100 lines
3.1 KiB
Python
100 lines
3.1 KiB
Python
import logging
|
|
|
|
from flask import Blueprint, make_response, url_for, request, jsonify
|
|
from functools import wraps
|
|
from urlparse import urlparse
|
|
|
|
import features
|
|
|
|
from app import metric_queue
|
|
from endpoints.decorators import anon_protect, anon_allowed
|
|
from endpoints.v2.errors import V2RegistryException
|
|
from auth.jwt_auth import process_jwt_auth
|
|
from auth.auth_context import get_grant_user_context
|
|
from auth.permissions import (ReadRepositoryPermission, ModifyRepositoryPermission,
|
|
AdministerRepositoryPermission)
|
|
from data import model
|
|
from util.http import abort
|
|
from util.saas.metricqueue import time_blueprint
|
|
from util import get_app_url
|
|
from app import app
|
|
|
|
|
|
logger = logging.getLogger(__name__)
|
|
v2_bp = Blueprint('v2', __name__)
|
|
|
|
time_blueprint(v2_bp, metric_queue)
|
|
|
|
@v2_bp.app_errorhandler(V2RegistryException)
|
|
def handle_registry_v2_exception(error):
|
|
response = jsonify({
|
|
'errors': [error.as_dict()]
|
|
})
|
|
response.status_code = error.http_status_code
|
|
logger.debug('sending response: %s', response.get_data())
|
|
return response
|
|
|
|
|
|
def _require_repo_permission(permission_class, allow_public=False):
|
|
def wrapper(func):
|
|
@wraps(func)
|
|
def wrapped(namespace, repo_name, *args, **kwargs):
|
|
logger.debug('Checking permission %s for repo: %s/%s', permission_class, namespace, repo_name)
|
|
permission = permission_class(namespace, repo_name)
|
|
if (permission.can() or
|
|
(allow_public and
|
|
model.repository.repository_is_public(namespace, repo_name))):
|
|
return func(namespace, repo_name, *args, **kwargs)
|
|
raise abort(401)
|
|
return wrapped
|
|
return wrapper
|
|
|
|
|
|
require_repo_read = _require_repo_permission(ReadRepositoryPermission, True)
|
|
require_repo_write = _require_repo_permission(ModifyRepositoryPermission)
|
|
require_repo_admin = _require_repo_permission(AdministerRepositoryPermission)
|
|
|
|
|
|
def get_input_stream(flask_request):
|
|
if flask_request.headers.get('transfer-encoding') == 'chunked':
|
|
return flask_request.environ['wsgi.input']
|
|
return flask_request.stream
|
|
|
|
|
|
# TODO remove when v2 is deployed everywhere
|
|
def route_show_if(value):
|
|
def decorator(f):
|
|
@wraps(f)
|
|
def decorated_function(*args, **kwargs):
|
|
if not value:
|
|
abort(404)
|
|
|
|
return f(*args, **kwargs)
|
|
return decorated_function
|
|
return decorator
|
|
|
|
@v2_bp.route('/')
|
|
@route_show_if(features.ADVERTISE_V2)
|
|
@process_jwt_auth
|
|
@anon_allowed
|
|
def v2_support_enabled():
|
|
response = make_response('true', 200)
|
|
|
|
if get_grant_user_context() is None:
|
|
response = make_response('true', 401)
|
|
realm_auth_path = url_for('v2.generate_registry_jwt')
|
|
|
|
authenticate = 'Bearer realm="{0}{1}",service="{2}"'.format(get_app_url(app.config),
|
|
realm_auth_path,
|
|
app.config['SERVER_HOSTNAME'])
|
|
response.headers['WWW-Authenticate'] = authenticate
|
|
|
|
response.headers['Docker-Distribution-API-Version'] = 'registry/2.0'
|
|
return response
|
|
|
|
|
|
from endpoints.v2 import v2auth
|
|
from endpoints.v2 import manifest
|
|
from endpoints.v2 import blob
|
|
from endpoints.v2 import tag
|
|
from endpoints.v2 import catalog
|