Fix the access control checking issue

should check access first, then check authentication
return 401/403 accroding to the checking results properly

src/ui/api/chart_repository.go

@@ -284,39 +284,31 @@ func (cra *ChartRepositoryAPI) requireAccess(namespace string, accessLevel uint)
 		return true //do nothing
 	}
 
-	//At least, authentication is necessary when level > public
-	if !cra.SecurityCtx.IsAuthenticated() {
-		cra.HandleUnauthorized()
-		return false
-	}
-
 	theLevel := accessLevel
 	//If repo is empty, system admin role must be required
 	if len(namespace) == 0 {
 		theLevel = accessLevelSystem
 	}
 
+	var err error
+
 	switch theLevel {
 	//Should be system admin role
 	case accessLevelSystem:
 		if !cra.SecurityCtx.IsSysAdmin() {
-			cra.RenderError(http.StatusForbidden, fmt.Sprintf("system admin role is required but user '%s' is not", cra.SecurityCtx.GetUsername()))
+			err = fmt.Errorf("system admin role is required but user '%s' is not", cra.SecurityCtx.GetUsername())
-			return false
 		}
 	case accessLevelAll:
 		if !cra.SecurityCtx.HasAllPerm(namespace) {
-			cra.RenderError(http.StatusForbidden, fmt.Sprintf("project admin role is required but user '%s' does not have", cra.SecurityCtx.GetUsername()))
+			err = fmt.Errorf("project admin role is required but user '%s' does not have", cra.SecurityCtx.GetUsername())
-			return false
 		}
 	case accessLevelWrite:
 		if !cra.SecurityCtx.HasWritePerm(namespace) {
-			cra.RenderError(http.StatusForbidden, fmt.Sprintf("developer role is required but user '%s' does not have", cra.SecurityCtx.GetUsername()))
+			err = fmt.Errorf("developer role is required but user '%s' does not have", cra.SecurityCtx.GetUsername())
-			return false
 		}
 	case accessLevelRead:
 		if !cra.SecurityCtx.HasReadPerm(namespace) {
-			cra.RenderError(http.StatusForbidden, fmt.Sprintf("at least a guest role is required for user '%s'", cra.SecurityCtx.GetUsername()))
+			err = fmt.Errorf("at least a guest role is required for user '%s'", cra.SecurityCtx.GetUsername())
-			return false
 		}
 	default:
 		//access rejected for invalid scope
@@ -324,6 +316,19 @@ func (cra *ChartRepositoryAPI) requireAccess(namespace string, accessLevel uint)
 		return false
 	}
 
+	//Access is not granted, check if user has authenticated
+	if err != nil {
+		//Unauthenticated, return 401
+		if !cra.SecurityCtx.IsAuthenticated() {
+			cra.HandleUnauthorized()
+			return false
+		}
+
+		//Authenticated, return 403
+		cra.RenderError(http.StatusForbidden, err.Error())
+		return false
+	}
+
 	return true
 }