Merge pull request #500 from vmware/new-ui-with-sync-image

merge "New ui with sync image" into master

.gitignore

@@ -3,6 +3,7 @@ Deploy/config/registry/config.yml
 Deploy/config/ui/env
 Deploy/config/ui/app.conf
 Deploy/config/db/env
-Deploy/harbor.cfg
+Deploy/config/jobservice/env
 ui/ui
 *.pyc
+jobservice/test

.travis.yml

@@ -29,13 +29,25 @@ env:
   HARBOR_ADMIN_PASSWD: Harbor12345 
 
 before_install:
-   - ./tests/hostcfg.sh
+   - sudo ./tests/hostcfg.sh
    - cd Deploy
-   - ./prepare
+   - sudo ./prepare
    - cd ..
 
 install: 
-  - sudo apt-get update && sudo apt-get install -y libldap2-dev
+  - sudo apt-get update && sudo apt-get install -y libldap2-dev 
+#  - sudo apt-get remove -y mysql-common mysql-server-5.5 mysql-server-core-5.5 mysql-client-5.5 mysql-client-core-5.5
+#  - sudo apt-get autoremove -y
+#  - sudo apt-get install -y libaio1
+#  - wget -O mysql-5.6.14.deb http://dev.mysql.com/get/Downloads/MySQL-5.6/mysql-5.6.14-debian6.0-x86_64.deb/from/http://cdn.mysql.com/
+#  - sudo dpkg -i mysql-5.6.14.deb
+#  - sudo cp /opt/mysql/server-5.6/support-files/mysql.server /etc/init.d/mysql.server
+#  - sudo ln -s /opt/mysql/server-5.6/bin/* /usr/bin/
+#  - sudo sed -i'' 's/table_cache/table_open_cache/' /etc/mysql/my.cnf
+#  - sudo sed -i'' 's/log_slow_queries/slow_query_log/' /etc/mysql/my.cnf
+#  - sudo sed -i'' 's/basedir[^=]\+=.*$/basedir = \/opt\/mysql\/server-5.6/' /etc/mysql/my.cnf
+#  - sudo /etc/init.d/mysql.server start
+#  - mysql --version
   - go get -d github.com/docker/distribution
   - go get -d github.com/docker/libtrust
   - go get -d github.com/go-sql-driver/mysql
@@ -46,6 +58,8 @@ install:
   - curl -L https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-`uname -s`-`uname -m` > docker-compose
   - chmod +x docker-compose
   - sudo mv docker-compose /usr/local/bin
+  - sudo sed -i '$a DOCKER_OPTS=\"$DOCKER_OPTS --insecure-registry 127.0.0.1\"' /etc/default/docker
+  - sudo service docker restart
   - go get github.com/dghubble/sling
   - go get github.com/stretchr/testify
   
@@ -66,4 +80,5 @@ script:
 
 
   # test for API
+  - sudo ./tests/testprepare.sh
   - go test -v ./tests/apitests

Deploy/config/jobservice/app.conf

@@ -0,0 +1,5 @@
+appname = jobservice
+runmode = dev
+
+[dev]
+httpport = 80

Deploy/config/registry/root.crt

@@ -1,15 +1,35 @@
 -----BEGIN CERTIFICATE-----
-MIICWDCCAcGgAwIBAgIJAN1nLuloDeHNMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQwHhcNMTYwMTI3MDQyMDM1WhcNNDMwNjE0MDQyMDM1WjBF
-MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
-ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
-gQClak/4HO7EeLU0w/BhtVENPLOqU0AP2QjVUdg1qhNiDWVrbWx9KYHqz5Kn0n2+
-fxdZo3o7ZY5/2+hhgkKh1z6Kge9XGgune6z4fx2J/X2Se8WsGeQUTiND8ngSnsCA
-NtYFwW50SbUZPtyf5XjAfKRofZem51OxbxzN3217L/ubKwIDAQABo1AwTjAdBgNV
-HQ4EFgQU5EG2VrB3I6G/TudUpz+kBgQXSvYwHwYDVR0jBBgwFoAU5EG2VrB3I6G/
-TudUpz+kBgQXSvYwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQAx+2eo
-oOm0YNy9KQ81+7GQkKVWoPQXjAGGgZuZj8WCFepYqUSJ4q5qbuVCY8WbGcHVk2Rx
-Jg1XDCmMjBgYP6S0ikezBRqSmNA3G6oFiydTKBfPs6RNalsB0C78Xk5l5+PIyd2R
-jFKOKoMpkjwfeJv2j64WNGoBgqj7XRBoJ11a4g==
+MIIGBzCCA++gAwIBAgIJAKB8CNqCxhr7MA0GCSqGSIb3DQEBCwUAMIGZMQswCQYD
+VQQGEwJDTjEOMAwGA1UECAwFU3RhdGUxCzAJBgNVBAcMAkNOMRUwEwYDVQQKDAxv
+cmdhbml6YXRpb24xHDAaBgNVBAsME29yZ2FuaXphdGlvbmFsIHVuaXQxFDASBgNV
+BAMMC2V4YW1wbGUuY29tMSIwIAYJKoZIhvcNAQkBFhNleGFtcGxlQGV4YW1wbGUu
+Y29tMB4XDTE2MDUxNjAyNDY1NVoXDTI2MDUxNDAyNDY1NVowgZkxCzAJBgNVBAYT
+AkNOMQ4wDAYDVQQIDAVTdGF0ZTELMAkGA1UEBwwCQ04xFTATBgNVBAoMDG9yZ2Fu
+aXphdGlvbjEcMBoGA1UECwwTb3JnYW5pemF0aW9uYWwgdW5pdDEUMBIGA1UEAwwL
+ZXhhbXBsZS5jb20xIjAgBgkqhkiG9w0BCQEWE2V4YW1wbGVAZXhhbXBsZS5jb20w
+ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2ky/K/XneJKbCbpOsWlQ7
+OwgYEQNsa044RkwSbTwPwgLafUZ3r9c5nkXE8APqAikTQQBwyiNjk7QeXgIOjJXd
+7+IpwGoU6Bi2miA21qfvJPknyDAqw9tT/ycGQrvkY6rnqd++ri30ZUByUgO0du6+
+aWHo7af5/G1HQz0tu6i1tIF1dhSHNeqJKwxyUG8vIiT/PfbtU/mXSdQ07M+4ojBC
+O7FgoOS+rWgbL3yhWUTrCXSV2HZlhksYBhtWGoFVRPVSf89iqL02h9rZEjmfVY6R
+QlCnzu9v49Q8WFU528f+gDNXr9v13PKEDmloMzTqWPaCyD2FBbEKBsWHXHf1zqlI
+jyGZV7rHZ3i0C1LI6bdDDP7M7aVs8O+RjxK+HmfFRg5us2t6g7zAevwwLpMZRAud
+S39F91Up7l9g8WXpViok/8vcsOdePvvWcWro8qJhuEHAnDdMzj2Cko1L85/vRM/a
+budWXK7Ix0TlPWPfHJc2SLFeqqcm5Iypf/cGabQ6f0oRt6bCfspFgX9upznT5FwZ
+R0o1w6Q3q+4xVl6LgZvEAudWppyz79RACJA/jbXZQ7uJkXAxoI0nev9vgY6XJqUj
+XIQDih2hmi/uTnNU7Me7w7pCYKPdHlNU652kaJSH6W6ZFGk2rEOCOeAuWO9pZTq2
+3IhuOcDAKOcmimlkzaWRGQIDAQABo1AwTjAdBgNVHQ4EFgQUPJF++WMsv1OJvf7F
+oCew37JTnfQwHwYDVR0jBBgwFoAUPJF++WMsv1OJvf7FoCew37JTnfQwDAYDVR0T
+BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAb5LvqukMxWd5Zajbh3orfYsXmhWn
+UWiwG176+bd3b5xMlG9iLd4vQ11lTZoIhFOfprRQzbizQ8BzR2JBQckpLcy+5hyA
+D3M9vLL37OwA0wT6kxFnd6LtlFaH5gG++huw2ts2PDXFz0jqw+0YE/R8ov2+YdaZ
+aPSEMunmAuEY1TbYWzz4u6PxycxhQzDQ34ZmJZ34Elvw1NYMfPMGTKp34PsxIcgT
+ao5jqb9RMU6JAumfXrOvXRjjl573vX2hgMZzEU6OF2/+uyg95chn6nO1GUQrT2+F
+/1xIqfHfFCm8+jujSDgqfBtGI+2C7No+Dq8LEyEINZe6wSQ81+ryt5jy5SZmAsnj
+V4OsSIwlpR5fLUwrFStVoUWHEKl1DflkYki/cAC1TL0Om+ldJ219kcOnaXDNaq66
+3I75BvRY7/88MYLl4Fgt7sn05Mn3uNPrCrci8d0R1tlXIcwMdCowIHeZdWHX43f7
+NsVk/7VSOxJ343csgaQc+3WxEFK0tBxGO6GP+Xj0XmdVGLhalVBsEhPjnmx+Yyrn
+oMsTA1Yrs88C8ItQn7zuO/30eKNGTnby0gptHiS6sa/c3O083Mpi8y33GPVZDvBl
+l9PfSZT8LG7SvpjsdgdNZlyFvTY4vsB+Vd5Howh7gXYPVXdCs4k7HMyo7zvzliZS
+ekCw9NGLoNqQqnA=
 -----END CERTIFICATE-----

Deploy/config/ui/private_key.pem

@@ -1,15 +1,51 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQClak/4HO7EeLU0w/BhtVENPLOqU0AP2QjVUdg1qhNiDWVrbWx9
-KYHqz5Kn0n2+fxdZo3o7ZY5/2+hhgkKh1z6Kge9XGgune6z4fx2J/X2Se8WsGeQU
-TiND8ngSnsCANtYFwW50SbUZPtyf5XjAfKRofZem51OxbxzN3217L/ubKwIDAQAB
-AoGBAITMMuNYJwAogCGaZHOs4yMjZoIJT9bpQMQxbsi2f9UqOA/ky0I4foqKloyQ
-2k6DLbXTHqBsydgwLgGKWAAiE5xIR2bPMUNSLgjbA2eLly3aOR/0FJ5n09k2EmGg
-Am7tLP+6yneXWKVi3HI3NzXriVjWK94WHGGC1b9F+n5CY/2RAkEA1d62OJUNve2k
-IY6/b6T0BdssFo3VFcm22vnayEL/wcYrnRfF9Pb5wM4HUUqwVelKTouivXg60GNK
-ZKYAx5CtHwJBAMYAEf5u0CQ/8URcwBuMkm0LzK4AM2x1nGs7gIxAEFhu1Z4xPjVe
-MtIxuHhDhlLvD760uccmo5yE72QJ1ZrYBHUCQQCAxLZMPRpoB4QyHEOREe1G9V6H
-OeBZXPk2wQcEWqqo3gt2a1DqHCXl+2aWgHTJVUxDHHngwFoRDCdHkFeZ0LcbAkAj
-T8/luI2WaXD16DS6tQ9IM1qFjbOeHDuRRENgv+wqWVnvpIibq/kUU5m6mRBTqh78
-u+6F/fYf6/VluftGalAhAkAukdMtt+sksq2e7Qw2dRr5GXtXjt+Otjj0NaJENmWk
-a7SgAs34EOWtbd0XGYpZFrg134MzQGbweFeEUTj++e8p
+MIIJKAIBAAKCAgEAtpMvyv153iSmwm6TrFpUOzsIGBEDbGtOOEZMEm08D8IC2n1G
+d6/XOZ5FxPAD6gIpE0EAcMojY5O0Hl4CDoyV3e/iKcBqFOgYtpogNtan7yT5J8gw
+KsPbU/8nBkK75GOq56nfvq4t9GVAclIDtHbuvmlh6O2n+fxtR0M9LbuotbSBdXYU
+hzXqiSsMclBvLyIk/z327VP5l0nUNOzPuKIwQjuxYKDkvq1oGy98oVlE6wl0ldh2
+ZYZLGAYbVhqBVUT1Un/PYqi9Nofa2RI5n1WOkUJQp87vb+PUPFhVOdvH/oAzV6/b
+9dzyhA5paDM06lj2gsg9hQWxCgbFh1x39c6pSI8hmVe6x2d4tAtSyOm3Qwz+zO2l
+bPDvkY8Svh5nxUYObrNreoO8wHr8MC6TGUQLnUt/RfdVKe5fYPFl6VYqJP/L3LDn
+Xj771nFq6PKiYbhBwJw3TM49gpKNS/Of70TP2m7nVlyuyMdE5T1j3xyXNkixXqqn
+JuSMqX/3Bmm0On9KEbemwn7KRYF/bqc50+RcGUdKNcOkN6vuMVZei4GbxALnVqac
+s+/UQAiQP4212UO7iZFwMaCNJ3r/b4GOlyalI1yEA4odoZov7k5zVOzHu8O6QmCj
+3R5TVOudpGiUh+lumRRpNqxDgjngLljvaWU6ttyIbjnAwCjnJoppZM2lkRkCAwEA
+AQKCAgAvsvCPlf2a3fR7Y6xNISRUfS22K+u7DaXX6fXB8qv4afWY45Xfex89vG35
+78L2Bi55C0h0LztjrpkmPeVHq88TtrJduhl88M5UFpxH93jUb9JwZErBQX4xyb2G
+UzUHjEqAT89W3+a9rR5TP74cDd59/MZJtp1mIF7keVqochi3sDsKVxkx4hIuWALe
+csk5hTApRyUWCBRzRCSe1yfF0wnMpA/JcP+SGXfTcmqbNNlelo/Q/kaga59+3UmT
+C0Wy41s8fIvP+MnGT2QLxkkrqYyfwrWTweqoTtuKEIHjpdnwUcoYJKfQ6jKp8aH0
+STyP5UIyFOKNuFjyh6ZfoPbuT1nGW+YKlUnK4hQ9N/GE0oMoecTaHTbqM+psQvbj
+6+CG/1ukA5ZTQyogNyuOApArFBQ+RRmVudPKA3JYygIhwctuB2oItsVEOEZMELCn
+g2aVFAVXGfGRDXvpa8oxs3Pc6RJEp/3tON6+w7cMCx0lwN/Jk2Ie6RgTzUycT3k6
+MoTQJRoO6/ZHcx3hTut/CfnrWiltyAUZOsefLuLg+Pwf9GHhOycLRI6gHfgSwdIV
+S77UbbELWdscVr1EoPIasUm1uYWBBcFRTturRW+GHJ8TZX+mcWSBcWwBhp15LjEl
+tJf+9U6lWMOSB2LvT+vFmR0M9q56fo7UeKFIR7mo7/GpiVu5AQKCAQEA6Qs7G9mw
+N/JZOSeQO6xIQakC+sKApPyXO58fa7WQzri+l2UrLNp0DEQfZCujqDgwys6OOzR/
+xg8ZKQWVoad08Ind3ZwoJgnLn6QLENOcE6PpWxA/JjnVGP4JrXCYR98cP0sf9jEI
+xkR1qT50GbeqU3RDFliI4kGRvbZ8cekzuWppfQcjstSBPdvuxqAcUVmTnTw83nvD
+FmBbhlLiEgI3iKtJ97UB7480ivnWnOuusduk7FO4jF3hkrOa+YRidinTCi8JBo0Y
+jx4Ci3Y5x6nvwkXhKzXapd7YmPNisUc5xA7/a+W71cyC0IKUwRc/8pYWLL3R3CpR
+YiV8gf6gwzOckQKCAQEAyI9CSNoAQH4zpS8B9PF8zILqEEuun8m1f5JB3hQnfWzm
+7uz/zg6I0TkcCE0AJVSKPHQm1V9+TRbF9+DiOWHEYYzPmK8h63SIufaWxZPqai4E
+PUj6eQWykBUVJ96n6/AW0JHRZ+WrJ5RXBqCLuY7NP6wDhORrCJjBwaGMohNpbKPS
+H3QewsoxCh+CEXKdKyy+/yU/f4E89PlHapkW1/bDJ5u7puSD+KvmiDDIXSBncdOO
+uFT8n+XH5IwgjdXFSDim15rQ8jD2l2xLcwKboTpx5GeRl8oB1VGm0fUbBn1dvGPG
+4WfHGyrp9VNZtP160WoHr+vRVPqvHNkoeAlCfEwQCQKCAQBN1dtzLN0HgqE8TrOE
+ysEDdTCykj4nXNoiJr522hi4gsndhQPLolb6NdKKQW0S5Vmekyi8K4e1nhtYMS5N
+5MFRCasZtmtOcR0af87WWucZRDjPmniNCunaxBZ1YFLsRl+H4E6Xir8UgY8O7PYY
+FNkFsKIrl3x4nU/RHl8oKKyG9Dyxbq4Er6dPAuMYYiezIAkGjjUCVjHNindnQM2T
+GDx2IEe/PSydV6ZD+LguhyU88FCAQmI0N7L8rZJIXmgIcWW0VAterceTHYHaFK2t
+u1uB9pcDOKSDnA+Z3kiLT2/CxQOYhQ2clgbnH4YRi/Nm0awsW2X5dATklAKm5GXL
+bLSRAoIBAQClaNnPQdTBXBR2IN3pSZ2XAkXPKMwdxvtk+phOc6raHA4eceLL7FrU
+y9gd1HvRTfcwws8gXcDKDYU62gNaNhMELWEt2QsNqS/2x7Qzwbms1sTyUpUZaSSL
+BohLOKyfv4ThgdIGcXoGi6Z2tcRnRqpq4BCK8uR/05TBgN5+8amaS0ZKYLfaCW4G
+nlPk1fVgHWhtAChtnYZLuKg494fKmB7+NMfAbmmVlxjrq+gkPkxyqXvk9Vrg+V8y
+VIuozu0Fkouv+GRpyw4ldtCHS1hV0eEK8ow2dwmqCMygDxm58X10mYn2b2PcOTl5
+9sNerUw1GNC8O66K+rGgBk4FKgXmg8kZAoIBABBcuisK250fXAfjAWXGqIMs2+Di
+vqAdT041SNZEOJSGNFsLJbhd/3TtCLf29PN/YXtnvBmC37rqryTsqjSbx/YT2Jbr
+Bk3jOr9JVbmcoSubXl8d/uzf7IGs91qaCgBwPZHgeH+kK13FCLexz+U9zYMZ78fF
+/yO82CpoekT+rcl1jzYn43b6gIklHABQU1uCD6MMyMhJ9Op2WmbDk3X+py359jMc
++Cr2zfzdHAIVff2dOV3OL+ZHEWbwtnn3htKUdOmjoTJrciFx0xNZJS5Q7QYHMONj
+yPqbajyhopiN01aBQpCSGF1F1uRpWeIjTrAZPbrwLl9YSYXz0AT05QeFEFk=
 -----END RSA PRIVATE KEY-----

Deploy/db/registry.sql

@@ -93,8 +93,8 @@ create table access_log (
  log_id int NOT NULL AUTO_INCREMENT,
  user_id int NOT NULL,
  project_id int NOT NULL,
- repo_name varchar (40), 
- repo_tag varchar (20),
+ repo_name varchar (256), 
+ repo_tag varchar (128),
  GUID varchar(64), 
  operation varchar(20) NOT NULL,
  op_time timestamp,
@@ -103,17 +103,58 @@ create table access_log (
  FOREIGN KEY (project_id) REFERENCES project (project_id)
 );
 
+create table replication_policy (
+ id int NOT NULL AUTO_INCREMENT,
+ name varchar(256),
+ project_id int NOT NULL,
+ target_id int NOT NULL,
+ enabled tinyint(1) NOT NULL DEFAULT 1,
+ description text,
+ cron_str varchar(256),
+ start_time timestamp NULL,
+ creation_time timestamp default CURRENT_TIMESTAMP,
+ update_time timestamp default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+ PRIMARY KEY (id)
+ );
+
+create table replication_target (
+ id int NOT NULL AUTO_INCREMENT,
+ name varchar(64),
+ url varchar(64),
+ username varchar(40),
+ password varchar(40),
+ /*
+ target_type indicates the type of target registry,
+ 0 means it's a harbor instance,
+ 1 means it's a regulart registry
+ */
+ target_type tinyint(1) NOT NULL DEFAULT 0,
+ creation_time timestamp default CURRENT_TIMESTAMP,
+ update_time timestamp default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+ PRIMARY KEY (id)
+ );
+
+create table replication_job (
+ id int NOT NULL AUTO_INCREMENT,
+ status varchar(64) NOT NULL,
+ policy_id int NOT NULL,
+ repository varchar(256) NOT NULL,
+ operation  varchar(64) NOT NULL,
+ tags   varchar(16384),
+ creation_time timestamp default CURRENT_TIMESTAMP,
+ update_time timestamp default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+ PRIMARY KEY (id),
+ INDEX policy (policy_id)
+ );
+ 
 create table properties (
  k varchar(64) NOT NULL,
  v varchar(128) NOT NULL,
  primary key (k)
  );
 
-insert into properties (k, v) values 
-('schema_version', '0.1.1');
-
 CREATE TABLE IF NOT EXISTS `alembic_version` (
     `version_num` varchar(32) NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 
-insert into alembic_version values ('0.1.1');
+insert into alembic_version values ('0.3.0');

Deploy/docker-compose.yml

@@ -46,6 +46,8 @@ services:
     volumes:
       - ./config/ui/app.conf:/etc/ui/app.conf
       - ./config/ui/private_key.pem:/etc/ui/private_key.pem
+      - ../static:/go/bin/static
+      - ../views:/go/bin/views
     depends_on:
       - log
     logging:
@@ -53,6 +55,22 @@ services:
       options:  
         syslog-address: "tcp://127.0.0.1:1514"
         syslog-tag: "ui"
+  jobservice:
+    build:
+      context: ../
+      dockerfile: Dockerfile.job
+    env_file:
+      - ./config/jobservice/env
+    volumes:
+      - /data/job_logs:/var/log/jobs
+      - ./config/jobservice/app.conf:/etc/jobservice/app.conf
+    depends_on:
+      - ui
+    logging:
+      driver: "syslog"
+      options:  
+        syslog-address: "tcp://127.0.0.1:1514"
+        syslog-tag: "jobservice"
   proxy:
     image: library/nginx:1.9
     volumes:

Deploy/harbor.cfg

@@ -2,7 +2,7 @@
 
 #The IP address or hostname to access admin UI and registry service.
 #DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
-hostname = reg.mydomain.com
+hostname = reg.mydomain.org
 
 #The protocol for accessing the UI and token/notification service, by default it is http.
 #It can be set to https if ssl is enabled on nginx.
@@ -35,7 +35,16 @@ db_password = root123
 #Turn on or off the self-registration feature
 self_registration = on
 
-#Turn on or off the customize your certicate
+#Number of job workers in job service, default is 3 
+max_job_workers = 3 
+
+#Toggle on and off to tell job service wheter or not verify the ssl cert
+#when it tries to access a remote registry
+verify_remote_cert = on
+
+#Turn on or off the customize your certificate for registry's token.
+#If the value is on, the prepare script will generate new root cert and private key 
+#for generating token to access the image in registry.
 customize_crt = on
 
 #fill in your certicate message

Deploy/prepare

@@ -2,6 +2,8 @@
 # -*- coding: utf-8 -*-
 from __future__ import print_function, unicode_literals # We require Python 2.6 or later
 from string import Template
+import random
+import string
 import os
 import sys
 from io import open
@@ -44,13 +46,16 @@ crt_organization = rcp.get("configuration", "crt_organization")
 crt_organizationalunit = rcp.get("configuration", "crt_organizationalunit")
 crt_commonname = rcp.get("configuration", "crt_commonname")
 crt_email = rcp.get("configuration", "crt_email")
+max_job_workers = rcp.get("configuration", "max_job_workers")
+verify_remote_cert = rcp.get("configuration", "verify_remote_cert")
 ########
 
+ui_secret = ''.join(random.choice(string.ascii_letters+string.digits) for i in range(16))  
+
 base_dir = os.path.dirname(__file__)
 config_dir = os.path.join(base_dir, "config")
 templates_dir = os.path.join(base_dir, "templates")
 
-
 ui_config_dir = os.path.join(config_dir,"ui")
 if not os.path.exists(ui_config_dir):
     os.makedirs(os.path.join(config_dir, "ui"))
@@ -59,6 +64,10 @@ db_config_dir = os.path.join(config_dir, "db")
 if not os.path.exists(db_config_dir):
     os.makedirs(os.path.join(config_dir, "db"))
 
+job_config_dir = os.path.join(config_dir, "jobservice")
+if not os.path.exists(job_config_dir):
+    os.makedirs(job_config_dir)
+
 def render(src, dest, **kw):
     t = Template(open(src, 'r').read())
     with open(dest, 'w') as f:
@@ -69,8 +78,9 @@ ui_conf_env = os.path.join(config_dir, "ui", "env")
 ui_conf = os.path.join(config_dir, "ui", "app.conf")
 registry_conf = os.path.join(config_dir, "registry", "config.yml")
 db_conf_env = os.path.join(config_dir, "db", "env")
+job_conf_env = os.path.join(config_dir, "jobservice", "env")
 
-conf_files = [ ui_conf, ui_conf_env, registry_conf, db_conf_env ]
+conf_files = [ ui_conf, ui_conf_env, registry_conf, db_conf_env, job_conf_env ]
 def rmdir(cf):
     for f in cf:
         if os.path.exists(f):
@@ -87,7 +97,9 @@ render(os.path.join(templates_dir, "ui", "env"),
         harbor_admin_password=harbor_admin_password,
         ldap_url=ldap_url,
         ldap_basedn=ldap_basedn,
-	self_registration=self_registration)
+	self_registration=self_registration,
+        ui_secret=ui_secret,
+		verify_remote_cert=verify_remote_cert)
 
 render(os.path.join(templates_dir, "ui", "app.conf"),
         ui_conf,
@@ -107,6 +119,14 @@ render(os.path.join(templates_dir, "db", "env"),
         db_conf_env,
         db_password=db_password)
 
+render(os.path.join(templates_dir, "jobservice", "env"),
+        job_conf_env,
+        db_password=db_password,
+        ui_secret=ui_secret,
+        max_job_workers=max_job_workers,
+        ui_url=ui_url,
+        verify_remote_cert=verify_remote_cert)
+
 def validate_crt_subj(dirty_subj):
     subj_list = [item for item in dirty_subj.strip().split("/") \
         if len(item.split("=")) == 2 and len(item.split("=")[1]) > 0]

Deploy/templates/jobservice/env

@@ -0,0 +1,14 @@
+MYSQL_HOST=mysql
+MYSQL_PORT=3306
+MYSQL_USR=root
+MYSQL_PWD=$db_password
+UI_SECRET=$ui_secret
+CONFIG_PATH=/etc/jobservice/app.conf
+REGISTRY_URL=http://registry:5000
+VERIFY_REMOTE_CERT=$verify_remote_cert
+MAX_JOB_WORKERS=$max_job_workers
+LOG_LEVEL=debug
+LOG_DIR=/var/log/jobs
+GODEBUG=netdns=cgo
+EXT_ENDPOINT=$ui_url
+TOKEN_URL=http://ui

Deploy/templates/ui/app.conf

@@ -2,8 +2,8 @@ appname = registry
 runmode = dev
 
 [lang]
-types = en-US|zh-CN|de-DE|ru-RU|ja-JP
-names = en-US|zh-CN|de-DE|ru-RU|ja-JP
+types = en-US|zh-CN
+names = en-US|zh-CN
 
 [dev]
 httpport = 80

Deploy/templates/ui/env

@@ -3,13 +3,18 @@ MYSQL_PORT=3306
 MYSQL_USR=root
 MYSQL_PWD=$db_password
 REGISTRY_URL=http://registry:5000
+UI_URL=http://ui
 CONFIG_PATH=/etc/ui/app.conf
 HARBOR_REG_URL=$hostname
 HARBOR_ADMIN_PASSWORD=$harbor_admin_password
-HARBOR_URL=$hostname
+HARBOR_URL=$ui_url
 AUTH_MODE=$auth_mode
 LDAP_URL=$ldap_url
 LDAP_BASE_DN=$ldap_basedn
+UI_SECRET=$ui_secret
 SELF_REGISTRATION=$self_registration
 LOG_LEVEL=debug
 GODEBUG=netdns=cgo
+EXT_ENDPOINT=$ui_url
+TOKEN_URL=http://ui
+VERIFY_REMOTE_CERT=$verify_remote_cert

Dockerfile.job

@@ -0,0 +1,18 @@
+FROM golang:1.6.2
+
+MAINTAINER jiangd@vmware.com
+
+RUN apt-get update \
+    && apt-get install -y libldap2-dev \
+    && rm -r /var/lib/apt/lists/*
+COPY . /go/src/github.com/vmware/harbor
+
+WORKDIR /go/src/github.com/vmware/harbor/jobservice
+
+RUN go get -d github.com/docker/distribution \
+    && go get -d github.com/docker/libtrust \
+    && go get -d github.com/go-sql-driver/mysql \
+    && go build -v -a -o /go/bin/harbor_jobservice \
+    && chmod u+x /go/bin/harbor_jobservice 
+WORKDIR /go/bin/
+ENTRYPOINT ["/go/bin/harbor_jobservice"]

api/base.go

@@ -17,8 +17,12 @@ package api
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
+	"os"
+	"strconv"
 
