How to Create a Mock Docker Registry Auth Token Server in Python

import base64
import hashlib
import hmac
import json
import time
from http.server import BaseHTTPRequestHandler, HTTPServer


class TokenAuthHandler(BaseHTTPRequestHandler):
    """Mock Docker Registry token authentication server."""

    SECRET_KEY = b"mock-secret-key"

    def generate_token(self, username: str, password: str) -> str:
        """Generate a mock Bearer token with HMAC signature."""
        payload = {
            "iss": "mock-registry-auth",
            "sub": username,
            "exp": int(time.time()) + 3600,  # 1 hour expiry
            "access": [{"type": "repository", "name": "myapp", "actions": ["push", "pull"]}]
        }
        header = {"alg": "HS256", "typ": "JWT"}

        header_b64 = base64.urlsafe_b64encode(json.dumps(header).encode()).rstrip(b"=")
        payload_b64 = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b"=")
        signing_input = header_b64 + b"." + payload_b64
        signature = hmac.new(self.SECRET_KEY, signing_input, hashlib.sha256).digest()
        signature_b64 = base64.urlsafe_b64encode(signature).rstrip(b"=")
        return f"{signing_input.decode()}.{signature_b64.decode()}"

    def do_GET(self):
        """Handle GET /token with Basic Auth credentials."""
        auth_header = self.headers.get("Authorization", "")
        if not auth_header.startswith("Basic "):
            self.send_response(401)
            self.send_header("WWW-Authenticate", 'Basic realm="Registry"')
            self.end_headers()
            return

        creds = base64.b64decode(auth_header.split(" ", 1)[1]).decode()
        username, password = creds.split(":", 1)
        token = self.generate_token(username, password)

        response = json.dumps({"token": token, "expires_in": 3600, "issued_at": time.time()})
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(response.encode())


def main():
    server = HTTPServer(("localhost", 5000), TokenAuthHandler)
    print("Mock registry auth server running on http://localhost:5000")
    print("GET /token with Basic Auth (e.g., admin:password)")
    print("Example response contains a mock JWT token for push/pull access.")
    server.serve_forever()


if __name__ == "__main__":
    main()