refactor(auth): support both password and token auth in password mode

commit: 3dc5982577fecde1380e49aa48782435a1c4411d
author: bnema · 9mo ago · 2026-01-18 03:16 UTC
parent: f3f65ba
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +8 -1

M internal/adapters/in/http/middleware/auth.go +8 -1


@@ -144,11 +144,18 @@ func RegistryAuthV2(authSvc in.AuthService, internalAuth InternalRegistryAuth, l
144	144		ctx := r.Context()
145	145
146	146		// Authenticate based on auth type
	147	+	// When auth type is "password", accept BOTH password and token auth
	148	+	// (allows CI/CD tokens while still supporting interactive password login)
147	149		var authenticated bool
148	150		var tokenClaims *domain.TokenClaims
149	151		switch authSvc.GetAuthType() {
150	152		case domain.AuthTypePassword:
	153	+	// Try password auth first
151	154		authenticated = authenticatePassword(ctx, r, authSvc, log)
	155	+	if !authenticated {
	156	+	// Fall back to token auth (for CI/CD tokens)
	157	+	authenticated, tokenClaims = authenticateToken(ctx, r, authSvc, log)
	158	+	}
152	159		case domain.AuthTypeToken:
153	160		authenticated, tokenClaims = authenticateToken(ctx, r, authSvc, log)
154	161		default:

@@ -410,7 +417,7 @@ func sendUnauthorized(w http.ResponseWriter, authType domain.AuthType, host stri
410	417		} else if r.TLS != nil {
411	418		scheme = "https"
412	419		}
413		-	realm := scheme + "://" + realmHost + "/v2/token"
	420	+	realm := scheme + "://" + realmHost + "/auth/token"
414	421		w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`",service="gordon-registry"`)
415	422		default:
416	423		w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)

 			ctx := r.Context()
 			// Authenticate based on auth type
+			// When auth type is "password", accept BOTH password and token auth
+			// (allows CI/CD tokens while still supporting interactive password login)
 			var authenticated bool
 			var tokenClaims *domain.TokenClaims
 			switch authSvc.GetAuthType() {
 			case domain.AuthTypePassword:
+				// Try password auth first
 				authenticated = authenticatePassword(ctx, r, authSvc, log)
+				if !authenticated {
+					// Fall back to token auth (for CI/CD tokens)
+					authenticated, tokenClaims = authenticateToken(ctx, r, authSvc, log)
+				}
 			case domain.AuthTypeToken:
 				authenticated, tokenClaims = authenticateToken(ctx, r, authSvc, log)
 			default:
 		} else if r.TLS != nil {
 			scheme = "https"
 		}
-		realm := scheme + "://" + realmHost + "/v2/token"
+		realm := scheme + "://" + realmHost + "/auth/token"
 		w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`",service="gordon-registry"`)
 	default:
 		w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)