From 1f0705a218ba8932b673bbb4c8357535695d6a9d Mon Sep 17 00:00:00 2001
From: Evan Jarrett <evan@evanjarrett.com>
Date: Fri, 2 Jan 2026 13:38:46 -0600
Subject: [PATCH] fix pull stats tracking

---
 .../db/migrations/0007_add_artifact_type.yaml      |  8 ++++++++
 pkg/hold/oci/xrpc.go                               | 14 ++++++++------
 2 files changed, 16 insertions(+), 6 deletions(-)
 create mode 100644 pkg/appview/db/migrations/0007_add_artifact_type.yaml

diff --git a/pkg/appview/db/migrations/0007_add_artifact_type.yaml b/pkg/appview/db/migrations/0007_add_artifact_type.yaml
new file mode 100644
index 0000000..8ffd43c
--- /dev/null
+++ b/pkg/appview/db/migrations/0007_add_artifact_type.yaml
@@ -0,0 +1,8 @@
+description: Add artifact_type column to manifests table for Helm chart support
+query: |
+  -- Add artifact_type column to track manifest types (container-image, helm-chart, unknown)
+  -- Default to container-image for existing manifests
+  ALTER TABLE manifests ADD COLUMN artifact_type TEXT NOT NULL DEFAULT 'container-image';
+
+  -- Add index for filtering by artifact type
+  CREATE INDEX IF NOT EXISTS idx_manifests_artifact_type ON manifests(artifact_type);
diff --git a/pkg/hold/oci/xrpc.go b/pkg/hold/oci/xrpc.go
index 40affd6..e3ccf9c 100644
--- a/pkg/hold/oci/xrpc.go
+++ b/pkg/hold/oci/xrpc.go
@@ -254,12 +254,6 @@ func (h *XRPCHandler) HandleNotifyManifest(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	// Verify user DID matches token
-	if req.UserDID != validatedUser.DID {
-		RespondError(w, http.StatusForbidden, "user DID mismatch")
-		return
-	}
-
 	// Default operation to "push" for backward compatibility
 	operation := req.Operation
 	if operation == "" {
@@ -272,6 +266,14 @@ func (h *XRPCHandler) HandleNotifyManifest(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
+	// Verify user DID matches token - only for pushes
+	// For pulls: userDID is the repo owner (for stats), but the token belongs to the puller
+	// This allows anyone to pull from a public repo and have stats tracked under the owner
+	if operation == "push" && req.UserDID != validatedUser.DID {
+		RespondError(w, http.StatusForbidden, "user DID mismatch")
+		return
+	}
+
 	var layersCreated int
 	var postCreated bool
 	var postURI string