problem: /api/v1/repos/{owner}/{repo}/branch_protections responses with 403 for public-only key #12397
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Does your problem still exist on the latest Forgejo version?
Yes, the problem still exists (tested on a next instance)
About your usage of Forgejo
n/a
Problem description
Steps to reproduce:
write:repository./api/swagger#/repository/repoCreateBranchProtectionand send request (after logging in with a token). The body can be empty in JSON format, it doesn't matter.Expected:
Actual:
user should be an owner or a collaborator with admin write of a repository)It looks like a regression, because I used v11 earlier and there were no problems.
Potential workarounds
Use access token with
All (public, private, and limited)option.Forgejo Version
16.0.0-dev-218-b6658076a9+gitea-1.22.0
Other details about your environment (software names and versions)
n/a
Solutions
Accepted solutions to address this problem will go here
It is noted in Forgejo 15's release notes that there is a breaking change, "remove admin-level permissions from repo-specific & public-only access tokens" (#11468). Changing branch protection rules on a repository requires repository admin access, which is why it has been affected by this breaking change -- and that is one of the APIs described in the details noted in #11468.
Please review the explanation in #11468. The logic behind this change is open for debate and discussion, and within this larger context of related changes, I'd be open to discussing how these changes could be made in a logical and secure way.