api/types/registry: move decode auth config function internal to daemon by austinvazquez · Pull Request #50765 · moby/moby

austinvazquez · 2025-08-19T01:23:12Z

- What I did
Partial for #50740

This change deprecates and moves the DecodeAuthConfig function internal to the daemon as well as removes the function from the api module.

- How I did it

- How to verify it

- Human readable description for the release notes

api/types/registry: daemon: move `DecodeAuthConfig` functionality internal to daemon

- A picture of a cute animal (not mandatory but encouraged)

…ternal to daemon Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>

Copilot

Pull Request Overview

This PR deprecates and moves the DecodeAuthConfig function from the public API module to internal daemon code. The change improves API encapsulation by making authentication decoding an internal implementation detail rather than exposing it in the public API.

Moved DecodeAuthConfig functionality from api/types/registry to daemon/internal/registry
Updated all daemon router files to use the new internal registry package
Added alias imports to maintain clear separation between public API types and internal functionality

Reviewed Changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
daemon/server/router/plugin/plugin_routes.go	Updated imports and function calls to use internal registry package
daemon/server/router/image/image_routes.go	Updated imports and function calls to use internal registry package
daemon/server/router/distribution/distribution_routes.go	Updated imports and function calls to use internal registry package
daemon/internal/registry/authconfig_test.go	Moved test file from API package to internal daemon package
daemon/internal/registry/authconfig.go	Moved DecodeAuthConfig implementation to internal daemon package
api/types/registry/authconfig_test.go	Removed DecodeAuthConfig tests from public API package
api/types/registry/authconfig.go	Removed DecodeAuthConfig function and related code from public API

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-08-19T03:08:33Z

daemon/internal/registry/authconfig_test.go

+	"strings"
+	"testing"
+
+	cerrdefs "github.com/containerd/errdefs"


[nitpick] The import alias 'cerrdefs' is not descriptive. Consider using a more explicit alias like 'containerdErrdefs' or removing the alias and using the full package name.

Suggested change

cerrdefs "github.com/containerd/errdefs"

"github.com/containerd/errdefs"

Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>

thaJeztah · 2025-08-19T07:30:02Z

daemon/server/router/distribution/distribution_routes.go

+	registrytypes "github.com/moby/moby/api/types/registry"
 	distributionpkg "github.com/moby/moby/v2/daemon/internal/distribution"
+	"github.com/moby/moby/v2/daemon/internal/registry"


It we name the package github.com/moby/moby/v2/daemon/internal/authconfig, then it looks like we can make the change much less disruptive, as we wouldn't need to add all the aliases for the imports.

We could even name DecodeAuthConfig to Decode, but I haven't looked yet what that looks like.

Let me push a commit to this branch to see what it all would look like

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah · 2025-08-19T07:38:24Z

api/types/registry/authconfig.go

-// DecodeAuthConfigBody decodes authentication information as sent as JSON in the
-// body of a request. This function is to provide backward compatibility with old
-// clients and API versions. Current clients and API versions expect authentication
-// to be provided through the X-Registry-Auth header.
-//
-// Like [DecodeAuthConfig], this function always returns an [AuthConfig], even if an
-// error occurs. It is up to the caller to decide if authentication is required,
-// and if the error can be ignored.
-//
-// Deprecated: this function is no longer used and will be removed in the next release.
-func DecodeAuthConfigBody(rdr io.ReadCloser) (*AuthConfig, error) {
-	return decodeAuthConfigFromReader(rdr)
-}
-
-func decodeAuthConfigFromReader(rdr io.Reader) (*AuthConfig, error) {


I stumbled on some code that probably should've been using this; ironically it's the code handling the docker login endpoint, so perhaps we should keep the deprecated one, and replace that code;

moby/daemon/server/router/system/system_routes.go

Lines 375 to 381 in b8897d9

func (s *systemRouter) postAuth(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {

var config *registry.AuthConfig

err := json.NewDecoder(r.Body).Decode(&config)

r.Body.Close()

if err != nil {

return err

}

Oh! Actually; there's another one here;

moby/daemon/cluster/services.go

Lines 232 to 240 in 812aa46

// retrieve auth config from encoded auth

authConfig := &registry.AuthConfig{}

if encodedAuth != "" {

authReader := strings.NewReader(encodedAuth)

dec := json.NewDecoder(base64.NewDecoder(base64.URLEncoding, authReader))

if err := dec.Decode(authConfig); err != nil {

log.G(ctx).Warnf("invalid authconfig: %v", err)

