unauthorized: reqPackageAccess when pushing to container registry

[avber]

Description

Hi,

I used the following page [https://docs.gitea.com/usage/packages/container] as a reference.

Steps

• an organization was created
• admin user PAT (write:package) was created
• regular user PAT (write:package) was created
• the regular user was iсnluded as a member in the organization

docker login works for both admin and regular user

• an image was tagged gitea.domain.com/orgname/image
• an image was tagged gitea.domain.com/username/image

docker push failed in both cases.

some logs

2025/02/26 15:18:32 ...eb/routing/logger.go:102:func1() [I] router: completed HEAD /v2/testuser/cts-webapi-dev/blobs/sha256:d2eb42b4a5ebb9b60b76c2235884a004110d05db225bd8b6a1c0e50752c6b5b5 for 192.168.150.250:0, 401 Unauthorized in 0.6ms @ packages/api.go:43(packages.ContainerRoutes.reqPackageAccess)

2025/02/26 15:18:32 ...eb/routing/logger.go:102:func1() [I] router: completed HEAD /v2/testuser/cts-webapi-dev/blobs/sha256:79da3bf36ca5c79f384673969b592f88397102cd8c066e46c48635ff6120ea58 for 192.168.150.250:0, 401 Unauthorized in 0.5ms @ packages/api.go:43(packages.ContainerRoutes.reqPackageAccess)

2025/02/26 15:18:32 ...eb/routing/logger.go:102:func1() [I] router: completed HEAD /v2/testuser/cts-webapi-dev/blobs/sha256:1fbb63ab055084424790ddd183d67fbd3e3651c644fff301e9a24f714e4fb586 for 192.168.150.250:0, 401 Unauthorized in 0.7ms @ packages/api.go:43(packages.ContainerRoutes.reqPackageAccess)

2025/02/26 15:18:32 ...eb/routing/logger.go:102:func1() [I] router: completed HEAD /v2/testuser/cts-webapi-dev/blobs/sha256:27f6eeb190cdf158e117e0546efe63007db80bd277ac4a9688ec9b05b61010ff for 192.168.150.250:0, 401 Unauthorized in 0.7ms @ packages/api.go:43(packages.ContainerRoutes.reqPackageAccess)

2025/02/26 15:18:32 ...eb/routing/logger.go:102:func1() [I] router: completed POST /v2/testuser/cts-webapi-dev/blobs/uploads/ for 192.168.150.250:0, 401 Unauthorized in 0.5ms @ packages/api.go:43(packages.ContainerRoutes.reqPackageAccess)

2025/02/26 15:18:32 ...eb/routing/logger.go:102:func1() [I] router: completed POST /v2/testuser/cts-webapi-dev/blobs/uploads/ for 192.168.150.250:0, 401 Unauthorized in 0.7ms @ packages/api.go:43(packages.ContainerRoutes.reqPackageAccess)

2025/02/26 15:18:32 ...eb/routing/logger.go:102:func1() [I] router: completed POST /v2/testuser/cts-webapi-dev/blobs/uploads/ for 192.168.150.250:0, 401 Unauthorized in 0.5ms @ packages/api.go:43(packages.ContainerRoutes.reqPackageAccess)

Gitea Version

1.23.4

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Ubuntu 22.04

How are you running Gitea?

self hosted in docker
gitea.domain.com

behind nginx

self check page shows not problems

Database

None