Add Docker Registry AIO with Nuxt Token Auth and admin UI.

Compose brings up registry:3 plus a Prisma/SQLite Nuxt app for docker login, ACL management, and image browsing with shadcn-vue.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/server/api/users/[id].delete.ts

@@ -0,0 +1,25 @@
+export default defineEventHandler(async (event) => {
+  const session = await requireAdmin(event)
+  await ensureBootstrap()
+
+  const id = getRouterParam(event, 'id')
+  if (!id) {
+    throw createError({ statusCode: 400, statusMessage: 'Missing id' })
+  }
+
+  if (session.id === id) {
+    throw createError({ statusCode: 400, statusMessage: 'Cannot delete yourself' })
+  }
+
+  const existing = await prisma.user.findUnique({ where: { id } })
+  if (!existing) {
+    throw createError({ statusCode: 404, statusMessage: 'User not found' })
+  }
+
+  if (existing.username === (process.env.ADMIN_USERNAME || 'admin')) {
+    throw createError({ statusCode: 400, statusMessage: 'Cannot delete bootstrap admin' })
+  }
+
+  await prisma.user.delete({ where: { id } })
+  return { ok: true }
+})

app/server/api/users/[id].get.ts

@@ -0,0 +1,29 @@
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+  await ensureBootstrap()
+
+  const id = getRouterParam(event, 'id')
+  if (!id) {
+    throw createError({ statusCode: 400, statusMessage: 'Missing id' })
+  }
+
+  const user = await prisma.user.findUnique({
+    where: { id },
+    include: { acls: true },
+  })
+  if (!user) {
+    throw createError({ statusCode: 404, statusMessage: 'User not found' })
+  }
+
+  return {
+    user: {
+      id: user.id,
+      username: user.username,
+      role: user.role,
+      active: user.active,
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt,
+      acls: user.acls,
+    },
+  }
+})

app/server/api/users/[id].put.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod'
+
+const aclSchema = z.object({
+  repository: z.string().min(1),
+  canPull: z.boolean().default(true),
+  canPush: z.boolean().default(false),
+  canDelete: z.boolean().default(false),
+})
+
+const bodySchema = z.object({
+  password: z.string().min(6).optional(),
+  role: z.enum(['ADMIN', 'USER']).optional(),
+  active: z.boolean().optional(),
+  acls: z.array(aclSchema).optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const session = await requireAdmin(event)
+  await ensureBootstrap()
+
+  const id = getRouterParam(event, 'id')
+  if (!id) {
+    throw createError({ statusCode: 400, statusMessage: 'Missing id' })
+  }
+
+  const existing = await prisma.user.findUnique({ where: { id } })
+  if (!existing) {
+    throw createError({ statusCode: 404, statusMessage: 'User not found' })
+  }
+
+  const body = bodySchema.parse(await readBody(event))
+
+  if (existing.username === (process.env.ADMIN_USERNAME || 'admin') && body.active === false) {
+    throw createError({ statusCode: 400, statusMessage: 'Cannot deactivate bootstrap admin' })
+  }
+
+  if (session.id === id && body.role && body.role !== 'ADMIN') {
+    throw createError({ statusCode: 400, statusMessage: 'Cannot demote yourself' })
+  }
+
+  const user = await prisma.$transaction(async (tx) => {
+    if (body.acls) {
+      await tx.acl.deleteMany({ where: { userId: id } })
+      await tx.acl.createMany({
+        data: body.acls.map((acl) => ({
+          userId: id,
+          repository: acl.repository,
+          canPull: acl.canPull,
+          canPush: acl.canPush,
+          canDelete: acl.canDelete,
+        })),
+      })
+    }
+
+    return tx.user.update({
+      where: { id },
+      data: {
+        ...(body.role ? { role: body.role } : {}),
+        ...(typeof body.active === 'boolean' ? { active: body.active } : {}),
+        ...(body.password ? { passwordHash: await hashPassword(body.password) } : {}),
+      },
+      include: { acls: true },
+    })
+  })
+
+  return {
+    user: {
+      id: user.id,
+      username: user.username,
+      role: user.role,
+      active: user.active,
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt,
+      acls: user.acls,
+    },
+  }
+})

app/server/api/users/index.get.ts

@@ -0,0 +1,21 @@
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+  await ensureBootstrap()
+
+  const users = await prisma.user.findMany({
+    orderBy: { username: 'asc' },
+    include: { acls: true },
+  })
+
+  return {
+    users: users.map((u) => ({
+      id: u.id,
+      username: u.username,
+      role: u.role,
+      active: u.active,
+      createdAt: u.createdAt,
+      updatedAt: u.updatedAt,
+      acls: u.acls,
+    })),
+  }
+})

app/server/api/users/index.post.ts

@@ -0,0 +1,61 @@
+import { z } from 'zod'
+
+const aclSchema = z.object({
+  repository: z.string().min(1),
+  canPull: z.boolean().default(true),
+  canPush: z.boolean().default(false),
+  canDelete: z.boolean().default(false),
+})
+
+const bodySchema = z.object({
+  username: z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-zA-Z0-9._-]+$/, 'Username may contain letters, numbers, . _ -'),
+  password: z.string().min(6),
+  role: z.enum(['ADMIN', 'USER']).default('USER'),
+  active: z.boolean().default(true),
+  acls: z.array(aclSchema).default([]),
+})
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+  await ensureBootstrap()
+
+  const body = bodySchema.parse(await readBody(event))
+  const existing = await prisma.user.findUnique({ where: { username: body.username } })
+  if (existing) {
+    throw createError({ statusCode: 409, statusMessage: 'Username already exists' })
+  }
+
+  const user = await prisma.user.create({
+    data: {
+      username: body.username,
+      passwordHash: await hashPassword(body.password),
+      role: body.role,
+      active: body.active,
+      acls: {
+        create: body.acls.map((acl) => ({
+          repository: acl.repository,
+          canPull: acl.canPull,
+          canPush: acl.canPush,
+          canDelete: acl.canDelete,
+        })),
+      },
+    },
+    include: { acls: true },
+  })
+
+  return {
+    user: {
+      id: user.id,
+      username: user.username,
+      role: user.role,
+      active: user.active,
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt,
+      acls: user.acls,
+    },
+  }
+})