+	"github.com/astaxie/beego/validation"
 	"github.com/vmware/harbor/auth"
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
@@ -51,6 +55,30 @@ func (b *BaseAPI) DecodeJSONReq(v interface{}) {
 	}
 }
 
+// Validate validates v if it implements interface validation.ValidFormer
+func (b *BaseAPI) Validate(v interface{}) {
+	validator := validation.Validation{}
+	isValid, err := validator.Valid(v)
+	if err != nil {
+		log.Errorf("failed to validate: %v", err)
+		b.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if !isValid {
+		message := ""
+		for _, e := range validator.Errors {
+			message += fmt.Sprintf("%s %s \n", e.Field, e.Message)
+		}
+		b.CustomAbort(http.StatusBadRequest, message)
+	}
+}
+
+// DecodeJSONReqAndValidate does both decoding and validation
+func (b *BaseAPI) DecodeJSONReqAndValidate(v interface{}) {
+	b.DecodeJSONReq(v)
+	b.Validate(v)
+}
+
 // ValidateUser checks if the request triggered by a valid user
 func (b *BaseAPI) ValidateUser() int {
 
@@ -94,3 +122,29 @@ func (b *BaseAPI) Redirect(statusCode int, resouceID string) {
 
 	b.Ctx.Redirect(statusCode, resoucreURI)
 }
+
+// GetIDFromURL checks the ID in request URL
+func (b *BaseAPI) GetIDFromURL() int64 {
+	idStr := b.Ctx.Input.Param(":id")
+	if len(idStr) == 0 {
+		b.CustomAbort(http.StatusBadRequest, "invalid ID in URL")
+	}
+
+	id, err := strconv.ParseInt(idStr, 10, 64)
+	if err != nil || id <= 0 {
+		b.CustomAbort(http.StatusBadRequest, "invalid ID in URL")
+	}
+
+	return id
+}
+
+func getIsInsecure() bool {
+	insecure := false
+
+	verifyRemoteCert := os.Getenv("VERIFY_REMOTE_CERT")
+	if verifyRemoteCert == "off" {
+		insecure = true
+	}
+
+	return insecure
+}

api/jobs/replication.go

@@ -0,0 +1,199 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httputil"
+	"strconv"
+
+	"github.com/vmware/harbor/api"
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/job"
+	"github.com/vmware/harbor/job/config"
+	"github.com/vmware/harbor/job/utils"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// ReplicationJob handles /api/replicationJobs /api/replicationJobs/:id/log
+// /api/replicationJobs/actions
+type ReplicationJob struct {
+	api.BaseAPI
+}
+
+// ReplicationReq holds informations of request for /api/replicationJobs
+type ReplicationReq struct {
+	PolicyID  int64    `json:"policy_id"`
+	Repo      string   `json:"repository"`
+	Operation string   `json:"operation"`
+	TagList   []string `json:"tags"`
+}
+
+// Post creates replication jobs according to the policy.
+func (rj *ReplicationJob) Post() {
+	var data ReplicationReq
+	rj.DecodeJSONReq(&data)
+	log.Debugf("data: %+v", data)
+	p, err := dao.GetRepPolicy(data.PolicyID)
+	if err != nil {
+		log.Errorf("Failed to get policy, error: %v", err)
+		rj.RenderError(http.StatusInternalServerError, fmt.Sprintf("Failed to get policy, id: %d", data.PolicyID))
+		return
+	}
+	if p == nil {
+		log.Errorf("Policy not found, id: %d", data.PolicyID)
+		rj.RenderError(http.StatusNotFound, fmt.Sprintf("Policy not found, id: %d", data.PolicyID))
+		return
+	}
+	if len(data.Repo) == 0 { // sync all repositories
+		repoList, err := getRepoList(p.ProjectID)
+		if err != nil {
+			log.Errorf("Failed to get repository list, project id: %d, error: %v", p.ProjectID, err)
+			rj.RenderError(http.StatusInternalServerError, err.Error())
+			return
+		}
+		log.Debugf("repo list: %v", repoList)
+		for _, repo := range repoList {
+			err := rj.addJob(repo, data.PolicyID, models.RepOpTransfer)
+			if err != nil {
+				log.Errorf("Failed to insert job record, error: %v", err)
+				rj.RenderError(http.StatusInternalServerError, err.Error())
+				return
+			}
+		}
+	} else { // sync a single repository
+		var op string
+		if len(data.Operation) > 0 {
+			op = data.Operation
+		} else {
+			op = models.RepOpTransfer
+		}
+		err := rj.addJob(data.Repo, data.PolicyID, op, data.TagList...)
+		if err != nil {
+			log.Errorf("Failed to insert job record, error: %v", err)
+			rj.RenderError(http.StatusInternalServerError, err.Error())
+			return
+		}
+	}
+}
+
+func (rj *ReplicationJob) addJob(repo string, policyID int64, operation string, tags ...string) error {
+	j := models.RepJob{
+		Repository: repo,
+		PolicyID:   policyID,
+		Operation:  operation,
+		TagList:    tags,
+	}
+	log.Debugf("Creating job for repo: %s, policy: %d", repo, policyID)
+	id, err := dao.AddRepJob(j)
+	if err != nil {
+		return err
+	}
+	log.Debugf("Send job to scheduler, job id: %d", id)
+	job.Schedule(id)
+	return nil
+}
+
+// RepActionReq holds informations of request for /api/replicationJobs/actions
+type RepActionReq struct {
+	PolicyID int64  `json:"policy_id"`
+	Action   string `json:"action"`
+}
+
+// HandleAction supports some operations to all the jobs of one policy
+func (rj *ReplicationJob) HandleAction() {
+	var data RepActionReq
+	rj.DecodeJSONReq(&data)
+	//Currently only support stop action
+	if data.Action != "stop" {
+		log.Errorf("Unrecognized action: %s", data.Action)
+		rj.RenderError(http.StatusBadRequest, fmt.Sprintf("Unrecongized action: %s", data.Action))
+		return
+	}
+	jobs, err := dao.GetRepJobToStop(data.PolicyID)
+	if err != nil {
+		log.Errorf("Failed to get jobs to stop, error: %v", err)
+		rj.RenderError(http.StatusInternalServerError, "Faild to get jobs to stop")
+		return
+	}
+	var jobIDList []int64
+	for _, j := range jobs {
+		jobIDList = append(jobIDList, j.ID)
+	}
+	job.WorkerPool.StopJobs(jobIDList)
+}
+
+// GetLog gets logs of the job
+func (rj *ReplicationJob) GetLog() {
+	idStr := rj.Ctx.Input.Param(":id")
+	jid, err := strconv.ParseInt(idStr, 10, 64)
+	if err != nil {
+		log.Errorf("Error parsing job id: %s, error: %v", idStr, err)
+		rj.RenderError(http.StatusBadRequest, "Invalid job id")
+		return
+	}
+	logFile := utils.GetJobLogPath(jid)
+	rj.Ctx.Output.Download(logFile)
+}
+
+// calls the api from UI to get repo list
+func getRepoList(projectID int64) ([]string, error) {
+	/*
+		uiUser := os.Getenv("UI_USR")
+		if len(uiUser) == 0 {
+			uiUser = "admin"
+		}
+		uiPwd := os.Getenv("UI_PWD")
+		if len(uiPwd) == 0 {
+			uiPwd = "Harbor12345"
+		}
+	*/
+	uiURL := config.LocalUIURL()
+	client := &http.Client{}
+	req, err := http.NewRequest("GET", uiURL+"/api/repositories?project_id="+strconv.Itoa(int(projectID)), nil)
+	if err != nil {
+		log.Errorf("Error when creating request: %v", err)
+		return nil, err
+	}
+	//req.SetBasicAuth(uiUser, uiPwd)
+	req.AddCookie(&http.Cookie{Name: models.UISecretCookie, Value: config.UISecret()})
+	//dump, err := httputil.DumpRequest(req, true)
+	//log.Debugf("req: %q", dump)
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Errorf("Error when calling UI api to get repositories, error: %v", err)
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		log.Errorf("Unexpected status code: %d", resp.StatusCode)
+		dump, _ := httputil.DumpResponse(resp, true)
+		log.Debugf("response: %q", dump)
+		return nil, fmt.Errorf("Unexpected status code when getting repository list: %d", resp.StatusCode)
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		log.Errorf("Failed to read the response body, error: %v", err)
+		return nil, err
+	}
+	var repoList []string
+	err = json.Unmarshal(body, &repoList)
+	return repoList, err
+}

api/log.go

@@ -0,0 +1,86 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package api
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+//LogAPI handles request api/logs
+type LogAPI struct {
+	BaseAPI
+	userID int
+}
+
+//Prepare validates the URL and the user
+func (l *LogAPI) Prepare() {
+	l.userID = l.ValidateUser()
+}
+
+//Get returns the recent logs according to parameters
+func (l *LogAPI) Get() {
+	var err error
+	startTime := l.GetString("start_time")
+	if len(startTime) != 0 {
+		i, err := strconv.ParseInt(startTime, 10, 64)
+		if err != nil {
+			log.Errorf("Parse startTime to int error, err: %v", err)
+			l.CustomAbort(http.StatusBadRequest, "startTime is not a valid integer")
+		}
+		startTime = time.Unix(i, 0).String()
+	}
+
+	endTime := l.GetString("end_time")
+	if len(endTime) != 0 {
+		j, err := strconv.ParseInt(endTime, 10, 64)
+		if err != nil {
+			log.Errorf("Parse endTime to int error, err: %v", err)
+			l.CustomAbort(http.StatusBadRequest, "endTime is not a valid integer")
+		}
+		endTime = time.Unix(j, 0).String()
+	}
+
+	var linesNum int
+	lines := l.GetString("lines")
+	if len(lines) != 0 {
+		linesNum, err = strconv.Atoi(lines)
+		if err != nil {
+			log.Errorf("Get parameters error--lines, err: %v", err)
+			l.CustomAbort(http.StatusBadRequest, "bad request of lines")
+		}
+		if linesNum <= 0 {
+			log.Warning("lines must be a positive integer")
+			l.CustomAbort(http.StatusBadRequest, "lines is 0 or negative")
+		}
+	} else if len(startTime) == 0 && len(endTime) == 0 {
+		linesNum = 10
+	}
+
+	var logList []models.AccessLog
+	logList, err = dao.GetRecentLogs(l.userID, linesNum, startTime, endTime)
+	if err != nil {
+		log.Errorf("Get recent logs error, err: %v", err)
+		l.CustomAbort(http.StatusInternalServerError, "Internal error")
+	}
+	l.Data["json"] = logList
+	l.ServeJSON()
+}

api/project.go

@@ -18,6 +18,7 @@ package api
 import (
 	"fmt"
 	"net/http"
+	"regexp"
 
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
@@ -40,6 +41,7 @@ type projectReq struct {
 }
 
 const projectNameMaxLen int = 30
+const projectNameMinLen int = 4
 
 // Prepare validates the URL and the user
 func (p *ProjectAPI) Prepare() {
@@ -75,7 +77,7 @@ func (p *ProjectAPI) Post() {
 	err := validateProjectReq(req)
 	if err != nil {
 		log.Errorf("Invalid project request, error: %v", err)
-		p.RenderError(http.StatusBadRequest, "Invalid request for creating project")
+		p.RenderError(http.StatusBadRequest, fmt.Sprintf("invalid request: %v", err))
 		return
 	}
 	projectName := req.ProjectName
@@ -157,7 +159,7 @@ func (p *ProjectAPI) List() {
 	if len(isPublic) > 0 {
 		public, err = strconv.Atoi(isPublic)
 		if err != nil {
-			log.Errorf("Error parsing public property: %d, error: %v", isPublic, err)
+			log.Errorf("Error parsing public property: %v, error: %v", isPublic, err)
 			p.CustomAbort(http.StatusBadRequest, "invalid project Id")
 		}
 	}
@@ -197,10 +199,9 @@ func (p *ProjectAPI) List() {
 	p.ServeJSON()
 }
 
-// Put ...
-func (p *ProjectAPI) Put() {
+// ToggleProjectPublic ...
+func (p *ProjectAPI) ToggleProjectPublic() {
 	p.userID = p.ValidateUser()
-
 	var req projectReq
 	var public int
 
@@ -284,11 +285,13 @@ func isProjectAdmin(userID int, pid int64) bool {
 
 func validateProjectReq(req projectReq) error {
 	pn := req.ProjectName
-	if len(pn) == 0 {
-		return fmt.Errorf("Project name can not be empty")
+	if isIllegalLength(req.ProjectName, projectNameMinLen, projectNameMaxLen) {
+		return fmt.Errorf("Project name is illegal in length. (greater than 4 or less than 30)")
 	}
-	if len(pn) > projectNameMaxLen {
-		return fmt.Errorf("Project name is too long")
+	validProjectName := regexp.MustCompile(`^[a-z0-9](?:-*[a-z0-9])*(?:[._][a-z0-9](?:-*[a-z0-9])*)*$`)
+	legal := validProjectName.MatchString(pn)
+	if !legal {
+		return fmt.Errorf("Project name is not in lower case or contains illegal characters!")
 	}
 	return nil
 }

api/replication_job.go

@@ -0,0 +1,180 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package api
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// RepJobAPI handles request to /api/replicationJobs /api/replicationJobs/:id/log
+type RepJobAPI struct {
+	BaseAPI
+	jobID int64
+}
+
+// Prepare validates that whether user has system admin role
+func (ra *RepJobAPI) Prepare() {
+	uid := ra.ValidateUser()
+	isAdmin, err := dao.IsAdminRole(uid)
+	if err != nil {
+		log.Errorf("Failed to Check if the user is admin, error: %v, uid: %d", err, uid)
+	}
+	if !isAdmin {
+		ra.CustomAbort(http.StatusForbidden, "")
+	}
+
+	idStr := ra.Ctx.Input.Param(":id")
+	if len(idStr) != 0 {
+		id, err := strconv.ParseInt(idStr, 10, 64)
+		if err != nil {
+			ra.CustomAbort(http.StatusBadRequest, "ID is invalid")
+		}
+		ra.jobID = id
+	}
+
+}
+
+// List filters jobs according to the policy and repository
+func (ra *RepJobAPI) List() {
+	var policyID int64
+	var repository, status string
+	var startTime, endTime *time.Time
+	var num int
+	var err error
+
+	policyIDStr := ra.GetString("policy_id")
+	if len(policyIDStr) != 0 {
+		policyID, err = strconv.ParseInt(policyIDStr, 10, 64)
+		if err != nil || policyID <= 0 {
+			ra.CustomAbort(http.StatusBadRequest, fmt.Sprintf("invalid policy ID: %s", policyIDStr))
+		}
+	}
+
+	numStr := ra.GetString("num")
+	if len(numStr) != 0 {
+		num, err = strconv.Atoi(numStr)
+		if err != nil {
+			ra.CustomAbort(http.StatusBadRequest, fmt.Sprintf("invalid num: %s", numStr))
+		}
+	}
+	if num <= 0 {
+		num = 200
+	}
+
+	endTimeStr := ra.GetString("end_time")
+	if len(endTimeStr) != 0 {
+		i, err := strconv.ParseInt(endTimeStr, 10, 64)
+		if err != nil {
+			ra.CustomAbort(http.StatusBadRequest, "invalid end_time")
+		}
+		t := time.Unix(i, 0)
+		endTime = &t
+	}
+
+	startTimeStr := ra.GetString("start_time")
+	if len(startTimeStr) != 0 {
+		i, err := strconv.ParseInt(startTimeStr, 10, 64)
+		if err != nil {
+			ra.CustomAbort(http.StatusBadRequest, "invalid start_time")
+		}
+		t := time.Unix(i, 0)
+		startTime = &t
+	}
+
+	if startTime == nil && endTime == nil {
+		// if start_time and end_time are both null, list jobs of last 10 days
+		t := time.Now().UTC().AddDate(0, 0, -10)
+		startTime = &t
+	}
+
+	repository = ra.GetString("repository")
+	status = ra.GetString("status")
+
+	jobs, err := dao.FilterRepJobs(policyID, repository, status, startTime, endTime, num)
+	if err != nil {
+		log.Errorf("failed to filter jobs according policy ID %d, repository %s, status %s: %v", policyID, repository, status, err)
+		ra.RenderError(http.StatusInternalServerError, "Failed to query job")
+		return
+	}
+	ra.Data["json"] = jobs
+	ra.ServeJSON()
+}
+
+// Delete ...
+func (ra *RepJobAPI) Delete() {
+	if ra.jobID == 0 {
+		ra.CustomAbort(http.StatusBadRequest, "id is nil")
+	}
+
+	job, err := dao.GetRepJob(ra.jobID)
+	if err != nil {
+		log.Errorf("failed to get job %d: %v", ra.jobID, err)
+		ra.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if job.Status == models.JobPending || job.Status == models.JobRunning {
+		ra.CustomAbort(http.StatusBadRequest, fmt.Sprintf("job is %s, can not be deleted", job.Status))
+	}
+
+	if err = dao.DeleteRepJob(ra.jobID); err != nil {
+		log.Errorf("failed to deleted job %d: %v", ra.jobID, err)
+		ra.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+}
+
+// GetLog ...
+func (ra *RepJobAPI) GetLog() {
+	if ra.jobID == 0 {
+		ra.CustomAbort(http.StatusBadRequest, "id is nil")
+	}
+
+	resp, err := http.Get(buildJobLogURL(strconv.FormatInt(ra.jobID, 10)))
+	if err != nil {
+		log.Errorf("failed to get log for job %d: %v", ra.jobID, err)
+		ra.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if resp.StatusCode == http.StatusOK {
+		ra.Ctx.ResponseWriter.Header().Set(http.CanonicalHeaderKey("Content-Length"), resp.Header.Get(http.CanonicalHeaderKey("Content-Length")))
+		ra.Ctx.ResponseWriter.Header().Set(http.CanonicalHeaderKey("Content-Type"), "text/plain")
+
+		if _, err = io.Copy(ra.Ctx.ResponseWriter, resp.Body); err != nil {
+			log.Errorf("failed to write log to response; %v", err)
+			ra.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+		return
+	}
+
+	defer resp.Body.Close()
+	b, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		log.Errorf("failed to read reponse body: %v", err)
+		ra.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	ra.CustomAbort(resp.StatusCode, string(b))
+}
+
+//TODO:add Post handler to call job service API to submit jobs by policy

api/replication_policy.go

@@ -0,0 +1,351 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package api
+
+import (
+	"fmt"
+
+	"net/http"
+	"strconv"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// RepPolicyAPI handles /api/replicationPolicies /api/replicationPolicies/:id/enablement
+type RepPolicyAPI struct {
+	BaseAPI
+}
+
+// Prepare validates whether the user has system admin role
+func (pa *RepPolicyAPI) Prepare() {
+	uid := pa.ValidateUser()
+	var err error
+	isAdmin, err := dao.IsAdminRole(uid)
+	if err != nil {
+		log.Errorf("Failed to Check if the user is admin, error: %v, uid: %d", err, uid)
+	}
+	if !isAdmin {
+		pa.CustomAbort(http.StatusForbidden, "")
+	}
+}
+
+// Get ...
+func (pa *RepPolicyAPI) Get() {
+	id := pa.GetIDFromURL()
+	policy, err := dao.GetRepPolicy(id)
+	if err != nil {
+		log.Errorf("failed to get policy %d: %v", id, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if policy == nil {
+		pa.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+	}
+
+	pa.Data["json"] = policy
+	pa.ServeJSON()
+}
+
+// List filters policies by name and project_id, if name and project_id
+// are nil, List returns all policies
+func (pa *RepPolicyAPI) List() {
+	name := pa.GetString("name")
+	projectIDStr := pa.GetString("project_id")
+
+	var projectID int64
+	var err error
+
+	if len(projectIDStr) != 0 {
+		projectID, err = strconv.ParseInt(projectIDStr, 10, 64)
+		if err != nil || projectID <= 0 {
+			pa.CustomAbort(http.StatusBadRequest, "invalid project ID")
+		}
+	}
+
+	policies, err := dao.FilterRepPolicies(name, projectID)
+	if err != nil {
+		log.Errorf("failed to filter policies %s project ID %d: %v", name, projectID, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+	pa.Data["json"] = policies
+	pa.ServeJSON()
+}
+
+// Post creates a policy, and if it is enbled, the replication will be triggered right now.
+func (pa *RepPolicyAPI) Post() {
+	policy := &models.RepPolicy{}
+	pa.DecodeJSONReqAndValidate(policy)
+
+	po, err := dao.GetRepPolicyByName(policy.Name)
+	if err != nil {
+		log.Errorf("failed to get policy %s: %v", policy.Name, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if po != nil {
+		pa.CustomAbort(http.StatusConflict, "name is already used")
+	}
+
+	project, err := dao.GetProjectByID(policy.ProjectID)
+	if err != nil {
+		log.Errorf("failed to get project %d: %v", policy.ProjectID, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if project == nil {
+		pa.CustomAbort(http.StatusBadRequest, fmt.Sprintf("project %d does not exist", policy.ProjectID))
+	}
+
+	target, err := dao.GetRepTarget(policy.TargetID)
+	if err != nil {
+		log.Errorf("failed to get target %d: %v", policy.TargetID, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if target == nil {
+		pa.CustomAbort(http.StatusBadRequest, fmt.Sprintf("target %d does not exist", policy.TargetID))
+	}
+
+	policies, err := dao.GetRepPolicyByProjectAndTarget(policy.ProjectID, policy.TargetID)
+	if err != nil {
+		log.Errorf("failed to get policy [project ID: %d,targetID: %d]: %v", policy.ProjectID, policy.TargetID, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if len(policies) > 0 {
+		pa.CustomAbort(http.StatusConflict, "policy already exists with the same project and target")
+	}
+
+	pid, err := dao.AddRepPolicy(*policy)
+	if err != nil {
+		log.Errorf("Failed to add policy to DB, error: %v", err)
+		pa.RenderError(http.StatusInternalServerError, "Internal Error")
+		return
+	}
+
+	if policy.Enabled == 1 {
+		go func() {
+			if err := TriggerReplication(pid, "", nil, models.RepOpTransfer); err != nil {
+				log.Errorf("failed to trigger replication of %d: %v", pid, err)
+			} else {
+				log.Infof("replication of %d triggered", pid)
+			}
+		}()
+	}
+
+	pa.Redirect(http.StatusCreated, strconv.FormatInt(pid, 10))
+}
+
+// Put modifies name, description, target and enablement of policy
+func (pa *RepPolicyAPI) Put() {
+	id := pa.GetIDFromURL()
+	originalPolicy, err := dao.GetRepPolicy(id)
+	if err != nil {
+		log.Errorf("failed to get policy %d: %v", id, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if originalPolicy == nil {
+		pa.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+	}
+
+	policy := &models.RepPolicy{}
+	pa.DecodeJSONReq(policy)
+	policy.ProjectID = originalPolicy.ProjectID
+	pa.Validate(policy)
+
+	// check duplicate name
+	if policy.Name != originalPolicy.Name {
+		po, err := dao.GetRepPolicyByName(policy.Name)
+		if err != nil {
+			log.Errorf("failed to get policy %s: %v", policy.Name, err)
+			pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+
+		if po != nil {
+			pa.CustomAbort(http.StatusConflict, "name is already used")
+		}
+	}
+
+	if policy.TargetID != originalPolicy.TargetID {
+		//target of policy can not be modified when the policy is enabled
+		if originalPolicy.Enabled == 1 {
+			pa.CustomAbort(http.StatusBadRequest, "target of policy can not be modified when the policy is enabled")
+		}
+
+		// check the existance of target
+		target, err := dao.GetRepTarget(policy.TargetID)
+		if err != nil {
+			log.Errorf("failed to get target %d: %v", policy.TargetID, err)
+			pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+
+		if target == nil {
+			pa.CustomAbort(http.StatusBadRequest, fmt.Sprintf("target %d does not exist", policy.TargetID))
+		}
+
+		// check duplicate policy with the same project and target
+		policies, err := dao.GetRepPolicyByProjectAndTarget(policy.ProjectID, policy.TargetID)
+		if err != nil {
+			log.Errorf("failed to get policy [project ID: %d,targetID: %d]: %v", policy.ProjectID, policy.TargetID, err)
+			pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+
+		if len(policies) > 0 {
+			pa.CustomAbort(http.StatusConflict, "policy already exists with the same project and target")
+		}
+	}
+
+	policy.ID = id
+
+	/*
+		isTargetChanged := !(policy.TargetID == originalPolicy.TargetID)
+		isEnablementChanged := !(policy.Enabled == policy.Enabled)
+
+		var shouldStop, shouldTrigger bool
+
+		// if target and enablement are not changed, do nothing
+		if !isTargetChanged && !isEnablementChanged {
+			shouldStop = false
+			shouldTrigger = false
+		} else if !isTargetChanged && isEnablementChanged {
+			// target is not changed, but enablement is changed
+			if policy.Enabled == 0 {
+				shouldStop = true
+				shouldTrigger = false
+			} else {
+				shouldStop = false
+				shouldTrigger = true
+			}
+		} else if isTargetChanged && !isEnablementChanged {
+			// target is changed, but enablement is not changed
+			if policy.Enabled == 0 {
+				// enablement is 0, do nothing
+				shouldStop = false
+				shouldTrigger = false
+			} else {
+				// enablement is 1, so stop original target's jobs
+				// and trigger new target's jobs
+				shouldStop = true
+				shouldTrigger = true
+			}
+		} else {
+			// both target and enablement are changed
+
+			// enablement: 1 -> 0
+			if policy.Enabled == 0 {
+				shouldStop = true
+				shouldTrigger = false
+			} else {
+				shouldStop = false
+				shouldTrigger = true
+			}
+		}
+
+		if shouldStop {
+			if err := postReplicationAction(id, "stop"); err != nil {
+				log.Errorf("failed to stop replication of %d: %v", id, err)
+				pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+			}
+			log.Infof("replication of %d has been stopped", id)
+		}
+
+		if err = dao.UpdateRepPolicy(policy); err != nil {
+			log.Errorf("failed to update policy %d: %v", id, err)
+			pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+
+		if shouldTrigger {
+			go func() {
+				if err := TriggerReplication(id, "", nil, models.RepOpTransfer); err != nil {
+					log.Errorf("failed to trigger replication of %d: %v", id, err)
+				} else {
+					log.Infof("replication of %d triggered", id)
+				}
+			}()
+		}
+	*/
+
+	if err = dao.UpdateRepPolicy(policy); err != nil {
+		log.Errorf("failed to update policy %d: %v", id, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if policy.Enabled != originalPolicy.Enabled && policy.Enabled == 1 {
+		go func() {
+			if err := TriggerReplication(id, "", nil, models.RepOpTransfer); err != nil {
+				log.Errorf("failed to trigger replication of %d: %v", id, err)
+			} else {
+				log.Infof("replication of %d triggered", id)
+			}
+		}()
+	}
+}
+
+type enablementReq struct {
+	Enabled int `json:"enabled"`
+}
+
+// UpdateEnablement changes the enablement of the policy
+func (pa *RepPolicyAPI) UpdateEnablement() {
+	id := pa.GetIDFromURL()
+	policy, err := dao.GetRepPolicy(id)
+	if err != nil {
+		log.Errorf("failed to get policy %d: %v", id, err)
+		pa.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if policy == nil {
+		pa.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+	}
+
+	e := enablementReq{}
+	pa.DecodeJSONReq(&e)
+	if e.Enabled != 0 && e.Enabled != 1 {
+		pa.RenderError(http.StatusBadRequest, "invalid enabled value")
+		return
+	}
+
+	if policy.Enabled == e.Enabled {
+		return
+	}
+
+	if err := dao.UpdateRepPolicyEnablement(id, e.Enabled); err != nil {
+		log.Errorf("Failed to update policy enablement in DB, error: %v", err)
+		pa.RenderError(http.StatusInternalServerError, "Internal Error")
+		return
+	}
+
+	if e.Enabled == 1 {
+		go func() {
+			if err := TriggerReplication(id, "", nil, models.RepOpTransfer); err != nil {
+				log.Errorf("failed to trigger replication of %d: %v", id, err)
+			} else {
+				log.Infof("replication of %d triggered", id)
+			}
+		}()
+	} else {
+		go func() {
+			if err := postReplicationAction(id, "stop"); err != nil {
+				log.Errorf("failed to stop replication of %d: %v", id, err)
+			} else {
+				log.Infof("try to stop replication of %d", id)
+			}
+		}()
+	}
+}

api/repository.go

@@ -27,17 +27,18 @@ import (
 	"github.com/docker/distribution/manifest/schema1"
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/service/cache"
 	svc_utils "github.com/vmware/harbor/service/utils"
 	"github.com/vmware/harbor/utils/log"
 	"github.com/vmware/harbor/utils/registry"
+
+	registry_error "github.com/vmware/harbor/utils/registry/error"
+
 	"github.com/vmware/harbor/utils/registry/auth"
-	"github.com/vmware/harbor/utils/registry/errors"
 )
 
