fix: Do NOT require list permissions on a single set of tags

Author: ivanilves

api/v1/registry/client/client.go

@@ -157,7 +157,7 @@ func (cli *RegistryClient) IsLoggedIn() bool {
 	return cli.Token != nil
 }
 
-func decodeTagData(body io.ReadCloser) ([]string, map[string]manifest.Manifest, error) {
+func decodeAllTagData(body io.ReadCloser) ([]string, map[string]manifest.Manifest, error) {
 	tagData := struct {
 		TagNames     []string                `json:"tags"`
 		RawManifests map[string]manifest.Raw `json:"manifest,omitempty"`
@@ -204,8 +204,21 @@ func (cli *RegistryClient) repoToken(repoPath string) (auth.Token, error) {
 	return cli.RepoTokens[repoPath], nil
 }
 
-// TagData gets list of all tag names and all additional data for the repository path specified
-func (cli *RegistryClient) TagData(repoPath string) ([]string, map[string]manifest.Manifest, error) {
+// TagData gets data of either all tags (list+get) or a set of single tags only (blind "get")
+func (cli *RegistryClient) TagData(
+	repoPath string,
+	isSingle bool,
+	repoTags []string,
+) ([]string, map[string]manifest.Manifest, error) {
+	if isSingle {
+		return cli.SingleTagData(repoTags)
+	}
+
+	return cli.AllTagData(repoPath)
+}
+
+// AllTagData gets list of all tag names and all additional data for the repository path specified
+func (cli *RegistryClient) AllTagData(repoPath string) ([]string, map[string]manifest.Manifest, error) {
 	repoToken, err := cli.repoToken(repoPath)
 	if err != nil {
 		return nil, nil, err
@@ -228,7 +241,7 @@ func (cli *RegistryClient) TagData(repoPath string) ([]string, map[string]manife
 			return nil, nil, err
 		}
 
-		tagNames, tagManifests, err := decodeTagData(resp.Body)
+		tagNames, tagManifests, err := decodeAllTagData(resp.Body)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -246,6 +259,17 @@ func (cli *RegistryClient) TagData(repoPath string) ([]string, map[string]manife
 	return allTagNames, allTagManifests, nil
 }
 
+// SingleTagData gets data for a set of single tags
+func (cli *RegistryClient) SingleTagData(repoTags []string) ([]string, map[string]manifest.Manifest, error) {
+	tagManifests := make(map[string]manifest.Manifest)
+
+	for _, tagName := range repoTags {
+		tagManifests[tagName] = manifest.Manifest{}
+	}
+
+	return repoTags, tagManifests, nil
+}
+
 func (cli *RegistryClient) tagDigest(repoPath, tagName string) (string, error) {
 	repoToken, err := cli.repoToken(repoPath)
 	if err != nil {

repository/repository.go

@@ -263,6 +263,7 @@ func ParseRef(ref string) (*Repository, error) {
 		refParts := strings.Split(fullRef, "=")
 		fullRepo = refParts[0]
 		repoTags = strings.Split(refParts[1], ",")
+		isSingle = true
 	case refWithFilter:
 		refParts := strings.Split(fullRef, "~")
 		fullRepo = refParts[0]

repository/repository_test.go

@@ -27,7 +27,7 @@ func TestParseRef(t *testing.T) {
 		"localhost:5000/nada/mindundi":          {"localhost:5000", false, "localhost:5000/nada/mindundi", "localhost:5000/nada/mindundi", "nada/mindundi", []string{}, ".*", "http://", false, true},
 		"localhost:7eff/nada/mindundi":          {"", true, "", "", "", []string{}, "", "", false, false},
 		"quay.io/coreos/awscli:master":          {"quay.io", false, "quay.io/coreos/awscli", "quay.io/coreos/awscli", "coreos/awscli", []string{"master"}, "", "https://", true, true},
-		"registry.org/some/repo=latest,stable":  {"registry.org", false, "registry.org/some/repo", "registry.org/some/repo", "some/repo", []string{"latest", "stable"}, "", "https://", false, true},
+		"registry.org/some/repo=latest,stable":  {"registry.org", false, "registry.org/some/repo", "registry.org/some/repo", "some/repo", []string{"latest", "stable"}, "", "https://", true, true},
 		"registry.org/some/repo=lat!st,stable":  {"", true, "", "", "", []string{}, "", "", false, false},
 		"registry.org/some/repo~/^v1/":          {"registry.org", false, "registry.org/some/repo", "registry.org/some/repo", "some/repo", []string{}, "^v1", "https://", false, true},
 		"registry.org/some/repo~|^v1|":          {"", true, "", "", "", []string{}, "", "", false, false},

tag/remote/remote.go

@@ -66,7 +66,7 @@ func FetchTags(repo *repository.Repository, username, password string) (map[stri
 		return nil, err
 	}
 
-	allTagNames, allTagManifests, err := cli.TagData(repo.Path())
+	allTagNames, allTagManifests, err := cli.TagData(repo.Path(), repo.IsSingle(), repo.Tags())
 	if err != nil {
 		return nil, err
 	}