Using Alexandrie as private about alexandrie HOT 3 OPEN

@Hirevo I'm willing to contribute code to make this use case possible. Specifically, I'm thinking about two separate features each represented by a default-disabled configuration option:

• Disable registration
• Require user to be logged in to access all API endpoints. One thing I'm not sure of here is whether cargo sends a token with search and download requests, as these aren't listed as authenticated in the alternative registries spec.

from alexandrie.

Hello !

Sorry for my long absence about this.
I agree that this is a feature that is indeed desirable to have.
@techninja1008, Thanks for showing interest in helping with this.

In the current state of affairs, it is possible to have the index be private by passing an SSH link to it in Cargo's config.
This makes it impossible for Cargo to fetch the index without the required SSH keys being present on the machine when doing cargo build.
But it is true that the frontend and the API makes searching crates public.
To answer @techninja1008's question, Cargo doesn't send any credentials when doing cargo search and cargo download, which kinda forced these endpoints to be public as well in Alexandrie.

Within the implementation of cargo search from rust-lang/cargo:
https://github.com/rust-lang/cargo/blob/ccf781ab902d53ab80d76aa0e34f91df0d49e4b3/crates/crates-io/lib.rs#L338-L348

I think we can indeed at least do:

• disabling registrations
• require being logged in for all frontend endpoints and most of the API (except for Cargo-related search and download endpoints)

The rest of Cargo-related endpoints (like those related to owners and publication) are already authenticated.

That said, I don't know if the Cargo team is planning anything regarding this.

from alexandrie.

Also, we can maybe do it as an option within the config, rather than it being a cargo feature-flag, because it doesn't make us save on dependencies when not used, and having to recompile just to change an option could be annoying.

from alexandrie.