mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-19 00:34:16 +00:00
Evan JarrettandClaude Opus 5
a7569a7717
Credential-less pulls of public images. /auth/token issues a pull-only
token with an empty subject when no Basic auth is present; the
destination hold still enforces captain.Public, and push or delete always
challenges.
- token.IsPullOnlyScope and AuthMethodAnonymous;
Handler.issueAnonymousToken skips the authorizer gate and the
service-auth pre-mint, since there is no identity to reconcile and no
AppView-to-hold service token to bind. The token is still stamped
with the resolved registry domain, so anonymous pull works on
secondary front doors whose access controller demands their own
audience.
- auth.allow_anonymous_pull (default true) turns it fully off, restoring
the previous always-challenge behavior. Mirrored into the deploy
template, since the default means existing deploys pick this up.
- RegistryContext.Anonymous is plumbed from the middleware.
- ProxyBlobStore sends no Authorization header when the service token is
empty, and returns 401 rather than 403 for anonymous denials so Docker
prompts for credentials, including when a stale captain cache lets the
request through and the hold says private.
- BearerChallenge wraps the /v2/ subtree so a 401 raised deep in the
stack via errcode.ServeJSON still carries WWW-Authenticate.
Distribution's own scoped challenges are left alone.
IsPullOnlyScope allowlists the pull action instead of denylisting push and
delete. Distribution's actionSet.contains treats "*" as *every* action, so
a scope of `repository:victim/img:*` names neither denied string and would
have handed an unauthenticated caller a token valid for push and delete on
someone else's repository — clearing the authgate entirely, since anonymous
tokens deliberately skip it. Writes would still have failed further down
(no PDS credential), but the gate itself was bypassable. Now every
requested action must be exactly "pull". Covered by new claims tests.
Unresolvable identities return NAME_UNKNOWN instead of a bare error that
distribution renders as 500. This path was previously unreachable without
credentials; anonymous pull opens it to the internet, and a 5xx on
arbitrary input both misreports a bad request as a server fault and sends
clients that retry 5xx into a retry loop. That loop was real: in the auth
matrix, regclient spent 83s on a single case before this fix, and the
suite now runs in 5s.
Stat preserves an authorization verdict from getPresignedURL rather than
flattening it to ErrBlobUnknown. Distribution calls Stat before ServeBlob
on GET and HEAD, so without this an anonymous pull from a private hold
answered 404 and BearerChallenge had no 401 to annotate — the 401 path
above could never actually reach a client.
The auth matrix is updated to match: anonymous pull of the seeded public
repo now succeeds, anonymous push is denied against a real identity's
namespace (rather than an unresolvable one, which was testing name
resolution rather than authorization), and a new case pins the
NAME_UNKNOWN behavior for an unknown identity.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
76 lines
2.7 KiB
Go
76 lines
2.7 KiB
Go
package middleware
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"atcr.io/pkg/auth/token"
|
|
)
|
|
|
|
// bearerChallengeResponseWriter wraps http.ResponseWriter and, on the first
|
|
// WriteHeader call, injects a Bearer WWW-Authenticate challenge when the status
|
|
// is 401 and no challenge was already set. This covers 401s produced deep in the
|
|
// handler stack (e.g. the blob proxy denying an anonymous read of a private
|
|
// hold) that are served via errcode.ServeJSON and would otherwise carry no
|
|
// WWW-Authenticate header, leaving Docker clients with no hint to re-authenticate.
|
|
type bearerChallengeResponseWriter struct {
|
|
http.ResponseWriter
|
|
challenge string
|
|
wroteHeader bool
|
|
}
|
|
|
|
func (w *bearerChallengeResponseWriter) WriteHeader(code int) {
|
|
if !w.wroteHeader {
|
|
w.wroteHeader = true
|
|
if code == http.StatusUnauthorized && w.Header().Get("WWW-Authenticate") == "" {
|
|
w.Header().Set("WWW-Authenticate", w.challenge)
|
|
}
|
|
}
|
|
w.ResponseWriter.WriteHeader(code)
|
|
}
|
|
|
|
func (w *bearerChallengeResponseWriter) Write(b []byte) (int, error) {
|
|
if !w.wroteHeader {
|
|
// Implicit 200 — still fire WriteHeader so the flag flips.
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
return w.ResponseWriter.Write(b)
|
|
}
|
|
|
|
// BearerChallenge returns middleware that guarantees every 401 in the registry
|
|
// subtree carries a Bearer WWW-Authenticate challenge. The distribution
|
|
// library's own challenges (which include a scope) are left untouched; only
|
|
// bare 401s get the fallback header. realm is the token endpoint URL.
|
|
//
|
|
// services is every registry domain this AppView fronts, in priority order, the
|
|
// same list the atcr-token access controller is built from. The challenge names
|
|
// the domain the request arrived on, because that controller demands its own
|
|
// domain's audience: advertising a different service would send the client back
|
|
// with a token that host then rejects. A request on a host that is not a
|
|
// configured domain falls back to services[0], matching the controller's own
|
|
// fallback. A single-element list makes every challenge identical.
|
|
func BearerChallenge(realm string, services []string) func(http.Handler) http.Handler {
|
|
byHost := make(map[string]string, len(services))
|
|
for _, svc := range services {
|
|
byHost[token.NormalizeService(svc)] = fmt.Sprintf(`Bearer realm=%q,service=%q`, realm, svc)
|
|
}
|
|
|
|
var fallback string
|
|
if len(services) > 0 {
|
|
fallback = byHost[token.NormalizeService(services[0])]
|
|
} else {
|
|
fallback = fmt.Sprintf(`Bearer realm=%q`, realm)
|
|
}
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
challenge, ok := byHost[token.NormalizeService(r.Host)]
|
|
if !ok {
|
|
challenge = fallback
|
|
}
|
|
wrapped := &bearerChallengeResponseWriter{ResponseWriter: w, challenge: challenge}
|
|
next.ServeHTTP(wrapped, r)
|
|
})
|
|
}
|
|
}
|