mirror of
https://github.com/quay/quay.git
synced 2026-10-23 09:49:06 +03:00
019a463ea8
Add a verifier abstraction behind BasicAuthenticator so user password auth and static robot token auth share credential verification without coupling robot-specific behavior to HTTP Basic parsing. Implement Python-compatible legacy robot token handling for RobotAccountToken rows, including DATABASE_SECRET_KEY conversion, encrypted-field AES-CCM decryption, robot allowlist enforcement, ASCII credential validation, robot and owner enabled checks, and last_accessed updates. Wire the database verifier into API and distribution authentication, then enforce pull, push, delete, and create-on-push authorization for user and robot principals, including public pulls, disabled namespace checks, repository state/kind checks, and superuser create behavior. Extend the Go migration E2E job to create a robot through old OMR's session and CSRF API flow, verify that token can push before migration, and verify the same migrated token can pull and push against the Go registry. Generate a migrated runtime config that preserves OMR secret keys while pointing Go at the migrated database and storage paths.