Fix auth process to check against username also and not just groups

[aszmyd]

Type: bug

Description:

When using some authentication plugins other than htpasswd (we're using sinopia-github-oauth) user gets 403 if package publish/access config is setup to use username. I.e.:

packages:
    '**':
        access: $authenticated
        publish: aszmyd

Is not working as authentication is checking this publish field against user groups only. But because my user object looks like this:

{ 
    name: 'aszmyd',
    groups: [ 'org', '$all', '$authenticated', '@all', '@authenticated', 'all' ],
    real_groups: [ 'org' ] 
 }

And the current check fails.

My PR is fixing this by changing the way authentication checks publish/access configurations - now it checks also against user.name and not just user.groups

[juanpicado]

Your change makes sense and fits with the documentation. I could not find any downside on this change. I'll merge. Thanks, nice catch.

[aszmyd]

Thanks. Do You have any idea when You'll be putting this to release?

[juanpicado]

10 seconds ago ;) v2.3.6

[aszmyd]

@juanpicado super fast! Thanks!

[juanpicado]

hehe thanks ! ☕️ helps at mornings ...

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.