Add everyone system user for anonymous registry pull.

Reserved PUBLIC ACLs can grant unauthenticated pull while blocking login, deletion, and anonymous push/delete.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/server/api/auth/login.post.ts

@@ -9,6 +9,10 @@ export default defineEventHandler(async (event) => {
   await ensureBootstrap()
   const body = bodySchema.parse(await readBody(event))
 
+  if (isEveryoneUsername(body.username)) {
+    throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' })
+  }
+
   const user = await prisma.user.findUnique({ where: { username: body.username } })
   if (!user || !user.active) {
     throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' })

app/server/api/users/[id].delete.ts

@@ -20,6 +20,10 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 400, statusMessage: 'Cannot delete bootstrap admin' })
   }
 
+  if (isEveryoneUsername(existing.username)) {
+    throw createError({ statusCode: 400, statusMessage: 'Cannot delete system user "everyone"' })
+  }
+
   await prisma.user.delete({ where: { id } })
   return { ok: true }
 })

app/server/api/users/[id].put.ts

@@ -29,6 +29,14 @@ export default defineEventHandler(async (event) => {
   }
 
   const body = bodySchema.parse(await readBody(event))
+  const isEveryone = isEveryoneUsername(existing.username)
+
+  if (isEveryone && (body.password || body.role)) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Cannot change password or role for system user "everyone"',
+    })
+  }
 
   if (existing.username === (process.env.ADMIN_USERNAME || 'admin') && body.active === false) {
     throw createError({ statusCode: 400, statusMessage: 'Cannot deactivate bootstrap admin' })
@@ -42,13 +50,15 @@ export default defineEventHandler(async (event) => {
     if (body.acls) {
       await tx.acl.deleteMany({ where: { userId: id } })
       await tx.acl.createMany({
-        data: body.acls.map((acl) => ({
-          userId: id,
-          repository: acl.repository,
-          canPull: acl.canPull,
-          canPush: acl.canPush,
-          canDelete: acl.canDelete,
-        })),
+        data: body.acls
+          .filter((acl) => !isEveryone || acl.canPull)
+          .map((acl) => ({
+            userId: id,
+            repository: acl.repository,
+            canPull: isEveryone ? true : acl.canPull,
+            canPush: isEveryone ? false : acl.canPush,
+            canDelete: isEveryone ? false : acl.canDelete,
+          })),
       })
     }
 

app/server/api/users/index.post.ts

@@ -24,6 +24,10 @@ export default defineEventHandler(async (event) => {
   await ensureBootstrap()
 
   const body = bodySchema.parse(await readBody(event))
+  if (isEveryoneUsername(body.username)) {
+    throw createError({ statusCode: 409, statusMessage: 'Username "everyone" is reserved' })
+  }
+
   const existing = await prisma.user.findUnique({ where: { username: body.username } })
   if (existing) {
     throw createError({ statusCode: 409, statusMessage: 'Username already exists' })