Pushing a new cargo release returns 500 if user does not have write access to cargo index repo

[merlleu]

Description

When you have an user with Packages: Read+Write access, he can't push to cargo registry if he does not have permission to the _cargo-index repo, returning a 500 error code.

I think at least we should change the error code for this, not sure if we should allow push for users without the repo write permissions still.

Gitea Version

1.21

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

https://gist.github.com/merlleu/50d26b2fe4dd1a1fb1ba9aa57d29c030

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

It is run from docker on the a587d25 commit's nightly build

Database

PostgreSQL

[lng2020]

I reproduced this issue as well.
Here is the detailed procedure to reproduce.

1. Assume there are test_org and test_team
2. Set write access in test_team->settings->packages
3. remove write access of test_team in _cargo-index.git->settings->collaborators
4. cargo publish then the error occurs

The credential passed the access control of the package, so cargo starts to use git to upload files. However, the repo denied the files because the credential can't write the repo. So here I come up with two possible solutions.

1. Check the error type then use a different HTTP error in routers/api/packages/cargo/cargo.go#250
2. A more elegant way is to sync the package permission with the package repo as mentioned in Permissions for package repositories #20596. It requires more effort but solves all issues of this kind.

I prefer the second solution but it's a little beyond my ability.
What do you think? @KN4CK3R