Ensure deploy key with write access can push

[wxiaoguang]

Fix:

• Deploy key with write access can not push #19009

In this PR, I use DeployKeyID to replace the IsDeployKey, then CanWriteCode can use the DeployKeyID to check the permission.

[wxiaoguang]

@6543 are you sure the APIContext can be used as db.Context?

Hmm, checked, db.GetEngine works like this. Thanks ~~

// GetEngine will get a db Engine from this context or return an Engine restricted to this context
func GetEngine(ctx context.Context) Engine {
	if engined, ok := ctx.(Engined); ok {
		return engined.Engine()
	}
	enginedInterface := ctx.Value(EnginedContextKey)
	if enginedInterface != nil {
		return enginedInterface.(Engined).Engine()
	}
	return x.Context(ctx)
}

[wxiaoguang]

There are a lot of code using db.DefaultContext in routers, maybe they should all be refactored to the new framework.

$ grep -r "db\.DefaultContext" ./routers | wc -l
56

[silverwind]

Backport necessary?

[zeripath]

I'm confused as to how this was failing because our testsuite should have picked this up... It would be helpful if you could add a test to our integrations suite that replicates the bug or give us a run down of the steps necessary to reproduce the original issue.

[wxiaoguang]

I have read the test cases before, if I understand correctly it seems that this case is not covered. I had the thought to write some tests at the same time however it's more complex than I thought, and I need this to be fixed in my server, so I just submitted the fix first. (although not fully covered by tests, but not too bad either)

I have a plan to do some further refactoring about the ssh/serv/internal system, and I will add more tests then.

About backport: this PR changes some env vars, it not as simple as a bug fix, so I think we can just keep it in 1.17. If anyone in 1.16 are affected, we can suggest them to use 1.17-dev or have further discussion then. Well ..... it seems that no one besides me need this feature 😂

[wxiaoguang]

About "the steps necessary to reproduce the original issue.": that's quite straight, add a deploy key with write access, then you can not use the key to push. Because there was no code to check the key's permission to allow write.