modules/gitea/client.ts

@@ -387,7 +387,11 @@ export class GiteaAdmin {
   }
 
   /** Ensure a user exists with exactly this password. Created if absent; if already there, its
-   *  password is patched — so the mesh minting a new secret takes on the next reconcile. */
+   *  password is patched — so the mesh minting a new secret takes on the next reconcile.
+   *
+   *  The edit path is taken only when the user actually exists. A 422 from the create is also what
+   *  a plain validation failure returns, and reading it as "already there" made the follow-up edit
+   *  404 — burying the create's own message, which is the one that says what is actually wrong. */
   async ensureUser(username: string, password: string, email: string): Promise<void> {
     const res = await this.request("/admin/users", {
       method: "POST",
@@ -395,6 +399,8 @@ export class GiteaAdmin {
     });
     if (res.status === 201) return;
     if (res.status === 422 || res.status === 409) {
+      const seen = await this.request(`/users/${encodeURIComponent(username)}`);
+      if (seen.status === 200) {
         const patch = await this.request(`/admin/users/${encodeURIComponent(username)}`, {
           method: "PATCH",
           // login_name is required by the admin edit endpoint; for a local user it is the username.
@@ -403,6 +409,7 @@ export class GiteaAdmin {
         if (patch.status === 200) return;
         GiteaAdmin.fail(`/admin/users/${username}`, patch);
       }
+    }
     GiteaAdmin.fail("/admin/users", res);
   }
 

modules/gitea/provisioner/index.ts

@@ -34,7 +34,12 @@ runProvisioner("package-registry", {
     const teamId = await gitea.ensureTeam(ORG, PACKAGE_TEAM, true);
     // The user carries the consumer's login and the mesh's minted password, set every run so a
     // rotation takes. Membership of the package team is what grants read+write on packages.
-    await gitea.ensureUser(p.as, p.password, `${p.as}@localhost`);
+    //
+    // The address is gitea's own convention for one that is not real: its email validation
+    // requires a dotted domain, so `@localhost` was refused at create — the fault that had this
+    // grant retrying for a day — while `@noreply.localhost` is the shape gitea itself gives
+    // hidden addresses.
+    await gitea.ensureUser(p.as, p.password, `${p.as}@noreply.localhost`);
     await gitea.addUserToTeam(teamId, p.as);
   },