 // RepositoryAPI handles request to /api/repositories /api/repositories/tags /api/repositories/manifests, the parm has to be put
 // in the query string as the web framework can not parse the URL if it contains veriadic sectors.
-// For repostiories, we won't check the session in this API due to search functionality, querying manifest will be contorlled by
-// the security of registry
 type RepositoryAPI struct {
 	BaseAPI
 }
@@ -62,7 +63,13 @@ func (ra *RepositoryAPI) Get() {
 	}
 
 	if p.Public == 0 {
-		userID := ra.ValidateUser()
+		var userID int
+
+		if svc_utils.VerifySecret(ra.Ctx.Request) {
+			userID = 1
+		} else {
+			userID = ra.ValidateUser()
+		}
 
 		if !checkProjectPermission(userID, projectID) {
 			ra.RenderError(http.StatusForbidden, "")
@@ -70,7 +77,7 @@ func (ra *RepositoryAPI) Get() {
 		}
 	}
 
-	repoList, err := svc_utils.GetRepoFromCache()
+	repoList, err := cache.GetRepoFromCache()
 	if err != nil {
 		log.Errorf("Failed to get repo from cache, error: %v", err)
 		ra.RenderError(http.StatusInternalServerError, "internal sever error")
@@ -106,6 +113,20 @@ func (ra *RepositoryAPI) Delete() {
 		ra.CustomAbort(http.StatusBadRequest, "repo_name is nil")
 	}
 
+	projectName := getProjectName(repoName)
+	project, err := dao.GetProjectByName(projectName)
+	if err != nil {
+		log.Errorf("failed to get project %s: %v", projectName, err)
+		ra.CustomAbort(http.StatusInternalServerError, "")
+	}
+
+	if project.Public == 0 {
+		userID := ra.ValidateUser()
+		if !hasProjectAdminRole(userID, project.ProjectID) {
+			ra.CustomAbort(http.StatusForbidden, "")
+		}
+	}
+
 	rc, err := ra.initRepositoryClient(repoName)
 	if err != nil {
 		log.Errorf("error occurred while initializing repository client for %s: %v", repoName, err)
@@ -117,40 +138,57 @@ func (ra *RepositoryAPI) Delete() {
 	if len(tag) == 0 {
 		tagList, err := rc.ListTag()
 		if err != nil {
-			e, ok := errors.ParseError(err)
-			if ok {
-				log.Info(e)
-				ra.CustomAbort(e.StatusCode, e.Message)
-			} else {
-				log.Error(err)
-				ra.CustomAbort(http.StatusInternalServerError, "internal error")
+			if regErr, ok := err.(*registry_error.Error); ok {
+				ra.CustomAbort(regErr.StatusCode, regErr.Detail)
 			}
+
+			log.Errorf("error occurred while listing tags of %s: %v", repoName, err)
+			ra.CustomAbort(http.StatusInternalServerError, "internal error")
 		}
+
+		// TODO remove the logic if the bug of registry is fixed
+		if len(tagList) == 0 {
+			ra.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+		}
+
 		tags = append(tags, tagList...)
 	} else {
 		tags = append(tags, tag)
 	}
 
+	user, _, ok := ra.Ctx.Request.BasicAuth()
+	if !ok {
+		user, err = ra.getUsername()
+		if err != nil {
+			log.Errorf("failed to get user: %v", err)
+		}
+	}
+
 	for _, t := range tags {
 		if err := rc.DeleteTag(t); err != nil {
-			e, ok := errors.ParseError(err)
-			if ok {
-				ra.CustomAbort(e.StatusCode, e.Message)
-			} else {
-				log.Error(err)
-				ra.CustomAbort(http.StatusInternalServerError, "internal error")
+			if regErr, ok := err.(*registry_error.Error); ok {
+				ra.CustomAbort(regErr.StatusCode, regErr.Detail)
 			}
+
+			log.Errorf("error occurred while deleting tags of %s: %v", repoName, err)
+			ra.CustomAbort(http.StatusInternalServerError, "internal error")
 		}
 		log.Infof("delete tag: %s %s", repoName, t)
+		go TriggerReplicationByRepository(repoName, []string{t}, models.RepOpDelete)
+
+		go func(tag string) {
+			if err := dao.AccessLog(user, projectName, repoName, tag, "delete"); err != nil {
+				log.Errorf("failed to add access log: %v", err)
+			}
+		}(t)
 	}
 
 	go func() {
 		log.Debug("refreshing catalog cache")
-		if err := svc_utils.RefreshCatalogCache(); err != nil {
+		if err := cache.RefreshCatalogCache(); err != nil {
 			log.Errorf("error occurred while refresh catalog cache: %v", err)
 		}
 	}()
-
 }
 
 type tag struct {
@@ -165,6 +203,20 @@ func (ra *RepositoryAPI) GetTags() {
 		ra.CustomAbort(http.StatusBadRequest, "repo_name is nil")
 	}
 
+	projectName := getProjectName(repoName)
+	project, err := dao.GetProjectByName(projectName)
+	if err != nil {
+		log.Errorf("failed to get project %s: %v", projectName, err)
+		ra.CustomAbort(http.StatusInternalServerError, "")
+	}
+
+	if project.Public == 0 {
+		userID := ra.ValidateUser()
+		if !checkProjectPermission(userID, project.ProjectID) {
+			ra.CustomAbort(http.StatusForbidden, "")
+		}
+	}
+
 	rc, err := ra.initRepositoryClient(repoName)
 	if err != nil {
 		log.Errorf("error occurred while initializing repository client for %s: %v", repoName, err)
@@ -175,13 +227,12 @@ func (ra *RepositoryAPI) GetTags() {
 
 	ts, err := rc.ListTag()
 	if err != nil {
-		e, ok := errors.ParseError(err)
-		if ok {
-			ra.CustomAbort(e.StatusCode, e.Message)
-		} else {
-			log.Error(err)
-			ra.CustomAbort(http.StatusInternalServerError, "internal error")
+		if regErr, ok := err.(*registry_error.Error); ok {
+			ra.CustomAbort(regErr.StatusCode, regErr.Detail)
 		}
+
+		log.Errorf("error occurred while listing tags of %s: %v", repoName, err)
+		ra.CustomAbort(http.StatusInternalServerError, "internal error")
 	}
 
 	tags = append(tags, ts...)
@@ -201,6 +252,20 @@ func (ra *RepositoryAPI) GetManifests() {
 		ra.CustomAbort(http.StatusBadRequest, "repo_name or tag is nil")
 	}
 
+	projectName := getProjectName(repoName)
+	project, err := dao.GetProjectByName(projectName)
+	if err != nil {
+		log.Errorf("failed to get project %s: %v", projectName, err)
+		ra.CustomAbort(http.StatusInternalServerError, "")
+	}
+
+	if project.Public == 0 {
+		userID := ra.ValidateUser()
+		if !checkProjectPermission(userID, project.ProjectID) {
+			ra.CustomAbort(http.StatusForbidden, "")
+		}
+	}
+
 	rc, err := ra.initRepositoryClient(repoName)
 	if err != nil {
 		log.Errorf("error occurred while initializing repository client for %s: %v", repoName, err)
@@ -212,13 +277,12 @@ func (ra *RepositoryAPI) GetManifests() {
 	mediaTypes := []string{schema1.MediaTypeManifest}
 	_, _, payload, err := rc.PullManifest(tag, mediaTypes)
 	if err != nil {
-		e, ok := errors.ParseError(err)
-		if ok {
-			ra.CustomAbort(e.StatusCode, e.Message)
-		} else {
-			log.Error(err)
-			ra.CustomAbort(http.StatusInternalServerError, "internal error")
+		if regErr, ok := err.(*registry_error.Error); ok {
+			ra.CustomAbort(regErr.StatusCode, regErr.Detail)
 		}
+
+		log.Errorf("error occurred while getting manifest of %s:%s: %v", repoName, tag, err)
+		ra.CustomAbort(http.StatusInternalServerError, "internal error")
 	}
 	mani := models.Manifest{}
 	err = json.Unmarshal(payload, &mani)
@@ -246,8 +310,8 @@ func (ra *RepositoryAPI) initRepositoryClient(repoName string) (r *registry.Repo
 
 	username, password, ok := ra.Ctx.Request.BasicAuth()
 	if ok {
-		credential := auth.NewBasicAuthCredential(username, password)
-		return registry.NewRepositoryWithCredential(repoName, endpoint, credential)
+		return newRepositoryClient(endpoint, getIsInsecure(), username, password,
+			repoName, "repository", repoName, "pull", "push", "*")
 	}
 
 	username, err = ra.getUsername()
@@ -255,7 +319,8 @@ func (ra *RepositoryAPI) initRepositoryClient(repoName string) (r *registry.Repo
 		return nil, err
 	}
 
-	return registry.NewRepositoryWithUsername(repoName, endpoint, username)
+	return cache.NewRepositoryClient(endpoint, getIsInsecure(), username, repoName,
+		"repository", repoName, "pull", "push", "*")
 }
 
 func (ra *RepositoryAPI) getUsername() (string, error) {
@@ -288,3 +353,56 @@ func (ra *RepositoryAPI) getUsername() (string, error) {
 
 	return "", nil
 }
+
+//GetTopRepos handles request GET /api/repositories/top
+func (ra *RepositoryAPI) GetTopRepos() {
+	var err error
+	var countNum int
+	count := ra.GetString("count")
+	if len(count) == 0 {
+		countNum = 10
+	} else {
+		countNum, err = strconv.Atoi(count)
+		if err != nil {
+			log.Errorf("Get parameters error--count, err: %v", err)
+			ra.CustomAbort(http.StatusBadRequest, "bad request of count")
+		}
+		if countNum <= 0 {
+			log.Warning("count must be a positive integer")
+			ra.CustomAbort(http.StatusBadRequest, "count is 0 or negative")
+		}
+	}
+	repos, err := dao.GetTopRepos(countNum)
+	if err != nil {
+		log.Errorf("error occured in get top 10 repos: %v", err)
+		ra.CustomAbort(http.StatusInternalServerError, "internal server error")
+	}
+	ra.Data["json"] = repos
+	ra.ServeJSON()
+}
+
+func newRepositoryClient(endpoint string, insecure bool, username, password, repository, scopeType, scopeName string,
+	scopeActions ...string) (*registry.Repository, error) {
+
+	credential := auth.NewBasicAuthCredential(username, password)
+	authorizer := auth.NewStandardTokenAuthorizer(credential, insecure, scopeType, scopeName, scopeActions...)
+
+	store, err := auth.NewAuthorizerStore(endpoint, insecure, authorizer)
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := registry.NewRepositoryWithModifiers(repository, endpoint, insecure, store)
+	if err != nil {
+		return nil, err
+	}
+	return client, nil
+}
+
+func getProjectName(repository string) string {
+	project := ""
+	if strings.Contains(repository, "/") {
+		project = repository[0:strings.LastIndex(repository, "/")]
+	}
+	return project
+}

api/search.go

@@ -22,7 +22,7 @@ import (
 
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
-	svc_utils "github.com/vmware/harbor/service/utils"
+	"github.com/vmware/harbor/service/cache"
 	"github.com/vmware/harbor/utils"
 	"github.com/vmware/harbor/utils/log"
 )
@@ -68,7 +68,7 @@ func (s *SearchAPI) Get() {
 		}
 	}
 
-	projectSorter := &utils.ProjectSorter{Projects: projects}
+	projectSorter := &models.ProjectSorter{Projects: projects}
 	sort.Sort(projectSorter)
 	projectResult := []map[string]interface{}{}
 	for _, p := range projects {
@@ -85,7 +85,7 @@ func (s *SearchAPI) Get() {
 		}
 	}
 
-	repositories, err2 := svc_utils.GetRepoFromCache()
+	repositories, err2 := cache.GetRepoFromCache()
 	if err2 != nil {
 		log.Errorf("Failed to get repos from cache, error: %v", err2)
 		s.CustomAbort(http.StatusInternalServerError, "Failed to get repositories search result")

api/statistic.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
-	svc_utils "github.com/vmware/harbor/service/utils"
+	"github.com/vmware/harbor/service/cache"
 	"github.com/vmware/harbor/utils/log"
 )
 
@@ -88,7 +88,7 @@ func (s *StatisticAPI) Get() {
 
 //getReposByProject returns repo numbers of specified project
 func getRepoCountByProject(projectName string) int {
-	repoList, err := svc_utils.GetRepoFromCache()
+	repoList, err := cache.GetRepoFromCache()
 	if err != nil {
 		log.Errorf("Failed to get repo from cache, error: %v", err)
 		return 0
@@ -107,7 +107,7 @@ func getRepoCountByProject(projectName string) int {
 
 //getTotalRepoCount returns total repo count
 func getTotalRepoCount() int {
-	repoList, err := svc_utils.GetRepoFromCache()
+	repoList, err := cache.GetRepoFromCache()
 	if err != nil {
 		log.Errorf("Failed to get repo from cache, error: %v", err)
 		return 0

api/target.go

@@ -0,0 +1,356 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils"
+	"github.com/vmware/harbor/utils/log"
+	"github.com/vmware/harbor/utils/registry"
+	"github.com/vmware/harbor/utils/registry/auth"
+	registry_error "github.com/vmware/harbor/utils/registry/error"
+)
+
+// TargetAPI handles request to /api/targets/ping /api/targets/{}
+type TargetAPI struct {
+	BaseAPI
+}
+
+// Prepare validates the user
+func (t *TargetAPI) Prepare() {
+	userID := t.ValidateUser()
+	isSysAdmin, err := dao.IsAdminRole(userID)
+	if err != nil {
+		log.Errorf("error occurred in IsAdminRole: %v", err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if !isSysAdmin {
+		t.CustomAbort(http.StatusForbidden, http.StatusText(http.StatusForbidden))
+	}
+}
+
+// Ping validates whether the target is reachable and whether the credential is valid
+func (t *TargetAPI) Ping() {
+	var endpoint, username, password string
+
+	idStr := t.GetString("id")
+	if len(idStr) != 0 {
+		id, err := strconv.ParseInt(idStr, 10, 64)
+		if err != nil {
+			t.CustomAbort(http.StatusBadRequest, fmt.Sprintf("id %s is invalid", idStr))
+		}
+
+		target, err := dao.GetRepTarget(id)
+		if err != nil {
+			log.Errorf("failed to get target %d: %v", id, err)
+			t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+
+		if target == nil {
+			t.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+		}
+
+		endpoint = target.URL
+		username = target.Username
+		password = target.Password
+
+		if len(password) != 0 {
+			password, err = utils.ReversibleDecrypt(password)
+			if err != nil {
+				log.Errorf("failed to decrypt password: %v", err)
+				t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+			}
+		}
+	} else {
+		endpoint = t.GetString("endpoint")
+		if len(endpoint) == 0 {
+			t.CustomAbort(http.StatusBadRequest, "id or endpoint is needed")
+		}
+
+		username = t.GetString("username")
+		password = t.GetString("password")
+	}
+
+	registry, err := newRegistryClient(endpoint, getIsInsecure(), username, password,
+		"", "", "")
+	if err != nil {
+		// timeout, dns resolve error, connection refused, etc.
+		if urlErr, ok := err.(*url.Error); ok {
+			if netErr, ok := urlErr.Err.(net.Error); ok {
+				t.CustomAbort(http.StatusBadRequest, netErr.Error())
+			}
+
+			t.CustomAbort(http.StatusBadRequest, urlErr.Error())
+		}
+
+		log.Errorf("failed to create registry client: %#v", err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if err = registry.Ping(); err != nil {
+		if regErr, ok := err.(*registry_error.Error); ok {
+			t.CustomAbort(regErr.StatusCode, regErr.Detail)
+		}
+
+		log.Errorf("failed to ping registry %s: %v", registry.Endpoint.String(), err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+}
+
+// Get ...
+func (t *TargetAPI) Get() {
+	id := t.GetIDFromURL()
+
+	target, err := dao.GetRepTarget(id)
+	if err != nil {
+		log.Errorf("failed to get target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if target == nil {
+		t.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+	}
+
+	// The reason why the password is returned is that when user just wants to
+	// modify other fields of target he does not need to input the password again.
+	// The security issue can be fixed by enable https.
+	if len(target.Password) != 0 {
+		pwd, err := utils.ReversibleDecrypt(target.Password)
+		if err != nil {
+			log.Errorf("failed to decrypt password: %v", err)
+			t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+		target.Password = pwd
+	}
+
+	t.Data["json"] = target
+	t.ServeJSON()
+}
+
+// List ...
+func (t *TargetAPI) List() {
+	name := t.GetString("name")
+	targets, err := dao.FilterRepTargets(name)
+	if err != nil {
+		log.Errorf("failed to filter targets %s: %v", name, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	for _, target := range targets {
+		if len(target.Password) == 0 {
+			continue
+		}
+
+		str, err := utils.ReversibleDecrypt(target.Password)
+		if err != nil {
+			log.Errorf("failed to decrypt password: %v", err)
+			t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+		target.Password = str
+	}
+
+	t.Data["json"] = targets
+	t.ServeJSON()
+	return
+}
+
+// Post ...
+func (t *TargetAPI) Post() {
+	target := &models.RepTarget{}
+	t.DecodeJSONReqAndValidate(target)
+
+	ta, err := dao.GetRepTargetByName(target.Name)
+	if err != nil {
+		log.Errorf("failed to get target %s: %v", target.Name, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if ta != nil {
+		t.CustomAbort(http.StatusConflict, "name is already used")
+	}
+
+	ta, err = dao.GetRepTargetByConnInfo(target.URL, target.Username)
+	if err != nil {
+		log.Errorf("failed to get target [ %s %s ]: %v", target.URL, target.Username, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if ta != nil {
+		t.CustomAbort(http.StatusConflict, "the connection information[ endpoint, username ] is conflict with other target")
+	}
+
+	if len(target.Password) != 0 {
+		target.Password = utils.ReversibleEncrypt(target.Password)
+	}
+
+	id, err := dao.AddRepTarget(*target)
+	if err != nil {
+		log.Errorf("failed to add target: %v", err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	t.Redirect(http.StatusCreated, strconv.FormatInt(id, 10))
+}
+
+// Put ...
+func (t *TargetAPI) Put() {
+	id := t.GetIDFromURL()
+
+	originalTarget, err := dao.GetRepTarget(id)
+	if err != nil {
+		log.Errorf("failed to get target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if originalTarget == nil {
+		t.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+	}
+
+	policies, err := dao.GetRepPolicyByTarget(id)
+	if err != nil {
+		log.Errorf("failed to get policies according target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	hasEnabledPolicy := false
+	for _, policy := range policies {
+		if policy.Enabled == 1 {
+			hasEnabledPolicy = true
+			break
+		}
+	}
+
+	if hasEnabledPolicy {
+		t.CustomAbort(http.StatusBadRequest, "the target is associated with policy which is enabled")
+	}
+
+	target := &models.RepTarget{}
+	t.DecodeJSONReqAndValidate(target)
+
+	if target.Name != originalTarget.Name {
+		ta, err := dao.GetRepTargetByName(target.Name)
+		if err != nil {
+			log.Errorf("failed to get target %s: %v", target.Name, err)
+			t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+
+		if ta != nil {
+			t.CustomAbort(http.StatusConflict, "name is already used")
+		}
+	}
+
+	if target.URL != originalTarget.URL || target.Username != originalTarget.Username {
+		ta, err := dao.GetRepTargetByConnInfo(target.URL, target.Username)
+		if err != nil {
+			log.Errorf("failed to get target [ %s %s ]: %v", target.URL, target.Username, err)
+			t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+		}
+
+		if ta != nil {
+			t.CustomAbort(http.StatusConflict, "the connection information[ endpoint, username ] is conflict with other target")
+		}
+	}
+
+	target.ID = id
+
+	if len(target.Password) != 0 {
+		target.Password = utils.ReversibleEncrypt(target.Password)
+	}
+
+	if err := dao.UpdateRepTarget(*target); err != nil {
+		log.Errorf("failed to update target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+}
+
+// Delete ...
+func (t *TargetAPI) Delete() {
+	id := t.GetIDFromURL()
+
+	target, err := dao.GetRepTarget(id)
+	if err != nil {
+		log.Errorf("failed to get target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if target == nil {
+		t.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+	}
+
+	policies, err := dao.GetRepPolicyByTarget(id)
+	if err != nil {
+		log.Errorf("failed to get policies according target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if len(policies) > 0 {
+		t.CustomAbort(http.StatusBadRequest, "the target is used by policies, can not be deleted")
+	}
+
+	if err = dao.DeleteRepTarget(id); err != nil {
+		log.Errorf("failed to delete target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+}
+
+func newRegistryClient(endpoint string, insecure bool, username, password, scopeType, scopeName string,
+	scopeActions ...string) (*registry.Registry, error) {
+	credential := auth.NewBasicAuthCredential(username, password)
+	authorizer := auth.NewStandardTokenAuthorizer(credential, insecure, scopeType, scopeName, scopeActions...)
+
+	store, err := auth.NewAuthorizerStore(endpoint, insecure, authorizer)
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := registry.NewRegistryWithModifiers(endpoint, insecure, store)
+	if err != nil {
+		return nil, err
+	}
+	return client, nil
+}
+
+// ListPolicies ...
+func (t *TargetAPI) ListPolicies() {
+	id := t.GetIDFromURL()
+
+	target, err := dao.GetRepTarget(id)
+	if err != nil {
+		log.Errorf("failed to get target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	if target == nil {
+		t.CustomAbort(http.StatusNotFound, http.StatusText(http.StatusNotFound))
+	}
+
+	policies, err := dao.GetRepPolicyByTarget(id)
+	if err != nil {
+		log.Errorf("failed to get policies according target %d: %v", id, err)
+		t.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
+	}
+
+	t.Data["json"] = policies
+	t.ServeJSON()
+}

api/user.go

@@ -16,8 +16,10 @@
 package api
 
 import (
+	"fmt"
 	"net/http"
 	"os"
+	"regexp"
 	"strconv"
 	"strings"
 
@@ -133,14 +135,52 @@ func (ua *UserAPI) Get() {
 }
 
 // Put ...
-func (ua *UserAPI) Put() { //currently only for toggle admin, so no request body
+func (ua *UserAPI) Put() {
+	ldapAdminUser := (ua.AuthMode == "ldap_auth" && ua.userID == 1 && ua.userID == ua.currentUserID)
+
+	if !(ua.AuthMode == "db_auth" || ldapAdminUser) {
+		ua.CustomAbort(http.StatusForbidden, "")
+	}
 	if !ua.IsAdmin {
-		log.Warningf("current user, id: %d does not have admin role, can not update other user's role", ua.currentUserID)
-		ua.RenderError(http.StatusForbidden, "User does not have admin role")
+		if ua.userID != ua.currentUserID {
+			log.Warning("Guests can only change their own account.")
+			ua.CustomAbort(http.StatusForbidden, "Guests can only change their own account.")
+		}
+	}
+	user := models.User{UserID: ua.userID}
+	ua.DecodeJSONReq(&user)
+	err := commonValidate(user)
+	if err != nil {
+		log.Warning("Bad request in change user profile: %v", err)
+		ua.RenderError(http.StatusBadRequest, "change user profile error:"+err.Error())
 		return
 	}
 	userQuery := models.User{UserID: ua.userID}
-	dao.ToggleUserAdminRole(userQuery)
+	u, err := dao.GetUser(userQuery)
+	if err != nil {
+		log.Errorf("Error occurred in GetUser, error: %v", err)
+		ua.CustomAbort(http.StatusInternalServerError, "Internal error.")
+	}
+	if u == nil {
+		log.Errorf("User with Id: %d does not exist", ua.userID)
+		ua.CustomAbort(http.StatusNotFound, "")
+	}
+	if u.Email != user.Email {
+		emailExist, err := dao.UserExists(user, "email")
+		if err != nil {
+			log.Errorf("Error occurred in change user profile: %v", err)
+			ua.CustomAbort(http.StatusInternalServerError, "Internal error.")
+		}
+		if emailExist {
+			log.Warning("email has already been used!")
+			ua.RenderError(http.StatusConflict, "email has already been used!")
+			return
+		}
+	}
+	if err := dao.ChangeUserProfile(user); err != nil {
+		log.Errorf("Failed to update user profile, error: %v", err)
+		ua.CustomAbort(http.StatusInternalServerError, err.Error())
+	}
 }
 
 // Post ...
@@ -157,12 +197,36 @@ func (ua *UserAPI) Post() {
 
 	user := models.User{}
 	ua.DecodeJSONReq(&user)
-
+	err := validate(user)
+	if err != nil {
+		log.Warning("Bad request in Register: %v", err)
+		ua.RenderError(http.StatusBadRequest, "register error:"+err.Error())
+		return
+	}
+	userExist, err := dao.UserExists(user, "username")
+	if err != nil {
+		log.Errorf("Error occurred in Register: %v", err)
+		ua.CustomAbort(http.StatusInternalServerError, "Internal error.")
+	}
+	if userExist {
+		log.Warning("username has already been used!")
+		ua.RenderError(http.StatusConflict, "username has already been used!")
+		return
+	}
+	emailExist, err := dao.UserExists(user, "email")
+	if err != nil {
+		log.Errorf("Error occurred in change user profile: %v", err)
+		ua.CustomAbort(http.StatusInternalServerError, "Internal error.")
+	}
+	if emailExist {
+		log.Warning("email has already been used!")
+		ua.RenderError(http.StatusConflict, "email has already been used!")
+		return
+	}
 	userID, err := dao.Register(user)
 	if err != nil {
 		log.Errorf("Error occurred in Register: %v", err)
-		ua.RenderError(http.StatusInternalServerError, "Internal error.")
-		return
+		ua.CustomAbort(http.StatusInternalServerError, "Internal error.")
 	}
 
 	ua.Redirect(http.StatusCreated, strconv.FormatInt(userID, 10))
@@ -186,9 +250,8 @@ func (ua *UserAPI) Delete() {
 
