We will have to ensure applying this authenticator to all possible write actions even in plugins, but ensuring it in all plugins is actually difficult or impossible.

One idea I came up with is that checking whether a repository is archived in writableUsersOnly too. This is redundant and don't cover all cases, but will automatically apply the minimum protection for the existing plugins. Or adding an option like allowUnarchivedRepository to all authenticator so that all actions currently use authenticator will need to be updated to specify that option explicitly.

Anyway, we would need to consider more carefully about how to apply the protection for archived repositories.

@takezoe Thanks for you review! I agree that applying UnarchivedAuthenticator to all write action is difficult and impossible.

checking whether a repository is archived in writableUsersOnly

That might be simple and good solution, but actually checking in writableUserOnly is not enough. Sometime we want to restrict even readableUserOnly user action if repository is archived such as "create new issue".

adding an option like allowUnarchivedRepository to all authenticator so that all actions currently use authenticator will need to be updated to specify that option explicitly.

It is more flexible than checking in writableUsersOnly, but as you said need update all actions, and even plugins...

hmm...

checking whether a repository is archived in writableUsersOnly too

@takezoe I misunderstood what you meant about this. You mean check if repository is archived in writableUsersOnly and use UnarchivedAuthenticator for other cases such as "create new issue" (readableUserOnly) if restriction required.

In that case this idea sound better because it "will automatically apply the minimum protection for the existing plugins" as you said.

Yes, that is what I meant. But that is also just one option. We would need to see more closely and consider possible options carefully to figure out what is the best way for this.

We would need to see more closely and consider possible options carefully to figure out what is the best way for this.

@takezoe Yeah. I agree with that.

BTW I updated PR 6653dbb, 89de8fd because checking in writableUsersOnly too sounds better than before at least.