smart_proxy_container_gateway 3.2.0 → 3.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 122f380fd60f0bbfae2a98fb2b76e18f2a4f000a12df75eeb31b9f4e0fee3dba
-  data.tar.gz: 2f1e2c8e328cf132fd2fe05b4bc2aead3e02daf20f379026d9636d40bfcbf75b
+  metadata.gz: b85cb8971300559f91cbae183a96bfa821c0bd90151c2b7c765561d9e1f84adc
+  data.tar.gz: 988f40bafe8e1aaf13042faf2bd5505bfc416e7e4160f94419ba7b271878bdfe
 SHA512:
-  metadata.gz: d00eb53ee413aa6eef7cac95f61ba770b4b120348d57b38a14c1837bb12e021934154110df47b39f478d79768f922eb4f60ffd99765308733d69c91fe98f9231
-  data.tar.gz: ce89f410c1afdb8972ac996cccf97e5b27d98f55cc4e31dfffc81c15a459a3f6b394085e994ecf1a198a7c43205a252d0c807e34b270bd26e5d29be58544c178
+  metadata.gz: 4c249cf8162619a123d179234182ff19b7f724393600738c421acd2b0627b0b370fb01f38cd0b57304c3d50765015df40170eae42617e5c29d56c457a25ec531
+  data.tar.gz: ff795672ab091823d36af4085ca328775ec8ce2f1f5d954d0760c7ba4540b4842ab0dfcdf9d741d53ec534a7603711f5da78ac65e7b8a423a5b5f44c54d2980c

data/lib/smart_proxy_container_gateway/container_gateway.rb

@@ -41,7 +41,8 @@ module Proxy
         container_instance.singleton_dependency :container_gateway_main_impl, (lambda do
           Proxy::ContainerGateway::ContainerGatewayMain.new(
             database: container_instance.get_dependency(:database_impl),
-            **settings.slice(:pulp_endpoint, :pulp_client_ssl_ca, :pulp_client_ssl_cert, :pulp_client_ssl_key)
+            **settings.slice(:pulp_endpoint, :pulp_client_ssl_ca, :pulp_client_ssl_cert,
+                             :pulp_client_ssl_key, :client_endpoint)
           )
         end)
       end

data/lib/smart_proxy_container_gateway/container_gateway_api.rb

@@ -46,8 +46,9 @@ module Proxy
           status pulp_response.code.to_i
           body pulp_response.body
         else
-          redirection_location = pulp_response['location']
-          redirect to(redirection_location)
+          redirection_uri = URI(pulp_response['location'])
+          redirection_uri.host = URI(container_gateway_main.client_endpoint).host
+          redirect(redirection_uri.to_s)
         end
       end
 
@@ -118,7 +119,7 @@ module Proxy
       get '/v2/_catalog/?' do
         catalog = []
         if auth_header.present?
-          if auth_header.unauthorized_token?
+          if auth_header.unauthenticated_token? || auth_header.unauthorized_token?
             catalog = container_gateway_main.catalog.select_map(::Sequel[:repositories][:name])
           elsif auth_header.valid_user_token?
             catalog = container_gateway_main.catalog(auth_header.user).select_map(::Sequel[:repositories][:name])
@@ -149,42 +150,33 @@ module Proxy
           request.params['account'] ||= username if username.present?
         end
 
-        unless auth_header.present? && auth_header.basic_auth?
-          return { token: AuthorizationHeader::UNAUTHORIZED_TOKEN, issued_at: Time.now.rfc3339,
-                   expires_in: 1.year.seconds.to_i }.to_json
-        end
-
         token_response = ForemanApi.new.fetch_token(auth_header.raw_header, request.params)
-        if token_response.code.to_i != 200
-          halt token_response.code.to_i, token_response.body
-        else
-          # This returned token should follow OAuth2 spec. We need some minor conversion
-          # to store the token with the expires_at time (using rfc3339).
-          token_response_body = JSON.parse(token_response.body)
+        halt token_response.code.to_i, token_response.body unless token_response.code.to_i == 200
 
-          if token_response_body['token'].nil?
-            halt 502, "Recieved malformed token response"
-          end
+        token_response_body = JSON.parse(token_response.body)
+        halt 502, "Recieved malformed token response" if token_response_body['token'].nil?
+
+        # Check for unauthorized tokens and respond with 401
+        halt 401, "unauthorized" if token_response_body['token'] == AuthorizationHeader::UNAUTHORIZED_TOKEN
+
+        # Skip storing the token if it is unauthenticated
+        unless token_response_body['token'] == AuthorizationHeader::UNAUTHENTICATED_TOKEN
 
           # "issued_at" is an optional field. Per OAuth2 we assume time of token response as
           # the issue time if the field is ommitted.
           token_issue_time = (token_response_body["issued_at"] || token_response["Date"])&.to_time
-          if token_issue_time.nil?
-            halt 502, "Recieved malformed token response"
-          end
+          halt 502, "Recieved malformed token response" if token_issue_time.nil?
 