 // ChangePassword handles PUT to /api/users/{}/password
 func (ua *UserAPI) ChangePassword() {
-
 	ldapAdminUser := (ua.AuthMode == "ldap_auth" && ua.userID == 1 && ua.userID == ua.currentUserID)
-	
+
 	if !(ua.AuthMode == "db_auth" || ldapAdminUser) {
 		ua.CustomAbort(http.StatusForbidden, "")
 	}
@@ -228,3 +291,80 @@ func (ua *UserAPI) ChangePassword() {
 		ua.CustomAbort(http.StatusInternalServerError, "Internal error.")
 	}
 }
+
+// ToggleUserAdminRole handles PUT api/users/{}/sysadmin
+func (ua *UserAPI) ToggleUserAdminRole() {
+	if !ua.IsAdmin {
+		log.Warningf("current user, id: %d does not have admin role, can not update other user's role", ua.currentUserID)
+		ua.RenderError(http.StatusForbidden, "User does not have admin role")
+		return
+	}
+	userQuery := models.User{UserID: ua.userID}
+	ua.DecodeJSONReq(&userQuery)
+	if err := dao.ToggleUserAdminRole(userQuery.UserID, userQuery.HasAdminRole); err != nil {
+		log.Errorf("Error occurred in ToggleUserAdminRole: %v", err)
+		ua.CustomAbort(http.StatusInternalServerError, "Internal error.")
+	}
+}
+
+// validate only validate when user register
+func validate(user models.User) error {
+
+	if isIllegalLength(user.Username, 0, 20) {
+		return fmt.Errorf("Username with illegal length.")
+	}
+	if isContainIllegalChar(user.Username, []string{",", "~", "#", "$", "%"}) {
+		return fmt.Errorf("Username contains illegal characters.")
+	}
+	if isIllegalLength(user.Password, 0, 20) {
+		return fmt.Errorf("Password with illegal length.")
+	}
+	if err := commonValidate(user); err != nil {
+		return err
+	}
+	return nil
+}
+
+//commonValidate validates email, realname, comment information when user register or change their profile
+func commonValidate(user models.User) error {
+
+	if len(user.Email) > 0 {
+		if m, _ := regexp.MatchString(`^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$`, user.Email); !m {
+			return fmt.Errorf("Email with illegal format.")
+		}
+	} else {
+		return fmt.Errorf("Email can't be empty")
+	}
+
+	if isIllegalLength(user.Realname, 0, 20) {
+		return fmt.Errorf("Realname with illegal length.")
+	}
+
+	if isContainIllegalChar(user.Realname, []string{",", "~", "#", "$", "%"}) {
+		return fmt.Errorf("Realname contains illegal characters.")
+	}
+	if isIllegalLength(user.Comment, -1, 30) {
+		return fmt.Errorf("Comment with illegal length.")
+	}
+	return nil
+
+}
+
+func isIllegalLength(s string, min int, max int) bool {
+	if min == -1 {
+		return (len(s) > max)
+	}
+	if max == -1 {
+		return (len(s) <= min)
+	}
+	return (len(s) < min || len(s) > max)
+}
+
+func isContainIllegalChar(s string, illegalChar []string) bool {
+	for _, c := range illegalChar {
+		if strings.Index(s, c) >= 0 {
+			return true
+		}
+	}
+	return false
+}

api/utils.go

@@ -16,6 +16,14 @@
 package api
 
 import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"strings"
+
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
 	"github.com/vmware/harbor/utils/log"
@@ -51,11 +59,13 @@ func listRoles(userID int, projectID int64) ([]models.Role, error) {
 	roles := make([]models.Role, 0, 1)
 	isSysAdmin, err := dao.IsAdminRole(userID)
 	if err != nil {
+		log.Errorf("failed to determine whether the user %d is system admin: %v", userID, err)
 		return roles, err
 	}
 	if isSysAdmin {
 		role, err := dao.GetRoleByID(models.PROJECTADMIN)
 		if err != nil {
+			log.Errorf("failed to get role %d: %v", models.PROJECTADMIN, err)
 			return roles, err
 		}
 		roles = append(roles, *role)
@@ -64,6 +74,7 @@ func listRoles(userID int, projectID int64) ([]models.Role, error) {
 
 	rs, err := dao.GetUserProjectRoles(userID, projectID)
 	if err != nil {
+		log.Errorf("failed to get user %d 's roles for project %d: %v", userID, projectID, err)
 		return roles, err
 	}
 	roles = append(roles, rs...)
@@ -81,3 +92,142 @@ func checkUserExists(name string) int {
 	}
 	return 0
 }
+
+// TriggerReplication triggers the replication according to the policy
+func TriggerReplication(policyID int64, repository string,
+	tags []string, operation string) error {
+	data := struct {
+		PolicyID  int64    `json:"policy_id"`
+		Repo      string   `json:"repository"`
+		Operation string   `json:"operation"`
+		TagList   []string `json:"tags"`
+	}{
+		PolicyID:  policyID,
+		Repo:      repository,
+		TagList:   tags,
+		Operation: operation,
+	}
+
+	b, err := json.Marshal(&data)
+	if err != nil {
+		return err
+	}
+
+	url := buildReplicationURL()
+
+	resp, err := http.DefaultClient.Post(url, "application/json", bytes.NewBuffer(b))
+	if err != nil {
+		return err
+	}
+
+	if resp.StatusCode == http.StatusOK {
+		return nil
+	}
+
+	defer resp.Body.Close()
+
+	b, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+
+	return fmt.Errorf("%d %s", resp.StatusCode, string(b))
+}
+
+// GetPoliciesByRepository returns policies according the repository
+func GetPoliciesByRepository(repository string) ([]*models.RepPolicy, error) {
+	repository = strings.TrimSpace(repository)
+	repository = strings.TrimRight(repository, "/")
+	projectName := repository[:strings.LastIndex(repository, "/")]
+
+	project, err := dao.GetProjectByName(projectName)
+	if err != nil {
+		return nil, err
+	}
+
+	policies, err := dao.GetRepPolicyByProject(project.ProjectID)
+	if err != nil {
+		return nil, err
+	}
+
+	return policies, nil
+}
+
+// TriggerReplicationByRepository triggers the replication according to the repository
+func TriggerReplicationByRepository(repository string, tags []string, operation string) {
+	policies, err := GetPoliciesByRepository(repository)
+	if err != nil {
+		log.Errorf("failed to get policies for repository %s: %v", repository, err)
+		return
+	}
+
+	for _, policy := range policies {
+		if err := TriggerReplication(policy.ID, repository, tags, operation); err != nil {
+			log.Errorf("failed to trigger replication of policy %d for %s: %v", policy.ID, repository, err)
+		} else {
+			log.Infof("replication of policy %d for %s triggered", policy.ID, repository)
+		}
+	}
+}
+
+func postReplicationAction(policyID int64, acton string) error {
+	data := struct {
+		PolicyID int64  `json:"policy_id"`
+		Action   string `json:"action"`
+	}{
+		PolicyID: policyID,
+		Action:   acton,
+	}
+
+	b, err := json.Marshal(&data)
+	if err != nil {
+		return err
+	}
+
+	url := buildReplicationActionURL()
+
+	resp, err := http.DefaultClient.Post(url, "application/json", bytes.NewBuffer(b))
+	if err != nil {
+		return err
+	}
+
+	if resp.StatusCode == http.StatusOK {
+		return nil
+	}
+
+	defer resp.Body.Close()
+
+	b, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+
+	return fmt.Errorf("%d %s", resp.StatusCode, string(b))
+}
+
+func buildReplicationURL() string {
+	url := getJobServiceURL()
+	return fmt.Sprintf("%s/api/jobs/replication", url)
+}
+
+func buildJobLogURL(jobID string) string {
+	url := getJobServiceURL()
+	return fmt.Sprintf("%s/api/jobs/replication/%s/log", url, jobID)
+}
+
+func buildReplicationActionURL() string {
+	url := getJobServiceURL()
+	return fmt.Sprintf("%s/api/jobs/replication/actions", url)
+}
+
+func getJobServiceURL() string {
+	url := os.Getenv("JOB_SERVICE_URL")
+	url = strings.TrimSpace(url)
+	url = strings.TrimRight(url, "/")
+
+	if len(url) == 0 {
+		url = "http://jobservice"
+	}
+
+	return url
+}

auth/ldap/ldap.go

@@ -111,6 +111,9 @@ func (l *Auth) Authenticate(m models.AuthModel) (*models.User, error) {
 		u.Realname = m.Principal
 		u.Password = "12345678AbC"
 		u.Comment = "registered from LDAP."
+		if u.Email == "" {
+			u.Email = u.Username + "@placeholder.com"
+		}
 		userID, err := dao.Register(u)
 		if err != nil {
 			return nil, err

controllers/accountsetting.go

@@ -0,0 +1,11 @@
+package controllers
+
+// AccountSettingController handles request to /account_setting
+type AccountSettingController struct {
+	BaseController
+}
+
+// Get renders the account settings page
+func (asc *AccountSettingController) Get() {
+	asc.Forward("page_title_account_setting", "account-settings.htm")
+}

controllers/addnew.go

@@ -0,0 +1,32 @@
+package controllers
+
+import (
+	"net/http"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// AddNewController handles requests to /add_new
+type AddNewController struct {
+	BaseController
+}
+
+// Get renders the add new page
+func (anc *AddNewController) Get() {
+	sessionUserID := anc.GetSession("userId")
+	anc.Data["AddNew"] = false
+	if sessionUserID != nil {
+		isAdmin, err := dao.IsAdminRole(sessionUserID.(int))
+		if err != nil {
+			log.Errorf("Error occurred in IsAdminRole: %v", err)
+			anc.CustomAbort(http.StatusInternalServerError, "")
+		}
+		if isAdmin && anc.AuthMode == "db_auth" {
+			anc.Data["AddNew"] = true
+			anc.Forward("page_title_add_new", "sign-up.htm")
+			return
+		}
+	}
+	anc.CustomAbort(http.StatusUnauthorized, "Status Unauthorized.")
+}

controllers/adminoption.go

@@ -0,0 +1,11 @@
+package controllers
+
+// AdminOptionController handles requests to /admin_option
+type AdminOptionController struct {
+	BaseController
+}
+
+// Get renders the admin options  page
+func (aoc *AdminOptionController) Get() {
+	aoc.Forward("page_title_admin_option", "admin-options.htm")
+}

controllers/base.go

@@ -1,47 +1,24 @@
-/*
-   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
 package controllers
 
 import (
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/astaxie/beego"
 	"github.com/beego/i18n"
+	"github.com/vmware/harbor/auth"
 	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
 	"github.com/vmware/harbor/utils/log"
 )
 
-// CommonController handles request from UI that doesn't expect a page, such as /login /logout ...
-type CommonController struct {
-	BaseController
-}
-
-// Render returns nil.
-func (c *CommonController) Render() error {
-	return nil
-}
-
 // BaseController wraps common methods such as i18n support, forward,  which can be leveraged by other UI render controllers.
 type BaseController struct {
 	beego.Controller
 	i18n.Locale
 	SelfRegistration bool
-	IsLdapAdminUser  bool	
 	IsAdmin          bool
 	AuthMode         string
 }
@@ -52,33 +29,48 @@ type langType struct {
 }
 
 const (
+	viewPath    = "sections"
+	prefixNg    = ""
 	defaultLang = "en-US"
 )
 
 var supportLanguages map[string]langType
+var mappingLangNames map[string]string
 
 // Prepare extracts the language information from request and populate data for rendering templates.
 func (b *BaseController) Prepare() {
 
 	var lang string
-	al := b.Ctx.Request.Header.Get("Accept-Language")
 
-	if len(al) > 4 {
-		al = al[:5] // Only compare first 5 letters.
-		if i18n.IsExist(al) {
-			lang = al
+	langCookie, err := b.Ctx.Request.Cookie("language")
+	if err != nil {
+		log.Errorf("Error occurred in Request.Cookie: %v", err)
+	}
+	if langCookie != nil {
+		lang = langCookie.Value
+	}
+	if len(lang) == 0 {
+		sessionLang := b.GetSession("lang")
+		if sessionLang != nil {
+			b.SetSession("Lang", lang)
+			lang = sessionLang.(string)
+		} else {
+			al := b.Ctx.Request.Header.Get("Accept-Language")
+			if len(al) > 4 {
+				al = al[:5] // Only compare first 5 letters.
+				if i18n.IsExist(al) {
+					lang = al
+				}
+			}
 		}
 	}
 
-	if _, exist := supportLanguages[lang]; exist == false { //Check if support the request language.
+	if _, exist := supportLanguages[lang]; !exist { //Check if support the request language.
 		lang = defaultLang //Set default language if not supported.
 	}
 
-	sessionLang := b.GetSession("lang")
-	if sessionLang != nil {
-		b.SetSession("Lang", lang)
-		lang = sessionLang.(string)
-	}
+	b.Ctx.SetCookie("language", lang, 0, "/")
+	b.SetSession("Lang", lang)
 
 	curLang := langType{
 		Lang: lang,
@@ -106,60 +98,101 @@ func (b *BaseController) Prepare() {
 	b.AuthMode = authMode
 	b.Data["AuthMode"] = b.AuthMode
 
-	selfRegistration := strings.ToLower(os.Getenv("SELF_REGISTRATION"))
-
-	if selfRegistration == "on" {
-		b.SelfRegistration = true
-	}
-
-	sessionUserID := b.GetSession("userId")
-	if sessionUserID != nil {
-		b.Data["Username"] = b.GetSession("username")
-		b.Data["UserId"] = sessionUserID.(int)
-		
-		if (sessionUserID == 1 && b.AuthMode == "ldap_auth") {
-			b.IsLdapAdminUser = true
-		}
-		
-		var err error
-		b.IsAdmin, err = dao.IsAdminRole(sessionUserID.(int))
-		if err != nil {
-			log.Errorf("Error occurred in IsAdminRole:%v", err)
-			b.CustomAbort(http.StatusInternalServerError, "Internal error.")
-		}
-	}
-
-	b.Data["IsAdmin"] = b.IsAdmin
-	b.Data["SelfRegistration"] = b.SelfRegistration
-	b.Data["IsLdapAdminUser"] = b.IsLdapAdminUser
-
 }
 
-// ForwardTo setup layout and template for content for a page.
-func (b *BaseController) ForwardTo(pageTitle string, pageName string) {
-	b.Layout = "segment/base-layout.tpl"
-	b.TplName = "segment/base-layout.tpl"
-	b.Data["PageTitle"] = b.Tr(pageTitle)
+// Forward to setup layout and template for content for a page.
+func (b *BaseController) Forward(title, templateName string) {
+	b.Layout = filepath.Join(prefixNg, "layout.htm")
+	b.TplName = filepath.Join(prefixNg, templateName)
+	b.Data["Title"] = b.Tr(title)
 	b.LayoutSections = make(map[string]string)
-	b.LayoutSections["HeaderInc"] = "segment/header-include.tpl"
-	b.LayoutSections["HeaderContent"] = "segment/header-content.tpl"
-	b.LayoutSections["BodyContent"] = pageName + ".tpl"
-	b.LayoutSections["ModalDialog"] = "segment/modal-dialog.tpl"
-	b.LayoutSections["FootContent"] = "segment/foot-content.tpl"
+	b.LayoutSections["HeaderInclude"] = filepath.Join(prefixNg, viewPath, "header-include.htm")
+	b.LayoutSections["FooterInclude"] = filepath.Join(prefixNg, viewPath, "footer-include.htm")
+	b.LayoutSections["HeaderContent"] = filepath.Join(prefixNg, viewPath, "header-content.htm")
+	b.LayoutSections["FooterContent"] = filepath.Join(prefixNg, viewPath, "footer-content.htm")
+
 }
 
 var langTypes []*langType
 
+// CommonController handles request from UI that doesn't expect a page, such as /SwitchLanguage /logout ...
+type CommonController struct {
+	BaseController
+}
+
+// Render returns nil.
+func (cc *CommonController) Render() error {
+	return nil
+}
+
+// Login handles login request from UI.
+func (cc *CommonController) Login() {
+	principal := cc.GetString("principal")
+	password := cc.GetString("password")
+
+	user, err := auth.Login(models.AuthModel{
+		Principal: principal,
+		Password:  password,
+	})
+	if err != nil {
+		log.Errorf("Error occurred in UserLogin: %v", err)
+		cc.CustomAbort(http.StatusUnauthorized, "")
+	}
+
+	if user == nil {
+		cc.CustomAbort(http.StatusUnauthorized, "")
+	}
+
+	cc.SetSession("userId", user.UserID)
+	cc.SetSession("username", user.Username)
+}
+
+// LogOut Habor UI
+func (cc *CommonController) LogOut() {
+	cc.DestroySession()
+}
+
+// SwitchLanguage User can swith to prefered language
+func (cc *CommonController) SwitchLanguage() {
+	lang := cc.GetString("lang")
+	hash := cc.GetString("hash")
+	if _, exist := supportLanguages[lang]; !exist {
+		lang = defaultLang
+	}
+	cc.SetSession("lang", lang)
+	cc.Data["Lang"] = lang
+	cc.Redirect(cc.Ctx.Request.Header.Get("Referer")+hash, http.StatusFound)
+}
+
+// UserExists checks if user exists when user input value in sign in form.
+func (cc *CommonController) UserExists() {
+	target := cc.GetString("target")
+	value := cc.GetString("value")
+
+	user := models.User{}
+	switch target {
+	case "username":
+		user.Username = value
+	case "email":
+		user.Email = value
+	}
+
+	exist, err := dao.UserExists(user, target)
+	if err != nil {
+		log.Errorf("Error occurred in UserExists: %v", err)
+		cc.CustomAbort(http.StatusInternalServerError, "Internal error.")
+	}
+	cc.Data["json"] = exist
+	cc.ServeJSON()
+}
+
 func init() {
 
 	//conf/app.conf -> os.Getenv("config_path")
 	configPath := os.Getenv("CONFIG_PATH")
 	if len(configPath) != 0 {
 		log.Infof("Config path: %s", configPath)
-		beego.AppConfigPath = configPath
-		if err := beego.ParseConfig(); err != nil {
-			log.Warningf("Failed to parse config file: %s, error: %v", configPath, err)
-		}
+		beego.LoadAppConfig("ini", configPath)
 	}
 
 	beego.AddFuncMap("i18n", i18n.Tr)
@@ -170,18 +203,17 @@ func init() {
 	supportLanguages = make(map[string]langType)
 
 	langTypes = make([]*langType, 0, len(langs))
-	for i, v := range langs {
+
+	for i, lang := range langs {
 		t := langType{
-			Lang: v,
+			Lang: lang,
 			Name: names[i],
 		}
 		langTypes = append(langTypes, &t)
-		supportLanguages[v] = t
-	}
-
-	for _, lang := range langs {
+		supportLanguages[lang] = t
 		if err := i18n.SetMessage(lang, "static/i18n/"+"locale_"+lang+".ini"); err != nil {
 			log.Errorf("Fail to set message file: %s", err.Error())
 		}
 	}
+
 }

controllers/changepassword.go

@@ -0,0 +1,11 @@
+package controllers
+
+// ChangePasswordController handles request to /change_password
+type ChangePasswordController struct {
+	BaseController
+}
+
+// Get renders the change password page
+func (asc *ChangePasswordController) Get() {
+	asc.Forward("page_title_change_password", "change-password.htm")
+}

controllers/dashboard.go

@@ -0,0 +1,11 @@
+package controllers
+
+// DashboardController handles requests to /dashboard
+type DashboardController struct {
+	BaseController
+}
+
+// Get renders the dashboard  page
+func (dc *DashboardController) Get() {
+	dc.Forward("page_title_dashboard", "dashboard.htm")
+}

controllers/index.go

@@ -0,0 +1,11 @@
+package controllers
+
+// IndexController handles request to /
+type IndexController struct {
+	BaseController
+}
+
+// Get renders the index page
+func (ic *IndexController) Get() {
+	ic.Forward("page_title_index", "index.htm")
+}

controllers/itemdetail.go

@@ -1,102 +0,0 @@
-/*
-   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package controllers
-
-import (
-	"net/http"
-	"net/url"
-	"os"
-
-	"github.com/vmware/harbor/dao"
-	"github.com/vmware/harbor/utils/log"
-)
-
-// ItemDetailController handles requet to /registry/detail, which shows the detail of a project.
-type ItemDetailController struct {
-	BaseController
-}
-
-// Get will check if user has permission to view a certain project, if not user will be redirected to signin or his homepage.
-// If the check is passed it renders the project detail page.
-func (idc *ItemDetailController) Get() {
-
-	projectID, _ := idc.GetInt64("project_id")
-
-	if projectID <= 0 {
-		log.Errorf("Invalid project id: %d", projectID)
-		idc.Redirect("/signIn", http.StatusFound)
-		return
-	}
-
-	project, err := dao.GetProjectByID(projectID)
-
-	if err != nil {
-		log.Errorf("Error occurred in GetProjectById: %v", err)
-		idc.CustomAbort(http.StatusInternalServerError, "Internal error.")
-	}
-
-	if project == nil {
-		idc.Redirect("/signIn", http.StatusFound)
-		return
-	}
-
-	sessionUserID := idc.GetSession("userId")
-
-	if project.Public != 1 && sessionUserID == nil {
-		idc.Redirect("/signIn?uri="+url.QueryEscape(idc.Ctx.Input.URI()), http.StatusFound)
-		return
-	}
-
-	if sessionUserID != nil {
-
-		userID := sessionUserID.(int)
-
-		idc.Data["Username"] = idc.GetSession("username")
-		idc.Data["UserId"] = userID
-
-		roleList, err := dao.GetUserProjectRoles(userID, projectID)
-		if err != nil {
-			log.Errorf("Error occurred in GetUserProjectRoles: %v", err)
-			idc.CustomAbort(http.StatusInternalServerError, "Internal error.")
-		}
-
-		isAdmin, err := dao.IsAdminRole(userID)
-		if err != nil {
-			log.Errorf("Error occurred in IsAdminRole: %v", err)
-			idc.CustomAbort(http.StatusInternalServerError, "Internal error.")
-		}
-
-		if !isAdmin && (project.Public == 0 && len(roleList) == 0) {
-			idc.Redirect("/registry/project", http.StatusFound)
-			return
-		}
-
-		if len(roleList) > 0 {
-			idc.Data["RoleId"] = roleList[0].RoleID
-		}
-	}
-
-	idc.Data["ProjectId"] = project.ProjectID
-	idc.Data["ProjectName"] = project.Name
-	idc.Data["OwnerName"] = project.OwnerName
-	idc.Data["OwnerId"] = project.OwnerID
-
-	idc.Data["HarborRegUrl"] = os.Getenv("HARBOR_REG_URL")
-	idc.Data["RepoName"] = idc.GetString("repo_name")
-
-	idc.ForwardTo("page_title_item_details", "item-detail")
-
-}

controllers/login.go

@@ -1,82 +0,0 @@
-/*
-   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package controllers
-
-import (
-	"net/http"
-
-	"github.com/vmware/harbor/auth"
-	"github.com/vmware/harbor/models"
-	"github.com/vmware/harbor/utils/log"
-)
-
-// IndexController handles request to /
-type IndexController struct {
-	BaseController
-}
-
-// Get renders the index page.
-func (c *IndexController) Get() {
-	c.Data["Username"] = c.GetSession("username")
-	c.ForwardTo("page_title_index", "index")
-}
-
-// SignInController handles request to /signIn
-type SignInController struct {
-	BaseController
-}
-
-// Get renders Sign In page.
-func (sic *SignInController) Get() {
-	sic.ForwardTo("page_title_sign_in", "sign-in")
-}
-
-// Login handles login request from UI.
-func (c *CommonController) Login() {
-	principal := c.GetString("principal")
-	password := c.GetString("password")
-
-	user, err := auth.Login(models.AuthModel{
-		Principal: principal,
-		Password:  password,
-	})
-	if err != nil {
-		log.Errorf("Error occurred in UserLogin: %v", err)
-		c.CustomAbort(http.StatusUnauthorized, "")
-	}
-
-	if user == nil {
-		c.CustomAbort(http.StatusUnauthorized, "")
-	}
-
-	c.SetSession("userId", user.UserID)
-	c.SetSession("username", user.Username)
-}
-
-// SwitchLanguage handles UI request to switch between different languages and re-render template based on language.
-func (c *CommonController) SwitchLanguage() {
-	lang := c.GetString("lang")
-	if lang == "en-US" || lang == "zh-CN" || lang == "de-DE" || lang == "ru-RU" || lang == "ja-JP" {
-		c.SetSession("lang", lang)
-		c.Data["Lang"] = lang
-	}
-	c.Redirect(c.Ctx.Request.Header.Get("Referer"), http.StatusFound)
-}
-
-// Logout handles UI request to logout.
-func (c *CommonController) Logout() {
-	c.DestroySession()
-}

controllers/navigationdetail.go

@@ -0,0 +1,36 @@
+package controllers
+
+import (
+	"net/http"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// NavigationDetailController handles requests to /navigation_detail
+type NavigationDetailController struct {
+	BaseController
+}
+
+// Get renders user's navigation details header
+func (ndc *NavigationDetailController) Get() {
+	sessionUserID := ndc.GetSession("userId")
+	var isAdmin int
+	if sessionUserID != nil {
+		userID := sessionUserID.(int)
+		u, err := dao.GetUser(models.User{UserID: userID})
+		if err != nil {
+			log.Errorf("Error occurred in GetUser, error: %v", err)
+			ndc.CustomAbort(http.StatusInternalServerError, "Internal error.")
+		}
+		if u == nil {
+			log.Warningf("User was deleted already, user id: %d, canceling request.", userID)
+			ndc.CustomAbort(http.StatusUnauthorized, "")
+		}
+		isAdmin = u.HasAdminRole
+	}
+	ndc.Data["IsAdmin"] = isAdmin
+	ndc.TplName = "navigation-detail.htm"
+	ndc.Render()
+}

controllers/navigationheader.go

@@ -0,0 +1,39 @@
+package controllers
+
+import (
+	"net/http"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// NavigationHeaderController handles requests to /navigation_header
+type NavigationHeaderController struct {
+	BaseController
+}
+
+// Get renders user's navigation header
+func (nhc *NavigationHeaderController) Get() {
+	sessionUserID := nhc.GetSession("userId")
+	var hasLoggedIn bool
+	var isAdmin int
+	if sessionUserID != nil {
+		hasLoggedIn = true
+		userID := sessionUserID.(int)
+		u, err := dao.GetUser(models.User{UserID: userID})
+		if err != nil {
+			log.Errorf("Error occurred in GetUser, error: %v", err)
+			nhc.CustomAbort(http.StatusInternalServerError, "Internal error.")
+		}
+		if u == nil {
+			log.Warningf("User was deleted already, user id: %d, canceling request.", userID)
+			nhc.CustomAbort(http.StatusUnauthorized, "")
+		}
+		isAdmin = u.HasAdminRole
+	}
+	nhc.Data["HasLoggedIn"] = hasLoggedIn
+	nhc.Data["IsAdmin"] = isAdmin
+	nhc.TplName = "navigation-header.htm"
+	nhc.Render()
+}

controllers/optionalmenu.go

@@ -0,0 +1,52 @@
+package controllers
+
+import (
+	"net/http"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// OptionalMenuController handles request to /optional_menu
+type OptionalMenuController struct {
+	BaseController
+}
+
+// Get renders optional menu, Admin user has "Add User" menu
+func (omc *OptionalMenuController) Get() {
+	sessionUserID := omc.GetSession("userId")
+
+	var hasLoggedIn bool
+	var allowAddNew bool
+
+	if sessionUserID != nil {
+		hasLoggedIn = true
+		userID := sessionUserID.(int)
+		u, err := dao.GetUser(models.User{UserID: userID})
+		if err != nil {
+			log.Errorf("Error occurred in GetUser, error: %v", err)
+			omc.CustomAbort(http.StatusInternalServerError, "Internal error.")
+		}
+		if u == nil {
+			log.Warningf("User was deleted already, user id: %d, canceling request.", userID)
+			omc.CustomAbort(http.StatusUnauthorized, "")
+		}
+		omc.Data["Username"] = u.Username
+
+		isAdmin, err := dao.IsAdminRole(sessionUserID.(int))
+		if err != nil {
+			log.Errorf("Error occurred in IsAdminRole: %v", err)
+			omc.CustomAbort(http.StatusInternalServerError, "")
+		}
+
+		if isAdmin && omc.AuthMode == "db_auth" {
+			allowAddNew = true
+		}
+	}
+	omc.Data["AddNew"] = allowAddNew
+	omc.Data["HasLoggedIn"] = hasLoggedIn
+	omc.TplName = "optional-menu.htm"
+	omc.Render()
+
+}

controllers/password.go

@@ -1,18 +1,3 @@
-/*
-   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
 package controllers
 
 import (
@@ -22,40 +7,13 @@ import (
 	"regexp"
 	"text/template"
 
+	"github.com/astaxie/beego"
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
 	"github.com/vmware/harbor/utils"
 	"github.com/vmware/harbor/utils/log"
-
-	"github.com/astaxie/beego"
 )
 
-// ChangePasswordController handles request to /changePassword
-type ChangePasswordController struct {
-	BaseController
-}
-
-// Get renders the page for user to change password.
-func (cpc *ChangePasswordController) Get() {
-	sessionUserID := cpc.GetSession("userId")
-	if sessionUserID == nil {
-		cpc.Redirect("/signIn", http.StatusFound)
-		return
-	}
-	cpc.Data["Username"] = cpc.GetSession("username")
-	cpc.ForwardTo("page_title_change_password", "change-password")
-}
-
-// ForgotPasswordController handles request to /forgotPassword
-type ForgotPasswordController struct {
-	BaseController
-}
-
-// Get Renders the page for user to input Email to reset password.
-func (fpc *ForgotPasswordController) Get() {
-	fpc.ForwardTo("page_title_forgot_password", "forgot-password")
-}
-
 type messageDetail struct {
 	Hint string
 	URL  string
@@ -137,6 +95,16 @@ func (cc *CommonController) SendEmail() {
 
 }
 
+// ForgotPasswordController handles requests to /forgot_password
+type ForgotPasswordController struct {
+	BaseController
+}
+
+// Get renders forgot password page
+func (fpc *ForgotPasswordController) Get() {
+	fpc.Forward("page_title_forgot_password", "forgot-password.htm")
+}
+
 // ResetPasswordController handles request to /resetPassword
 type ResetPasswordController struct {
 	BaseController
@@ -161,7 +129,7 @@ func (rpc *ResetPasswordController) Get() {
 
 	if user != nil {
 		rpc.Data["ResetUuid"] = user.ResetUUID
-		rpc.ForwardTo("page_title_reset_password", "reset-password")
+		rpc.Forward("page_title_reset_password", "reset-password.htm")
 	} else {
 		rpc.Redirect("/", http.StatusFound)
 	}

controllers/project.go

@@ -1,27 +1,11 @@
-/*
-   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
 package controllers
 
-// ProjectController handles request to /registry/project
+// ProjectController handles requests to /project
 type ProjectController struct {
 	BaseController
 }
 
