<commit_before>
host = ENV["REDIS_HOST"] || "172.17.42.1"
port = (ENV["REDIS_PORT"] || 6379).to_i
namespace = ENV["REDIS_NAMESPACE"] || "docker-registry"
passwords_key = "#{namespace}:passwords"

salt = ENV["DIGEST_SALT"] || "deadbeaf:"

redis = Redis.new(host, port)

req = Nginx::Request.new

auth = req.headers_in["Authorization"]
if auth && /\ABasic\s+([a-zA-Z0-9\+\/]+=*)/ =~ auth
  base64 = Regexp.last_match[1]
  user, raw_pass = base64.unpack("m").first.split(":", 2)
  digest = redis.hget(passwords_key, user)
  if raw_pass
    sha1 = Digest::SHA1.hexdigest(salt+raw_pass)
  end

  if digest and digest == sha1
    #Nginx.return Nginx::HTTP_OK
  else
    req.headers_out["WWW-Authenticate"] = "Basic realm=\"nginx-docker-registry\""
    Nginx.rputs "Authorization required"
    Nginx.return Nginx::HTTP_UNAUTHORIZED
  end
else
  req.headers_out["WWW-Authenticate"] = "Basic realm=\"nginx-docker-registry\""
  Nginx.rputs "Please enter user&password"
  Nginx.return Nginx::HTTP_UNAUTHORIZED
end
<commit_msg>add access control for /v1/repositories resource.<commit_after>
host = ENV["REDIS_HOST"] || "172.17.42.1"
port = (ENV["REDIS_PORT"] || 6379).to_i
namespace = ENV["REDIS_NAMESPACE"] || "docker-registry"
passwords_key = "#{namespace}:passwords"

salt = ENV["DIGEST_SALT"] || "deadbeaf:"

redis = Redis.new(host, port)

req = Nginx::Request.new

auth = req.headers_in["Authorization"]
if auth && /\ABasic\s+([a-zA-Z0-9\+\/]+=*)/ =~ auth
  base64 = Regexp.last_match[1]
  user, raw_pass = base64.unpack("m").first.split(":", 2)
  digest = redis.hget(passwords_key, user)
  if raw_pass
    sha1 = Digest::SHA1.hexdigest(salt+raw_pass)
  end

  if digest and digest == sha1
    # check repositories namespace
    if /\A\/v1\/repositories\/([^\/]+)/ =~ req.uri
      unless Regexp.last_match[1] == user
        Nginx.errlogger Nginx::LOG_INFO, "repositories namespace permission denied: user: #{user}"
        Nginx.rputs "Permission Denied"
        Nginx.return Nginx::HTTP_UNAUTHORIZED
      end
    end
    #Nginx.return Nginx::HTTP_OK
  else
    req.headers_out["WWW-Authenticate"] = "Basic realm=\"nginx-docker-registry\""
    Nginx.rputs "Authorization required"
    Nginx.return Nginx::HTTP_UNAUTHORIZED
  end
else
  req.headers_out["WWW-Authenticate"] = "Basic realm=\"nginx-docker-registry\""
  Nginx.rputs "Please enter user&password"
  Nginx.return Nginx::HTTP_UNAUTHORIZED
end

{'fraction_non_alphanumeric': 0.16270337922403003, 'fraction_numerical': 0.020442219440967878, 'mean_word_length': 4.28193832599119, 'pattern_counts': {'":': 2, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1541186', 'n_tokens_mistral': 976, 'n_tokens_neox': 916, 'n_words': 165}