fix(licenses): allow downloads on private repos with license key #425

Merged

jmiller merged 1 commits from dev into main

2026-06-02 15:13:52 +00:00

Author	SHA1	Message	Date
Jonathan Miller	02424c3f75	fix(licenses): allow download access on private licensed repos with license key Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details Universal: PR Check / Branch Policy (pull_request) Successful in 1s Details Universal: PR Check / Validate PR (pull_request) Failing after 4s Details Branch Cleanup / Delete merged branch (pull_request) Has been skipped Details PR RC Release / Build RC Release (pull_request) Successful in 20s Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details RepoAssignment now checks for dlid/key/download_key query params when licensing is enabled. Anonymous Joomla/WordPress clients with valid license keys can access release download routes on private repos without being signed in. Access flow for licensed private repos: - Anonymous + no key → 403 (styled page) - Anonymous + valid dlid → access granted (CheckDownloadGating validates) - Signed in + no membership → access granted (releases visible, downloads hidden) - Org member → full access Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-02 10:12:45 -05:00