This caused me a lot of confusion; Phabricator returns a 403 when you try to pull down an inactive repository, and no matter whether you get the credentials correct, you basically get access denied.
Either Phabricator should allow pulling from Inactive repositories (I see no reason to prevent pulls, but preventing pushes is probably reasonable), or the error should be much more clear (and not a 403).
Either Phabricator should allow pulling from Inactive repositories (I see no reason to prevent pulls, but preventing pushes is probably reasonable),
I think this is a better behavior.
403 is access denied, which Git clients treat as "bad credentials". When the repository is disabled, there's no credentials which will make the check pass.
A 404 is more appropriate, since from the perspective of the Git client, there is nothing there.
According to http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
| 401 | Unauthorized | The client MAY repeat the request with a suitable Authorization header field. |
| 403 | Forbidden | Authorization will not help and the request SHOULD NOT be repeated. |
| 404 | Not Found | The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent. The 410 (Gone) status code SHOULD be used if the server knows, through some internally configurable mechanism, that an old resource is permanently unavailable and has no forwarding address. |
| 410 | Gone | The requested resource is no longer available at the server and no forwarding address is known. This condition is expected to be considered permanent. |
Given those details 403 seems like the most appropriate. Does Git prompt for credentials when receiving 403?
I believe so? Maybe only some clients do?
Either way 403 still implies that there was some level of consideration given to the client's request since it was forbidden to take that action. 404 is much clearer because the resource isn't actually there any more.