fix: allow unauthenticated access to package search for juliahub.com pkgserver - #52
Open
thelonewolf1603 wants to merge 2 commits into
Open
fix: allow unauthenticated access to package search for juliahub.com pkgserver#52thelonewolf1603 wants to merge 2 commits into
juliahub.com pkgserver#52thelonewolf1603 wants to merge 2 commits into
Conversation
`jh package search --verbose` printed a `Status: Active/Inactive` line derived from the registry map and a `Score:` line carrying the GraphQL ranking score. Both are internal details with no meaning to users, so remove them from the `packageInfo` display struct, the verbose printer, and the `gqlToInfo` mapping. The wire-level `Package.Score` and `PackageRegistryMap.Status` fields stay, since they still mirror the GraphQL response shape. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Searching without a stored token failed with "authentication required". On juliahub.com the package data is public, so an anonymous search now works there. Every other server (juliahub.dev, private deployments) still requires authentication. The authenticated endpoints are unusable logged out, so the anonymous path is GraphQL-only: - optionalToken(server) returns the stored token when there is one, and (nil, nil) for juliahub.com when there is not, so callers can fall back to public endpoints. Any other server gets an error, as before. - executeGraphQL omits the Authorization header and sends X-Hasura-Role: anonymous when the token is nil. - searchPackages skips the REST attempt when unauthenticated, since /packages/info is always authenticated and would only 401 before falling back to GraphQL anyway. - fetchPackageRegistries resolves registry IDs from the public /app/packages/registries endpoint (the one the logged-out web UI uses). This is required, not an optimisation: the anonymous Hasura role returns no rows unless the registries variable is non-empty. - apiGet skips the Authorization header when given an empty token. Row-level permissions scope anonymous results to public registries, so --registries naming a private registry returns "No packages found" rather than an error. Authenticated behaviour is unchanged: REST first, GraphQL fallback. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vdayanand
reviewed
Aug 13, 2026
| // /packages/info always requires authentication, so anonymous searches go | ||
| // straight to GraphQL, which serves public registries under the anonymous role. | ||
| if token == nil { | ||
| return searchPackagesGraphQL(params) |
Member
There was a problem hiding this comment.
Shouldnt we access REST endpoints instead of Graphql?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
jh package searchnow works logged out — on juliahub.com only.Package data there is public, so an unauthenticated search returns results instead of failing
with
authentication required. Every other server (*.juliahub.dev, privatedeployments) still requires auth.
Since the authenticated endpoints 401 when logged out, the anonymous path is
GraphQL-only:
optionalTokenreturns(nil, nil)for juliahub.com when there'sno token,
executeGraphQLthen sendsX-Hasura-Role: anonymouswith noAuthorizationheader, the REST attempt is skipped, and registry IDs come fromthe public
/app/packages/registries(required — the anonymous role returnsnothing without a non-empty
registriesvariable). Row-level permissions scoperesults to public registries. Authenticated behavior is unchanged.
Also dropped
StatusandScorefrom--verboseoutput — internal registrystate and ranking details with no meaning to users.