Artifact owner-only authorization is not working as expected

[aboucham]

Setting an Artifact owner-only authorization=true in the Registry.

For most of the edit calls it is working as expected, except below api call:

POST with /apis/registry/v2/groups/{groupId}/artifacts?ifExists=RETURN_OR_UPDATE
POST with /apis/registry/v2/groups/{groupId}/artifacts?ifExists=UPDATE

Actual behaviour : With the above api call if artifact has been created by one user, it is getting updated successfully by another user.

Expected behaviour : It should forbidden the other user to update the artifact

Observation: Issue is only with the POST method, if a put method is used to update the artifact, it is working as expected.

[apicurio-bot]

Thank you for reporting an issue!

Pinging @EricWittmann to respond or triage.