-// Get renders project page.
-func (p *ProjectController) Get() {
-	p.Data["Username"] = p.GetSession("username")
-	p.ForwardTo("page_title_project", "project")
+// Get renders project page
+func (pc *ProjectController) Get() {
+	pc.Forward("page_title_project", "project.htm")
 }

controllers/register.go

@@ -1,87 +0,0 @@
-/*
-   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package controllers
-
-import (
-	"net/http"
-
-	"github.com/vmware/harbor/dao"
-	"github.com/vmware/harbor/models"
-
-	"github.com/vmware/harbor/utils/log"
-)
-
-// RegisterController handles request to /register
-type RegisterController struct {
-	BaseController
-}
-
-// Get renders the Sign In page, it only works if the auth mode is set to db_auth
-func (rc *RegisterController) Get() {
-
-	if !rc.SelfRegistration {
-		log.Warning("Registration is disabled when self-registration is off.")
-		rc.Redirect("/signIn", http.StatusFound)
-	}
-
-	if rc.AuthMode == "db_auth" {
-		rc.ForwardTo("page_title_registration", "register")
-	} else {
-		rc.Redirect("/signIn", http.StatusFound)
-	}
-}
-
-// AddUserController handles request for adding user with an admin role user
-type AddUserController struct {
-	BaseController
-}
-
-// Get renders the Sign In page, it only works if the auth mode is set to db_auth
-func (ac *AddUserController) Get() {
-
-	if !ac.IsAdmin {
-		log.Warning("Add user can only be used by admin role user.")
-		ac.Redirect("/signIn", http.StatusFound)
-	}
-
-	if ac.AuthMode == "db_auth" {
-		ac.ForwardTo("page_title_add_user", "register")
-	} else {
-		ac.Redirect("/signIn", http.StatusFound)
-	}
-}
-
-// UserExists checks if user exists when user input value in sign in form.
-func (cc *CommonController) UserExists() {
-	target := cc.GetString("target")
-	value := cc.GetString("value")
-
-	user := models.User{}
-	switch target {
-	case "username":
-		user.Username = value
-	case "email":
-		user.Email = value
-	}
-
-	exist, err := dao.UserExists(user, target)
-	if err != nil {
-		log.Errorf("Error occurred in UserExists: %v", err)
-		cc.CustomAbort(http.StatusInternalServerError, "Internal error.")
-	}
-	cc.Data["json"] = exist
-	cc.ServeJSON()
-}

controllers/repository.go

@@ -0,0 +1,14 @@
+package controllers
+
+import "os"
+
+// RepositoryController handles request to /repository
+type RepositoryController struct {
+	BaseController
+}
+
+// Get renders repository page
+func (rc *RepositoryController) Get() {
+	rc.Data["HarborRegUrl"] = os.Getenv("HARBOR_REG_URL")
+	rc.Forward("page_title_repository", "repository.htm")
+}

controllers/search.go

@@ -1,18 +1,3 @@
-/*
-   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
 package controllers
 
 // SearchController handles request to /search
@@ -20,9 +5,7 @@ type SearchController struct {
 	BaseController
 }
 
-// Get renders page for displaying search result.
+// Get rendlers search bar
 func (sc *SearchController) Get() {
-	sc.Data["Username"] = sc.GetSession("username")
-	sc.Data["QueryParam"] = sc.GetString("q")
-	sc.ForwardTo("page_title_search", "search")
+	sc.Forward("page_title_search", "search.htm")
 }

controllers/signin.go

@@ -0,0 +1,40 @@
+package controllers
+
+import (
+	"net/http"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// SignInController handles requests to /sign_in
+type SignInController struct {
+	BaseController
+}
+
+//Get renders sign_in page
+func (sic *SignInController) Get() {
+	sessionUserID := sic.GetSession("userId")
+	var hasLoggedIn bool
+	var username string
+	if sessionUserID != nil {
+		hasLoggedIn = true
+		userID := sessionUserID.(int)
+		u, err := dao.GetUser(models.User{UserID: userID})
+		if err != nil {
+			log.Errorf("Error occurred in GetUser, error: %v", err)
+			sic.CustomAbort(http.StatusInternalServerError, "Internal error.")
+		}
+		if u == nil {
+			log.Warningf("User was deleted already, user id: %d, canceling request.", userID)
+			sic.CustomAbort(http.StatusUnauthorized, "")
+		}
+		username = u.Username
+	}
+	sic.Data["AuthMode"] = sic.AuthMode
+	sic.Data["Username"] = username
+	sic.Data["HasLoggedIn"] = hasLoggedIn
+	sic.TplName = "sign-in.htm"
+	sic.Render()
+}

controllers/signup.go

@@ -0,0 +1,19 @@
+package controllers
+
+import (
+	"net/http"
+)
+
+// SignUpController handles requests to /sign_up
+type SignUpController struct {
+	BaseController
+}
+
+// Get renders sign up page
+func (suc *SignUpController) Get() {
+	if suc.AuthMode != "db_auth" {
+		suc.CustomAbort(http.StatusUnauthorized, "Status unauthorized.")
+	}
+	suc.Data["AddNew"] = false
+	suc.Forward("page_title_sign_up", "sign-up.htm")
+}

dao/accesslog.go

@@ -115,3 +115,79 @@ func AccessLog(username, projectName, repoName, repoTag, action string) error {
 	}
 	return err
 }
+
+//GetRecentLogs returns recent logs according to parameters
+func GetRecentLogs(userID, linesNum int, startTime, endTime string) ([]models.AccessLog, error) {
+	var recentLogList []models.AccessLog
+	queryParam := make([]interface{}, 1)
+
+	sql := "select log_id, access_log.user_id, project_id, repo_name, repo_tag, GUID, operation, op_time, username from access_log left join  user on access_log.user_id=user.user_id where project_id in (select distinct project_id from project_member where user_id = ?)"
+	queryParam = append(queryParam, userID)
+	if startTime != "" {
+		sql += " and op_time >= ?"
+		queryParam = append(queryParam, startTime)
+	}
+
+	if endTime != "" {
+		sql += " and op_time <= ?"
+		queryParam = append(queryParam, endTime)
+	}
+
+	sql += " order by op_time desc"
+	if linesNum != 0 {
+		sql += " limit ?"
+		queryParam = append(queryParam, linesNum)
+	}
+	o := GetOrmer()
+	_, err := o.Raw(sql, queryParam).QueryRows(&recentLogList)
+	if err != nil {
+		return nil, err
+	}
+	return recentLogList, nil
+}
+
+//GetTopRepos return top  accessed public repos
+func GetTopRepos(countNum int) ([]models.TopRepo, error) {
+
+	o := GetOrmer()
+	// hide the where condition: project.public = 1, Can add to the sql when necessary.
+	sql := "select repo_name, COUNT(repo_name) as access_count from access_log left join project on access_log.project_id=project.project_id where access_log.operation = 'pull' group by repo_name order by access_count desc limit ? "
+	queryParam := []interface{}{}
+	queryParam = append(queryParam, countNum)
+	var list []models.TopRepo
+	_, err := o.Raw(sql, queryParam).QueryRows(&list)
+	if err != nil {
+		return nil, err
+	}
+	if len(list) == 0 {
+		return list, nil
+	}
+	placeHolder := make([]string, len(list))
+	repos := make([]string, len(list))
+	for i, v := range list {
+		repos[i] = v.RepoName
+		placeHolder[i] = "?"
+	}
+	placeHolderStr := strings.Join(placeHolder, ",")
+	queryParam = nil
+	queryParam = append(queryParam, repos)
+	var usrnameList []models.TopRepo
+	sql = `select a.username as creator, a.repo_name from (select access_log.repo_name, user.username,
+	access_log.op_time from user left join access_log on user.user_id = access_log.user_id where 
+	access_log.operation = 'push' and access_log.repo_name in (######) order by access_log.repo_name,
+	access_log.op_time ASC) a group by a.repo_name`
+	sql = strings.Replace(sql, "######", placeHolderStr, 1)
+	_, err = o.Raw(sql, queryParam).QueryRows(&usrnameList)
+	if err != nil {
+		return nil, err
+	}
+	for i := 0; i < len(list); i++ {
+		for _, v := range usrnameList {
+			if v.RepoName == list[i].RepoName {
+				list[i].Creator = v.Creator
+				break
+			}
+		}
+	}
+	return list, nil
+}

dao/base.go

@@ -18,39 +18,18 @@ package dao
 import (
 	"net"
 
-	"github.com/vmware/harbor/utils/log"
-
 	"os"
-	"strings"
 	"sync"
 	"time"
 
 	"github.com/astaxie/beego/orm"
 	_ "github.com/go-sql-driver/mysql" //register mysql driver
+	"github.com/vmware/harbor/utils/log"
 )
 
 // NonExistUserID : if a user does not exist, the ID of the user will be 0.
 const NonExistUserID = 0
 
-func isIllegalLength(s string, min int, max int) bool {
-	if min == -1 {
-		return (len(s) > max)
-	}
-	if max == -1 {
-		return (len(s) <= min)
-	}
-	return (len(s) < min || len(s) > max)
-}
-
-func isContainIllegalChar(s string, illegalChar []string) bool {
-	for _, c := range illegalChar {
-		if strings.Index(s, c) >= 0 {
-			return true
-		}
-	}
-	return false
-}
-
 // GenerateRandomString generates a random string
 func GenerateRandomString() (string, error) {
 	o := orm.NewOrm()
@@ -65,6 +44,7 @@ func GenerateRandomString() (string, error) {
 
 //InitDB initializes the database
 func InitDB() {
+	//	orm.Debug = true
 	orm.RegisterDriver("mysql", orm.DRMySQL)
 	addr := os.Getenv("MYSQL_HOST")
 	port := os.Getenv("MYSQL_PORT")

dao/dao_test.go

@@ -20,20 +20,18 @@ import (
 	"testing"
 	"time"
 
-	"github.com/vmware/harbor/utils/log"
-
-	"github.com/vmware/harbor/models"
-
 	"github.com/astaxie/beego/orm"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
 )
 
-func execUpdate(o orm.Ormer, sql string, params interface{}) error {
+func execUpdate(o orm.Ormer, sql string, params ...interface{}) error {
 	p, err := o.Raw(sql).Prepare()
 	if err != nil {
 		return err
 	}
 	defer p.Close()
-	_, err = p.Exec(params)
+	_, err = p.Exec(params...)
 	if err != nil {
 		return err
 	}
@@ -97,6 +95,19 @@ func clearUp(username string) {
 		o.Rollback()
 		log.Error(err)
 	}
+
+	err = execUpdate(o, `delete from replication_job where id < 99`)
+	if err != nil {
+		log.Error(err)
+	}
+	err = execUpdate(o, `delete from replication_policy where id < 99`)
+	if err != nil {
+		log.Error(err)
+	}
+	err = execUpdate(o, `delete from replication_target where id < 99`)
+	if err != nil {
+		log.Error(err)
+	}
 	o.Commit()
 }
 
@@ -678,7 +689,7 @@ func TestDeleteProjectMember(t *testing.T) {
 }
 
 func TestToggleAdminRole(t *testing.T) {
-	err := ToggleUserAdminRole(*currentUser)
+	err := ToggleUserAdminRole(currentUser.UserID, 1)
 	if err != nil {
 		t.Errorf("Error in toggle ToggleUserAdmin role: %v, user: %+v", err, currentUser)
 	}
@@ -689,7 +700,7 @@ func TestToggleAdminRole(t *testing.T) {
 	if !isAdmin {
 		t.Errorf("User is not admin after toggled, user id: %d", currentUser.UserID)
 	}
-	err = ToggleUserAdminRole(*currentUser)
+	err = ToggleUserAdminRole(currentUser.UserID, 0)
 	if err != nil {
 		t.Errorf("Error in toggle ToggleUserAdmin role: %v, user: %+v", err, currentUser)
 	}
@@ -702,6 +713,78 @@ func TestToggleAdminRole(t *testing.T) {
 	}
 }
 
+func TestChangeUserProfile(t *testing.T) {
+	user := models.User{UserID: currentUser.UserID, Email: username + "@163.com", Realname: "test", Comment: "Unit Test"}
+	err := ChangeUserProfile(user)
+	if err != nil {
+		t.Errorf("Error occurred in ChangeUserProfile: %v", err)
+	}
+	loginedUser, err := GetUser(models.User{UserID: currentUser.UserID})
+	if err != nil {
+		t.Errorf("Error occurred in GetUser: %v", err)
+	}
+	if loginedUser != nil {
+		if loginedUser.Email != username+"@163.com" {
+			t.Errorf("user email does not update, expected: %s, acutal: %s", username+"@163.com", loginedUser.Email)
+		}
+		if loginedUser.Realname != "test" {
+			t.Errorf("user realname does not update, expected: %s, acutal: %s", "test", loginedUser.Realname)
+		}
+		if loginedUser.Comment != "Unit Test" {
+			t.Errorf("user email does not update, expected: %s, acutal: %s", "Unit Test", loginedUser.Comment)
+		}
+	}
+}
+
+func TestGetRecentLogs(t *testing.T) {
+	logs, err := GetRecentLogs(currentUser.UserID, 10, "2016-05-13 00:00:00", time.Now().String())
+	if err != nil {
+		t.Errorf("error occured in getting recent logs, error: %v", err)
+	}
+	if len(logs) <= 0 {
+		t.Errorf("get logs error, expected: %d, actual: %d", 1, len(logs))
+	}
+}
+
+func TestGetTopRepos(t *testing.T) {
+
+	err := ToggleProjectPublicity(currentProject.ProjectID, publicityOn)
+	if err != nil {
+		t.Errorf("Error occurred in ToggleProjectPublicity: %v", err)
+	}
+	err = AccessLog(currentUser.Username, currentProject.Name, currentProject.Name+"/ubuntu", repoTag2, "push")
+	if err != nil {
+		t.Errorf("Error occurred in AccessLog: %v", err)
+	}
+	err = AccessLog(currentUser.Username, currentProject.Name, currentProject.Name+"/ubuntu", repoTag2, "pull")
+	if err != nil {
+		t.Errorf("Error occurred in AccessLog: %v", err)
+	}
+	topRepos, err := GetTopRepos(10)
+	if err != nil {
+		t.Errorf("error occured in getting top repos, error: %v", err)
+	}
+	if topRepos[0].RepoName != currentProject.Name+"/ubuntu" {
+		t.Errorf("error occured in get top reop's name, expected: %v, actual: %v", currentProject.Name+"/ubuntu", topRepos[0].RepoName)
+	}
+	if topRepos[0].AccessCount != 1 {
+		t.Errorf("error occured in get top reop's access count, expected: %v, actual: %v", 1, topRepos[0].AccessCount)
+	}
+	if topRepos[0].Creator != currentUser.Username {
+		t.Errorf("error occured in get top reop's creator, expected: %v, actual: %v", currentUser.Username, topRepos[0].Creator)
+	}
+	err = ToggleProjectPublicity(currentProject.ProjectID, publicityOff)
+	if err != nil {
+		t.Errorf("Error occurred in ToggleProjectPublicity: %v", err)
+	}
+	o := GetOrmer()
+	_, err = o.QueryTable("access_log").Filter("operation__in", "push,pull").Delete()
+	if err != nil {
+		t.Errorf("error occurred in deleting access logs, %v", err)
+	}
+
+}
+
 func TestDeleteUser(t *testing.T) {
 	err := DeleteUser(currentUser.UserID)
 	if err != nil {
@@ -716,6 +799,573 @@ func TestDeleteUser(t *testing.T) {
 	}
 }
 
+var targetID, policyID, policyID2, policyID3, jobID, jobID2, jobID3 int64
+
+func TestAddRepTarget(t *testing.T) {
+	target := models.RepTarget{
+		Name:     "test",
+		URL:      "127.0.0.1:5000",
+		Username: "admin",
+		Password: "admin",
+	}
+	//_, err := AddRepTarget(target)
+	id, err := AddRepTarget(target)
+	t.Logf("added target, id: %d", id)
+	if err != nil {
+		t.Errorf("Error occurred in AddRepTarget: %v", err)
+	} else {
+		targetID = id
+	}
+	id2 := id + 99
+	tgt, err := GetRepTarget(id2)
+	if err != nil {
+		t.Errorf("Error occurred in GetTarget: %v, id: %d", err, id2)
+	}
+	if tgt != nil {
+		t.Errorf("There should not be a target with id: %d", id2)
+	}
+	tgt, err = GetRepTarget(id)
+	if err != nil {
+		t.Errorf("Error occurred in GetTarget: %v, id: %d", err, id)
+	}
+	if tgt == nil {
+		t.Errorf("Unable to find a target with id: %d", id)
+	}
+	if tgt.URL != "127.0.0.1:5000" {
+		t.Errorf("Unexpected url in target: %s, expected 127.0.0.1:5000", tgt.URL)
+	}
+	if tgt.Username != "admin" {
+		t.Errorf("Unexpected username in target: %s, expected admin", tgt.Username)
+	}
+}
+
+func TestGetRepTargetByName(t *testing.T) {
+	target, err := GetRepTarget(targetID)
+	if err != nil {
+		t.Fatalf("failed to get target %d: %v", targetID, err)
+	}
+
+	target2, err := GetRepTargetByName(target.Name)
+	if err != nil {
+		t.Fatalf("failed to get target %s: %v", target.Name, err)
+	}
+
+	if target.Name != target2.Name {
+		t.Errorf("unexpected target name: %s, expected: %s", target2.Name, target.Name)
+	}
+}
+
+func TestUpdateRepTarget(t *testing.T) {
+	target := &models.RepTarget{
+		Name:     "name",
+		URL:      "http://url",
+		Username: "username",
+		Password: "password",
+	}
+
+	id, err := AddRepTarget(*target)
+	if err != nil {
+		t.Fatalf("failed to add target: %v", err)
+	}
+	defer func() {
+		if err := DeleteRepTarget(id); err != nil {
+			t.Logf("failed to delete target %d: %v", id, err)
+		}
+	}()
+
+	target.ID = id
+	target.Name = "new_name"
+	target.URL = "http://new_url"
+	target.Username = "new_username"
+	target.Password = "new_password"
+
+	if err = UpdateRepTarget(*target); err != nil {
+		t.Fatalf("failed to update target: %v", err)
+	}
+
+	target, err = GetRepTarget(id)
+	if err != nil {
+		t.Fatalf("failed to get target %d: %v", id, err)
+	}
+
+	if target.Name != "new_name" {
+		t.Errorf("unexpected name: %s, expected: %s", target.Name, "new_name")
+	}
+
+	if target.URL != "http://new_url" {
+		t.Errorf("unexpected url: %s, expected: %s", target.URL, "http://new_url")
+	}
+
+	if target.Username != "new_username" {
+		t.Errorf("unexpected username: %s, expected: %s", target.Username, "new_username")
+	}
+
+	if target.Password != "new_password" {
+		t.Errorf("unexpected password: %s, expected: %s", target.Password, "new_password")
+	}
+}
+
+func TestFilterRepTargets(t *testing.T) {
+	targets, err := FilterRepTargets("test")
+	if err != nil {
+		t.Fatalf("failed to get all targets: %v", err)
+	}
+
+	if len(targets) == 0 {
+		t.Errorf("unexpected num of targets: %d, expected: %d", len(targets), 1)
+	}
+}
+
+func TestAddRepPolicy(t *testing.T) {
+	policy := models.RepPolicy{
+		ProjectID:   1,
+		Enabled:     1,
+		TargetID:    targetID,
+		Description: "whatever",
+		Name:        "mypolicy",
+	}
+	id, err := AddRepPolicy(policy)
+	t.Logf("added policy, id: %d", id)
+	if err != nil {
+		t.Errorf("Error occurred in AddRepPolicy: %v", err)
+	} else {
+		policyID = id
+	}
+	p, err := GetRepPolicy(id)
+	if err != nil {
+		t.Errorf("Error occurred in GetPolicy: %v, id: %d", err, id)
+	}
+	if p == nil {
+		t.Errorf("Unable to find a policy with id: %d", id)
+	}
+
+	if p.Name != "mypolicy" || p.TargetID != targetID || p.Enabled != 1 || p.Description != "whatever" {
+		t.Errorf("The data does not match, expected: Name: mypolicy, TargetID: %d, Enabled: 1, Description: whatever;\n result: Name: %s, TargetID: %d, Enabled: %d, Description: %s",
+			targetID, p.Name, p.TargetID, p.Enabled, p.Description)
+	}
+	var tm = time.Now().AddDate(0, 0, -1)
+	if !p.StartTime.After(tm) {
+		t.Errorf("Unexpected start_time: %v", p.StartTime)
+	}
+
+}
+
+func TestGetRepPolicyByTarget(t *testing.T) {
+	policies, err := GetRepPolicyByTarget(targetID)
+	if err != nil {
+		t.Fatalf("failed to get policy according target %d: %v", targetID, err)
+	}
+
+	if len(policies) == 0 {
+		t.Fatal("unexpected length of policies 0, expected is >0")
+	}
+
+	if policies[0].ID != policyID {
+		t.Fatalf("unexpected policy: %d, expected: %d", policies[0].ID, policyID)
+	}
+}
+
+func TestGetRepPolicyByProjectAndTarget(t *testing.T) {
+	policies, err := GetRepPolicyByProjectAndTarget(1, targetID)
+	if err != nil {
+		t.Fatalf("failed to get policy according project %d and target %d: %v", 1, targetID, err)
+	}
+
+	if len(policies) == 0 {
+		t.Fatal("unexpected length of policies 0, expected is >0")
+	}
+
+	if policies[0].ID != policyID {
+		t.Fatalf("unexpected policy: %d, expected: %d", policies[0].ID, policyID)
+	}
+}
+
+func TestGetRepPolicyByName(t *testing.T) {
+	policy, err := GetRepPolicy(policyID)
+	if err != nil {
+		t.Fatalf("failed to get policy %d: %v", policyID, err)
+	}
+
+	policy2, err := GetRepPolicyByName(policy.Name)
+	if err != nil {
+		t.Fatalf("failed to get policy %s: %v", policy.Name, err)
+	}
+
+	if policy.Name != policy2.Name {
+		t.Errorf("unexpected name: %s, expected: %s", policy2.Name, policy.Name)
+	}
+
+}
+
+func TestDisableRepPolicy(t *testing.T) {
+	err := DisableRepPolicy(policyID)
+	if err != nil {
+		t.Errorf("Failed to disable policy, id: %d", policyID)
+	}
+	p, err := GetRepPolicy(policyID)
+	if err != nil {
+		t.Errorf("Error occurred in GetPolicy: %v, id: %d", err, policyID)
+	}
+	if p == nil {
+		t.Errorf("Unable to find a policy with id: %d", policyID)
+	}
+	if p.Enabled == 1 {
+		t.Errorf("The Enabled value of replication policy is still 1 after disabled, id: %d", policyID)
+	}
+}
+
+func TestEnableRepPolicy(t *testing.T) {
+	err := EnableRepPolicy(policyID)
+	if err != nil {
+		t.Errorf("Failed to disable policy, id: %d", policyID)
+	}
+	p, err := GetRepPolicy(policyID)
+	if err != nil {
+		t.Errorf("Error occurred in GetPolicy: %v, id: %d", err, policyID)
+	}
+	if p == nil {
+		t.Errorf("Unable to find a policy with id: %d", policyID)
+	}
+	if p.Enabled == 0 {
+		t.Errorf("The Enabled value of replication policy is still 0 after disabled, id: %d", policyID)
+	}
+}
+
+func TestAddRepPolicy2(t *testing.T) {
+	policy2 := models.RepPolicy{
+		ProjectID:   3,
+		Enabled:     0,
+		TargetID:    3,
+		Description: "whatever",
+		Name:        "mypolicy",
+	}
+	policyID2, err := AddRepPolicy(policy2)
+	t.Logf("added policy, id: %d", policyID2)
+	if err != nil {
+		t.Errorf("Error occurred in AddRepPolicy: %v", err)
+	}
+	p, err := GetRepPolicy(policyID2)
+	if err != nil {
+		t.Errorf("Error occurred in GetPolicy: %v, id: %d", err, policyID2)
+	}
+	if p == nil {
+		t.Errorf("Unable to find a policy with id: %d", policyID2)
+	}
+	var tm time.Time
+	if p.StartTime.After(tm) {
+		t.Errorf("Unexpected start_time: %v", p.StartTime)
+	}
+}
+
+func TestAddRepJob(t *testing.T) {
+	job := models.RepJob{
+		Repository: "library/ubuntu",
+		PolicyID:   policyID,
+		Operation:  "transfer",
+		TagList:    []string{"12.01", "14.04", "latest"},
+	}
+	id, err := AddRepJob(job)
+	if err != nil {
+		t.Errorf("Error occurred in AddRepJob: %v", err)
+		return
+	}
+	jobID = id
+
+	j, err := GetRepJob(id)
+	if err != nil {
+		t.Errorf("Error occurred in GetRepJob: %v, id: %d", err, id)
+		return
+	}
+	if j == nil {
+		t.Errorf("Unable to find a job with id: %d", id)
+		return
+	}
+	if j.Status != models.JobPending || j.Repository != "library/ubuntu" || j.PolicyID != policyID || j.Operation != "transfer" || len(j.TagList) != 3 {
+		t.Errorf("Expected data of job, id: %d, Status: %s, Repository: library/ubuntu, PolicyID: %d, Operation: transfer, taglist length 3"+
+			"but in returned data:, Status: %s, Repository: %s, Operation: %s, PolicyID: %d, TagList: %v", id, models.JobPending, policyID, j.Status, j.Repository, j.Operation, j.PolicyID, j.TagList)
+		return
+	}
+}
+
+func TestUpdateRepJobStatus(t *testing.T) {
+	err := UpdateRepJobStatus(jobID, models.JobFinished)
+	if err != nil {
+		t.Errorf("Error occured in UpdateRepJobStatus, error: %v, id: %d", err, jobID)
+		return
+	}
+	j, err := GetRepJob(jobID)
+	if err != nil {
+		t.Errorf("Error occurred in GetRepJob: %v, id: %d", err, jobID)
+	}
+	if j == nil {
+		t.Errorf("Unable to find a job with id: %d", jobID)
+	}
+	if j.Status != models.JobFinished {
+		t.Errorf("Job's status: %s, expected: %s, id: %d", j.Status, models.JobFinished, jobID)
+	}
+	err = UpdateRepJobStatus(jobID, models.JobPending)
+	if err != nil {
+		t.Errorf("Error occured in UpdateRepJobStatus when update it back to status pending, error: %v, id: %d", err, jobID)
+		return
+	}
+}
+
+func TestGetRepPolicyByProject(t *testing.T) {
+	p1, err := GetRepPolicyByProject(99)
+	if err != nil {
+		t.Errorf("Error occured in GetRepPolicyByProject:%v, project ID: %d", err, 99)
+		return
+	}
+	if len(p1) > 0 {
+		t.Errorf("Unexpected length of policy list, expected: 0, in fact: %d, project id: %d", len(p1), 99)
+		return
+	}
+
+	p2, err := GetRepPolicyByProject(1)
+	if err != nil {
+		t.Errorf("Error occuered in GetRepPolicyByProject:%v, project ID: %d", err, 2)
+		return
+	}
+	if len(p2) != 1 {
+		t.Errorf("Unexpected length of policy list, expected: 1, in fact: %d, project id: %d", len(p2), 1)
+		return
+	}
+	if p2[0].ID != policyID {
+		t.Errorf("Unexpecred policy id in result, expected: %d, in fact: %d", policyID, p2[0].ID)
+		return
+	}
+}
+
+func TestGetRepJobByPolicy(t *testing.T) {
+	jobs, err := GetRepJobByPolicy(999)
+	if err != nil {
+		t.Errorf("Error occured in GetRepJobByPolicy: %v, policy ID: %d", err, 999)
+		return
+	}
+	if len(jobs) > 0 {
+		t.Errorf("Unexpected length of jobs, expected: 0, in fact: %d", len(jobs))
+		return
+	}
+	jobs, err = GetRepJobByPolicy(policyID)
+	if err != nil {
+		t.Errorf("Error occured in GetRepJobByPolicy: %v, policy ID: %d", err, policyID)
+		return
+	}
+	if len(jobs) != 1 {
+		t.Errorf("Unexpected length of jobs, expected: 1, in fact: %d", len(jobs))
+		return
+	}
+	if jobs[0].ID != jobID {
+		t.Errorf("Unexpected job ID in the result, expected: %d, in fact: %d", jobID, jobs[0].ID)
+		return
+	}
+}
+
+func TestFilterRepJobs(t *testing.T) {
+	jobs, err := FilterRepJobs(policyID, "", "", nil, nil, 1000)
+	if err != nil {
+		t.Errorf("Error occured in FilterRepJobs: %v, policy ID: %d", err, policyID)
+		return
+	}
+	if len(jobs) != 1 {
+		t.Errorf("Unexpected length of jobs, expected: 1, in fact: %d", len(jobs))
+		return
+	}
+	if jobs[0].ID != jobID {
+		t.Errorf("Unexpected job ID in the result, expected: %d, in fact: %d", jobID, jobs[0].ID)
+		return
+	}
+}
+
+func TestDeleteRepJob(t *testing.T) {
+	err := DeleteRepJob(jobID)
+	if err != nil {
+		t.Errorf("Error occured in DeleteRepJob: %v, id: %d", err, jobID)
+		return
+	}
+	t.Logf("deleted rep job, id: %d", jobID)
+	j, err := GetRepJob(jobID)
+	if err != nil {
+		t.Errorf("Error occured in GetRepJob:%v", err)
+		return
+	}
+	if j != nil {
+		t.Errorf("Able to find rep job after deletion, id: %d", jobID)
+		return
+	}
+}
+
+func TestGetRepoJobToStop(t *testing.T) {
+	jobs := [...]models.RepJob{
+		models.RepJob{
+			Repository: "library/ubuntu",
+			PolicyID:   policyID,
+			Operation:  "transfer",
+			Status:     models.JobRunning,
+		},
+		models.RepJob{
+			Repository: "library/ubuntu",
+			PolicyID:   policyID,
+			Operation:  "transfer",
+			Status:     models.JobFinished,
+		},
+		models.RepJob{
+			Repository: "library/ubuntu",
+			PolicyID:   policyID,
+			Operation:  "transfer",
+			Status:     models.JobCanceled,
+		},
+	}
+	var err error
+	var i int64
+	var ids []int64
+	for _, j := range jobs {
+		i, err = AddRepJob(j)
+		ids = append(ids, i)
+		if err != nil {
+			log.Errorf("Failed to add Job: %+v, error: %v", j, err)
+			return
+		}
+	}
+	res, err := GetRepJobToStop(policyID)
+	if err != nil {
+		log.Errorf("Failed to Get Jobs, error: %v", err)
+		return
+	}
+	//time.Sleep(15 * time.Second)
+	if len(res) != 1 {
+		log.Errorf("Expected length of stoppable jobs, expected:1, in fact: %d", len(res))
+		return
+	}
+	for _, id := range ids {
+		err = DeleteRepJob(id)
+		if err != nil {
+			log.Errorf("Failed to delete job, id: %d, error: %v", id, err)
+			return
+		}
+	}
+}
+
+func TestDeleteRepTarget(t *testing.T) {
+	err := DeleteRepTarget(targetID)
+	if err != nil {
+		t.Errorf("Error occured in DeleteRepTarget: %v, id: %d", err, targetID)
+		return
+	}
+	t.Logf("deleted target, id: %d", targetID)
+	tgt, err := GetRepTarget(targetID)
+	if err != nil {
+		t.Errorf("Error occurred in GetTarget: %v, id: %d", err, targetID)
+	}
+	if tgt != nil {
+		t.Errorf("Able to find target after deletion, id: %d", targetID)
+	}
+}
+
+func TestFilterRepPolicies(t *testing.T) {
+	_, err := FilterRepPolicies("name", 0)
+	if err != nil {
+		t.Fatalf("failed to filter policy: %v", err)
+	}
+}
+
+func TestUpdateRepPolicy(t *testing.T) {
+	policy := &models.RepPolicy{
+		ID:   policyID,
+		Name: "new_policy_name",
+	}
+	if err := UpdateRepPolicy(policy); err != nil {
+		t.Fatalf("failed to update policy")
+	}
+}
+
+func TestDeleteRepPolicy(t *testing.T) {
+	err := DeleteRepPolicy(policyID)
+	if err != nil {
+		t.Errorf("Error occured in DeleteRepPolicy: %v, id: %d", err, policyID)
+		return
+	}
+	t.Logf("delete rep policy, id: %d", policyID)
+	p, err := GetRepPolicy(policyID)
+	if err != nil && err != orm.ErrNoRows {
+		t.Errorf("Error occured in GetRepPolicy:%v", err)
+	}
+	if p != nil {
+		t.Errorf("Able to find rep policy after deletion, id: %d", policyID)
+	}
+}
+
+func TestResetRepJobs(t *testing.T) {
+
+	job1 := models.RepJob{
+		Repository: "library/ubuntua",
+		PolicyID:   policyID,
+		Operation:  "transfer",
+		Status:     models.JobRunning,
+	}
+	job2 := models.RepJob{
+		Repository: "library/ubuntub",
+		PolicyID:   policyID,
+		Operation:  "transfer",
+		Status:     models.JobCanceled,
+	}
+	id1, err := AddRepJob(job1)
+	if err != nil {
+		t.Errorf("Failed to add job: %+v, error: %v", job1, err)
+		return
+	}
+	id2, err := AddRepJob(job2)
+	if err != nil {
+		t.Errorf("Failed to add job: %+v, error: %v", job2, err)
+		return
+	}
+	err = ResetRunningJobs()
+	if err != nil {
+		t.Errorf("Failed to reset running jobs, error: %v", err)
+	}
+	j1, err := GetRepJob(id1)
+	if err != nil {
+		t.Errorf("Failed to get rep job, id: %d, error: %v", id1, err)
+		return
+	}
+	if j1.Status != models.JobPending {
+		t.Errorf("The rep job: %d, status should be Pending, but infact: %s", id1, j1.Status)
+		return
+	}
+	j2, err := GetRepJob(id2)
+	if err != nil {
+		t.Errorf("Failed to get rep job, id: %d, error: %v", id2, err)
+		return
+	}
+	if j2.Status == models.JobPending {
+		t.Errorf("The rep job: %d, status should be Canceled, but infact: %s", id2, j2.Status)
+		return
+	}
+}
+
+func TestGetJobByStatus(t *testing.T) {
+	r1, err := GetRepJobByStatus(models.JobPending, models.JobRunning)
+	if err != nil {
+		t.Errorf("Failed to run GetRepJobByStatus, error: %v", err)
+	}
+	if len(r1) != 1 {
+		t.Errorf("Unexpected length of result, expected 1, but in fact:%d", len(r1))
+		return
+	}
+
+	r2, err := GetRepJobByStatus(models.JobPending, models.JobCanceled)
+	if err != nil {
+		t.Errorf("Failed to run GetRepJobByStatus, error: %v", err)
+	}
+	if len(r2) != 2 {
+		t.Errorf("Unexpected length of result, expected 2, but in fact:%d", len(r2))
+		return
+	}
+	for _, j := range r2 {
+		DeleteRepJob(j.ID)
+	}
+}
+
 func TestGetOrmer(t *testing.T) {
 	o := GetOrmer()
 	if o == nil {

