quay/endpoints/v2/__init__.py

import logging

from flask import Blueprint, make_response, url_for, request, jsonify
from functools import wraps
from urlparse import urlparse

import features

from app import metric_queue
from endpoints.decorators import anon_protect, anon_allowed
from endpoints.v2.errors import V2RegistryException
from auth.jwt_auth import process_jwt_auth
from auth.auth_context import get_grant_user_context
from auth.permissions import (ReadRepositoryPermission, ModifyRepositoryPermission,
                              AdministerRepositoryPermission)
from data import model
from util.http import abort
from util.saas.metricqueue import time_blueprint
from util import get_app_url
from app import app


logger = logging.getLogger(__name__)
v2_bp = Blueprint('v2', __name__)

time_blueprint(v2_bp, metric_queue)

@v2_bp.app_errorhandler(V2RegistryException)
def handle_registry_v2_exception(error):
  response = jsonify({
    'errors': [error.as_dict()]
  })
  response.status_code = error.http_status_code
  logger.debug('sending response: %s', response.get_data())
  return response


def _require_repo_permission(permission_class, allow_public=False):
  def wrapper(func):
    @wraps(func)
    def wrapped(namespace, repo_name, *args, **kwargs):
      logger.debug('Checking permission %s for repo: %s/%s', permission_class, namespace, repo_name)
      permission = permission_class(namespace, repo_name)
      if (permission.can() or
          (allow_public and
           model.repository.repository_is_public(namespace, repo_name))):
        return func(namespace, repo_name, *args, **kwargs)
      raise abort(401)
    return wrapped
  return wrapper


require_repo_read = _require_repo_permission(ReadRepositoryPermission, True)
require_repo_write = _require_repo_permission(ModifyRepositoryPermission)
require_repo_admin = _require_repo_permission(AdministerRepositoryPermission)


def get_input_stream(flask_request):
  if flask_request.headers.get('transfer-encoding') == 'chunked':
    return flask_request.environ['wsgi.input']
  return flask_request.stream


# TODO remove when v2 is deployed everywhere
def route_show_if(value):
  def decorator(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
      if not value:
        abort(404)

      return f(*args, **kwargs)
    return decorated_function
  return decorator

@v2_bp.route('/')
@route_show_if(features.ADVERTISE_V2)
@process_jwt_auth
@anon_allowed
def v2_support_enabled():
  response = make_response('true', 200)

  if get_grant_user_context() is None:
    response = make_response('true', 401)
    realm_auth_path = url_for('v2.generate_registry_jwt')

    authenticate = 'Bearer realm="{0}{1}",service="{2}"'.format(get_app_url(app.config),
                                                                realm_auth_path,
                                                                app.config['SERVER_HOSTNAME'])
    response.headers['WWW-Authenticate'] = authenticate

  response.headers['Docker-Distribution-API-Version'] = 'registry/2.0'
  return response


from endpoints.v2 import v2auth
from endpoints.v2 import manifest
from endpoints.v2 import blob
from endpoints.v2 import tag
from endpoints.v2 import catalog