fix(registry): add internal auth for loopback registry pulls

- Add InternalAuth struct for internal registry credentials
- Check for internal auth on localhost requests before external auth
- Pass internal credentials to token handler from app startup

commit: 06011c002f5fe1b5d5e096db6b57dae065f725a8
author: brice · 9mo ago · 2026-01-14 06:23 UTC
parent: a340e3d
signature: unsigned

2 files · +50 -15

M internal/adapters/in/http/registry/token.go +45 -14


@@ -19,17 +19,25 @@ type TokenResponse struct {
19	19		IssuedAt string `json:"issued_at,omitempty"`
20	20		}
21	21
	22	+	// InternalAuth holds credentials for internal loopback registry access.
	23	+	type InternalAuth struct {
	24	+	Username string
	25	+	Password string
	26	+	}
	27	+
22	28		// TokenHandler handles token server requests for Docker Registry authentication.
23	29		type TokenHandler struct {
24		-	authSvc in.AuthService
25		-	log zerowrap.Logger
	30	+	authSvc in.AuthService
	31	+	internalAuth InternalAuth
	32	+	log zerowrap.Logger
26	33		}
27	34
28	35		// NewTokenHandler creates a new token handler.
29		-	func NewTokenHandler(authSvc in.AuthService, log zerowrap.Logger) *TokenHandler {
	36	+	func NewTokenHandler(authSvc in.AuthService, internalAuth InternalAuth, log zerowrap.Logger) *TokenHandler {
30	37		return &TokenHandler{
31		-	authSvc: authSvc,
32		-	log: log,
	38	+	authSvc: authSvc,
	39	+	internalAuth: internalAuth,
	40	+	log: log,
33	41		}
34	42		}
35	43

@@ -70,16 +78,22 @@ func (h TokenHandler) handleToken(w http.ResponseWriter, r http.Request) {
70	78		return
71	79		}
72	80
73		-	// Validate credentials based on auth type
	81	+	// Check for internal registry auth (localhost requests with internal creds)
74	82		var authenticated bool
75		-	switch h.authSvc.GetAuthType() {
76		-	case domain.AuthTypePassword:
77		-	authenticated = h.authSvc.ValidatePassword(ctx, username, password)
78		-	case domain.AuthTypeToken:
79		-	// For token auth, the password might be an existing JWT
80		-	claims, err := h.authSvc.ValidateToken(ctx, password)
81		-	if err == nil && claims.Subject == username {
82		-	authenticated = true
	83	+	if isLocalhostRequest(r) && h.isInternalAuth(username, password) {
	84	+	authenticated = true
	85	+	log.Debug().Str("username", username).Msg("internal registry auth accepted")
	86	+	} else {
	87	+	// Validate credentials based on auth type
	88	+	switch h.authSvc.GetAuthType() {
	89	+	case domain.AuthTypePassword:
	90	+	authenticated = h.authSvc.ValidatePassword(ctx, username, password)
	91	+	case domain.AuthTypeToken:
	92	+	// For token auth, the password might be an existing JWT
	93	+	claims, err := h.authSvc.ValidateToken(ctx, password)
	94	+	if err == nil && claims.Subject == username {
	95	+	authenticated = true
	96	+	}
83	97		}
84	98		}
85	99

@@ -137,3 +151,20 @@ func (h *TokenHandler) sendAnonymousToken(w http.ResponseWriter, log zerowrap.Lo
137	151
138	152		log.Debug().Msg("anonymous token issued")
139	153		}
	154	+
	155	+	// isLocalhostRequest checks if the request is from localhost.
	156	+	func isLocalhostRequest(r *http.Request) bool {
	157	+	host := r.Host
	158	+	if host == "" {
	159	+	host = r.URL.Host
	160	+	}
	161	+	return host == "localhost:5000" \|\| host == "127.0.0.1:5000" \|\| host == "[::1]:5000"
	162	+	}
	163	+
	164	+	// isInternalAuth checks if the credentials match internal registry auth.
	165	+	func (h *TokenHandler) isInternalAuth(username, password string) bool {
	166	+	if h.internalAuth.Username == "" \|\| h.internalAuth.Password == "" {
	167	+	return false
	168	+	}
	169	+	return username == h.internalAuth.Username && password == h.internalAuth.Password
	170	+	}