dao/project.go

@@ -18,7 +18,6 @@ package dao
 import (
 	"github.com/vmware/harbor/models"
 
-	"errors"
 	"fmt"
 	"time"
 
@@ -30,15 +29,7 @@ import (
 // AddProject adds a project to the database along with project roles information and access log records.
 func AddProject(project models.Project) (int64, error) {
 
-	if isIllegalLength(project.Name, 4, 30) {
-		return 0, errors.New("project name is illegal in length. (greater than 4 or less than 30)")
-	}
-	if isContainIllegalChar(project.Name, []string{"~", "-", "$", "\\", "[", "]", "{", "}", "(", ")", "&", "^", "%", "*", "<", ">", "\"", "'", "/", "?", "@"}) {
-		return 0, errors.New("project name contains illegal characters")
-	}
-
 	o := GetOrmer()
-
 	p, err := o.Raw("insert into project (owner_id, name, creation_time, update_time, deleted, public) values (?, ?, ?, ?, ?, ?)").Prepare()
 	if err != nil {
 		return 0, err

dao/projectmember.go

@@ -58,7 +58,7 @@ func DeleteProjectMember(projectID int64, userID int) error {
 func GetUserByProject(projectID int64, queryUser models.User) ([]models.User, error) {
 	o := GetOrmer()
 	u := []models.User{}
-	sql := `select u.user_id, u.username, r.name rolename, r.role_id
+	sql := `select u.user_id, u.username, r.name rolename, r.role_id as role
 		from user u 
 		join project_member pm 
 		on pm.project_id = ? and u.user_id = pm.user_id 

dao/register.go

@@ -17,7 +17,6 @@ package dao
 
 import (
 	"errors"
-	"regexp"
 	"time"
 
 	"github.com/vmware/harbor/models"
@@ -26,14 +25,7 @@ import (
 
 // Register is used for user to register, the password is encrypted before the record is inserted into database.
 func Register(user models.User) (int64, error) {
-
-	err := validate(user)
-	if err != nil {
-		return 0, err
-	}
-
 	o := GetOrmer()
-
 	p, err := o.Raw("insert into user (username, password, realname, email, comment, salt, sysadmin_flag, creation_time, update_time) values (?, ?, ?, ?, ?, ?, ?, ?, ?)").Prepare()
 	if err != nil {
 		return 0, err
@@ -59,46 +51,6 @@ func Register(user models.User) (int64, error) {
 	return userID, nil
 }
 
-func validate(user models.User) error {
-
-	if isIllegalLength(user.Username, 0, 20) {
-		return errors.New("Username with illegal length.")
-	}
-	if isContainIllegalChar(user.Username, []string{",", "~", "#", "$", "%"}) {
-		return errors.New("Username contains illegal characters.")
-	}
-
-	if exist, _ := UserExists(models.User{Username: user.Username}, "username"); exist {
-		return errors.New("Username already exists.")
-	}
-
-	if len(user.Email) > 0 {
-		if m, _ := regexp.MatchString(`^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$`, user.Email); !m {
-			return errors.New("Email with illegal format.")
-		}
-		if exist, _ := UserExists(models.User{Email: user.Email}, "email"); exist {
-			return errors.New("Email already exists.")
-		}
-	}
-
-	if isIllegalLength(user.Realname, 0, 20) {
-		return errors.New("Realname with illegal length.")
-	}
-
-	if isContainIllegalChar(user.Realname, []string{",", "~", "#", "$", "%"}) {
-		return errors.New("Realname contains illegal characters.")
-	}
-
-	if isIllegalLength(user.Password, 0, 20) {
-		return errors.New("Password with illegal length.")
-	}
-
-	if isIllegalLength(user.Comment, -1, 30) {
-		return errors.New("Comment with illegal length.")
-	}
-	return nil
-}
-
 // UserExists returns whether a user exists according username or Email.
 func UserExists(user models.User, target string) (bool, error) {
 

dao/replication_job.go

@@ -0,0 +1,423 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package dao
+
+import (
+	"fmt"
+	"time"
+
+	"strings"
+
+	"github.com/astaxie/beego/orm"
+	"github.com/vmware/harbor/models"
+)
+
+// AddRepTarget ...
+func AddRepTarget(target models.RepTarget) (int64, error) {
+	o := GetOrmer()
+	return o.Insert(&target)
+}
+
+// GetRepTarget ...
+func GetRepTarget(id int64) (*models.RepTarget, error) {
+	o := GetOrmer()
+	t := models.RepTarget{ID: id}
+	err := o.Read(&t)
+	if err == orm.ErrNoRows {
+		return nil, nil
+	}
+	return &t, err
+}
+
+// GetRepTargetByName ...
+func GetRepTargetByName(name string) (*models.RepTarget, error) {
+	o := GetOrmer()
+	t := models.RepTarget{Name: name}
+	err := o.Read(&t, "Name")
+	if err == orm.ErrNoRows {
+		return nil, nil
+	}
+	return &t, err
+}
+
+// GetRepTargetByConnInfo ...
+func GetRepTargetByConnInfo(endpoint, username string) (*models.RepTarget, error) {
+	o := GetOrmer()
+	t := models.RepTarget{
+		URL:      endpoint,
+		Username: username,
+	}
+	err := o.Read(&t, "URL", "Username")
+	if err == orm.ErrNoRows {
+		return nil, nil
+	}
+	return &t, err
+}
+
+// DeleteRepTarget ...
+func DeleteRepTarget(id int64) error {
+	o := GetOrmer()
+	_, err := o.Delete(&models.RepTarget{ID: id})
+	return err
+}
+
+// UpdateRepTarget ...
+func UpdateRepTarget(target models.RepTarget) error {
+	o := GetOrmer()
+	_, err := o.Update(&target, "URL", "Name", "Username", "Password")
+	return err
+}
+
+// FilterRepTargets filters targets by name
+func FilterRepTargets(name string) ([]*models.RepTarget, error) {
+	o := GetOrmer()
+
+	var args []interface{}
+
+	sql := `select * from replication_target `
+	if len(name) != 0 {
+		sql += `where name like ? `
+		args = append(args, "%"+name+"%")
+	}
+	sql += `order by creation_time`
+
+	var targets []*models.RepTarget
+
+	if _, err := o.Raw(sql, args).QueryRows(&targets); err != nil {
+		return nil, err
+	}
+
+	return targets, nil
+}
+
+// AddRepPolicy ...
+func AddRepPolicy(policy models.RepPolicy) (int64, error) {
+	o := GetOrmer()
+	sqlTpl := `insert into replication_policy (name, project_id, target_id, enabled, description, cron_str, start_time, creation_time, update_time ) values (?, ?, ?, ?, ?, ?, %s, NOW(), NOW())`
+	var sql string
+	if policy.Enabled == 1 {
+		sql = fmt.Sprintf(sqlTpl, "NOW()")
+	} else {
+		sql = fmt.Sprintf(sqlTpl, "NULL")
+	}
+	p, err := o.Raw(sql).Prepare()
+	if err != nil {
+		return 0, err
+	}
+	r, err := p.Exec(policy.Name, policy.ProjectID, policy.TargetID, policy.Enabled, policy.Description, policy.CronStr)
+	if err != nil {
+		return 0, err
+	}
+	id, err := r.LastInsertId()
+	return id, err
+}
+
+// GetRepPolicy ...
+func GetRepPolicy(id int64) (*models.RepPolicy, error) {
+	o := GetOrmer()
+	sql := `select * from replication_policy where id = ?`
+
+	var policy models.RepPolicy
+
+	if err := o.Raw(sql, id).QueryRow(&policy); err != nil {
+		if err == orm.ErrNoRows {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	return &policy, nil
+}
+
+// FilterRepPolicies filters policies by name and project ID
+func FilterRepPolicies(name string, projectID int64) ([]*models.RepPolicy, error) {
+	o := GetOrmer()
+
+	var args []interface{}
+
+	sql := `select rp.id, rp.project_id, p.name as project_name, rp.target_id, 
+				rt.name as target_name, rp.name, rp.enabled, rp.description,
+				rp.cron_str, rp.start_time, rp.creation_time, rp.update_time, 
+				count(rj.status) as error_job_count 
+			from replication_policy rp 
+			left join project p on rp.project_id=p.project_id 
+			left join replication_target rt on rp.target_id=rt.id 
+			left join replication_job rj on rp.id=rj.policy_id and (rj.status="error" 
+				or rj.status="retrying") `
+
+	if len(name) != 0 && projectID != 0 {
+		sql += `where rp.name like ? and rp.project_id = ? `
+		args = append(args, "%"+name+"%")
+		args = append(args, projectID)
+	} else if len(name) != 0 {
+		sql += `where rp.name like ? `
+		args = append(args, "%"+name+"%")
+	} else if projectID != 0 {
+		sql += `where rp.project_id = ? `
+		args = append(args, projectID)
+	}
+
+	sql += `group by rp.id order by rp.creation_time`
+
+	var policies []*models.RepPolicy
+	if _, err := o.Raw(sql, args).QueryRows(&policies); err != nil {
+		return nil, err
+	}
+	return policies, nil
+}
+
+// GetRepPolicyByName ...
+func GetRepPolicyByName(name string) (*models.RepPolicy, error) {
+	o := GetOrmer()
+	sql := `select * from replication_policy where name = ?`
+
+	var policy models.RepPolicy
+
+	if err := o.Raw(sql, name).QueryRow(&policy); err != nil {
+		if err == orm.ErrNoRows {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	return &policy, nil
+}
+
+// GetRepPolicyByProject ...
+func GetRepPolicyByProject(projectID int64) ([]*models.RepPolicy, error) {
+	o := GetOrmer()
+	sql := `select * from replication_policy where project_id = ?`
+
+	var policies []*models.RepPolicy
+
+	if _, err := o.Raw(sql, projectID).QueryRows(&policies); err != nil {
+		return nil, err
+	}
+
+	return policies, nil
+}
+
+// GetRepPolicyByTarget ...
+func GetRepPolicyByTarget(targetID int64) ([]*models.RepPolicy, error) {
+	o := GetOrmer()
+	sql := `select * from replication_policy where target_id = ?`
+
+	var policies []*models.RepPolicy
+
+	if _, err := o.Raw(sql, targetID).QueryRows(&policies); err != nil {
+		return nil, err
+	}
+
+	return policies, nil
+}
+
+// GetRepPolicyByProjectAndTarget ...
+func GetRepPolicyByProjectAndTarget(projectID, targetID int64) ([]*models.RepPolicy, error) {
+	o := GetOrmer()
+	sql := `select * from replication_policy where project_id = ? and target_id = ?`
+
+	var policies []*models.RepPolicy
+
+	if _, err := o.Raw(sql, projectID, targetID).QueryRows(&policies); err != nil {
+		return nil, err
+	}
+
+	return policies, nil
+}
+
+// UpdateRepPolicy ...
+func UpdateRepPolicy(policy *models.RepPolicy) error {
+	o := GetOrmer()
+	_, err := o.Update(policy, "TargetID", "Name", "Enabled", "Description", "CronStr")
+	return err
+}
+
+// DeleteRepPolicy ...
+func DeleteRepPolicy(id int64) error {
+	o := GetOrmer()
+	_, err := o.Delete(&models.RepPolicy{ID: id})
+	return err
+}
+
+// UpdateRepPolicyEnablement ...
+func UpdateRepPolicyEnablement(id int64, enabled int) error {
+	o := GetOrmer()
+	p := models.RepPolicy{
+		ID:      id,
+		Enabled: enabled,
+	}
+
+	var err error
+	if enabled == 1 {
+		p.StartTime = time.Now()
+		_, err = o.Update(&p, "Enabled", "StartTime")
+	} else {
+		_, err = o.Update(&p, "Enabled")
+	}
+
+	return err
+}
+
+// EnableRepPolicy ...
+func EnableRepPolicy(id int64) error {
+	return UpdateRepPolicyEnablement(id, 1)
+}
+
+// DisableRepPolicy ...
+func DisableRepPolicy(id int64) error {
+	return UpdateRepPolicyEnablement(id, 0)
+}
+
+// AddRepJob ...
+func AddRepJob(job models.RepJob) (int64, error) {
+	o := GetOrmer()
+	if len(job.Status) == 0 {
+		job.Status = models.JobPending
+	}
+	if len(job.TagList) > 0 {
+		job.Tags = strings.Join(job.TagList, ",")
+	}
+	return o.Insert(&job)
+}
+
+// GetRepJob ...
+func GetRepJob(id int64) (*models.RepJob, error) {
+	o := GetOrmer()
+	j := models.RepJob{ID: id}
+	err := o.Read(&j)
+	if err == orm.ErrNoRows {
+		return nil, nil
+	}
+	genTagListForJob(&j)
+	return &j, nil
+}
+
+// GetRepJobByPolicy ...
+func GetRepJobByPolicy(policyID int64) ([]*models.RepJob, error) {
+	var res []*models.RepJob
+	_, err := repJobPolicyIDQs(policyID).All(&res)
+	genTagListForJob(res...)
+	return res, err
+}
+
+// FilterRepJobs filters jobs by repo and policy ID
+func FilterRepJobs(policyID int64, repository, status string, startTime,
+	endTime *time.Time, limit int) ([]*models.RepJob, error) {
+	o := GetOrmer()
+
+	qs := o.QueryTable(new(models.RepJob))
+	if policyID != 0 {
+		qs = qs.Filter("PolicyID", policyID)
+	}
+	if len(repository) != 0 {
+		qs = qs.Filter("Repository__icontains", repository)
+	}
+	if len(status) != 0 {
+		qs = qs.Filter("Status__icontains", status)
+	}
+
+	if startTime != nil {
+		fmt.Printf("%v\n", startTime)
+		qs = qs.Filter("CreationTime__gte", startTime)
+	}
+
+	if endTime != nil {
+		fmt.Printf("%v\n", endTime)
+		qs = qs.Filter("CreationTime__lte", endTime)
+	}
+
+	if limit != 0 {
+		qs = qs.Limit(limit)
+	}
+
+	qs = qs.OrderBy("-CreationTime")
+
+	var jobs []*models.RepJob
+	_, err := qs.All(&jobs)
+	if err != nil {
+		return nil, err
+	}
+
+	genTagListForJob(jobs...)
+
+	return jobs, nil
+}
+
+// GetRepJobToStop get jobs that are possibly being handled by workers of a certain policy.
+func GetRepJobToStop(policyID int64) ([]*models.RepJob, error) {
+	var res []*models.RepJob
+	_, err := repJobPolicyIDQs(policyID).Filter("status__in", models.JobPending, models.JobRunning).All(&res)
+	genTagListForJob(res...)
+	return res, err
+}
+
+func repJobQs() orm.QuerySeter {
+	o := GetOrmer()
+	return o.QueryTable("replication_job")
+}
+
+func repJobPolicyIDQs(policyID int64) orm.QuerySeter {
+	return repJobQs().Filter("policy_id", policyID)
+}
+
+// DeleteRepJob ...
+func DeleteRepJob(id int64) error {
+	o := GetOrmer()
+	_, err := o.Delete(&models.RepJob{ID: id})
+	return err
+}
+
+// UpdateRepJobStatus ...
+func UpdateRepJobStatus(id int64, status string) error {
+	o := GetOrmer()
+	j := models.RepJob{
+		ID:     id,
+		Status: status,
+	}
+	num, err := o.Update(&j, "Status")
+	if num == 0 {
+		err = fmt.Errorf("Failed to update replication job with id: %d %s", id, err.Error())
+	}
+	return err
+}
+
+// ResetRunningJobs update all running jobs status to pending
+func ResetRunningJobs() error {
+	o := GetOrmer()
+	sql := fmt.Sprintf("update replication_job set status = '%s' where status = '%s'", models.JobPending, models.JobRunning)
+	_, err := o.Raw(sql).Exec()
+	return err
+}
+
+// GetRepJobByStatus get jobs of certain statuses
+func GetRepJobByStatus(status ...string) ([]*models.RepJob, error) {
+	var res []*models.RepJob
+	var t []interface{}
+	for _, s := range status {
+		t = append(t, interface{}(s))
+	}
+	_, err := repJobQs().Filter("status__in", t...).All(&res)
+	genTagListForJob(res...)
+	return res, err
+}
+
+func genTagListForJob(jobs ...*models.RepJob) {
+	for _, j := range jobs {
+		if len(j.Tags) > 0 {
+			j.TagList = strings.Split(j.Tags, ",")
+		}
+	}
+}

dao/role.go

@@ -18,6 +18,7 @@ package dao
 import (
 	"fmt"
 
+	"github.com/astaxie/beego/orm"
 	"github.com/vmware/harbor/models"
 )
 
@@ -83,6 +84,9 @@ func GetRoleByID(id int) (*models.Role, error) {
 
 	var role models.Role
 	if err := o.Raw(sql, id).QueryRow(&role); err != nil {
+		if err == orm.ErrNoRows {
+			return nil, nil
+		}
 		return nil, err
 	}
 	return &role, nil

dao/user.go

@@ -109,12 +109,13 @@ func ListUsers(query models.User) ([]models.User, error) {
 }
 
 // ToggleUserAdminRole gives a user admin role.
-func ToggleUserAdminRole(u models.User) error {
+func ToggleUserAdminRole(userID, hasAdmin int) error {
 	o := GetOrmer()
-
-	sql := `update user set sysadmin_flag =not sysadmin_flag where user_id = ?`
-
-	r, err := o.Raw(sql, u.UserID).Exec()
+        queryParams := make([]interface{}, 1)
+	sql := `update user set sysadmin_flag = ? where user_id = ?`
+	queryParams = append(queryParams, hasAdmin)
+	queryParams = append(queryParams, userID)
+	r, err := o.Raw(sql, queryParams).Exec()
 	if err != nil {
 		return err
 	}
@@ -229,3 +230,13 @@ func DeleteUser(userID int) error {
 	_, err := o.Raw(`update user set deleted = 1 where user_id = ?`, userID).Exec()
 	return err
 }
+
+// ChangeUserProfile ...
+func ChangeUserProfile(user models.User) error {
+	o := GetOrmer()
+	if _, err := o.Update(&user, "Email", "Realname", "Comment"); err != nil {
+		log.Errorf("update user failed, error: %v", err)
+		return err
+	}
+	return nil
+}

docs/swagger.yaml

@@ -119,7 +119,7 @@ paths:
           description: Project name already exists.
         500:
           description: Unexpected internal errors.
-  /projects/{project_id}:
+  /projects/{project_id}/publicity:
     put:
       summary: Update properties for a selected project.
       description: |
@@ -353,7 +353,24 @@ paths:
         404:
           description: Project ID does not exist.
         500:
-          description: Unexpected internal errors.   
+          description: Unexpected internal errors.
+  /statistics:
+    get:
+      summary: Get projects number and repositories number relevant to the user
+      description: |
+        This endpoint is aimed to statistic all of the projects number and repositories number relevant to the logined user, also the public projects number and repositories number. If the user is admin, he can also get total projects number and total repositories number.
+      tags:
+        - Products
+      responses:
+        200:
+          description: Get the projects number and repositories number relevant to the user successfully.
+          schema:
+            $ref: '#/definitions/StatisticMap'
+        401:
+          description: User need to log in first.
+        500:
+          description: Unexpected internal errors.
+
   /users:
     get:
       summary: Get registered users of Harbor.
@@ -407,10 +424,9 @@ paths:
           description: Unexpected internal errors.
   /users/{user_id}:
     put:
-      summary: Update a registered user to change to be an administrator of Harbor.
+      summary: Update a registered user to change his profile.
       description: |
-        This endpoint let a registered user change to be an administrator
-        of Harbor.
+       This endpoint let a registered user change his profile.
       parameters:
         - name: user_id
           in: path
@@ -418,6 +434,12 @@ paths:
           format: int32
           required: true
           description: Registered user ID
+        - name: profile
+          in: body
+          description: Only email, realname and comment can be modified.
+          required: true
+          schema:
+            $ref: '#/definitions/User' 
       tags:
         - Products
       responses:
@@ -490,7 +512,35 @@ paths:
         403:
           description: Guests can only change their own account.
         500:
-          description: Unexpected internal errors.	
+          description: Unexpected internal errors.
+  /users/{user_id}/sysadmin:
+     put:
+      summary: Update a registered user to change to be an administrator of Harbor.
+      description: |
+        This endpoint let a registered user change to be an administrator
+        of Harbor.
+      parameters:
+        - name: user_id
+          in: path
+          type: integer
+          format: int32
+          required: true
+          description: Registered user ID
+      tags:
+        - Products
+      responses:
+        200:
+          description: Updated user's admin role successfully.
+        400:
+          description: Invalid user ID.
+        401:
+          description: User need to log in first.
+        403:
+          description: User does not have permission of admin role.
+        404:
+          description: User ID does not exist.
+        500:
+          description: Unexpected internal errors.
   /repositories:
     get:
       summary: Get repositories accompany with relevant project and repo name.
@@ -597,6 +647,70 @@ paths:
           description: Retrieved manifests from a relevant repository successfully.
         500:
           description: Unexpected internal errors.
+  /repositories/top:
+    get:
+      summary: Get public repositories which are accessed most.
+      description: |
+        This endpoint aims to let users see the most popular public repositories
+      parameters:
+        - name: count
+          in: query
+          type: integer
+          format: int32
+          required: false
+          description: The number of the requested public repositories, default is 10 if not provided.
+      tags:
+       - Products
+      responses:
+        200:
+          description: Retrieved top repositories successfully.
+          schema:
+            type: array
+            items:
+              $ref: '#/definitions/TopRepo'
+        400:
+          description: Bad request because of invalid count.
+        500:
+          description: Unexpected internal errors.
+  /logs:
+    get:
+      summary: Get recent logs of the projects which the user is a member of
+      description: |
+        This endpoint let user see the recent operation logs of the projects which he is member of 
+      parameters:
+        - name: lines
+          in: query
+          type: integer
+          format: int32
+          required: false
+          description: The number of logs to be shown, default is 10 if lines, start_time, end_time are not provided.
+        - name: start_time
+          in: query
+          type: integer
+          format: int64
+          required: false
+          description: The start time of logs to be shown in unix timestap
+        - name: end_time
+          in: query
+          type: integer
+          format: int64
+          required: false
+          description: The end time of logs to be shown in unix timestap
+      tags:
+        - Products
+      responses:
+        200:
+          description: Get the required logs successfully.
+          schema:
+            type: array
+            items:
+              $ref: '#/definitions/AccessLog'
+        400:
+          description: Bad request because of invalid parameter of lines or start_time or end_time.
+        401:
+          description: User need to login first.
+        500:
+          description: Unexpected internal errors.
 definitions:
   Search:
     type: object
@@ -801,3 +915,45 @@ definitions:
       username:
         type: string
         description: Username relevant to a project role member.
+  TopRepo:
+    type: object
+    properties:
+      repo_name: 
+        type: string
+        description: The name of the repo 
+      access_count: 
+        type: integer
+        format: int
+        description: The access count of the repo
+  StatisticMap:
+    type: object
+    properties:
+      my_project_count: 
+        type: integer
+        format: int32
+        description: The count of the projects which the user is a member of.
+      my_repo_count: 
+        type: integer
+        format: int32
+        description: The count of the repositories belonging to the projects which the user is a member of.
+      public_project_count: 
+        type: integer
+        format: int32
+        description: The count of the public projects.
+      public_repo_count: 
+        type: integer
+        format: int32
+        description: The count of the public repositories belonging to the public projects which the user is a member of.
+      total_project_count: 
+        type: integer
+        format: int32
+        description: The count of the total projects, only be seen when the is admin.
+      total_repo_count: 
+        type: integer
+        format: int32
+        description: The count of the total repositories, only be seen when the user is admin.
+        
+        
+        
+        
+        

docs/user_guide.md

@@ -4,9 +4,14 @@ This guide takes you through the fundamentals of using Harbor. You'll learn how
 
 * Manage your projects.
 * Manage members of a project.
+* Replicate projects to a remote registry.
 * Search projects and repositories.
-* Manage Harbor system if you are the system administrator.
+* Manage Harbor system if you are the system administrator:
+ + Manage users.
+ + Manage destinations.
+ + Manage replication policies.
 * Pull and push images using Docker client.
+* Delete repositories.
 
