fix pull stats tracking

pkg/appview/db/migrations/0007_add_artifact_type.yaml

@@ -0,0 +1,8 @@
+description: Add artifact_type column to manifests table for Helm chart support
+query: |
+  -- Add artifact_type column to track manifest types (container-image, helm-chart, unknown)
+  -- Default to container-image for existing manifests
+  ALTER TABLE manifests ADD COLUMN artifact_type TEXT NOT NULL DEFAULT 'container-image';
+
+  -- Add index for filtering by artifact type
+  CREATE INDEX IF NOT EXISTS idx_manifests_artifact_type ON manifests(artifact_type);

pkg/hold/oci/xrpc.go

@@ -254,12 +254,6 @@ func (h *XRPCHandler) HandleNotifyManifest(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	// Verify user DID matches token
-	if req.UserDID != validatedUser.DID {
-		RespondError(w, http.StatusForbidden, "user DID mismatch")
-		return
-	}
-
 	// Default operation to "push" for backward compatibility
 	operation := req.Operation
 	if operation == "" {
@@ -272,6 +266,14 @@ func (h *XRPCHandler) HandleNotifyManifest(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
+	// Verify user DID matches token - only for pushes
+	// For pulls: userDID is the repo owner (for stats), but the token belongs to the puller
+	// This allows anyone to pull from a public repo and have stats tracked under the owner
+	if operation == "push" && req.UserDID != validatedUser.DID {
+		RespondError(w, http.StatusForbidden, "user DID mismatch")
+		return
+	}
+
 	var layersCreated int
 	var postCreated bool
 	var postURI string