App Store: NEXTCLOUD_APPSTORE_TOKEN does not own openregister, zaakafhandelapp, pipelinq or shillinq (HTTP 403)

[rubenvdlinde]

Measured 2026-08-27 from the release job logs of every fleet app.

Four apps are registered on the App Store, have a valid Nextcloud-issued certificate, and still cannot publish. The upload returns:

HTTP 403 {"detail":"You do not have permission to perform this action."}

and registration (which is also the certificate-update endpoint) returns:

HTTP 403 {"detail":"Only the app owner is allowed to update the certificate"}

app	store entry	latest on store	last published
openregister	openregister	1.1.6-beta.20260820205738	2026-08-20
zaakafhandelapp	zaakafhandelapp	0.2.0-beta.1	2026-06-05
pipelinq	pipelinq	0.4.0-beta.2	2026-06-25
shillinq	shillinq	0.2.0-beta.3	2026-06-25

_check_permission in nextcloudappstore/api/v1/views.py requires the token's account to be the app's owner or co-maintainer. It is not, for these four. It is for opencatalogi, launchpad and portaliq, whose uploads succeed — so this is per-app ownership on apps.nextcloud.com, not a bad token.

What needs doing

A human on apps.nextcloud.com, signed in as the current owner of each of these four apps, either:

• adds the CI account as a co-maintainer, or
• enables ownership transfer and hands the app to the CI account.

Both live under the app's page → Manage. Nothing in CI can do this.

Why it went unnoticed

The upload step reported this as ::warning:: and exited 0, so all four apps have been recording green releases while publishing nothing. Fixed in #593 — after that lands these runs go red, which is the point.

Related

• Fleet signing certificates: what to do when the 13 CSRs come back #591 — the 13 renamed ids awaiting certificates (a different failure: HTTP 400, id not registered)
• Release blocked on six core apps: NEXTCLOUD_SIGNING_CERT is not a PEM (two causes, one error) #576 — six apps whose NEXTCLOUD_SIGNING_CERT is not a PEM (job dies before the upload)
• fix(release): outrank the App Store, and fail when the upload does not land #593 — makes all of the above visible instead of green, and stops the version line going backwards

[rubenvdlinde]

Tested three credentials against the live API today. None of them can publish these apps, and the reason is now exact rather than inferred.

What the three were

credential	length	result against POST /api/v1/apps/releases
mP0f…	20	401 {"detail":"Invalid token."}
130b…	40	400 {"download":["This field is required."]} ← authenticated
LuTq…	20	401 {"detail":"Invalid token."}

The two 20-character ones are account passwords, not API tokens. The API only accepts Authorization: Token <token>; a password cannot be used directly. Each contributor must generate an API token from their own apps.nextcloud.com account.

Probe used an empty POST body so nothing could be uploaded — authentication is checked before payload validation, which is what makes 401 vs 400 the discriminator.

The 40-char token is valid but still cannot publish

Set as a repo-level secret on opencatalogi (09:36), overriding the org secret. Repo secrets take precedence, so the 11:08 beta release used it. Result:

App Store: opencatalogi is registered (max 1.0.10-beta.20260821073732)
Beta version: 1.0.13-beta.20260829110910 (stable baseline: 1.0.12)
✓ opencatalogi is already on the App Store; not re-sending the certificate.
##[error]App Store upload returned HTTP 403: {"detail":"You do not have permission to perform this action."}

So we have now tested two distinct accounts — the org one and this one — and neither is owner or co-maintainer.

The exact rule

From nextcloudappstore/core/models.py:

def can_update(self, user: User) -> bool:
    return self.owner == user or user in self.co_maintainers.all()

Uploading a release requires the token's account to be the owner or a co-maintainer. Nothing else qualifies — not org membership, not being listed among authors.

⚠️ There is no way to test this without publishing. POST /api/v1/apps (the registration endpoint) validates the certificate signature before the ownership check, so a non-owner and an owner both get 400 on a bad signature. I tried that as a non-destructive probe and it proved nothing — a real signed release is the only test.

What actually unblocks it

Whoever owns each app on apps.nextcloud.com — reportedly Robert and Mark, who contributed them — does one of:

1. Add the CI account as a co-maintainer (app page → Manage). The existing org token then works and no secret changes are needed anywhere. Preferred: it survives people leaving.
2. Generate an API token from the owning account and hand that over to be set as a repo secret. Works, but ties publishing to one person.

Affected and confirmed by a real release attempt: opencatalogi, openregister. Also seen 403 earlier: zaakafhandelapp, pipelinq, shillinq.

Meanwhile

The version logic is correct and waiting — opencatalogi computed 1.0.13-beta.20260829110910 against a store holding 1.0.10-beta.20260821073732. The moment permission is granted, a release publishes with the right number. Nothing in the code is blocking.