quay/endpoints/v2/__init__.py

import logging
import os.path

from functools import wraps
from urlparse import urlparse
from urllib import urlencode

from flask import Blueprint, make_response, url_for, request, jsonify
from semantic_version import Spec

import features

from app import app, get_app_url
from auth.auth_context import get_authenticated_context
from auth.permissions import (
    ReadRepositoryPermission,
    ModifyRepositoryPermission,
    AdministerRepositoryPermission,
)
from auth.registry_jwt_auth import process_registry_jwt_auth, get_auth_headers
from data.registry_model import registry_model
from data.readreplica import ReadOnlyModeException
from endpoints.decorators import anon_protect, anon_allowed, route_show_if
from endpoints.v2.errors import (
    V2RegistryException,
    Unauthorized,
    Unsupported,
    NameUnknown,
    ReadOnlyMode,
)
from util.http import abort
from util.metrics.prometheus import timed_blueprint
from util.registry.dockerver import docker_version
from util.pagination import encrypt_page_token, decrypt_page_token


logger = logging.getLogger(__name__)
v2_bp = timed_blueprint(Blueprint("v2", __name__))


@v2_bp.app_errorhandler(V2RegistryException)
def handle_registry_v2_exception(error):
    response = jsonify({"errors": [error.as_dict()]})

    response.status_code = error.http_status_code
    if response.status_code == 401:
        response.headers.extend(get_auth_headers(repository=error.repository, scopes=error.scopes))
    logger.debug("sending response: %s", response.get_data())
    return response


@v2_bp.app_errorhandler(ReadOnlyModeException)
def handle_readonly(ex):
    error = ReadOnlyMode()
    response = jsonify({"errors": [error.as_dict()]})
    response.status_code = error.http_status_code
    logger.debug("sending response: %s", response.get_data())
    return response


_MAX_RESULTS_PER_PAGE = app.config.get("V2_PAGINATION_SIZE", 100)


def paginate(
    start_id_kwarg_name="start_id",
    limit_kwarg_name="limit",
    callback_kwarg_name="pagination_callback",
):
    """
    Decorates a handler adding a parsed pagination token and a callback to encode a response token.
    """

    def wrapper(func):
        @wraps(func)
        def wrapped(*args, **kwargs):
            try:
                requested_limit = int(request.args.get("n", _MAX_RESULTS_PER_PAGE))
            except ValueError:
                requested_limit = 0

            limit = max(min(requested_limit, _MAX_RESULTS_PER_PAGE), 1)
            next_page_token = request.args.get("next_page", request.args.get("last", None))

            # Decrypt the next page token, if any.
            start_id = None
            page_info = decrypt_page_token(next_page_token)
            if page_info is not None:
                start_id = page_info.get("start_id", None)

            def callback(results, response):
                if len(results) <= limit:
                    return

                next_page_token = encrypt_page_token({"start_id": max([obj.id for obj in results])})

                link_url = os.path.join(
                    get_app_url(), url_for(request.endpoint, **request.view_args)
                )
                link_param = urlencode({"n": limit, "next_page": next_page_token})
                link = '<%s?%s>; rel="next"' % (link_url, link_param)
                response.headers["Link"] = link

            kwargs[limit_kwarg_name] = limit
            kwargs[start_id_kwarg_name] = start_id
            kwargs[callback_kwarg_name] = callback
            return func(*args, **kwargs)

        return wrapped

    return wrapper


def _require_repo_permission(permission_class, scopes=None, allow_public=False):
    def wrapper(func):
        @wraps(func)
        def wrapped(namespace_name, repo_name, *args, **kwargs):
            logger.debug(
                "Checking permission %s for repo: %s/%s",
                permission_class,
                namespace_name,
                repo_name,
            )

            permission = permission_class(namespace_name, repo_name)
            if permission.can():
                return func(namespace_name, repo_name, *args, **kwargs)

            repository = namespace_name + "/" + repo_name
            if allow_public:
                repository_ref = registry_model.lookup_repository(namespace_name, repo_name)
                if repository_ref is None or not repository_ref.is_public:
                    raise Unauthorized(repository=repository, scopes=scopes)

                if repository_ref.kind != "image":
                    msg = (
                        "This repository is for managing %s and not container images."
                        % repository_ref.kind
                    )
                    raise Unsupported(detail=msg)

                if repository_ref.is_public:
                    if not features.ANONYMOUS_ACCESS:
                        raise Unauthorized(repository=repository, scopes=scopes)

                    return func(namespace_name, repo_name, *args, **kwargs)

            raise Unauthorized(repository=repository, scopes=scopes)

        return wrapped

    return wrapper


require_repo_read = _require_repo_permission(
    ReadRepositoryPermission, scopes=["pull"], allow_public=True
)
require_repo_write = _require_repo_permission(ModifyRepositoryPermission, scopes=["pull", "push"])
require_repo_admin = _require_repo_permission(
    AdministerRepositoryPermission, scopes=["pull", "push"]
)


def get_input_stream(flask_request):
    if flask_request.headers.get("transfer-encoding") == "chunked":
        return flask_request.environ["wsgi.input"]
    return flask_request.stream


@v2_bp.route("/")
@route_show_if(features.ADVERTISE_V2)
@process_registry_jwt_auth()
@anon_allowed
def v2_support_enabled():
    docker_ver = docker_version(request.user_agent.string)

    # Check if our version is one of the blacklisted versions, if we can't
    # identify the version (None) we will fail open and assume that it is
    # newer and therefore should not be blacklisted.
    if docker_ver is not None and Spec(app.config["BLACKLIST_V2_SPEC"]).match(docker_ver):
        abort(404)

    response = make_response("true", 200)

    if get_authenticated_context() is None:
        response = make_response("true", 401)

    response.headers.extend(get_auth_headers())
    return response


from endpoints.v2 import (
    blob,
    catalog,
    manifest,
    tag,
    v2auth,
)