Issue #3541

Updated by milan over 6 years ago

h3. General Problem: 

 Some plugins have validation requirements for the membership of content units in a repository. The validation required depends on the plugin and the content type. Currently add/remove is done with a POST to v3/repositories/1234/versions/. `v3/repositories/1234/versions/`. This does not involve the plugins at all, so there is no opportunity for plugins to create these validations. 

 h3. Example Problem with Docker: 

 ManifestLists cannot be added unless the Manifests they refer to are also in the repository.  
 L1 is ManifestList, and it refers to (contains) 2 Manifests, M1, M2. The repository is considered corrupt if it contains L1, but not M1 and M2. M1 and M2 could be in the repository without L1. 

 h2. Solutions: 

 There are currently several proposed solutions [0] that fall into two categories. 

 # plugin-controlled add/remove endpoints. POST to v3/repositories/1234/versions/ should be disabled, each plugin will need to provide an add/remove endpoint. There are a few ideas for how to namespace these endpoints, and what kind of tooling can be provided by core. 
 # validation hooks. The core endpoint will remain and will validate using hooks that plugin writers optionally provide.