smart_proxy_container_gateway 3.1.1 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 129561beba74e2d626b09ec8236defd0d7fc01b9f2a3a55f18c8da358f9b22d7
-  data.tar.gz: e7ad6221d17625f4dfd236ae5299a18d19b2d97f92fb13fcb1d2246394f1b48a
+  metadata.gz: 1965b68bd7795a23fafce6976458a33bf58f8ef67ccab714ab52edcd69558e4e
+  data.tar.gz: f025588bd31da08bbf6fc2bfd9b58924a4d99d86571b689f6bbfdfc2a7e458dd
 SHA512:
-  metadata.gz: cf49a821ff8e81465ec017be198c8b7a3217a236c223a33934ee7fc3e530daf2761e628710694937609be70f5e1823065fb9ad47addc33fddd12da1fc8267468
-  data.tar.gz: 6bd2923fcf74cdcae8ff5828ec38eeca41e29b52d759ca4b306da5bc377d1b2c07fab9180fb5acd3d2e8d88277905e4ed4852dadee9d0c24fc0564dedc92a7d9
+  metadata.gz: 8592a29f188ccc45ee9db74cf72579b5c63957ed4a9a64e015c7f3627bd2ee0fdf23e80efad608b690313fe5a4db28f2db0d5660a0a0a894736e500d1aa5bc78
+  data.tar.gz: eedefbd87696d56163aef9da0b6af8b4061bea74626054d4bf1c78b7d70425a61939db451a6081b79efdb42b17e248f1a8eaf037b5c882026bff7f5a79d87e62

data/lib/smart_proxy_container_gateway/container_gateway.rb

@@ -41,7 +41,8 @@ module Proxy
         container_instance.singleton_dependency :container_gateway_main_impl, (lambda do
           Proxy::ContainerGateway::ContainerGatewayMain.new(
             database: container_instance.get_dependency(:database_impl),
-            **settings.slice(:pulp_endpoint, :pulp_client_ssl_ca, :pulp_client_ssl_cert, :pulp_client_ssl_key)
+            **settings.slice(:pulp_endpoint, :pulp_client_ssl_ca, :pulp_client_ssl_cert,
+                             :pulp_client_ssl_key, :client_endpoint)
           )
         end)
       end

data/lib/smart_proxy_container_gateway/container_gateway_api.rb

@@ -1,6 +1,7 @@
 require 'active_support'
 require 'active_support/core_ext/integer'
 require 'active_support/core_ext/string'
+require 'active_support/core_ext/object/blank'
 require 'active_support/time_with_zone'
 require 'sinatra'
 require 'smart_proxy_container_gateway/container_gateway'
@@ -45,8 +46,9 @@ module Proxy
           status pulp_response.code.to_i
           body pulp_response.body
         else
-          redirection_location = pulp_response['location']
-          redirect to(redirection_location)
+          redirection_uri = URI(pulp_response['location'])
+          redirection_uri.host = URI(container_gateway_main.client_endpoint).host
+          redirect(redirection_uri.to_s)
         end
       end
 
@@ -137,6 +139,17 @@ module Proxy
       get '/v2/token' do
         response.headers['Docker-Distribution-API-Version'] = 'registry/2.0'
 
+        # Flatpak client requests do not contain the account param that podman relies on.
+        # It contains Base64 encoded username in the Authorization header.
+        # We need to extract the username from the Authorization header and
+        # set it as the account param to be used when inserting new token record.
+        if flatpak_client? && auth_header.raw_header.present?
+          encoded_string = auth_header.raw_header&.split(' ')&.[](1)
+          decoded_string = Base64.decode64(encoded_string) if encoded_string.present?
+          username = decoded_string.split(':')[0] if decoded_string.present?
+          request.params['account'] ||= username if username.present?
+        end
+
         unless auth_header.present? && auth_header.basic_auth?
           return { token: AuthorizationHeader::UNAUTHORIZED_TOKEN, issued_at: Time.now.rfc3339,
                    expires_in: 1.year.seconds.to_i }.to_json
@@ -164,12 +177,15 @@ module Proxy
           # 'expires_in' is an optional field. If not provided, assume 60 seconds per OAuth2 spec
           expires_in = token_response_body.fetch("expires_in", 60)
           expires_at = token_issue_time + expires_in.seconds
-
-          container_gateway_main.insert_token(
-            request.params['account'],
-            token_response_body['token'],
-            expires_at.rfc3339
-          )
+          if request.params['account'].present?
+            container_gateway_main.insert_token(
+              request.params['account'],
+              token_response_body['token'],
+              expires_at.rfc3339
+            )
+          else
+            halt 401, "unauthorized"
+          end
 
