jbpratt 019a463ea8 NO-ISSUE: feat(auth): add robot token authentication (#6392) ...

Add a verifier abstraction behind BasicAuthenticator so user password
auth and static robot token auth share credential verification without
coupling robot-specific behavior to HTTP Basic parsing.

Implement Python-compatible legacy robot token handling for
RobotAccountToken rows, including DATABASE_SECRET_KEY conversion,
encrypted-field AES-CCM decryption, robot allowlist enforcement, ASCII
credential validation, robot and owner enabled checks, and last_accessed
updates.

Wire the database verifier into API and distribution authentication,
then enforce pull, push, delete, and create-on-push authorization for
user and robot principals, including public pulls, disabled namespace
checks, repository state/kind checks, and superuser create behavior.

Extend the Go migration E2E job to create a robot through old OMR's
session and CSRF API flow, verify that token can push before migration,
and verify the same migrated token can pull and push against the Go
registry. Generate a migrated runtime config that preserves OMR secret
keys while pointing Go at the migrated database and storage paths.

2026-07-10 12:59:38 -05:00

..

encryptedfield

NO-ISSUE: feat(auth): add robot token authentication (#6392)

2026-07-10 12:59:38 -05:00