Kyle Isom
3314b7a618
Phase 2 — internal/storage/: Content-addressed blob storage with atomic writes via rename. BlobWriter stages data in uploads dir with running SHA-256 hash, commits by verifying digest then renaming to layers/sha256/<prefix>/<hex>. Reader provides Open, Stat, Delete, Exists with digest validation. Phase 3 — internal/auth/ + internal/server/: MCIAS client with Login and ValidateToken, 30s SHA-256-keyed cache with lazy eviction and injectable clock for testing. TLS 1.3 minimum with optional custom CA cert. Chi router with RequireAuth middleware (Bearer token extraction, WWW-Authenticate header, OCI error format), token endpoint (Basic auth → bearer exchange via MCIAS), and /v2/ version check handler. 52 tests passing (14 storage + 9 auth + 9 server + 20 existing). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
22 lines
621 B
Go
22 lines
621 B
Go
package server
|
|
|
|
import "github.com/go-chi/chi/v5"
|
|
|
|
// NewRouter builds the chi router with all OCI Distribution Spec
|
|
// endpoints and auth middleware wired up.
|
|
func NewRouter(validator TokenValidator, loginClient LoginClient, serviceName string) *chi.Mux {
|
|
r := chi.NewRouter()
|
|
|
|
// Token endpoint is NOT behind RequireAuth — clients use Basic auth
|
|
// here to obtain a bearer token.
|
|
r.Get("/v2/token", TokenHandler(loginClient))
|
|
|
|
// All other /v2 endpoints require a valid bearer token.
|
|
r.Route("/v2", func(v2 chi.Router) {
|
|
v2.Use(RequireAuth(validator, serviceName))
|
|
v2.Get("/", V2Handler())
|
|
})
|
|
|
|
return r
|
|
}
|