}

}

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah · 2025-08-19T07:58:19Z

api/types/registry/authconfig.go

+// Deprecated: this function is deprecated and will be removed in the next release.
+//


We should probably squash the first 2 commits (or first 3 with the commit I pushed), and make this a separate patch for the 28.x branch.

thaJeztah · 2025-08-19T08:00:35Z

daemon/internal/authconfig/authconfig.go

+// be ignored.
+//
+// [RFC4648, section 5]: https://tools.ietf.org/html/rfc4648#section-5
+func DecodeAuthConfig(authEncoded string) (*registry.AuthConfig, error) {


I didn't rename this one yet; was on the fence if it perhaps should be called DecodeHeader or DecodeAuthHeader (or something) to indicate it's specifically for the format used in the X-Registry-Auth header.

thaJeztah · 2025-08-19T10:34:43Z

Let me also link to my comment on the related ticket to see if this is indeed the correct direction, or if we should keep encoding/decoding together; #50740 (comment)

austinvazquez · 2025-08-26T15:45:49Z

Closing in favor of #50785

api/types/registry: deprecate decode auth config function and move in…

044382c

…ternal to daemon Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>

austinvazquez added area/api API impact/api area/daemon Core Engine labels Aug 19, 2025

austinvazquez force-pushed the move-decode-auth-config-to-daemon branch from bb0b412 to 3daf914 Compare August 19, 2025 03:05

austinvazquez added the kind/refactor PR's that refactor, or clean-up code label Aug 19, 2025

austinvazquez requested review from Copilot, corhere, dmcgowan and thaJeztah August 19, 2025 03:07

austinvazquez marked this pull request as ready for review August 19, 2025 03:08

Copilot AI reviewed Aug 19, 2025

View reviewed changes

api/types/registry: remove deprecated decode auth config functions

a82bf2f

Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>

austinvazquez force-pushed the move-decode-auth-config-to-daemon branch from 3daf914 to a82bf2f Compare August 19, 2025 03:09

thaJeztah reviewed Aug 19, 2025

View reviewed changes

to be squashed; rename to daemon/internal/authconfig

9f9e7b2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah reviewed Aug 19, 2025

View reviewed changes

daemon/cluster: use authconfig package for decoding

7945aed

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah reviewed Aug 19, 2025

View reviewed changes

This was referenced Aug 19, 2025

cli/command: TestRetrieveAuthTokenFromImage: don't decode authconfig docker/cli#6300

Merged

[28.x backport] cli/command: TestRetrieveAuthTokenFromImage: don't decode authconfig docker/cli#6310

Merged

austinvazquez mentioned this pull request Aug 22, 2025

api/types/registry: move auth config functions to pkg #50785

Merged

austinvazquez closed this Aug 26, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

api/types/registry: move decode auth config function internal to daemon#50765

api/types/registry: move decode auth config function internal to daemon#50765
austinvazquez wants to merge 4 commits intomoby:masterfrom
austinvazquez:move-decode-auth-config-to-daemon

austinvazquez commented Aug 19, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 19, 2025

Uh oh!

thaJeztah Aug 19, 2025

Uh oh!

thaJeztah Aug 19, 2025

Uh oh!

thaJeztah Aug 19, 2025

Uh oh!

thaJeztah Aug 19, 2025

Uh oh!

thaJeztah Aug 19, 2025

Uh oh!

thaJeztah commented Aug 19, 2025

Uh oh!

austinvazquez commented Aug 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	cerrdefs "github.com/containerd/errdefs"
	"github.com/containerd/errdefs"

	func (s systemRouter) postAuth(ctx context.Context, w http.ResponseWriter, r http.Request, vars map[string]string) error {
	var config *registry.AuthConfig
	err := json.NewDecoder(r.Body).Decode(&config)
	r.Body.Close()
	if err != nil {
	return err
	}

	// retrieve auth config from encoded auth
	authConfig := &registry.AuthConfig{}
	if encodedAuth != "" {
	authReader := strings.NewReader(encodedAuth)
	dec := json.NewDecoder(base64.NewDecoder(base64.URLEncoding, authReader))
	if err := dec.Decode(authConfig); err != nil {
	log.G(ctx).Warnf("invalid authconfig: %v", err)
	}
	}

		// Deprecated: this function is deprecated and will be removed in the next release.
		//

Conversation

austinvazquez commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Aug 19, 2025

Uh oh!

austinvazquez commented Aug 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

austinvazquez commented Aug 19, 2025 •

edited

Loading