[Bug][Webhook] Requests via /rest/... alias return 401 when AUTH_ENABLED=true, even with a valid API key

[kamphaus]

Search before asking

• I had searched in the issues and found no similar issues.

What happened

When AUTH_ENABLED=true, requests to REST-style webhook endpoints (e.g. /rest/plugins/webhook/connections/:id/deployments) with a valid Authorization: Bearer <key> are rejected with 401 Unauthorized, even though the key is valid and authorized for the path.

Root cause: RestAuthentication (backend/server/api/middlewares.go) validates the key and sets the user on the gin context via c.Set(common.USER, ...), then reroutes /rest/... → /plugins/... via gin's HandleContext. That call resets c.Keys internally, wiping the just-set user, so the downstream RequireAuth middleware finds no user and returns 401.

What do you expect to happen

A valid, authorized REST API key request should reach the handler and get 200, regardless of AUTH_ENABLED. The authenticated user should survive gin's context reset during the /rest/... → /plugins/... reroute.

How to reproduce

1. Set AUTH_ENABLED=true, start DevLake.
2. Create an API key with AllowedPath covering a webhook endpoint, e.g. /plugins/webhook/connections/1/.*.
3. POST /rest/plugins/webhook/connections/1/deployments with Authorization: Bearer .
4. Observe 401 instead of 200.

Anything else

Only affects the /rest/... alias path (rerouted via HandleContext) when an auth-gating middleware like RequireAuth is active; direct /plugins/... requests are unaffected.

Version

v1.0.3-beta15

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct