Merge branch 'docker-registry' into 'master'

Added authentication service for docker registry

This adds a simple authentication service for docker which uses current user credentials to authenticate pulls and pushes.

I have only one concern. Since the `.docker/config` is unencrypted, thus the password for user stored there is unencrypted, maybe we should from the start implement function to generate/provide a separate password just for the purposes of accessing docker registry?

What do you think @jacobvosmaer @sytses @marin?

cc @marin 

See merge request !3787

2 files changed, 61 insertions, 0 deletions

diff --git a/spec/lib/json_web_token/rsa_token_spec.rb b/spec/lib/json_web_token/rsa_token_spec.rb
new file mode 100644
index 00000000000..0c3d3ea7019
--- /dev/null
+++ b/spec/lib/json_web_token/rsa_token_spec.rb
@@ -0,0 +1,43 @@
+describe JSONWebToken::RSAToken do
+  let(:rsa_key) do
+    OpenSSL::PKey::RSA.new <<-eos.strip_heredoc
+      -----BEGIN RSA PRIVATE KEY-----
+      MIIBOgIBAAJBAMA5sXIBE0HwgIB40iNidN4PGWzOyLQK0bsdOBNgpEXkDlZBvnak
+      OUgAPF+rME4PB0Yl415DabUI40T5UNmlwxcCAwEAAQJAZtY2pSwIFm3JAXIh0cZZ
+      iXcAfiJ+YzuqinUOS+eW2sBCAEzjcARlU/o6sFQgtsOi4FOMczAd1Yx8UDMXMmrw
+      2QIhAPBgVhJiTF09pdmeFWutCvTJDlFFAQNbrbo2X2x/9WF9AiEAzLgqMKeStSRu
+      H9N16TuDrUoO8R+DPqriCwkKrSHaWyMCIFzMhE4inuKcSywBaLmiG4m3GQzs++Al
+      A6PRG/PSTpQtAiBxtBg6zdf+JC3GH3zt/dA0/10tL4OF2wORfYQghRzyYQIhAL2l
+      0ZQW+yLIZAGrdBFWYEAa52GZosncmzBNlsoTgwE4
+      -----END RSA PRIVATE KEY-----
+    eos
+  end
+  let(:rsa_token) { described_class.new(nil) }
+  let(:rsa_encoded) { rsa_token.encoded }
+
+  before { allow_any_instance_of(described_class).to receive(:key).and_return(rsa_key) }
+
+  context 'token' do
+    context 'for valid key to be validated' do
+      before { rsa_token['key'] = 'value' }
+
+      subject { JWT.decode(rsa_encoded, rsa_key) }
+
+      it { expect{subject}.to_not raise_error }
+      it { expect(subject.first).to include('key' => 'value') }
+      it do
+        expect(subject.second).to eq(
+          "typ" => "JWT",
+          "alg" => "RS256",
+          "kid" => "OGXY:4TR7:FAVO:WEM2:XXEW:E4FP:TKL7:7ACK:TZAF:D54P:SUIA:P3B2")
+      end
+    end
+
+    context 'for invalid key to raise an exception' do
+      let(:new_key) { OpenSSL::PKey::RSA.generate(512) }
+      subject { JWT.decode(rsa_encoded, new_key) }
+
+      it { expect{subject}.to raise_error(JWT::DecodeError) }
+    end
+  end
+end
diff --git a/spec/lib/json_web_token/token_spec.rb b/spec/lib/json_web_token/token_spec.rb
new file mode 100644
index 00000000000..3d955e4d774
--- /dev/null
+++ b/spec/lib/json_web_token/token_spec.rb
@@ -0,0 +1,18 @@
+describe JSONWebToken::Token do
+  let(:token) { described_class.new }
+
+  context 'custom parameters' do
+    let(:value) { 'value' }
+    before { token[:key] = value }
+
+    it { expect(token[:key]).to eq(value) }
+    it { expect(token.payload).to include(key: value) }
+  end
+
+  context 'embeds default payload' do
+    subject { token.payload }
+    let(:default) { token.send(:default_payload) }
+
+    it { is_expected.to include(default) }
+  end
+end