Add a feature flag for disabling unauthenticated access to the registry in its entirety.

test/test_api_security.py

@@ -371,6 +371,24 @@ class TestOrganizationList(ApiTestCase):
     self._run_test('POST', 400, 'devtable', {u'name': 'KSIS', u'email': 'DHVZ'})
 
 
+class TestPublicRepository(ApiTestCase):
+  def setUp(self):
+    ApiTestCase.setUp(self)
+    self._set_url(Repository, repository="public/publicrepo")
+
+  def test_get_anonymous(self):
+    self._run_test('GET', 200, None, None)
+
+  def test_get_freshuser(self):
+    self._run_test('GET', 200, 'freshuser', None)
+
+  def test_get_reader(self):
+    self._run_test('GET', 200, 'reader', None)
+
+  def test_get_devtable(self):
+    self._run_test('GET', 200, 'devtable', None)
+
+
 class TestRepositoryList(ApiTestCase):
   def setUp(self):
     ApiTestCase.setUp(self)

test/test_api_usage.py

@@ -1246,6 +1246,19 @@ class TestListRepos(ApiTestCase):
     self.assertEquals(len(json['repositories']), 2)
 
 
+class TestViewPublicRepository(ApiTestCase):
+  def test_normalview(self):
+    self.getJsonResponse(Repository, params=dict(repository='public/publicrepo'))
+
+  def test_anon_access_disabled(self):
+    import features
+    features.ANONYMOUS_ACCESS = False
+    try:
+      self.getResponse(Repository, params=dict(repository='public/publicrepo'), expected_code=401)
+    finally:
+      features.ANONYMOUS_ACCESS = True
+
+
 class TestUpdateRepo(ApiTestCase):
   SIMPLE_REPO = ADMIN_ACCESS_USER + '/simple'
   def test_updatedescription(self):