feat: make metadata/manifest API endpoint publicly accessible without auth #676

New Issue

2026-06-21T14:55:17Z

jmiller commented

2026-06-21 14:55:17 +00:00

Summary

The /repos/{owner}/{repo}/metadata (and /manifest) GET endpoint currently requires reqRepoReader authentication. It should be accessible anonymously for public repos, similar to how badges work.

Motivation

CI workflows need to read platform type without a token (for platform-conditional logic in pre-release.yml)
Package registries need to discover version info
Public tooling (MCP servers, CLI) should read metadata without auth
Metadata doesn't contain sensitive info — just version, platform, element name, etc.

Current Behavior

m.Combo("/metadata", reqRepoReader(unit.TypeCode)).
    Get(repo.GetRepoMetadata).
    Put(reqToken(), reqAdmin(), repo.UpdateRepoMetadata)

Anonymous GET to /api/v1/repos/{owner}/{repo}/metadata returns 403 even for public repos.

Desired Behavior

GET /metadata and /manifest: No auth required for public repos (anonymous access)
PUT /metadata and /manifest: Still requires token + admin (unchanged)

Implementation

In routers/api/v1/api.go ~line 1483, change from Combo to separate routes:

m.Get("/metadata", repo.GetRepoMetadata)
m.Put("/metadata", reqToken(), reqAdmin(), repo.UpdateRepoMetadata)
m.Get("/manifest", repo.GetRepoMetadata) // backward compat
m.Put("/manifest", reqToken(), reqAdmin(), repo.UpdateRepoMetadata)

This removes reqRepoReader from the GET path. The repo context resolution middleware still handles private vs public repo visibility at a higher level.

## Summary The `/repos/{owner}/{repo}/metadata` (and `/manifest`) GET endpoint currently requires `reqRepoReader` authentication. It should be accessible anonymously for public repos, similar to how badges work. ## Motivation - CI workflows need to read platform type without a token (for platform-conditional logic in pre-release.yml) - Package registries need to discover version info - Public tooling (MCP servers, CLI) should read metadata without auth - Metadata doesn't contain sensitive info — just version, platform, element name, etc. ## Current Behavior ```go m.Combo("/metadata", reqRepoReader(unit.TypeCode)). Get(repo.GetRepoMetadata). Put(reqToken(), reqAdmin(), repo.UpdateRepoMetadata) ``` Anonymous GET to `/api/v1/repos/{owner}/{repo}/metadata` returns 403 even for public repos. ## Desired Behavior - **GET** `/metadata` and `/manifest`: No auth required for public repos (anonymous access) - **PUT** `/metadata` and `/manifest`: Still requires token + admin (unchanged) ## Implementation In `routers/api/v1/api.go` ~line 1483, change from `Combo` to separate routes: ```go m.Get("/metadata", repo.GetRepoMetadata) m.Put("/metadata", reqToken(), reqAdmin(), repo.UpdateRepoMetadata) m.Get("/manifest", repo.GetRepoMetadata) // backward compat m.Put("/manifest", reqToken(), reqAdmin(), repo.UpdateRepoMetadata) ``` This removes `reqRepoReader` from the GET path. The repo context resolution middleware still handles private vs public repo visibility at a higher level.

jmiller referenced this issue from a commit

2026-06-21 15:03:49 +00:00

feat: make metadata/manifest GET endpoint publicly accessible (#676)

jmiller referenced this issue

2026-06-21 15:07:58 +00:00

feat: make metadata/manifest GET endpoint publicly accessible (#676) #677

jmiller referenced this issue from a commit

2026-06-21 15:11:36 +00:00

feat: make metadata/manifest GET endpoint publicly accessible (#676)

jmiller referenced a pull request that will close this issue

2026-06-21 15:11:49 +00:00

feat: make metadata/manifest GET endpoint publicly accessible (#676) #678