Summary

Branch/ref permissions are not respected by the Tags REST API.

Steps to Reproduce

1. Create a simple restriction to disable tags, e.g.: refs/tags/**
2. Try to create a tag via a normal git push
3. Try to create a tag via the REST API

Expected Results

• Both the git push and the API call should fail

Actual Results

• The git push fails, however the API call bypasses the branch permissions and succeeds

Workaround

n/a