Bugfix: do not serve freeze/mirror images via the Wave proxy token path (#1087)

* fix: do not serve freeze/mirror images via the Wave proxy token path

Freeze and mirror requests publish the image to the caller's target registry
and return a direct registry reference; they are meant to be pulled directly
from that registry. However the ephemeral /v2/wt/<token>/ proxy route still
resolved and served them for the token TTL. Reject durable (freeze/mirror)
requests on the proxy token path so the image can only be pulled directly
from the target registry. Status/detail lookups by request id are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Make freeze/mirror rejection message actionable; tighten test

Point the caller to the direct image reference in the NotFoundException
message, and assert the message carries that reference in the test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Return direct image for durable requests on the V1 endpoint (#1090)

makeResponseV2 already returns the direct target-registry image for
freeze/mirror (durable) requests, but makeResponseV1 kept handing back
the Wave proxy token url. Since durable images are no longer served via
the proxy token path (see RouteHandler), V1 freeze clients pulling via
targetImage would 404. Resolve targetImage to the direct image for
durable requests on V1 too, matching V2.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

Author: 3 people

src/main/groovy/io/seqera/wave/core/RouteHandler.groovy

@@ -62,6 +62,12 @@ class RouteHandler {
             if( !request ) {
                 throw new NotFoundException("Unknown Wave container for token '$token'")
             }
+            // freeze and mirror requests publish the image to the target registry and are
+            // meant to be pulled directly from there - they must not be served via the Wave
+            // proxy token path (see also ContainerRequest.durable)
+            if( request.durable() ) {
+                throw new NotFoundException("Container '$token' is a freeze/mirror image and must be pulled directly from '${request.containerImage}'")
+            }
             // the image name (without tag) must match
             final coords = request.coordinates()
             if( image != coords.image )

src/main/groovy/io/seqera/wave/util/ContainerHelper.groovy

@@ -116,7 +116,9 @@ class ContainerHelper {
     }
 
     static SubmitContainerTokenResponse makeResponseV1(ContainerRequest data, TokenData token, String waveImage) {
-        final target = waveImage
+        // freeze/mirror images are published to the target registry and must be pulled
+        // directly from there - the Wave proxy token path does not serve them (see RouteHandler)
+        final target = data.durable() ? data.containerImage : waveImage
         final build = data.buildNew ? data.buildId : null
         return new SubmitContainerTokenResponse(data.requestId, token.value, target, token.expiration, data.containerImage, build, null, null, null, null, null)
     }

src/test/groovy/io/seqera/wave/core/RouteHandlerTest.groovy

@@ -133,4 +133,24 @@ class RouteHandlerTest extends Specification {
 
     }
 
+    @Unroll
+    def 'should reject proxy pull for durable freeze/mirror requests' () {
+        given:
+        def tokenService = Mock(ContainerRequestService)
+
+        when:
+        new RouteHandler(tokenService).parse(REQ_PATH)
+        then:
+        1 * tokenService.getRequest(TOKEN) >> REQUEST
+        and:
+        def e = thrown(NotFoundException)
+        // the error must point the caller to the direct image reference
+        e.message.contains(IMAGE)
+
+        where:
+        REQ_PATH                                      | TOKEN | IMAGE                       | REQUEST
+        '/v2/wt/a1/library/ubuntu/manifests/latest'   | 'a1'  | 'quay.io/org/ubuntu:1.0'    | ContainerRequest.of(containerImage: 'quay.io/org/ubuntu:1.0', freeze: true)
+        '/v2/wt/b2/library/ubuntu/blobs/latest'       | 'b2'  | 'quay.io/org/ubuntu:1.0'    | ContainerRequest.of(containerImage: 'quay.io/org/ubuntu:1.0', type: ContainerRequest.Type.Mirror)
+    }
+
 }

src/test/groovy/io/seqera/wave/util/ContainerHelperTest.groovy

@@ -253,12 +253,36 @@ class ContainerHelperTest extends Specification {
         result.cached == null
         result.freeze == null
 
-        where: 
+        where:
         NEW_BUILD   | EXPECTED_BUILD_ID
         false       | null
         true        | '123'
     }
 
+    @Unroll
+    def 'should create response v1 for durable request returning the direct image' () {
+        given:
+        def data = ContainerRequest.of(
+                containerImage: 'quay.io/org/container:1.0',
+                freeze: IS_FREEZE,
+                type: TYPE )
+        def token = new TokenData('123abc', Instant.now().plusSeconds(100))
+        def target = 'wave.com/wt/123abc/org/container:1.0'
+
+        when:
+        def result = ContainerHelper.makeResponseV1(data, token, target)
+        then:
+        // freeze/mirror images must resolve to the direct target-registry image,
+        // not the Wave proxy token url (which no longer serves durable images)
+        result.targetImage == 'quay.io/org/container:1.0'
+        result.containerImage == 'quay.io/org/container:1.0'
+
+        where:
+        TYPE                          | IS_FREEZE
+        null                          | true
+        ContainerRequest.Type.Mirror  | false
+    }
+
     @Unroll
     def 'should create response v2' () {
         given: