fix(licenses): allow downloads on private repos with license key #425

Merged
jmiller merged 1 commits from dev into main 2026-06-02 15:13:52 +00:00
Owner

RepoAssignment checks for dlid/key params on licensed repos.

RepoAssignment checks for dlid/key params on licensed repos.
jmiller added 1 commit 2026-06-02 15:13:38 +00:00
fix(licenses): allow download access on private licensed repos with license key
Branch Policy Check / Verify merge target (pull_request) Successful in 1s
Universal: PR Check / Branch Policy (pull_request) Successful in 1s
Universal: PR Check / Validate PR (pull_request) Failing after 4s
Branch Cleanup / Delete merged branch (pull_request) Has been skipped
PR RC Release / Build RC Release (pull_request) Successful in 20s
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
02424c3f75
RepoAssignment now checks for dlid/key/download_key query params
when licensing is enabled. Anonymous Joomla/WordPress clients with
valid license keys can access release download routes on private
repos without being signed in.

Access flow for licensed private repos:
- Anonymous + no key → 403 (styled page)
- Anonymous + valid dlid → access granted (CheckDownloadGating validates)
- Signed in + no membership → access granted (releases visible, downloads hidden)
- Org member → full access

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jmiller merged commit 128b120ad9 into main 2026-06-02 15:13:52 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea#425