From eac8b52ae24b1e4c1cc2d9d3bc1299694e426320 Mon Sep 17 00:00:00 2001 From: josmueller <46693545+am9zZWY@users.noreply.github.com> Date: Wed, 8 Jul 2026 17:38:57 +0200 Subject: [PATCH] Allow anonymous pull-through for public distributions Assisted By: Claude Opus 4.8 --- CHANGES/1976.bugfix | 1 + pulp_container/app/registry_api.py | 6 +++++- .../tests/functional/api/test_pull_through_cache.py | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) create mode 100644 CHANGES/1976.bugfix diff --git a/CHANGES/1976.bugfix b/CHANGES/1976.bugfix new file mode 100644 index 000000000..46a2e10b8 --- /dev/null +++ b/CHANGES/1976.bugfix @@ -0,0 +1 @@ +Allow anonymous pull-through for public distributions diff --git a/pulp_container/app/registry_api.py b/pulp_container/app/registry_api.py index 289eb4356..3631a612e 100644 --- a/pulp_container/app/registry_api.py +++ b/pulp_container/app/registry_api.py @@ -371,7 +371,11 @@ def get_pull_through_drv(self, path): .order_by("-base_path") .first() ) - if not pull_through_cache_distribution or not self.request.user.is_authenticated: + # allow anonymous pull-through access for public distributions + if not pull_through_cache_distribution: + raise RepositoryNotFound(name=path) + # user must be authenticated when pull-through is private + if pull_through_cache_distribution.private and not self.request.user.is_authenticated: raise RepositoryNotFound(name=path) upstream_name = path.split(pull_through_cache_distribution.base_path, maxsplit=1)[1].strip( diff --git a/pulp_container/tests/functional/api/test_pull_through_cache.py b/pulp_container/tests/functional/api/test_pull_through_cache.py index d332e8a90..afac1252e 100644 --- a/pulp_container/tests/functional/api/test_pull_through_cache.py +++ b/pulp_container/tests/functional/api/test_pull_through_cache.py @@ -63,8 +63,8 @@ def _pull_and_verify(images, pull_through_distribution): local_image_path = f"{pull_through_distribution.base_path}/{image_path}" local_image_pull_path = full_path(local_image_path) # Handle if domain is enabled - # 0. test if an anonymous user cannot pull new content through the pull-through cache - with anonymous_user, pytest.raises(CalledProcessError): + # 0. test if an anonymous user can pull new content through the pull-through cache for public distributions + with anonymous_user: local_registry.pull(local_image_pull_path) # 1. pull remote content through the pull-through distribution