user on the gin context via `c.Set(common.USER, ...)`, then reroutes /rest/... → /plugins/... via gin's HandleContext. That call resets c.Keys internally, wiping the just-set user, so the downstream RequireAuth middleware finds no user and returns 401.
   
   ### What do you expect to happen
   
   A valid, authorized REST API key request should reach the handler and get 200, regardless of `AUTH_ENABLED`. The authenticated user should survive gin's context reset during the /rest/... → /plugins/... reroute.
   
   ### How to reproduce
   
   1. Set `AUTH_ENABLED=true`, start DevLake.
   2. Create an API key with AllowedPath covering a webhook endpoint, e.g. /plugins/webhook/connections/1/.*.
   3. POST /rest/plugins/webhook/connections/1/deployments with Authorization: Bearer <api-key>.
   4. Observe 401 instead of 200.
   
   ### Anything else
   
   Only affects the /rest/... alias path (rerouted via HandleContext) when an auth-gating middleware like RequireAuth is active; direct /plugins/... requests are unaffected.
   
   ### Version
   
   v1.0.3-beta15
   
   ### Are you willing to submit PR?
   
   - [x] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@devlake.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug][Webhook] Requests via /rest/... alias return 401 when AUTH_ENABLED=true, even with a valid API key [devlake]

["klesh (via GitHub)" <gi...@apache.org>]

klesh closed issue #9007: [Bug][Webhook] Requests via /rest/... alias return 401 when AUTH_ENABLED=true, even with a valid API key
URL: https://github.com/apache/devlake/issues/9007


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org