basic auth case

when basic auth is present, proxy. this ps also adds the test case for the basic auth case.
scarf-sh · Sep 19, 2024 · 7913260 · 7913260
1 parent 9018f1b
commit 7913260
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 0 deletions.
diff --git a/src/Scarf/Gateway/Rule/Docker.hs b/src/Scarf/Gateway/Rule/Docker.hs
@@ -151,6 +151,10 @@ redirectOrProxy request domain alwaysProxy !capture ResponseBuilder {..}
   | alwaysProxy =
       -- Proxy request unconditionally
       proxyTo (const capture) domain
+  -- when a basic authorization header is present, it will be proxied
+  | Just authHeader <- lookup "Authorization" (Wai.requestHeaders request),
+    "Basic" `ByteString.isPrefixOf` authHeader =
+      proxyTo (const capture) domain
   | shouldRedirectDockerRequest request =
       -- As with the Host header we have to respect the proxy protocol
       -- when redirecting.

diff --git a/test/golden/docker-basic-auth.output.body b/test/golden/docker-basic-auth.output.body
diff --git a/test/golden/docker-basic-auth.output.yaml b/test/golden/docker-basic-auth.output.yaml
@@ -0,0 +1,14 @@
+capture: |-
+  Just
+    DockerCapture
+      { dockerCaptureImage = [ "library" , "enterprise" ]
+      , dockerCaptureReference = "latest"
+      , dockerCaptureBackendRegistry = "ghcr.io"
+      , dockerCapturePackage =
+          Just "d7e7f172-67af-4b5b-ba6d-c9eab0903b0c"
+      , dockerCaptureAutoCreate = Nothing
+      }
+headers:
+  Location: https://ghcr.io/v2/library/enterprise/manifests/latest
+  X-This-Request-Was-Proxied: '1'
+status: 307
diff --git a/test/golden/docker-basic-auth.yaml b/test/golden/docker-basic-auth.yaml
@@ -0,0 +1,12 @@
+path: /v2/library/enterprise/manifests/latest
+headers:
+  Host: mariadb.com
+  Authorization: Basic ZGVtbzpwQDU1dzByZA==
+manifest:
+  rules:
+    - type:  docker-v1
+      repository-name: library/enterprise
+      domain: mariadb.com
+      registry: ghcr.io
+      package-id: "d7e7f172-67af-4b5b-ba6d-c9eab0903b0c"
+