 
 ##Role Based Access Control
@@ -37,39 +42,60 @@ A project in Harbor contains all repositories of an application. RBAC is applied
 * **Public**: All users have the read privilege to a public project, it's convenient for you to share some repositories with others in this way.
 * **Private**: A private project can only be accessed by users with proper privileges.  
 
-You can create a project after you signed in. Enabling the "Public project" checkbox will make this project public.  
+You can create a project after you signed in. Enabling the "Public" checkbox will make this project public.  
 
-![create project](img/create_project.png)  
+![create project](img/new_create_project.png)  
 
-After the project is created, you can browse repositories, users and access logs using the navigation column on the left.  
+After the project is created, you can browse repositories, users and logs using the navigation tab.  
 
-![browse project](img/browse_project.png)  
+![browse project](img/new_browse_project.png)  
 
-All access logs can be listed by clicking "Logs". You can apply a filter by username, or operations and dates under "Advanced Search".  
+All logs can be listed by clicking "Logs". You can apply a filter by username, or operations and dates under "Advanced Search".  
 
-![browse project](img/project_log.png)  
+![browse project](img/new_project_log.png)  
 
 ##Managing members of a project 
 ###Adding members
 You can add members with different roles to an existing project.  
 
-![browse project](img/add_member.png)
+![browse project](img/new_add_member.png)
 
 ###Updating and removing members
 You can update or remove a member by clicking the icon on the right.  
 
-![browse project](img/remove_update_member.png)
+![browse project](img/new_remove_update_member.png)
+
+##Replicating images
+If you are a system administrator, you can replicate images to a remote registry, which is called destination in Harbor. Only Harbor instance is supported as a destination for now.  
+Click "Add New Policy" on the "Replication" tab, fill the necessary fields and click "OK", a policy for this project will be created. If  "Enable" is chosen, the project will be replicated to the remote immediately, and when a new repository is pushed to this project or an existing repository is deleted from this project, the same operation will also be replicated to the destination.  
+
+![browse project](img/new_create_policy.png)
+
+You can enable or disable a policy in the policy list view, and only the policies which are disbled can be edited.  
+Click a policy, jobs which belong to this policy will be listed. A job represents the progress which will replicate a repository of one project to the remote.
+
+![browse project](img/new_policy_list.png)
 
 ##Searching projects and repositories
-Entering a keyword in the search field at the top lists all matching projects and repos. The search result includes public repos and private repos you have access privilege to.  
+Entering a keyword in the search field at the top lists all matching projects and repositories. The search result includes both public and private repositories you have access privilege to.  
 
-![browse project](img/search.png)
+![browse project](img/new_search.png)
 
 ##Administrator options
-###Setting administrator and deleting user
-Administrator can add "SysAdmin" role to an ordinary user by toggling the switch under "System Admin". To delete a user, click on the recycle bin icon.  
+###Managing user
+Administrator can add "administrator" role to an ordinary user by toggling the switch under "Administrator". To delete a user, click on the recycle bin icon.  
 
-![browse project](img/set_admin_remove_user.png)
+![browse project](img/new_set_admin_remove_user.png)
+
+###Managing destination
+You can list, add, edit and delete destinations in the "Destination" tab. Only destinations which are not referenced by any policies can be edited.  
+
+![browse project](img/new_manage_destination.png)
+
+###Managing replication
+You can list, edit, enable and disable policies in the "Replication" tab. Make sure the policy is disabled before you edit it.  
+
+![browse project](img/new_manage_replication.png)
 
 ##Pulling and pushing images using Docker client
 
@@ -119,4 +145,28 @@ Push the image:
 $ docker push 10.117.169.182/demo/ubuntu:14.04  
 ```  
 
-**Note: Replace "10.117.169.182" with the IP address or domain name of your Harbor node.**
+**Note: Replace "10.117.169.182" with the IP address or domain name of your Harbor node.**
+
+##Deleting repositories
+
+Repositories deletion runs in two steps.  
+First, delete repositories in Harbor's UI. This is soft deletion. You can delete the entire repository or just a tag of it.  
+
+![browse project](img/new_delete_repository.png)
+
+**Note: If both tag A and tag B reference the same image, after deleting tag A, B will also disappear.**  
+
+Second, delete the real data using registry's garbage colliection(GC).  
+Make sure that no one is pushing images or Harbor is not running at all before you do GC. If someone were to push an image while GC is running, there is the risk that the image's layers will be mistakenly deleted, leading to a corrupted image. So before running GC, a preferred approach is to stop Harbor first.  
+
+Run the command on the host which harbor is deployed on. 
+
+```sh
+$ docker-compose stop
+$ docker run -it --name gc --rm --volumes-from deploy_registry_1 registry:2.4.0 garbage-collect [--dry-run] /etc/registry/config.yml
+$ docker-compose start
+```  
+
+Option "--dry-run" will print the progress without removing any data.  
+
+About the details of GC, please see [GC](https://github.com/docker/distribution/blob/master/docs/garbage-collection.md).  

job/config/config.go

@@ -0,0 +1,125 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/astaxie/beego"
+	"github.com/vmware/harbor/utils/log"
+)
+
+const defaultMaxWorkers int = 10
+
+var maxJobWorkers int
+var localUIURL string
+var localRegURL string
+var logDir string
+var uiSecret string
+var verifyRemoteCert string
+
+func init() {
+	maxWorkersEnv := os.Getenv("MAX_JOB_WORKERS")
+	maxWorkers64, err := strconv.ParseInt(maxWorkersEnv, 10, 32)
+	maxJobWorkers = int(maxWorkers64)
+	if err != nil {
+		log.Warningf("Failed to parse max works setting, error: %v, the default value: %d will be used", err, defaultMaxWorkers)
+		maxJobWorkers = defaultMaxWorkers
+	}
+
+	localRegURL = os.Getenv("REGISTRY_URL")
+	if len(localRegURL) == 0 {
+		localRegURL = "http://registry:5000"
+	}
+
+	localUIURL = os.Getenv("UI_URL")
+	if len(localUIURL) == 0 {
+		localUIURL = "http://ui"
+	}
+
+	logDir = os.Getenv("LOG_DIR")
+	if len(logDir) == 0 {
+		logDir = "/var/log"
+	}
+
+	f, err := os.Open(logDir)
+	defer f.Close()
+	if err != nil {
+		panic(err)
+	}
+	finfo, err := f.Stat()
+	if err != nil {
+		panic(err)
+	}
+	if !finfo.IsDir() {
+		panic(fmt.Sprintf("%s is not a direcotry", logDir))
+	}
+
+	uiSecret = os.Getenv("UI_SECRET")
+	if len(uiSecret) == 0 {
+		panic("UI Secret is not set")
+	}
+
+	verifyRemoteCert = os.Getenv("VERIFY_REMOTE_CERT")
+	if len(verifyRemoteCert) == 0 {
+		verifyRemoteCert = "on"
+	}
+
+	configPath := os.Getenv("CONFIG_PATH")
+	if len(configPath) != 0 {
+		log.Infof("Config path: %s", configPath)
+		beego.LoadAppConfig("ini", configPath)
+	}
+
+	log.Debugf("config: maxJobWorkers: %d", maxJobWorkers)
+	log.Debugf("config: localUIURL: %s", localUIURL)
+	log.Debugf("config: localRegURL: %s", localRegURL)
+	log.Debugf("config: verifyRemoteCert: %s", verifyRemoteCert)
+	log.Debugf("config: logDir: %s", logDir)
+	log.Debugf("config: uiSecret: ******")
+}
+
+// MaxJobWorkers ...
+func MaxJobWorkers() int {
+	return maxJobWorkers
+}
+
+// LocalUIURL returns the local ui url, job service will use this URL to call API hosted on ui process
+func LocalUIURL() string {
+	return localUIURL
+}
+
+// LocalRegURL returns the local registry url, job service will use this URL to pull image from the registry
+func LocalRegURL() string {
+	return localRegURL
+}
+
+// LogDir returns the absolute path to which the log file will be written
+func LogDir() string {
+	return logDir
+}
+
+// UISecret will return the value of secret cookie for jobsevice to call UI API.
+func UISecret() string {
+	return uiSecret
+}
+
+// VerifyRemoteCert return the flag to tell jobservice whether or not verify the cert of remote registry
+func VerifyRemoteCert() bool {
+	return verifyRemoteCert != "off"
+}

job/replication/delete.go

@@ -0,0 +1,112 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package replication
+
+import (
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+	"github.com/vmware/harbor/utils/registry"
+	"github.com/vmware/harbor/utils/registry/auth"
+)
+
+const (
+	// StateDelete ...
+	StateDelete = "delete"
+)
+
+// Deleter deletes repository or tags
+type Deleter struct {
+	repository string // prject_name/repo_name
+	tags       []string
+
+	dstURL string // url of target registry
+	dstUsr string // username ...
+	dstPwd string // username ...
+
+	insecure bool
+
+	dstClient *registry.Repository
+
+	logger *log.Logger
+}
+
+// NewDeleter returns a Deleter
+func NewDeleter(repository string, tags []string, dstURL, dstUsr, dstPwd string, insecure bool, logger *log.Logger) *Deleter {
+	deleter := &Deleter{
+		repository: repository,
+		tags:       tags,
+		dstURL:     dstURL,
+		dstUsr:     dstUsr,
+		dstPwd:     dstPwd,
+		insecure:   insecure,
+		logger:     logger,
+	}
+	deleter.logger.Infof("initialization completed: repository: %s, tags: %v, destination URL: %s, insecure: %v, destination user: %s",
+		deleter.repository, deleter.tags, deleter.dstURL, deleter.insecure, deleter.dstUsr)
+	return deleter
+}
+
+// Exit ...
+func (d *Deleter) Exit() error {
+	return nil
+}
+
+// Enter deletes repository or tags
+func (d *Deleter) Enter() (string, error) {
+	state, err := d.enter()
+	if err != nil && retry(err) {
+		d.logger.Info("waiting for retrying...")
+		return models.JobRetrying, nil
+	}
+
+	return state, err
+}
+
+func (d *Deleter) enter() (string, error) {
+	dstCred := auth.NewBasicAuthCredential(d.dstUsr, d.dstPwd)
+	dstClient, err := newRepositoryClient(d.dstURL, d.insecure, dstCred,
+		d.repository, "repository", d.repository, "pull", "push", "*")
+	if err != nil {
+		d.logger.Errorf("an error occurred while creating destination repository client: %v", err)
+		return "", err
+	}
+
+	d.dstClient = dstClient
+
+	if len(d.tags) == 0 {
+		tags, err := d.dstClient.ListTag()
+		if err != nil {
+			d.logger.Errorf("an error occurred while listing tags of repository %s on %s with user %s: %v", d.repository, d.dstURL, d.dstUsr, err)
+			return "", err
+		}
+
+		d.tags = append(d.tags, tags...)
+	}
+
+	d.logger.Infof("tags %v will be deleted", d.tags)
+
+	for _, tag := range d.tags {
+
+		if err := d.dstClient.DeleteTag(tag); err != nil {
+			d.logger.Errorf("an error occurred while deleting repository %s:%s on %s with user %s: %v", d.repository, tag, d.dstURL, d.dstUsr, err)
+			return "", err
+		}
+
+		d.logger.Infof("repository %s:%s on %s has been deleted", d.repository, tag, d.dstURL)
+	}
+
+	return models.JobFinished, nil
+}

job/replication/error.go

@@ -0,0 +1,39 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package replication
+
+import (
+	"net"
+)
+
+func retry(err error) bool {
+	if err == nil {
+		return false
+	}
+	return isNetworkErr(err)
+}
+
+func isTemporary(err error) bool {
+	if netErr, ok := err.(net.Error); ok {
+		return netErr.Temporary()
+	}
+	return false
+}
+
+func isNetworkErr(err error) bool {
+	_, ok := err.(net.Error)
+	return ok
+}

job/replication/transfer.go

@@ -0,0 +1,560 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package replication
+
+import (
+	"bytes"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"strings"
+
+	"github.com/docker/distribution"
+	"github.com/docker/distribution/manifest/schema1"
+	"github.com/docker/distribution/manifest/schema2"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+	"github.com/vmware/harbor/utils/registry"
+	"github.com/vmware/harbor/utils/registry/auth"
+)
+
+const (
+	// StateInitialize ...
+	StateInitialize = "initialize"
+	// StateCheck ...
+	StateCheck = "check"
+	// StatePullManifest ...
+	StatePullManifest = "pull_manifest"
+	// StateTransferBlob ...
+	StateTransferBlob = "transfer_blob"
+	// StatePushManifest ...
+	StatePushManifest = "push_manifest"
+)
+
+var (
+	// ErrConflict represents http 409 error
+	ErrConflict = errors.New("conflict")
+)
+
+// BaseHandler holds informations shared by other state handlers
+type BaseHandler struct {
+	project    string // project_name
+	repository string // prject_name/repo_name
+	tags       []string
+
+	srcURL    string // url of source registry
+	srcSecret string
+
+	dstURL string // url of target registry
+	dstUsr string // username ...
+	dstPwd string // password ...
+
+	insecure bool // whether skip secure check when using https
+
+	srcClient *registry.Repository
+	dstClient *registry.Repository
+
+	manifest distribution.Manifest // manifest of tags[0]
+	digest   string                //digest of tags[0]'s manifest
+	blobs    []string              // blobs need to be transferred for tags[0]
+
+	blobsExistence map[string]bool //key: digest of blob, value: existence
+
+	logger *log.Logger
+}
+
+// InitBaseHandler initializes a BaseHandler.
+func InitBaseHandler(repository, srcURL, srcSecret,
+	dstURL, dstUsr, dstPwd string, insecure bool, tags []string, logger *log.Logger) *BaseHandler {
+
+	base := &BaseHandler{
+		repository:     repository,
+		tags:           tags,
+		srcURL:         srcURL,
+		srcSecret:      srcSecret,
+		dstURL:         dstURL,
+		dstUsr:         dstUsr,
+		dstPwd:         dstPwd,
+		insecure:       insecure,
+		blobsExistence: make(map[string]bool, 10),
+		logger:         logger,
+	}
+
+	base.project = getProjectName(base.repository)
+
+	return base
+}
+
+// Exit ...
+func (b *BaseHandler) Exit() error {
+	return nil
+}
+
+func getProjectName(repository string) string {
+	repository = strings.TrimSpace(repository)
+	repository = strings.TrimRight(repository, "/")
+	return repository[:strings.LastIndex(repository, "/")]
+}
+
+// Initializer creates clients for source and destination registry,
+// lists tags of the repository if parameter tags is nil.
+type Initializer struct {
+	*BaseHandler
+}
+
+// Enter ...
+func (i *Initializer) Enter() (string, error) {
+	i.logger.Infof("initializing: repository: %s, tags: %v, source URL: %s, destination URL: %s, insecure: %v, destination user: %s",
+		i.repository, i.tags, i.srcURL, i.dstURL, i.insecure, i.dstUsr)
+
+	state, err := i.enter()
+	if err != nil && retry(err) {
+		i.logger.Info("waiting for retrying...")
+		return models.JobRetrying, nil
+	}
+
+	return state, err
+}
+
+func (i *Initializer) enter() (string, error) {
+	c := &http.Cookie{Name: models.UISecretCookie, Value: i.srcSecret}
+	srcCred := auth.NewCookieCredential(c)
+	srcClient, err := newRepositoryClient(i.srcURL, i.insecure, srcCred,
+		i.repository, "repository", i.repository, "pull", "push", "*")
+	if err != nil {
+		i.logger.Errorf("an error occurred while creating source repository client: %v", err)
+		return "", err
+	}
+	i.srcClient = srcClient
+
+	dstCred := auth.NewBasicAuthCredential(i.dstUsr, i.dstPwd)
+	dstClient, err := newRepositoryClient(i.dstURL, i.insecure, dstCred,
+		i.repository, "repository", i.repository, "pull", "push", "*")
+	if err != nil {
+		i.logger.Errorf("an error occurred while creating destination repository client: %v", err)
+		return "", err
+	}
+	i.dstClient = dstClient
+
+	if len(i.tags) == 0 {
+		tags, err := i.srcClient.ListTag()
+		if err != nil {
+			i.logger.Errorf("an error occurred while listing tags for source repository: %v", err)
+			return "", err
+		}
+		i.tags = tags
+	}
+
+	i.logger.Infof("initialization completed: project: %s, repository: %s, tags: %v, source URL: %s, destination URL: %s, insecure: %v, destination user: %s",
+		i.project, i.repository, i.tags, i.srcURL, i.dstURL, i.insecure, i.dstUsr)
+
+	return StateCheck, nil
+}
+
+// Checker checks the existence of project and the user's privlege to the project
+type Checker struct {
+	*BaseHandler
+}
+
+// Enter check existence of project, if it does not exist, create it,
+// if it exists, check whether the user has write privilege to it.
+func (c *Checker) Enter() (string, error) {
+	state, err := c.enter()
+	if err != nil && retry(err) {
+		c.logger.Info("waiting for retrying...")
+		return models.JobRetrying, nil
+	}
+
+	return state, err
+}
+
+func (c *Checker) enter() (string, error) {
+enter:
+	exist, canWrite, err := c.projectExist()
+	if err != nil {
+		c.logger.Errorf("an error occurred while checking existence of project %s on %s with user %s : %v", c.project, c.dstURL, c.dstUsr, err)
+		return "", err
+	}
+	if !exist {
+		err := c.createProject()
+		if err != nil {
+			// other job may be also doing the same thing when the current job
+			// is creating project, so when the response code is 409, re-check
+			// the existence of project
+			if err == ErrConflict {
+				goto enter
+			} else {
+				c.logger.Errorf("an error occurred while creating project %s on %s with user %s : %v", c.project, c.dstURL, c.dstUsr, err)
+				return "", err
+			}
+		}
+		c.logger.Infof("project %s is created on %s with user %s", c.project, c.dstURL, c.dstUsr)
+		return StatePullManifest, nil
+	}
+
+	c.logger.Infof("project %s already exists on %s", c.project, c.dstURL)
+
+	if !canWrite {
+		err = fmt.Errorf("the user %s is unauthorized to write to project %s on %s", c.dstUsr, c.project, c.dstURL)
+		c.logger.Errorf("%v", err)
+		return "", err
+	}
+	c.logger.Infof("the user %s has write privilege to project %s on %s", c.dstUsr, c.project, c.dstURL)
+
+	return StatePullManifest, nil
+}
+
+// check the existence of project, if it exists, returning whether the user has write privilege to it
+func (c *Checker) projectExist() (exist, canWrite bool, err error) {
+	url := strings.TrimRight(c.dstURL, "/") + "/api/projects/?project_name=" + c.project
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		return
+	}
+
+	req.SetBasicAuth(c.dstUsr, c.dstPwd)
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: c.insecure,
+			},
+		},
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return
+	}
+
+	if resp.StatusCode == http.StatusNotFound {
+		return
+	}
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		exist = true
+		return
+	}
+
+	defer resp.Body.Close()
+	data, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return
+	}
+
+	if resp.StatusCode == http.StatusOK {
+		var projects []models.Project
+		if err = json.Unmarshal(data, &projects); err != nil {
+			return
+		}
+
+		if len(projects) == 0 {
+			return
+		}
+
+		for _, project := range projects {
+			if project.Name == c.project {
+				exist = true
+				canWrite = (project.Role == models.PROJECTADMIN ||
+					project.Role == models.DEVELOPER)
+				break
+			}
+		}
+
+		return
+	}
+
+	err = fmt.Errorf("an error occurred while checking existen of project %s on %s with user %s: %d %s",
+		c.project, c.dstURL, c.dstUsr, resp.StatusCode, string(data))
+
+	return
+}
+
+func (c *Checker) createProject() error {
+	// TODO handle publicity of project
+	project := struct {
+		ProjectName string `json:"project_name"`
+		Public      bool   `json:"public"`
+	}{
+		ProjectName: c.project,
+	}
+
+	data, err := json.Marshal(project)
+	if err != nil {
+		return err
+	}
+
+	url := strings.TrimRight(c.dstURL, "/") + "/api/projects/"
+	req, err := http.NewRequest("POST", url, bytes.NewReader(data))
+	if err != nil {
+		return err
+	}
+
+	req.SetBasicAuth(c.dstUsr, c.dstPwd)
+
+	client := &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: c.insecure,
+			},
+		},
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+
+	// version 0.1.1's reponse code is 200
+	if resp.StatusCode == http.StatusCreated ||
+		resp.StatusCode == http.StatusOK {
+		return nil
+	}
+
+	if resp.StatusCode == http.StatusConflict {
+		return ErrConflict
+	}
+
+	defer resp.Body.Close()
+	message, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		c.logger.Errorf("an error occurred while reading message from response: %v", err)
+	}
+
+	return fmt.Errorf("failed to create project %s on %s with user %s: %d %s",
+		c.project, c.dstURL, c.dstUsr, resp.StatusCode, string(message))
+}
+
+// ManifestPuller pulls the manifest of a tag. And if no tag needs to be pulled,
+// the next state that state machine should enter is "finished".
+type ManifestPuller struct {
+	*BaseHandler
+}
+
+// Enter pulls manifest of a tag and checks if all blobs exist in the destination registry
+func (m *ManifestPuller) Enter() (string, error) {
+	state, err := m.enter()
+	if err != nil && retry(err) {
+		m.logger.Info("waiting for retrying...")
+		return models.JobRetrying, nil
+	}
+
+	return state, err
+
+}
+
+func (m *ManifestPuller) enter() (string, error) {
+	if len(m.tags) == 0 {
+		m.logger.Infof("no tag needs to be replicated, next state is \"finished\"")
+		return models.JobFinished, nil
+	}
+
+	name := m.repository
+	tag := m.tags[0]
+
+	acceptMediaTypes := []string{schema1.MediaTypeManifest, schema2.MediaTypeManifest}
+	digest, mediaType, payload, err := m.srcClient.PullManifest(tag, acceptMediaTypes)
+	if err != nil {
+		m.logger.Errorf("an error occurred while pulling manifest of %s:%s from %s: %v", name, tag, m.srcURL, err)
+		return "", err
+	}
+	m.digest = digest
+	m.logger.Infof("manifest of %s:%s pulled successfully from %s: %s", name, tag, m.srcURL, digest)
+
+	if strings.Contains(mediaType, "application/json") {
+		mediaType = schema1.MediaTypeManifest
+	}
+
+	manifest, _, err := registry.UnMarshal(mediaType, payload)
+	if err != nil {
+		m.logger.Errorf("an error occurred while parsing manifest of %s:%s from %s: %v", name, tag, m.srcURL, err)
+		return "", err
+	}
+
+	m.manifest = manifest
+
+	// all blobs(layers and config)
+	var blobs []string
+
+	for _, discriptor := range manifest.References() {
+		blobs = append(blobs, discriptor.Digest.String())
+	}
+
+	// config is also need to be transferred if the schema of manifest is v2
+	manifest2, ok := manifest.(*schema2.DeserializedManifest)
+	if ok {
+		blobs = append(blobs, manifest2.Target().Digest.String())
+	}
+
+	m.logger.Infof("all blobs of %s:%s from %s: %v", name, tag, m.srcURL, blobs)
+
+	for _, blob := range blobs {
+		exist, ok := m.blobsExistence[blob]
+		if !ok {
+			exist, err = m.dstClient.BlobExist(blob)
+			if err != nil {
+				m.logger.Errorf("an error occurred while checking existence of blob %s of %s:%s on %s: %v", blob, name, tag, m.dstURL, err)
+				return "", err
+			}
+			m.blobsExistence[blob] = exist
+		}
+
+		if !exist {
+			m.blobs = append(m.blobs, blob)
+		} else {
+			m.logger.Infof("blob %s of %s:%s already exists in %s", blob, name, tag, m.dstURL)
+		}
+	}
+	m.logger.Infof("blobs of %s:%s need to be transferred to %s: %v", name, tag, m.dstURL, m.blobs)
+
+	return StateTransferBlob, nil
+}
+
+// BlobTransfer transfers blobs of a tag
+type BlobTransfer struct {
+	*BaseHandler
+}
+
+// Enter pulls blobs and then pushs them to destination registry.
+func (b *BlobTransfer) Enter() (string, error) {
+	state, err := b.enter()
+	if err != nil && retry(err) {
+		b.logger.Info("waiting for retrying...")
+		return models.JobRetrying, nil
+	}
+
+	return state, err
+
+}
+
+func (b *BlobTransfer) enter() (string, error) {
+	name := b.repository
+	tag := b.tags[0]
+	for _, blob := range b.blobs {
+		b.logger.Infof("transferring blob %s of %s:%s to %s ...", blob, name, tag, b.dstURL)
+		size, data, err := b.srcClient.PullBlob(blob)
+		if err != nil {
+			b.logger.Errorf("an error occurred while pulling blob %s of %s:%s from %s: %v", blob, name, tag, b.srcURL, err)
+			return "", err
+		}
+		if err = b.dstClient.PushBlob(blob, size, data); err != nil {
+			b.logger.Errorf("an error occurred while pushing blob %s of %s:%s to %s : %v", blob, name, tag, b.dstURL, err)
+			return "", err
+		}
+		b.logger.Infof("blob %s of %s:%s transferred to %s completed", blob, name, tag, b.dstURL)
+	}
+
+	return StatePushManifest, nil
+}
+
+// ManifestPusher pushs the manifest to destination registry
+type ManifestPusher struct {
+	*BaseHandler
+}
+
+// Enter checks the existence of manifest in the source registry first, and if it
+// exists, pushs it to destination registry. The checking operation is to avoid
+// the situation that the tag is deleted during the blobs transfering
+func (m *ManifestPusher) Enter() (string, error) {
+	state, err := m.enter()
+	if err != nil && retry(err) {
+		m.logger.Info("waiting for retrying...")
+		return models.JobRetrying, nil
+	}
+
+	return state, err
+
+}
+
+func (m *ManifestPusher) enter() (string, error) {
+	name := m.repository
+	tag := m.tags[0]
+	_, exist, err := m.srcClient.ManifestExist(tag)
+	if err != nil {
+		m.logger.Infof("an error occurred while checking the existence of manifest of %s:%s on %s: %v", name, tag, m.srcURL, err)
+		return "", err
+	}
+	if !exist {
+		m.logger.Infof("manifest of %s:%s does not exist on source registry %s, cancel manifest pushing", name, tag, m.srcURL)
+	} else {
+		m.logger.Infof("manifest of %s:%s exists on source registry %s, continue manifest pushing", name, tag, m.srcURL)
+
+		_, manifestExist, err := m.dstClient.ManifestExist(m.digest)
+		if manifestExist {
+			m.logger.Infof("manifest of %s:%s exists on destination registry %s, skip manifest pushing", name, tag, m.dstURL)
+
+			m.tags = m.tags[1:]
+			m.manifest = nil
+			m.digest = ""
+			m.blobs = nil
+
+			return StatePullManifest, nil
+		}
+
+		mediaType, data, err := m.manifest.Payload()
+		if err != nil {
+			m.logger.Errorf("an error occurred while getting payload of manifest for %s:%s : %v", name, tag, err)
+			return "", err
+		}
+
+		if _, err = m.dstClient.PushManifest(tag, mediaType, data); err != nil {
+			m.logger.Errorf("an error occurred while pushing manifest of %s:%s to %s : %v", name, tag, m.dstURL, err)
+			return "", err
+		}
+		m.logger.Infof("manifest of %s:%s has been pushed to %s", name, tag, m.dstURL)
+	}
+
+	m.tags = m.tags[1:]
+	m.manifest = nil
+	m.digest = ""
+	m.blobs = nil
+
+	return StatePullManifest, nil
+}
+
+func newRepositoryClient(endpoint string, insecure bool, credential auth.Credential, repository, scopeType, scopeName string,
+	scopeActions ...string) (*registry.Repository, error) {
+
+	authorizer := auth.NewStandardTokenAuthorizer(credential, insecure, scopeType, scopeName, scopeActions...)
+
+	store, err := auth.NewAuthorizerStore(endpoint, insecure, authorizer)
+	if err != nil {
+		return nil, err
+	}
+
+	uam := &userAgentModifier{
+		userAgent: "harbor-registry-client",
+	}
+
+	client, err := registry.NewRepositoryWithModifiers(repository, endpoint, insecure, store, uam)
+	if err != nil {
+		return nil, err
+	}
+	return client, nil
+}
+
+type userAgentModifier struct {
+	userAgent string
+}
+
+// Modify adds user-agent header to the request
+func (u *userAgentModifier) Modify(req *http.Request) error {
+	req.Header.Set(http.CanonicalHeaderKey("User-Agent"), u.userAgent)
+	return nil
+}

job/scheduler.go

@@ -0,0 +1,36 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package job
+
+import (
+	"github.com/vmware/harbor/utils/log"
+	"time"
+)
+
+var jobQueue = make(chan int64)
+
+// Schedule put a job id into job queue.
+func Schedule(jobID int64) {
+	jobQueue <- jobID
+}
+
+// Reschedule is called by statemachine to retry a job
+func Reschedule(jobID int64) {
+	log.Debugf("Job %d will be rescheduled in 5 minutes", jobID)
+	time.Sleep(5 * time.Minute)
+	log.Debugf("Rescheduling job %d", jobID)
+	Schedule(jobID)
+}

job/statehandlers.go

@@ -0,0 +1,119 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package job
+
+import (
+	"time"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// StateHandler handles transition, it associates with each state, will be called when
+// SM enters and exits a state during a transition.
+type StateHandler interface {
+	// Enter returns the next state, if it returns empty string the SM will hold the current state or
+	// or decide the next state.
+	Enter() (string, error)
+	//Exit should be idempotent
+	Exit() error
+}
+
+// StatusUpdater implements the StateHandler interface which updates the status of a job in DB when the job enters
+// a status.
+type StatusUpdater struct {
+	JobID int64
+	State string
+}
+
+// Enter updates the status of a job and returns "_continue" status to tell state machine to move on.
+// If the status is a final status it returns empty string and the state machine will be stopped.
+func (su StatusUpdater) Enter() (string, error) {
+	err := dao.UpdateRepJobStatus(su.JobID, su.State)
+	if err != nil {
+		log.Warningf("Failed to update state of job: %d, state: %s, error: %v", su.JobID, su.State, err)
+	}
+	var next = models.JobContinue
+	if su.State == models.JobStopped || su.State == models.JobError || su.State == models.JobFinished {
+		next = ""
+	}
+	return next, err
+}
+
+// Exit ...
+func (su StatusUpdater) Exit() error {
+	return nil
+}
+
+// Retry handles a special "retrying" in which case it will update the status in DB and reschedule the job
+// via scheduler
+type Retry struct {
+	JobID int64
+}
+
+// Enter ...
+func (jr Retry) Enter() (string, error) {
+	err := dao.UpdateRepJobStatus(jr.JobID, models.JobRetrying)
+	if err != nil {
+		log.Errorf("Failed to update state of job :%d to Retrying, error: %v", jr.JobID, err)
+	}
+	go Reschedule(jr.JobID)
+	return "", err
+}
+
+// Exit ...
+func (jr Retry) Exit() error {
+	return nil
+}
+
+// ImgPuller was for testing
+type ImgPuller struct {
+	img    string
+	logger *log.Logger
+}
+
+// Enter ...
+func (ip ImgPuller) Enter() (string, error) {
+	ip.logger.Infof("I'm pretending to pull img:%s, then sleep 30s", ip.img)
+	time.Sleep(30 * time.Second)
+	ip.logger.Infof("wake up from sleep.... testing retry")
+	return models.JobRetrying, nil
+}
+
+// Exit ...
+func (ip ImgPuller) Exit() error {
+	return nil
+}
+
+// ImgPusher is a statehandler for testing
+type ImgPusher struct {
+	targetURL string
+	logger    *log.Logger
+}
+
+// Enter ...
+func (ip ImgPusher) Enter() (string, error) {
+	ip.logger.Infof("I'm pretending to push img to:%s, then sleep 30s", ip.targetURL)
+	time.Sleep(30 * time.Second)
+	ip.logger.Infof("wake up from sleep.... testing retry")
+	return models.JobRetrying, nil
+}
+
+// Exit ...
+func (ip ImgPusher) Exit() error {
+	return nil
+}

job/statemachine.go

@@ -0,0 +1,291 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package job
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/job/config"
+	"github.com/vmware/harbor/job/replication"
+	"github.com/vmware/harbor/job/utils"
+	"github.com/vmware/harbor/models"
+	uti "github.com/vmware/harbor/utils"
+	"github.com/vmware/harbor/utils/log"
+)
+
+// RepJobParm wraps the parm of a job
+type RepJobParm struct {
+	LocalRegURL    string
+	TargetURL      string
+	TargetUsername string
+	TargetPassword string
+	Repository     string
+	Tags           []string
+	Enabled        int
+	Operation      string
+	Insecure       bool
+}
+
+// SM is the state machine to handle job, it handles one job at a time.
+type SM struct {
+	JobID         int64
+	CurrentState  string
+	PreviousState string
+	//The states that don't have to exist in transition map, such as "Error", "Canceled"
+	ForcedStates map[string]struct{}
+	Transitions  map[string]map[string]struct{}
+	Handlers     map[string]StateHandler
+	desiredState string
+	Logger       *log.Logger
+	Parms        *RepJobParm
+	lock         *sync.Mutex
+}
+
+// EnterState transit the statemachine from the current state to the state in parameter.
+// It returns the next state the statemachine should tranit to.
+func (sm *SM) EnterState(s string) (string, error) {
+	log.Debugf("Job id: %d, transiting from State: %s, to State: %s", sm.JobID, sm.CurrentState, s)
+	targets, ok := sm.Transitions[sm.CurrentState]
+	_, exist := targets[s]
+	_, isForced := sm.ForcedStates[s]
+	if !exist && !isForced {
+		return "", fmt.Errorf("Job id: %d, transition from %s to %s does not exist!", sm.JobID, sm.CurrentState, s)
+	}
+	exitHandler, ok := sm.Handlers[sm.CurrentState]
+	if ok {
+		if err := exitHandler.Exit(); err != nil {
+			return "", err
+		}
+	} else {
+		log.Debugf("Job id: %d, no handler found for state:%s, skip", sm.JobID, sm.CurrentState)
+	}
+	enterHandler, ok := sm.Handlers[s]
+	var next = models.JobContinue
+	var err error
+	if ok {
+		if next, err = enterHandler.Enter(); err != nil {
+			return "", err
+		}
+	} else {
+		log.Debugf("Job id: %d, no handler found for state:%s, skip", sm.JobID, s)
+	}
+	sm.PreviousState = sm.CurrentState
+	sm.CurrentState = s
+	log.Debugf("Job id: %d, transition succeeded, current state: %s", sm.JobID, s)
+	return next, nil
+}
+
+// Start kicks off the statemachine to transit from current state to s, and moves on
+// It will search the transit map if the next state is "_continue", and
+// will enter error state if there's more than one possible path when next state is "_continue"
+func (sm *SM) Start(s string) {
+	n, err := sm.EnterState(s)
+	log.Debugf("Job id: %d, next state from handler: %s", sm.JobID, n)
+	for len(n) > 0 && err == nil {
+		if d := sm.getDesiredState(); len(d) > 0 {
+			log.Debugf("Job id: %d. Desired state: %s, will ignore the next state from handler", sm.JobID, d)
+			n = d
+			sm.setDesiredState("")
+			continue
+		}
+		if n == models.JobContinue && len(sm.Transitions[sm.CurrentState]) == 1 {
+			for n = range sm.Transitions[sm.CurrentState] {
+				break
+			}
+			log.Debugf("Job id: %d, Continue to state: %s", sm.JobID, n)
+			continue
+		}
+		if n == models.JobContinue && len(sm.Transitions[sm.CurrentState]) != 1 {
+			log.Errorf("Job id: %d, next state is continue but there are %d possible next states in transition table", sm.JobID, len(sm.Transitions[sm.CurrentState]))
+			err = fmt.Errorf("Unable to continue")
+			break
+		}
+		n, err = sm.EnterState(n)
+		log.Debugf("Job id: %d, next state from handler: %s", sm.JobID, n)
+	}
+	if err != nil {
+		log.Warningf("Job id: %d, the statemachin will enter error state due to error: %v", sm.JobID, err)
+		sm.EnterState(models.JobError)
+	}
+}
+
+// AddTransition add a transition to the transition table of state machine, the handler is the handler of target state "to"
+func (sm *SM) AddTransition(from string, to string, h StateHandler) {
+	_, ok := sm.Transitions[from]
+	if !ok {
+		sm.Transitions[from] = make(map[string]struct{})
+	}
+	sm.Transitions[from][to] = struct{}{}
+	sm.Handlers[to] = h
+}
+
+// RemoveTransition removes a transition from transition table of the state machine
+func (sm *SM) RemoveTransition(from string, to string) {
+	_, ok := sm.Transitions[from]
+	if !ok {
+		return
+	}
+	delete(sm.Transitions[from], to)
+}
+
+// Stop will set the desired state as "stopped" such that when next tranisition happen the state machine will stop handling the current job
+// and the worker can release itself to the workerpool.
+func (sm *SM) Stop(id int64) {
+	log.Debugf("Trying to stop the job: %d", id)
+	sm.lock.Lock()
+	defer sm.lock.Unlock()
+	//need to check if the sm switched to other job
+	if id == sm.JobID {
+		sm.desiredState = models.JobStopped
+		log.Debugf("Desired state of job %d is set to stopped", id)
+	} else {
+		log.Debugf("State machine has switched to job %d, so the action to stop job %d will be ignored", sm.JobID, id)
+	}
+}
+
+func (sm *SM) getDesiredState() string {
+	sm.lock.Lock()
+	defer sm.lock.Unlock()
+	return sm.desiredState
+}
+
+func (sm *SM) setDesiredState(s string) {
+	sm.lock.Lock()
+	defer sm.lock.Unlock()
+	sm.desiredState = s
+}
+
+// Init initialzie the state machine, it will be called once in the lifecycle of state machine.
+func (sm *SM) Init() {
+	sm.lock = &sync.Mutex{}
+	sm.Handlers = make(map[string]StateHandler)
+	sm.Transitions = make(map[string]map[string]struct{})
+	sm.ForcedStates = map[string]struct{}{
+		models.JobError:    struct{}{},
+		models.JobStopped:  struct{}{},
+		models.JobCanceled: struct{}{},
+		models.JobRetrying: struct{}{},
+	}
+}
+
+// Reset resets the state machine so it will start handling another job.
+func (sm *SM) Reset(jid int64) error {
+	//To ensure the new jobID is visible to the thread to stop the SM
+	sm.lock.Lock()
+	sm.JobID = jid
+	sm.desiredState = ""
+	sm.lock.Unlock()
+
+	//init parms
+	job, err := dao.GetRepJob(sm.JobID)
+	if err != nil {
+		return fmt.Errorf("Failed to get job, error: %v", err)
+	}
+	if job == nil {
+		return fmt.Errorf("The job doesn't exist in DB, job id: %d", sm.JobID)
+	}
+	policy, err := dao.GetRepPolicy(job.PolicyID)
+	if err != nil {
+		return fmt.Errorf("Failed to get policy, error: %v", err)
+	}
+	if policy == nil {
+		return fmt.Errorf("The policy doesn't exist in DB, policy id:%d", job.PolicyID)
+	}
+	sm.Parms = &RepJobParm{
+		LocalRegURL: config.LocalRegURL(),
+		Repository:  job.Repository,
+		Tags:        job.TagList,
+		Enabled:     policy.Enabled,
+		Operation:   job.Operation,
+		Insecure:    !config.VerifyRemoteCert(),
+	}
+	if policy.Enabled == 0 {
+		//worker will cancel this job
+		return nil
+	}
+	target, err := dao.GetRepTarget(policy.TargetID)
+	if err != nil {
+		return fmt.Errorf("Failed to get target, error: %v", err)
+	}
+	if target == nil {
+		return fmt.Errorf("The target doesn't exist in DB, target id: %d", policy.TargetID)
+	}
+	sm.Parms.TargetURL = target.URL
+	sm.Parms.TargetUsername = target.Username
+	pwd := target.Password
+
+	if len(pwd) != 0 {
+		pwd, err = uti.ReversibleDecrypt(pwd)
+		if err != nil {
+			return fmt.Errorf("failed to decrypt password: %v", err)
+		}
+	}
+
+	sm.Parms.TargetPassword = pwd
+
+	//init states handlers
+	sm.Logger = utils.NewLogger(sm.JobID)
+	sm.Handlers = make(map[string]StateHandler)
+	sm.Transitions = make(map[string]map[string]struct{})
+	sm.CurrentState = models.JobPending
+
+	sm.AddTransition(models.JobPending, models.JobRunning, StatusUpdater{sm.JobID, models.JobRunning})
+	sm.AddTransition(models.JobRetrying, models.JobRunning, StatusUpdater{sm.JobID, models.JobRunning})
+	sm.Handlers[models.JobError] = StatusUpdater{sm.JobID, models.JobError}
+	sm.Handlers[models.JobStopped] = StatusUpdater{sm.JobID, models.JobStopped}
+	sm.Handlers[models.JobRetrying] = Retry{sm.JobID}
+
+	switch sm.Parms.Operation {
+	case models.RepOpTransfer:
+		addImgTransferTransition(sm)
+	case models.RepOpDelete:
+		addImgDeleteTransition(sm)
+	default:
+		err = fmt.Errorf("unsupported operation: %s", sm.Parms.Operation)
+	}
+
+	return err
+}
+
+//for testing onlly
+func addTestTransition(sm *SM) error {
+	sm.AddTransition(models.JobRunning, "pull-img", ImgPuller{img: sm.Parms.Repository, logger: sm.Logger})
+	return nil
+}
+
+func addImgTransferTransition(sm *SM) {
+	base := replication.InitBaseHandler(sm.Parms.Repository, sm.Parms.LocalRegURL, config.UISecret(),
+		sm.Parms.TargetURL, sm.Parms.TargetUsername, sm.Parms.TargetPassword,
+		sm.Parms.Insecure, sm.Parms.Tags, sm.Logger)
+
+	sm.AddTransition(models.JobRunning, replication.StateInitialize, &replication.Initializer{BaseHandler: base})
+	sm.AddTransition(replication.StateInitialize, replication.StateCheck, &replication.Checker{BaseHandler: base})
+	sm.AddTransition(replication.StateCheck, replication.StatePullManifest, &replication.ManifestPuller{BaseHandler: base})
+	sm.AddTransition(replication.StatePullManifest, replication.StateTransferBlob, &replication.BlobTransfer{BaseHandler: base})
+	sm.AddTransition(replication.StatePullManifest, models.JobFinished, &StatusUpdater{sm.JobID, models.JobFinished})
+	sm.AddTransition(replication.StateTransferBlob, replication.StatePushManifest, &replication.ManifestPusher{BaseHandler: base})
+	sm.AddTransition(replication.StatePushManifest, replication.StatePullManifest, &replication.ManifestPuller{BaseHandler: base})
+}
+
+func addImgDeleteTransition(sm *SM) {
+	deleter := replication.NewDeleter(sm.Parms.Repository, sm.Parms.Tags, sm.Parms.TargetURL,
+		sm.Parms.TargetUsername, sm.Parms.TargetPassword, sm.Parms.Insecure, sm.Logger)
+
+	sm.AddTransition(models.JobRunning, replication.StateDelete, deleter)
+	sm.AddTransition(replication.StateDelete, models.JobFinished, &StatusUpdater{sm.JobID, models.JobFinished})
+}

job/utils/logger.go

@@ -0,0 +1,66 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"fmt"
+
+	"github.com/vmware/harbor/job/config"
+	"github.com/vmware/harbor/utils/log"
+	"os"
+	"path/filepath"
+	"strconv"
+)
+
+// NewLogger create a logger for a speicified job
+func NewLogger(jobID int64) *log.Logger {
+	logFile := GetJobLogPath(jobID)
+	d := filepath.Dir(logFile)
+	if _, err := os.Stat(d); os.IsNotExist(err) {
+		err := os.MkdirAll(d, 0660)
+		if err != nil {
+			log.Errorf("Failed to create directory for log file %s, the error: %v", logFile, err)
+		}
+	}
+	f, err := os.OpenFile(logFile, os.O_RDWR|os.O_APPEND|os.O_CREATE, 0660)
+	if err != nil {
+		log.Errorf("Failed to open log file %s, the log of job %d will be printed to standard output, the error: %v", logFile, jobID, err)
+		f = os.Stdout
+	}
+	return log.New(f, log.NewTextFormatter(), log.InfoLevel)
+}
+
+// GetJobLogPath returns the absolute path in which the job log file is located.
+func GetJobLogPath(jobID int64) string {
+	f := fmt.Sprintf("job_%d.log", jobID)
+	k := jobID / 1000
+	p := ""
+	var d string
+	for k > 0 {
+		d = strconv.FormatInt(k%1000, 10)
+		k = k / 1000
+		if k > 0 && len(d) == 1 {
+			d = "00" + d
+		}
+		if k > 0 && len(d) == 2 {
+			d = "0" + d
+		}
+
+		p = filepath.Join(d, p)
+	}
+	p = filepath.Join(config.LogDir(), p, f)
+	return p
+}

job/workerpool.go

@@ -0,0 +1,138 @@
+/*
+    Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+        
+        http://www.apache.org/licenses/LICENSE-2.0
+        
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+*/
+
+package job
+
+import (
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/job/config"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+type workerPool struct {
+	workerChan chan *Worker
+	workerList []*Worker
+}
+
+// WorkerPool is a set of workers each worker is associate to a statemachine for handling jobs.
+// it consists of a channel for free workers and a list to all workers
+var WorkerPool *workerPool
+
+// StopJobs accepts a list of jobs and will try to stop them if any of them is being executed by the worker.
+func (wp *workerPool) StopJobs(jobs []int64) {
+	log.Debugf("Works working on jobs: %v will be stopped", jobs)
+	for _, id := range jobs {
+		for _, w := range wp.workerList {
+			if w.SM.JobID == id {
+				log.Debugf("found a worker whose job ID is %d, will try to stop it", id)
+				w.SM.Stop(id)
+			}
+		}
+	}
+}
+
+// Worker consists of a channel for job from which worker gets the next job to handle, and a pointer to a statemachine,
+// the actual work to handle the job is done via state machine.
+type Worker struct {
+	ID      int
+	RepJobs chan int64
+	SM      *SM
+	quit    chan bool
+}
+
+// Start is a loop worker gets id from its channel and handle it.
+func (w *Worker) Start() {
+	go func() {
+		for {
+			WorkerPool.workerChan <- w
+			select {
+			case jobID := <-w.RepJobs:
+				log.Debugf("worker: %d, will handle job: %d", w.ID, jobID)
+				w.handleRepJob(jobID)
+			case q := <-w.quit:
+				if q {
+					log.Debugf("worker: %d, will stop.", w.ID)
+					return
+				}
+			}
+		}
+	}()
+}
+
+// Stop ...
+func (w *Worker) Stop() {
+	go func() {
+		w.quit <- true
+	}()
+}
+
+func (w *Worker) handleRepJob(id int64) {
+	err := w.SM.Reset(id)
+	if err != nil {
+		log.Errorf("Worker %d, failed to re-initialize statemachine for job: %d, error: %v", w.ID, id, err)
+		err2 := dao.UpdateRepJobStatus(id, models.JobError)
+		if err2 != nil {
+			log.Errorf("Failed to update job status to ERROR, job: %d, error:%v", id, err2)
+		}
+		return
+	}
+	if w.SM.Parms.Enabled == 0 {
+		log.Debugf("The policy of job:%d is disabled, will cancel the job")
+		_ = dao.UpdateRepJobStatus(id, models.JobCanceled)
+	} else {
+		w.SM.Start(models.JobRunning)
+	}
+}
+
+// NewWorker returns a pointer to new instance of worker
+func NewWorker(id int) *Worker {
+	w := &Worker{
+		ID:      id,
+		RepJobs: make(chan int64),
+		quit:    make(chan bool),
+		SM:      &SM{},
+	}
+	w.SM.Init()
+	return w
+}
+
+// InitWorkerPool create workers according to configuration.
+func InitWorkerPool() {
+	WorkerPool = &workerPool{
+		workerChan: make(chan *Worker, config.MaxJobWorkers()),
+		workerList: make([]*Worker, 0, config.MaxJobWorkers()),
+	}
+	for i := 0; i < config.MaxJobWorkers(); i++ {
+		worker := NewWorker(i)
+		WorkerPool.workerList = append(WorkerPool.workerList, worker)
+		worker.Start()
+		log.Debugf("worker %d started", worker.ID)
+	}
+}
+
+// Dispatch will listen to the jobQueue of job service and try to pick a free worker from the worker pool and assign the job to it.
+func Dispatch() {
+	for {
+		select {
+		case job := <-jobQueue:
+			go func(jobID int64) {
+				log.Debugf("Trying to dispatch job: %d", jobID)
+				worker := <-WorkerPool.workerChan
+				worker.RepJobs <- jobID
+			}(job)
+		}
+	}
+}

jobservice/main.go

@@ -0,0 +1,50 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"github.com/astaxie/beego"
+	"github.com/vmware/harbor/dao"
+	"github.com/vmware/harbor/job"
+	"github.com/vmware/harbor/models"
+	"github.com/vmware/harbor/utils/log"
+)
+
+func main() {
+	dao.InitDB()
+	initRouters()
+	job.InitWorkerPool()
+	go job.Dispatch()
+	resumeJobs()
+	beego.Run()
+}
+
+func resumeJobs() {
+	log.Debugf("Trying to resume halted jobs...")
+	err := dao.ResetRunningJobs()
+	if err != nil {
+		log.Warningf("Failed to reset all running jobs to pending, error: %v", err)
+	}
+	jobs, err := dao.GetRepJobByStatus(models.JobPending, models.JobRetrying)
+	if err == nil {
+		for _, j := range jobs {
+			log.Debugf("Resuming job: %d", j.ID)
+			job.Schedule(j.ID)
+		}
+	} else {
+		log.Warningf("Failed to jobs to resume, error: %v", err)
+	}
+}

jobservice/router.go

@@ -0,0 +1,28 @@
+/*
+    Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+        
+        http://www.apache.org/licenses/LICENSE-2.0
+        
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+*/
+
+package main
+
+import (
+	api "github.com/vmware/harbor/api/jobs"
+
+	"github.com/astaxie/beego"
+)
+
+func initRouters() {
+	beego.Router("/api/jobs/replication", &api.ReplicationJob{})
+	beego.Router("/api/jobs/replication/:id/log", &api.ReplicationJob{}, "get:GetLog")
+	beego.Router("/api/jobs/replication/actions", &api.ReplicationJob{}, "post:HandleAction")
+}

migration/README.md

@@ -6,11 +6,15 @@ This module is for those machine running Harbor's old version, such as 0.1.0. If
 **WARNING!!** You must backup your data before migrating
 
 ###Installation
-- step 1: change `db_username`, `db_password`, `db_port`, `db_name` in migration.cfg
-- step 2: build image from dockerfile
+- step 1: 
+
+    ```
+    cd migration
+    ```
+- step 2: change `db_username`, `db_password`, `db_port`, `db_name` in migration.cfg
+- step 3: build image from dockerfile
+
     ```
-    cd harbor-migration
-    
     docker build -t migrate-tool .
     ```
 