+          # This returned token should follow OAuth2 spec. We need some minor conversion
+          # to store the token with the expires_at time (using rfc3339).
           # 'expires_in' is an optional field. If not provided, assume 60 seconds per OAuth2 spec
           expires_in = token_response_body.fetch("expires_in", 60)
           expires_at = token_issue_time + expires_in.seconds
-          if request.params['account'].present?
-            container_gateway_main.insert_token(
-              request.params['account'],
-              token_response_body['token'],
-              expires_at.rfc3339
-            )
-          else
-            halt 401, "unauthorized"
-          end
+          container_gateway_main.insert_token(
+            request.params['account'],
+            token_response_body['token'],
+            expires_at.rfc3339
+          )
 
           repo_response = ForemanApi.new.fetch_user_repositories(auth_header.raw_header, request.params)
           if repo_response.code.to_i != 200
@@ -193,10 +185,10 @@ module Proxy
             container_gateway_main.update_user_repositories(request.params['account'],
                                                             JSON.parse(repo_response.body)['repositories'])
           end
-
-          # Return the original token response from Katello
-          return token_response.body
         end
+
+        # Return the original token response from Katello
+        return token_response.body
       end
 
       get '/users/?' do
@@ -236,8 +228,9 @@ module Proxy
           status pulp_response.code.to_i
           body pulp_response.body
         else
-          redirection_location = pulp_response['location']
-          redirect to(redirection_location)
+          redirection_uri = URI(pulp_response['location'])
+          redirection_uri.host = URI(container_gateway_main.client_endpoint).host
+          redirect(redirection_uri.to_s)
         end
       end
 
@@ -318,6 +311,7 @@ module Proxy
         inject_attr :database_impl, :database
         inject_attr :container_gateway_main_impl, :container_gateway_main
         UNAUTHORIZED_TOKEN = 'unauthorized'.freeze
+        UNAUTHENTICATED_TOKEN = 'unauthenticated'.freeze
 
         def initialize(value)
           @value = value || ''
@@ -343,6 +337,10 @@ module Proxy
           @value.split(' ')[1] == UNAUTHORIZED_TOKEN
         end
 
+        def unauthenticated_token?
+          @value.split(' ')[1] == UNAUTHENTICATED_TOKEN
+        end
+
         def token_auth?
           @value.split(' ')[0] == 'Bearer'
         end

data/lib/smart_proxy_container_gateway/container_gateway_main.rb

@@ -9,17 +9,20 @@ module Proxy
     extend ::Proxy::Log
 
     class ContainerGatewayMain
-      attr_reader :database
+      attr_reader :database, :client_endpoint
 
-      def initialize(database:, pulp_endpoint:, pulp_client_ssl_ca:, pulp_client_ssl_cert:, pulp_client_ssl_key:)
+      # rubocop:disable Metrics/ParameterLists, Layout/LineLength
+      def initialize(database:, pulp_endpoint:, pulp_client_ssl_ca:, pulp_client_ssl_cert:, pulp_client_ssl_key:, client_endpoint: nil)
         @database = database
         @pulp_endpoint = pulp_endpoint
+        @client_endpoint = client_endpoint || pulp_endpoint
         @pulp_client_ssl_ca = pulp_client_ssl_ca
         @pulp_client_ssl_cert = OpenSSL::X509::Certificate.new(File.read(pulp_client_ssl_cert))
         @pulp_client_ssl_key = OpenSSL::PKey::RSA.new(
           File.read(pulp_client_ssl_key)
         )
       end
+      # rubocop:enable Metrics/ParameterLists, Layout/LineLength
 
       def pulp_registry_request(uri, headers)
         http_client = Net::HTTP.new(uri.host, uri.port)

data/lib/smart_proxy_container_gateway/version.rb

@@ -1,5 +1,5 @@
 module Proxy
   module ContainerGateway
-    VERSION = '3.2.0'.freeze
+    VERSION = '3.3.1'.freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_container_gateway
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.3.1
 platform: ruby
 authors:
 - Ian Ballou
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-23 00:00:00.000000000 Z
+date: 2025-04-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -116,7 +116,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.21
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Pulp 3 container registry support for Foreman/Katello Smart-Proxy