From 9f2b31f58fa4e3664e7ec1362fbcfc3b7e0dc35e Mon Sep 17 00:00:00 2001
From: Jesper Jensen <jesper@jnsn.dev>
Date: Sat, 7 Feb 2026 16:00:46 +0100
Subject: Add support for anonymous auth

We need this to actually run the integration tests. With that said,
please don't run the integration tests unless you need to. It's not nice
to use other peoples infrastructure for tests.
---
 src/registry.rs | 47 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 34 insertions(+), 13 deletions(-)

(limited to 'src/registry.rs')

diff --git a/src/registry.rs b/src/registry.rs
index afd2794..9f497fd 100644
--- a/src/registry.rs
+++ b/src/registry.rs
@@ -39,9 +39,14 @@ pub fn basic_auth(user: &str, pass: &str) -> String {
     return BASE64_STANDARD.encode(format!("{}:{}", user, pass));
 }
 
+pub enum Credentials {
+    Anonymous,
+    Basic(String),
+}
+
 pub struct AuthInfo {
     pub host: String,
-    pub auth: String,
+    pub credentials: Credentials,
 }
 
 enum AuthStage {
@@ -92,22 +97,32 @@ impl AuthState {
         let auth_header = response.headers().get("www-authenticate").unwrap();
         match AuthMethod::from_header(auth_header) {
             Some(AuthMethod::Basic) => {
-                let basic_auth = format!("Basic {}", self.info.auth);
-                self.stage = AuthStage::Authorized(basic_auth);
-
-                return Ok(());
+                match &self.info.credentials {
+                    Credentials::Basic(creds) => {
+                        self.stage = AuthStage::Authorized(format!("Basic {}", creds));
+                        return Ok(());
+                    }
+                    Credentials::Anonymous => {
+                        return Err(format!(
+                            "Server {} requires Basic auth but configured as anonymous",
+                            self.info.host
+                        ));
+                    }
+                }
             }
             Some(AuthMethod::Bearer { realm, scope, service }) => {
-                let basic_auth = format!("Basic {}", self.info.auth);
-
                 let url = format!("{}?service={}&scope={}", realm, service, scope);
 
-                let body = ureq::get(url)
+                let mut request = ureq::get(url)
                     .config()
                     .http_status_as_error(false)
-                    .build()
-                    .header("Authorization", basic_auth)
-                    .call();
+                    .build();
+
+                if let Credentials::Basic(creds) = &self.info.credentials {
+                    request = request.header("Authorization", format!("Basic {}", creds));
+                }
+
+                let body = request.call();
 
                 let body = body
                     .map_err(|x| {
@@ -467,7 +482,10 @@ mod tests {
     #[cfg(feature = "integration")]
     fn conformance_http_get_tags() {
         crate::metrics::init();
-        let reg = HttpRegistry::new(vec![]);
+        let reg = HttpRegistry::new(vec![AuthInfo {
+            host: "registry.hub.docker.com".to_string(),
+            credentials: Credentials::Anonymous,
+        }]);
         test_http_get_tags(&reg);
     }
 
@@ -475,7 +493,10 @@ mod tests {
     #[cfg(feature = "integration")]
     fn conformance_http_get_digest() {
         crate::metrics::init();
-        let reg = HttpRegistry::new(vec![]);
+        let reg = HttpRegistry::new(vec![AuthInfo {
+            host: "registry.hub.docker.com".to_string(),
+            credentials: Credentials::Anonymous,
+        }]);
         test_http_get_digest(&reg);
     }
 }
-- 
cgit v1.2.3