fix(webhook): fix webhook authorization

Author: kamphaus

backend/server/api/middlewares.go

@@ -33,6 +33,7 @@ import (
 	"github.com/apache/incubator-devlake/core/errors"
 	"github.com/apache/incubator-devlake/core/models/common"
 	"github.com/apache/incubator-devlake/helpers/apikeyhelper"
+	"github.com/apache/incubator-devlake/server/api/shared"
 	"github.com/gin-gonic/gin"
 )
 
@@ -272,9 +273,13 @@ func CheckAuthorizationHeader(c *gin.Context, logger log.Logger, db dal.Dal, api
 
 	logger.Info("redirect path: %s to: %s", c.Request.URL.Path, path)
 	c.Request.URL.Path = path
-	c.Set(common.USER, &common.User{
+	user := &common.User{
 		Name:  apiKey.Creator.Creator,
 		Email: apiKey.Creator.CreatorEmail,
-	})
+	}
+	c.Set(common.USER, user)
+	// Also store in the request context so the user survives gin's HandleContext
+	// resetting c.Keys when rerouting from /rest/... to /plugins/...
+	c.Request = shared.SetRestAuthUser(c.Request, user)
 	return true
 }

backend/server/api/shared/gin_utils.go

@@ -18,15 +18,36 @@ limitations under the License.
 package shared
 
 import (
+	"context"
+	"net/http"
+
 	"github.com/apache/incubator-devlake/core/models/common"
 	"github.com/gin-gonic/gin"
 )
 
+// restAuthKey is an unexported type used as a request-context key so it cannot
+// collide with keys set by other packages.
+type restAuthKey struct{}
+
+// SetRestAuthUser stores the authenticated user in the HTTP request context.
+// This is necessary because gin's HandleContext calls c.reset(), which clears
+// c.Keys but leaves c.Request (and its context) intact. RestAuthentication
+// calls this before rerouting so the user survives the reset.
+func SetRestAuthUser(r *http.Request, user *common.User) *http.Request {
+	return r.WithContext(context.WithValue(r.Context(), restAuthKey{}, user))
+}
+
 func GetUser(c *gin.Context) (*common.User, bool) {
 	userObj, exist := c.Get(common.USER)
-	if !exist {
-		return nil, false
+	if exist {
+		if user, ok := userObj.(*common.User); ok {
+			return user, true
+		}
+	}
+	// Fallback: RestAuthentication stores the user here before calling
+	// HandleContext, which resets c.Keys but preserves c.Request.
+	if user, ok := c.Request.Context().Value(restAuthKey{}).(*common.User); ok && user != nil {
+		return user, true
 	}
-	user := userObj.(*common.User)
-	return user, true
+	return nil, false
 }