Function try_fetch_token

vmm/src/app/registry.rs:292–326

Try to fetch a Bearer token. Returns None if the registry doesn't need one.

(client: &Client, registry: &str, repo: &str)

/// Try to fetch a Bearer token. Returns None if the registry doesn't need one.
async fn try_fetch_token(client: &Client, registry: &str, repo: &str) -> Option<String> {
    // Probe the /v2/ endpoint to check if auth is needed
    let probe = client
        .get(format!("https://{registry}/v2/"))
        .send()
        .await
        .ok()?;

    if probe.status() != reqwest::StatusCode::UNAUTHORIZED {
        return None;
    }

    // Parse WWW-Authenticate header for realm and service
    let www_auth = probe
        .headers()
        .get("www-authenticate")
        .and_then(|v| v.to_str().ok())
        .unwrap_or("");

    let (realm, service) = parse_www_authenticate(www_auth);

    let token_url = if !realm.is_empty() {
        format!("{realm}?service={service}&scope=repository:{repo}:pull")
    } else {
        format!("https://{registry}/v2/token?service={registry}&scope=repository:{repo}:pull")
    };

    let resp = client.get(&token_url).send().await.ok()?;
    if !resp.status().is_success() {
        return None;
    }

    let token_data: TokenResponse = resp.json().await.ok()?;
    Some(token_data.token)
}

async fn fetch_token(client: &Client, registry: &str, repo: &str) -> Result<String> {
    try_fetch_token(client, registry, repo)