mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-08-29 04:06:58 +00:00
Evan JarrettandClaude Opus 5
2719428071
An AppView can front several registry domains that all reach the same backend (seamark.dev serving buoy.cr, seamark.cr, and soon atcr.io). Distribution's token access controller holds `service` as a single string and uses it twice: as the value advertised in the WWW-Authenticate challenge, and as the sole accepted JWT audience. So it announced one domain's name on every domain, and honoured one domain's tokens everywhere. A push to seamark.cr was challenged with service="buoy.cr". Both uses sit inside Authorized, which already has the request, but the value is fixed at construction and reachable through no hook — autoredirect only templates the realm. So register an "atcr-token" controller that builds one upstream controller per domain and dispatches on r.Host. Each front door now advertises its own name and demands its own audience. All signature, certificate and claim verification stays in upstream code; this only routes. The token handler stops discarding ?service= and stamps the audience with the front door the client used, allowlist-checked against the configured domains so the value stays server-determined despite arriving from the client. It has to come from the query param because the realm lives on the UI host, where r.Host names no registry domain. This is token hygiene and spec conformance, not a privilege boundary: every domain fronts the same backend, so a client can obtain a token for any of them just by handshaking there. What it buys is a truthful challenge and the decoupling needed to later split a domain onto its own AppView. Also unify the domain list. DomainRoutingMiddleware keyed its map on the raw config while matching a port-stripped host, so a domain configured with a port could never match its own requests. It now shares the normalized cfg.Auth.Services, so routing and authorization agree on one set of names. cfg.Auth.ServiceName was an exact alias for Services[0] and is replaced by PrimaryService(), which also removes an empty-slice index. Rollout: the audience for seamark.cr and bouy.cr changes, so a token minted just before the restart draws one 401 and Docker re-handshakes into a valid one. buoy.cr is unchanged (it stays primary), and atcr.io keeps the service name it already has today. The challenge and the accepted audience come from the same delegate, so the retry converges by construction. Deploy as a single flip, not a canary: an old instance ignores ?service= and would keep minting the primary audience while a new one rejects it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
39 lines
1.2 KiB
Go
39 lines
1.2 KiB
Go
package token
|
|
|
|
import (
|
|
"net"
|
|
"strings"
|
|
)
|
|
|
|
// NormalizeService reduces a registry service identifier to the bare,
|
|
// port-stripped, lowercased hostname used to key registry domains.
|
|
//
|
|
// It tolerates the forms that actually reach us: a bare host ("atcr.io"), a
|
|
// host:port ("127.0.0.1:5000"), and a full URL ("https://atcr.io"), which is
|
|
// what the credential helper sends as ?service= when it validates stored
|
|
// credentials (pkg/credhelper/device_auth.go).
|
|
//
|
|
// Ports are stripped so the result matches the port-stripped r.Host that
|
|
// DomainRoutingMiddleware compares registry domains against. Returns "" when
|
|
// there is no recognisable host.
|
|
func NormalizeService(s string) string {
|
|
s = strings.TrimSpace(s)
|
|
|
|
// Drop any scheme, then anything from the first path/query delimiter on,
|
|
// leaving just the authority.
|
|
if i := strings.Index(s, "://"); i >= 0 {
|
|
s = s[i+3:]
|
|
}
|
|
if i := strings.IndexAny(s, "/?#"); i >= 0 {
|
|
s = s[:i]
|
|
}
|
|
|
|
// SplitHostPort only succeeds when a port is present; a bare host errors
|
|
// and is used as-is. Brackets survive that path for an IPv6 literal.
|
|
if host, _, err := net.SplitHostPort(s); err == nil {
|
|
s = host
|
|
}
|
|
|
|
return strings.ToLower(strings.Trim(s, "[]"))
|
|
}
|