Add everyone system user for anonymous registry pull.

Reserved PUBLIC ACLs can grant unauthenticated pull while blocking login, deletion, and anonymous push/delete.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/server/utils/authz.ts

@@ -86,6 +86,29 @@ export function authorizeScopes(user: UserWithAcls, scopes: ParsedScope[]): Regi
   return access
 }
 
+/** Anonymous clients may only receive pull access explicitly granted to everyone. */
+export function authorizeAnonymousScopes(
+  everyone: UserWithAcls,
+  scopes: ParsedScope[],
+): RegistryAccess[] {
+  if (!everyone.active) return []
+
+  const access: RegistryAccess[] = []
+  for (const scope of scopes) {
+    if (scope.type !== 'repository' || !scope.actions.includes('pull')) continue
+
+    const allowed = allowedActionsForRepo(everyone, scope.name)
+    if (!allowed.includes('pull') && !allowed.includes('*')) continue
+
+    access.push({
+      type: 'repository',
+      name: scope.name,
+      actions: ['pull'],
+    })
+  }
+  return access
+}
+
 export function parseBasicAuth(header: string | undefined): { username: string; password: string } | null {
   if (!header?.startsWith('Basic ')) return null
   try {

app/server/utils/bootstrap.ts

@@ -1,6 +1,6 @@
 import { ensureTokenCerts } from './certs'
 import { prisma } from './prisma'
-import { seedAdmin } from '../../prisma/seed'
+import { seedAdmin, seedEveryone } from '../../prisma/seed'
 
 let ready: Promise<void> | null = null
 
@@ -8,6 +8,7 @@ async function bootstrap() {
   ensureTokenCerts()
   await prisma.$connect()
   await seedAdmin(prisma)
+  await seedEveryone(prisma)
 }
 
 export async function ensureBootstrap() {

app/server/utils/system-users.ts

@@ -0,0 +1,5 @@
+export const EVERYONE_USERNAME = 'everyone'
+
+export function isEveryoneUsername(username: string): boolean {
+  return username.toLowerCase() === EVERYONE_USERNAME
+}