           repo_response = ForemanApi.new.fetch_user_repositories(auth_header.raw_header, request.params)
           if repo_response.code.to_i != 200
@@ -208,6 +224,10 @@ module Proxy
 
       private
 
+      def flatpak_client?
+        request.user_agent&.downcase&.include?('flatpak')
+      end
+
       def head_or_get_blobs
         repository = params[:splat][0]
         digest = params[:splat][1]
@@ -217,8 +237,9 @@ module Proxy
           status pulp_response.code.to_i
           body pulp_response.body
         else
-          redirection_location = pulp_response['location']
-          redirect to(redirection_location)
+          redirection_uri = URI(pulp_response['location'])
+          redirection_uri.host = URI(container_gateway_main.client_endpoint).host
+          redirect(redirection_uri.to_s)
         end
       end
 
@@ -264,12 +285,21 @@ module Proxy
         if auth_header.present? && auth_header.valid_user_token?
           user_token_is_valid = true
           username = auth_header.user[:name]
+          # For flatpak client, header doesn't contain user name. Extract it from token.
+          username ||= container_gateway_main.token_user(@value.split(' ')[1]) if flatpak_client?
         end
         username = request.params['account'] if username.nil?
 
         return if container_gateway_main.authorized_for_repo?(repository, user_token_is_valid, username)
 
         redirect_authorization_headers
+
+        # If username couldn't be determined from the token or auth_headers
+        # which is case for first flatpak request, halt with 401 instead of 404
+        if flatpak_client? && username.nil?
+          halt 401, "unauthorized"
+        end
+
         throw_repo_not_found_error
       end
 

data/lib/smart_proxy_container_gateway/container_gateway_main.rb

@@ -9,17 +9,20 @@ module Proxy
     extend ::Proxy::Log
 
     class ContainerGatewayMain
-      attr_reader :database
+      attr_reader :database, :client_endpoint
 
-      def initialize(database:, pulp_endpoint:, pulp_client_ssl_ca:, pulp_client_ssl_cert:, pulp_client_ssl_key:)
+      # rubocop:disable Metrics/ParameterLists, Layout/LineLength
+      def initialize(database:, pulp_endpoint:, pulp_client_ssl_ca:, pulp_client_ssl_cert:, pulp_client_ssl_key:, client_endpoint: nil)
         @database = database
         @pulp_endpoint = pulp_endpoint
+        @client_endpoint = client_endpoint || pulp_endpoint
         @pulp_client_ssl_ca = pulp_client_ssl_ca
         @pulp_client_ssl_cert = OpenSSL::X509::Certificate.new(File.read(pulp_client_ssl_cert))
         @pulp_client_ssl_key = OpenSSL::PKey::RSA.new(
           File.read(pulp_client_ssl_key)
         )
       end
+      # rubocop:enable Metrics/ParameterLists, Layout/LineLength
 
       def pulp_registry_request(uri, headers)
         http_client = Net::HTTP.new(uri.host, uri.port)

data/lib/smart_proxy_container_gateway/version.rb

@@ -1,5 +1,5 @@
 module Proxy
   module ContainerGateway
-    VERSION = '3.1.1'.freeze
+    VERSION = '3.3.0'.freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_container_gateway
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.3.0
 platform: ruby
 authors:
 - Ian Ballou
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-05 00:00:00.000000000 Z
+date: 2025-04-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport