coulomb/canned-prompts
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CANP-WP-0006 T04: publish API

Browse source 
POST /packages takes {registry, source, files}, where files is the same shape
GET /archives returns — so an archive round-trips into a publish without
translation and a mirror is a GET followed by a POST. A test verifies the
round-trip by digest rather than asserting it.

Validation is the reference implementation's, applied to the posted files
materialized in a temporary directory. Only reserved paths and
manifest-referenced files are stored (section 2), path traversal is refused,
identical re-publishes are accepted, and different content under the same
id@version is 409 (section 17).

The identity mechanism, stated plainly rather than implied: a single shared
bearer token proving the caller is the operator of this service. It is not
per-publisher identity — every token holder is indistinguishable — and auth.py
says so where someone might otherwise assume more.

With no token configured the service is read-only. That is the correct default
rather than an inconvenience: section 20.1 asks a registry to refuse
publication into a closed namespace it does not consider the publisher to own,
and an unauthenticated service considers nobody to own anything.

Namespace claims live in namespace_claims (migration 0002) and are enforced
here, which a filesystem registry cannot do at all — but only as precisely as
the identity allows. A closed namespace is protected from anonymous callers; it
cannot be attributed among several publishers. Per-publisher identity is
deferred and is the main thing between this and a registry several people can
publish to.

Migration hygiene found while adding 0002: autogenerate proposed an ALTER
COLUMN TYPE on package_files.package_version_id, because the foreign key's type
was left to inference and compared as a variant against a reflected plain type.
SQLite cannot alter a column type, so 0002 failed halfway — table created,
revision unstamped, the partially-applied state that is worst to debug later.
Fixed at the cause: the column is typed explicitly, and 0001 was corrected
rather than patched over, which is legitimate only because it has never run
outside this repo's tests. alembic check now reports no drift.

Health tests now compute the expected migration head from the script directory
instead of hardcoding it, so adding a migration cannot fail them spuriously.

Service tests 22 -> 33; reference unaffected at 99.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
This commit is contained in:
tegwick 2026-09-06 20:30:00 +02:00
parent 133e796eff
commit a7e12d5e04
13 changed files with 468 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

34
workplans/CANP-WP-0006-hosted-registry-service.md
View file

@ -155,7 +155,7 @@ models and the same migration.
```task
id: CANP-WP-0006-T04
status: todo
status: done
priority: high
state_hub_task_id: "929932b6-931b-5409-a648-b6814f07f0b4"
```
@ -170,6 +170,38 @@ filesystem registry a service *can* authenticate a publisher. Note what identity
mechanism it uses; if there is none yet, say so and refuse writes rather than
accepting anonymous publishes into a closed namespace.
**Done.** `POST /packages` takes the same `files` shape `GET /archives`
returns, so an archive round-trips into a publish without translation and a
mirror is a GET followed by a POST — verified by a test, not just asserted.
**The identity mechanism, stated plainly.** A single shared bearer token
proving the caller is *the operator of this service*. Not per-publisher
identity: every token holder is indistinguishable. With no token configured the
service is read-only, which is the right default rather than an inconvenience —
§ 20.1 asks a registry to refuse publication into a closed namespace it does not
consider the publisher to own, and an unauthenticated service considers nobody
to own anything.
Namespace claims live in `namespace_claims` (migration `0002`) and are enforced,
which a filesystem registry cannot do at all — but only as precisely as the
identity allows. A closed namespace is protected from anonymous callers; it
cannot be attributed among several publishers. Until per-publisher identity
exists, a claim's `owner` is documentation rather than an access decision, and
`auth.py` says so rather than letting the code imply more than it delivers.
**Handed forward:** per-publisher identity is the main thing between this and a
registry several people can publish to.
**Migration hygiene found while adding `0002`.** Autogenerate proposed an
`ALTER COLUMN TYPE` on `package_files.package_version_id`, because the foreign
key's type was left to inference and compared as a variant against a reflected
plain type. SQLite cannot alter a column type, so `0002` failed halfway,
leaving the table created and the revision unstamped — the partially-applied
state that is worst to debug later. Fixed at the cause: the column is typed
explicitly, and `0001` was corrected rather than patched over, which is
legitimate only because it has never run outside this repo's tests. `alembic
check` now reports no drift.
## HTTP registry in the reference CLI
```task