egress: preserve_auth flag for per-route Authorization passthrough #453

Merged

didericis merged 1 commits from egress-preserve-auth-for-registry-routes into main

2026-07-21 15:02:02 -04:00

Author	SHA1	Message	Date
didericis-claude	b1ef83ac84	feat(egress): add preserve_auth flag to pass agent Authorization through tracker-policy-pr / check-pr (pull_request) Successful in 6s Details test / integration-docker (pull_request) Successful in 13s Details test / unit (pull_request) Successful in 35s Details lint / lint (push) Successful in 2m28s Details test / integration-firecracker (pull_request) Successful in 3m34s Details test / coverage (pull_request) Successful in 16s Details test / publish-infra (pull_request) Has been skipped Details Adds a per-route boolean field preserve_auth (default false) that skips the gateway's Authorization header stripping for that host. Intended for registry endpoints like Docker Hub (registry-1.docker.io) and GHCR (ghcr.io) where the agent must supply its own per-scope bearer token. Threaded through ManifestEgressRoute → EgressRoute → Route, serialized in route_to_yaml_dict, and parsed in parse_routes. The strip at egress_addon.py now checks route.preserve_auth before popping the header. Closes #392	2026-07-21 18:09:50 +00:00