 	IssuedAt    string `json:"issued_at,omitempty"`
 }
+// InternalAuth holds credentials for internal loopback registry access.
+type InternalAuth struct {
+	Username string
+	Password string
+}
 // TokenHandler handles token server requests for Docker Registry authentication.
 type TokenHandler struct {
-	authSvc in.AuthService
+	authSvc      in.AuthService
-	log     zerowrap.Logger
+	internalAuth InternalAuth
+	log          zerowrap.Logger
 }
 // NewTokenHandler creates a new token handler.
-func NewTokenHandler(authSvc in.AuthService, log zerowrap.Logger) *TokenHandler {
+func NewTokenHandler(authSvc in.AuthService, internalAuth InternalAuth, log zerowrap.Logger) *TokenHandler {
 	return &TokenHandler{
-		authSvc: authSvc,
+		authSvc:      authSvc,
-		log:     log,
+		internalAuth: internalAuth,
+		log:          log,
 	}
 }
 		return
 	}
-	// Validate credentials based on auth type
+	// Check for internal registry auth (localhost requests with internal creds)
 	var authenticated bool
-	switch h.authSvc.GetAuthType() {
+	if isLocalhostRequest(r) && h.isInternalAuth(username, password) {
-	case domain.AuthTypePassword:
+		authenticated = true
-		authenticated = h.authSvc.ValidatePassword(ctx, username, password)
+		log.Debug().Str("username", username).Msg("internal registry auth accepted")
-	case domain.AuthTypeToken:
+	} else {
-		// For token auth, the password might be an existing JWT
+		// Validate credentials based on auth type
-		claims, err := h.authSvc.ValidateToken(ctx, password)
+		switch h.authSvc.GetAuthType() {
-		if err == nil && claims.Subject == username {
+		case domain.AuthTypePassword:
-			authenticated = true
+			authenticated = h.authSvc.ValidatePassword(ctx, username, password)
+		case domain.AuthTypeToken:
+			// For token auth, the password might be an existing JWT
+			claims, err := h.authSvc.ValidateToken(ctx, password)
+			if err == nil && claims.Subject == username {
+				authenticated = true
+			}
 		}
 	}
 	log.Debug().Msg("anonymous token issued")
 }
+// isLocalhostRequest checks if the request is from localhost.
+func isLocalhostRequest(r *http.Request) bool {
+	host := r.Host
+	if host == "" {
+		host = r.URL.Host
+	}
+	return host == "localhost:5000" || host == "127.0.0.1:5000" || host == "[::1]:5000"
+}
+// isInternalAuth checks if the credentials match internal registry auth.
+func (h *TokenHandler) isInternalAuth(username, password string) bool {
+	if h.internalAuth.Username == "" || h.internalAuth.Password == "" {
+		return false
+	}
+	return username == h.internalAuth.Username && password == h.internalAuth.Password
+}

M internal/app/run.go +5 -1


@@ -260,7 +260,11 @@ func createServices(ctx context.Context, v *viper.Viper, cfg Config, log zerowra
260	260
261	261		// Create token handler for registry token endpoint
262	262		if svc.authSvc != nil {
263		-	svc.tokenHandler = registry.NewTokenHandler(svc.authSvc, log)
	263	+	internalAuth := registry.InternalAuth{
	264	+	Username: svc.internalRegUser,
	265	+	Password: svc.internalRegPass,
	266	+	}
	267	+	svc.tokenHandler = registry.NewTokenHandler(svc.authSvc, internalAuth, log)
264	268		}
265	269
266	270		return svc, nil

 	// Create token handler for registry token endpoint
 	if svc.authSvc != nil {
-		svc.tokenHandler = registry.NewTokenHandler(svc.authSvc, log)
+		internalAuth := registry.InternalAuth{
+			Username: svc.internalRegUser,
+			Password: svc.internalRegPass,
+		}
+		svc.tokenHandler = registry.NewTokenHandler(svc.authSvc, internalAuth, log)
 	}
 	return svc, nil