Repository navigation
fix: keep the session when browsing a group repository - #46
Merged
Merged
Conversation
A group that mirrors private members through loopback references answered 401 when a member refused the mirror identity, and a remote mirror relayed its own 401 or 403. Maven metadata is mirror first under the default storage policy, so that refusal reached the caller as it was. The dashboard reads a 401 as a rejected session, so a signed in user was logged out by the details card of such a group. A loopback member that refuses the mirror identity is answered as not found: the refusal concerns the instance and not the caller, and the member is not part of the answer. A remote host that refuses its configured credentials is answered as bad gateway for the same reason.
A 401 on a listing or content request ended the signed in session. In cookie mode the request was refreshed and retried once, and a second 401 ended a session that the refresh had just proved valid. A token session ended on the first 401 without asking the server. A refused retry after a successful refresh is now treated as the server refusing that one request. In token mode a 401 ends the session only when GET /api/auth/me refuses the same credentials. A refused refresh still ends the session, and so does a request that carries no credentials of its own, as before.
Test results 264 files 264 suites 46m 33s ⏱️ Results for commit a72d6a6. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Signed-in users were logged out when they opened a group repository in the dashboard, for example a group that mirrors private members through loopback references.
The details card of a group requests
/<group>/maven-metadata.xml. Maven metadata is mirror first under the default storage policy, so that request goes to the loopback members. A member that refused the mirror identity answered 401, and the instance relayed that 401 to the browser. A loopback reference with theBASICmethod never uses its credentials, so the member was read anonymously and refused. The dashboard then refreshed the session, retried the request, got the same 401 and ended the session, although the refresh had just proven that the session is valid.Changes:
GET /api/auth/merefuses the same credentials. A refused refresh still ends the session.Deliberately not changed:
authorizationwith theBASICmethod is ignored and onlyLOOPBACK_LINKtakes effect. Changing that is a configuration decision and is left to a separate change.Type of change
fix- bug fixfeat- new featurerefactor- internal change without behaviour changeperf- performance improvementdocs- documentation onlytest- tests onlybuild/ci/chore- tooling, dependencies, pipelinesHow was this tested?
./gradlew :reposilite-backend:test --tests com.reposilite.maven.RepositoryLoopbackRefusalTest: four new tests. Three fail without the backend change: the metadata of a group whose member the mirror cannot read, for a signed in and for an anonymous caller, and the bad gateway for a refusing remote. The fourth keeps a member that the mirror identity can read served.RepositoryMembersTest,MavenFacadeTest,ResolutionCacheTest,ResolutionCacheIntegrationTest,MirrorCacheServiceTestandUpstreamSourceHostTest: all green.npx vitest runonclient.test.js,client-cookie.test.js,session-cookie.test.js,session.test.jsand the other client and session specs: 184 tests pass. New tests cover a refused content request that keeps the session, a refused refresh that ends it, and the token mode session check.GET /onelitefeather/maven-metadata.xmlGET /api/auth/meafter a successful refreshGET /public/<artifact>/maven-metadata.xmlfor a public memberChecklist
CLAUDE.md(English, imperative, one offeat,fix,docs,refactor,test,build,ci,chore,perf)./gradlew buildpasses locally - not run. Only the touched test classes were run, as listed above, because a full build was out of scope for this change