GitLab Source Forbidden, even with API token

[JustScreaMy]

Describe the bug
I have my private GitLab repository, and have made a Release with .apk files. After creating and setting up the GitLab Private Access Token and adding the repository url, it throws "Forbidden" error. The Personal Access Token had all permissions set. And I have that ensured i can download the apk files in web browser in the Releases on gitlab too.

To Reproduce

1. Have a private repository on gitlab.com
2. Build and apk file using CI and upload it to artifacts
3. Create a new release with the files in artifacts
4. Add the repository url to obtainum and get the error

Screenshots and Logs
Logs just say
error: Forbidden

Please complete the following information:

• Device: Xiaomi 13T
• OS: HyperOS 1.0.4.0
• Obtainium Version: v1.1.6

[JustScreaMy]

This is actually weird, I have followed the source code to the point of creating my own curl request by the rules of the gitlab app_source and got a correct result, but havent been able to get Forbidden under any circumstances.

[ImranR98]

Does the error show up when adding the repo or only when you try to actually install the app? Also keep in mind the error might be due to this: #1489 (comment)

[JustScreaMy]

The error shows up only when adding the repository, but I dont think it is related to #1489 (comment) , because when I tried to construct the request in terminal (with the %2F syntax and the same API key), I get back everything correctly.

[ImranR98]

It's possible the headers might be different

[JustScreaMy]

That could be interesting, because in Gitlab REST API documentation, the 403 Forbidden status code is documented as The request isn’t allowed. For example, the user isn’t allowed to delete a project., which is really specific. I will try to debug this more when I have more time.

[JustScreaMy]

Well, after debugging, I found out that it fetched the releases correctly, but it fails when it tries to download the application (but it doesn't add the app to the list because of that).

The Personal Access Token is used correctly when fetching the releases, but it isn't sent when the .apk file itself should be downloaded.

The solution I think would be to use headers for this case, because that shouldn't break out the apk name resolution from the download url.

[JustScreaMy]

Just tested the dev version and I was successfully able to install the app correctly. Once merged, this is ready to be closed! Thanks!

[ImranR98]

Updated: https://github.com/ImranR98/Obtainium/releases/tag/v1.1.10