Allow anonymous pull-through for public distributions

CHANGES/1976.bugfix

@@ -0,0 +1 @@
+Allow anonymous pull-through for public distributions

pulp_container/app/registry_api.py

@@ -371,7 +371,11 @@ def get_pull_through_drv(self, path):
             .order_by("-base_path")
             .first()
         )
-        if not pull_through_cache_distribution or not self.request.user.is_authenticated:
+        # allow anonymous pull-through access for public distributions
+        if not pull_through_cache_distribution:
+            raise RepositoryNotFound(name=path)
+        # user must be authenticated when pull-through is private
+        if pull_through_cache_distribution.private and not self.request.user.is_authenticated:
             raise RepositoryNotFound(name=path)
 
         upstream_name = path.split(pull_through_cache_distribution.base_path, maxsplit=1)[1].strip(

pulp_container/tests/functional/api/test_pull_through_cache.py

@@ -63,8 +63,8 @@ def _pull_and_verify(images, pull_through_distribution):
             local_image_path = f"{pull_through_distribution.base_path}/{image_path}"
             local_image_pull_path = full_path(local_image_path)  # Handle if domain is enabled
 
-            # 0. test if an anonymous user cannot pull new content through the pull-through cache
-            with anonymous_user, pytest.raises(CalledProcessError):
+            # 0. test if an anonymous user can pull new content through the pull-through cache for public distributions
+            with anonymous_user:
                 local_registry.pull(local_image_pull_path)
 
             # 1. pull remote content through the pull-through distribution