Revisit Registry Authentication

[jay-dee7]

It's been a while since we revisited our authentication/authorisation flow (which we should do as soon as we can). This ticket is going to act like a spike/research placeholder. Let's prepare a diagram of the entire flow.

• What happens if you want to push an image?
• What happens if you want to pull an image?
• What if it's a HEAD, POST, PUT, PATCH, GET requests?

Also probably a good idea to close this issue out and migrate all the work over here?
#13

When doing some work, today I realised that we've been comparing the wrong values inside our BasicAuth middleware:

From main:
https://github.com/containerish/OpenRegistry/blob/main/auth/basic_auth.go#L50

This line tries to compare like

if ctx.Request().RequestURI != "/v2/" {
 ...
}

Request URI is always in the follow this pattern - <host>:<port>/<path>

What we need to do here is:

// ctx is echo.Context
if ctx.Request().URL.Path != "/v2/" {
  ...
}

Same is true for https://github.com/containerish/OpenRegistry/blob/main/auth/basic_auth.go#L56

While we're at it, probably do it the way official registry (https://github.com/distribution/distribution) does it?

Auth Interface - https://github.com/distribution/distribution/blob/main/registry/auth/auth.go