Prevent registry operations against disabled namespaces

Allows admins to completely wall off a namespace by disabling it

Fixes https://jira.coreos.com/browse/QUAY-869

endpoints/v2/errors.py

@@ -138,3 +138,9 @@ class InvalidLogin(V2RegistryException):
 class InvalidRequest(V2RegistryException):
   def __init__(self, message=None):
     super(InvalidRequest, self).__init__('INVALID_REQUEST', message or 'Invalid request', {}, 400)
+
+
+class NamespaceDisabled(V2RegistryException):
+  def __init__(self, message=None):
+    message = message or 'This namespace is disabled. Please contact your system administrator.'
+    super(NamespaceDisabled, self).__init__('NAMESPACE_DISABLED', message, {}, 400)

endpoints/v2/models_interface.py

@@ -270,3 +270,9 @@ class DockerRegistryV2DataInterface(object):
     Looks up all blobs with the matching digests under the given repository.
     """
     pass
+
+  @abstractmethod
+  def is_namespace_enabled(self, namespace_name):
+    """ Returns whether the given namespace is enabled. If the namespace doesn't exist,
+        returns True. """
+    pass

endpoints/v2/models_pre_oci.py

@@ -258,6 +258,10 @@ class PreOCIModel(DockerRegistryV2DataInterface):
     except model.InvalidManifestException:
       return
 
+  def is_namespace_enabled(self, namespace_name):
+    namespace = model.user.get_namespace_user(namespace_name)
+    return namespace is None or namespace.enabled
+
 
 def _docker_v1_metadata(namespace_name, repo_name, repo_image):
   """

endpoints/v2/test/test_v2auth.py

@@ -54,6 +54,11 @@ from test.fixtures import *
   ('repository:somenamespace/unknownrepo:pull,push', 'devtable', 'password', 200,
    ['somenamespace/unknownrepo:']),
 
+  # Disabled namespace.
+  (['repository:devtable/simple:pull,push', 'repository:disabled/complex:pull'],
+    'devtable', 'password', 400,
+   []),
+
   # Multiple scopes.
   (['repository:devtable/simple:pull,push', 'repository:devtable/complex:pull'],
     'devtable', 'password', 200,

endpoints/v2/v2auth.py

@@ -13,7 +13,8 @@ from auth.permissions import (ModifyRepositoryPermission, ReadRepositoryPermissi
                               CreateRepositoryPermission, AdministerRepositoryPermission)
 from endpoints.decorators import anon_protect
 from endpoints.v2 import v2_bp
-from endpoints.v2.errors import InvalidLogin, NameInvalid, InvalidRequest, Unsupported, Unauthorized
+from endpoints.v2.errors import (InvalidLogin, NameInvalid, InvalidRequest, Unsupported,
+                                 Unauthorized, NamespaceDisabled)
 from endpoints.v2.models_pre_oci import data_model as model
 from util.cache import no_cache
 from util.names import parse_namespace_repository, REPOSITORY_NAME_REGEX
@@ -160,6 +161,11 @@ def _authorize_or_downscope_request(scope_param, has_valid_auth_context):
 
     raise NameInvalid(message='Invalid repository name: %s' % namespace_and_repo)
 
+  # Ensure the namespace is enabled.
+  if not model.is_namespace_enabled(namespace):
+    msg = 'Namespace %s has been disabled. Please contact a system administrator.' % namespace
+    raise NamespaceDisabled(message=msg)
+
   final_actions = []
 
   repo = model.get_repository(namespace, reponame)