repo permissions section is not functional

internal/api/handlers/githttp.go

@@ -59,11 +59,21 @@ func (h *GitHTTPHandler) ServeGit(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	// Require authentication for push; allow anonymous read for public repos
+	// Authenticate and enforce permission checks.
 	var authedUser string
 	user, authed := h.basicAuth(r)
 	if authed {
 		authedUser = user
+		// Push requires write or admin permission.
+		if service == "git-receive-pack" && !HasPermission(h.db, &repo, user, "write") {
+			http.Error(w, "forbidden: you do not have write access to this repository", http.StatusForbidden)
+			return
+		}
+		// Pull on a private repo requires at least read permission.
+		if repo.IsPrivate && !HasPermission(h.db, &repo, user, "read") {
+			http.Error(w, "forbidden: you do not have read access to this repository", http.StatusForbidden)
+			return
+		}
 	} else if service == "git-receive-pack" || repo.IsPrivate {
 		w.Header().Set("WWW-Authenticate", `Basic realm="ForgeBucket"`)
 		http.Error(w, "authentication required", http.StatusUnauthorized)