MokoConsulting/MokoGitea-APP
1
0
Fork 0
Code Issues 158 Pull Requests 3 Releases 96 Wiki Activity

feat(licenses): gate release asset downloads behind license key when licensing enabled #347

New Issue
Closed
opened 2026-05-31 15:31:44 +00:00 by jmiller · 2 comments
jmiller commented 2026-05-31 15:31:44 +00:00
Owner
Copy Link
Copy Source

Summary

When licensing is enabled and RequireKey is on for a repo, prevent unauthenticated/unauthorized users from directly downloading release assets (.zip files). Currently, anyone with the direct URL can download even without a valid license key.

Behavior

  • Logged-in users: Can always download (they have the repo in their dashboard)
  • Anonymous users with valid ?dlid= key: Can download (key is validated against the license system)
  • Anonymous users without key: Get a 403 or redirect to a "license required" page

Implementation

Add middleware to the release asset download route that checks:

  1. If licensing is enabled and RequireKey is on for the repo
  2. If the user is authenticated (allow)
  3. If a dlid/key query param is present and valid (allow)
  4. Otherwise reject

Claude Opus 4.6 (1M context) noreply@anthropic.com

## Summary When licensing is enabled and RequireKey is on for a repo, prevent unauthenticated/unauthorized users from directly downloading release assets (.zip files). Currently, anyone with the direct URL can download even without a valid license key. ### Behavior - **Logged-in users**: Can always download (they have the repo in their dashboard) - **Anonymous users with valid `?dlid=` key**: Can download (key is validated against the license system) - **Anonymous users without key**: Get a 403 or redirect to a "license required" page ### Implementation Add middleware to the release asset download route that checks: 1. If licensing is enabled and RequireKey is on for the repo 2. If the user is authenticated (allow) 3. If a `dlid`/`key` query param is present and valid (allow) 4. Otherwise reject --- *Claude Opus 4.6 (1M context) <noreply@anthropic.com>*
jmiller commented 2026-06-01 10:11:53 +00:00
Author
Owner
Copy Link
Copy Source

Testing Plan — Download Gating

API

  • Gating=none: GET /releases/download/v1.0/file.zip → 200 (no key needed)
  • Gating=all: GET same without key → 403
  • Gating=all: GET same with ?dlid=VALIDKEY → 200
  • Gating=all: GET same with ?dlid=INVALIDKEY → 403
  • Gating=prerelease: stable tag download without key → 200
  • Gating=prerelease: RC tag download without key → 403
  • Gating=prerelease: RC tag download with key → 200
  • Archive download (/archive/v1.0.zip) follows same gating rules
  • Gating respects effective config (repo override → org default)

GUI

  • Download gating dropdown in repo settings (none/prerelease/all)
  • Download gating dropdown in org settings
  • Help text explains each mode

🤖 Generated with Claude Code

## Testing Plan — Download Gating ### API - [ ] Gating=none: GET /releases/download/v1.0/file.zip → 200 (no key needed) - [ ] Gating=all: GET same without key → 403 - [ ] Gating=all: GET same with ?dlid=VALIDKEY → 200 - [ ] Gating=all: GET same with ?dlid=INVALIDKEY → 403 - [ ] Gating=prerelease: stable tag download without key → 200 - [ ] Gating=prerelease: RC tag download without key → 403 - [ ] Gating=prerelease: RC tag download with key → 200 - [ ] Archive download (/archive/v1.0.zip) follows same gating rules - [ ] Gating respects effective config (repo override → org default) ### GUI - [ ] Download gating dropdown in repo settings (none/prerelease/all) - [ ] Download gating dropdown in org settings - [ ] Help text explains each mode 🤖 Generated with [Claude Code](https://claude.com/claude-code)
jmiller reopened this issue 2026-06-02 11:21:40 +00:00
jmiller commented 2026-06-03 00:39:41 +00:00
Author
Owner
Copy Link
Copy Source

Tested and verified in production on MokoWaaS. All three download gating modes (none/prerelease/all), feed visibility, XML metadata, download URLs, and access control confirmed working.

Tested and verified in production on MokoWaaS. All three download gating modes (none/prerelease/all), feed visibility, XML metadata, download URLs, and access control confirmed working.
Sign in to join this conversation.
Labels
Clear labels
breaking-change
Breaking API or behavior change
 ci-cd
CI/CD pipeline changes
 config
Configuration changes
 dependencies
Dependency updates
 deploy-failure
Deployment failed
 docker
Docker/container changes
 documentation
Documentation changes
 good first issue
Good for newcomers
 health-check
Repo health check result
 help wanted
Extra attention needed
 mokostandards
Related to MokoStandards framework
 push-failure
Git push operation failed
 security
Security vulnerability or hardening
 size/l
200-500 lines changed
 size/m
50-200 lines changed
 size/s
10-50 lines changed
 size/xl
500+ lines changed
 size/xs
< 10 lines changed
 standards-drift
Deviates from MokoStandards
 standards-update
MokoStandards compliance update
 sync-failure
Sync or mirror failed
 tech-debt
Technical debt and TODO/FIXME items
 upstream
upstream
Inherited from upstream Gitea
 work-in-progress
Draft or incomplete work
No labels
Priority Medium
Type Feature
Milestone
No items
No Milestone
Assignees
Clear assignees
jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-APP#347
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?