[schmitch]

Fixes #787

Problem

#703 (#704) made a selector-hidden image return 404 NAME_UNKNOWN. That arm now runs before the one that challenges an unauthenticated caller. A request that sent no credential of its own got 404 with no WWW-Authenticate:

• an anonymous request under anonymous mode all, where the anonymous role's grant has a selector;
• an account a trusted-header realm names, whose grant has a selector.

containerd sends its credentials only after a 401. So a Kubernetes pull with an imagePullSecret failed with "not found" for an image the secret may pull. On 2.1 the same request got the challenge, and the pull worked.

Change

Registry::refusal (crates/server/src/images/dispatch.rs) answers Decision::Hidden with the Bearer challenge when the request presented neither a credential nor a registry token: !mutation_credential(principal) && claims.is_none().

Every other case answers 404 NAME_UNKNOWN, as #703 intends:

• a request with a registry token, an anonymous one included;
• a request with Basic credentials.

Pushes and deletes are unchanged (403).

#703's changelog fragment (unreleased) said an anonymous caller now gets 404 too. It, and docs/docker.md, now describe the challenge. The regression never shipped, so this change adds no fragment of its own.

Tests

a_hidden_image_challenges_a_request_without_credentials (crates/server/tests/registry.rs) checks:

• 401 with a Bearer challenge for secret/app, on GET and HEAD, for an anonymous request and for a trusted-header account, whose selector shows public/*;
• public/app is still served to both;
• 404 NAME_UNKNOWN with an anonymous registry token;
• 200 with the credentials of a user who may read the whole repository.

Without the fix the test fails with anonymous: GET of a hidden image, left: 404, right: 401.

Run locally:

• cargo test -p forge-server --test registry --test trusted_header: 49 + 11 passed;
• cargo clippy -p forge-server --all-targets -- -D warnings, cargo fmt --all --check and cargo xtask changelog --check: clean.

---

Generated by Claude Code