migration/changelog.md

@@ -17,3 +17,11 @@ Changelog for harbor database schema
   - delete data `AMDRWS` from table `role`
   - delete data `A` from table `access`
   
+## 0.2.0
+
+  - create table `replication_policy`
+  - create table `replication_target`
+  - create table `replication_job`
+  - add column `repo_tag` to table `access_log`
+  - alter column `repo_name` on table `access_log`
+  - alter column `email` on table `user` 

migration/db_meta.py

@@ -85,3 +85,43 @@ class Project(Base):
     deleted = sa.Column(sa.Integer, nullable=False, server_default=sa.text("'0'"))
     public = sa.Column(sa.Integer, nullable=False, server_default=sa.text("'0'"))
     owner = relationship(u'User')
+
+class ReplicationPolicy(Base):
+    __tablename__ = "replication_policy"
+
+    id = sa.Column(sa.Integer, primary_key=True)
+    name = sa.Column(sa.String(256))
+    project_id = sa.Column(sa.Integer, nullable=False)
+    target_id = sa.Column(sa.Integer, nullable=False)
+    enabled = sa.Column(mysql.TINYINT(1), nullable=False, server_default=sa.text("'1'"))
+    description = sa.Column(sa.Text)
+    cron_str = sa.Column(sa.String(256))
+    start_time = sa.Column(mysql.TIMESTAMP)
+    creation_time = sa.Column(mysql.TIMESTAMP, server_default = sa.text("CURRENT_TIMESTAMP"))
+    update_time = sa.Column(mysql.TIMESTAMP, server_default = sa.text("CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP"))
+
+class ReplicationTarget(Base):
+    __tablename__ = "replication_target"
+
+    id = sa.Column(sa.Integer, primary_key=True)
+    name = sa.Column(sa.String(64))
+    url = sa.Column(sa.String(64))
+    username = sa.Column(sa.String(40))
+    password = sa.Column(sa.String(40))
+    target_type = sa.Column(mysql.TINYINT(1), nullable=False, server_default=sa.text("'0'"))
+    creation_time = sa.Column(mysql.TIMESTAMP, server_default = sa.text("CURRENT_TIMESTAMP"))
+    update_time = sa.Column(mysql.TIMESTAMP, server_default = sa.text("CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP"))
+
+class ReplicationJob(Base):
+    __tablename__ = "replication_job"
+
+    id = sa.Column(sa.Integer, primary_key=True)
+    status = sa.Column(sa.String(64), nullable=False)
+    policy_id = sa.Column(sa.Integer, nullable=False)
+    repository = sa.Column(sa.String(256), nullable=False)
+    operation = sa.Column(sa.String(64), nullable=False)
+    tags = sa.Column(sa.String(16384))
+    creation_time = sa.Column(mysql.TIMESTAMP, server_default = sa.text("CURRENT_TIMESTAMP"))
+    update_time = sa.Column(mysql.TIMESTAMP, server_default = sa.text("CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP"))
+    
+    __table_args__ = (sa.Index('policy', "policy_id"),)

migration/migration_harbor/versions/0_3_0.py

@@ -0,0 +1,57 @@
+# Copyright (c) 2008-2016 VMware, Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""0.1.1 to 0.3.0
+
+Revision ID: 0.1.1
+Revises: 
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = '0.3.0'
+down_revision = '0.1.1'
+branch_labels = None
+depends_on = None
+
+from alembic import op
+from db_meta import *
+
+from sqlalchemy.dialects import mysql
+
+def upgrade():
+    """
+    update schema&data
+    """
+    bind = op.get_bind()
+    #alter column user.email, alter column access_log.repo_name, and add column access_log.repo_tag
+    op.alter_column('user', 'email', type_=sa.String(128), existing_type=sa.String(30))
+    op.alter_column('access_log', 'repo_name', type_=sa.String(256), existing_type=sa.String(40))
+    try:
+    	op.add_column('access_log', sa.Column('repo_tag', sa.String(128)))
+    except Exception as e:
+        if str(e).find("Duplicate column") >=0:
+            print "ignore dup column error for repo_tag"
+        else:
+            raise e
+    #create tables: replication_policy, replication_target, replication_job
+    ReplicationPolicy.__table__.create(bind)
+    ReplicationTarget.__table__.create(bind)
+    ReplicationJob.__table__.create(bind)
+
+def downgrade():
+    """
+    Downgrade has been disabled.
+    """
+    pass

models/accesslog.go

@@ -21,17 +21,16 @@ import (
 
 // AccessLog holds information about logs which are used to record the actions that user take to the resourses.
 type AccessLog struct {
-	LogID     int       `orm:"column(log_id)" json:"log_id"`
-	UserID    int       `orm:"column(user_id)"  json:"user_id"`
-	ProjectID int64     `orm:"column(project_id)"  json:"project_id"`
-	RepoName  string    `orm:"column(repo_name)" json:"repo_name"`
-	RepoTag   string    `orm:"column(repo_tag)" json:"repo_tag"`
-	GUID      string    `orm:"column(GUID)"  json:"guid"`
-	Operation string    `orm:"column(operation)" json:"operation"`
-	OpTime    time.Time `orm:"column(op_time)" json:"op_time"`
-	Username  string    `json:"username"`
-	Keywords  string    `json:"keywords"`
-
+	LogID          int       `orm:"pk;column(log_id)" json:"log_id"`
+	UserID         int       `orm:"column(user_id)"  json:"user_id"`
+	ProjectID      int64     `orm:"column(project_id)"  json:"project_id"`
+	RepoName       string    `orm:"column(repo_name)" json:"repo_name"`
+	RepoTag        string    `orm:"column(repo_tag)" json:"repo_tag"`
+	GUID           string    `orm:"column(GUID)"  json:"guid"`
+	Operation      string    `orm:"column(operation)" json:"operation"`
+	OpTime         time.Time `orm:"column(op_time)" json:"op_time"`
+	Username       string    `json:"username"`
+	Keywords       string    `json:"keywords"`
 	BeginTime      time.Time
 	BeginTimestamp int64 `json:"begin_timestamp"`
 	EndTime        time.Time

models/base.go

@@ -12,20 +12,19 @@
     See the License for the specific language governing permissions and
     limitations under the License.
 */
-jQuery(function(){
-	
-	new AjaxUtil({
-		url: "/api/users/current",
-		type: "get",
-		success: function(data, status, xhr){
-			if(xhr && xhr.status == 200){
-				document.location = "/registry/project";
-			}
-		},
-		error: function(jqXhr){
-			if(jqXhr.status == 401)
-				return false;
-		}
-	}).exec();
-	
-});
+
+package models
+
+import (
+	"github.com/astaxie/beego/orm"
+)
+
+func init() {
+	orm.RegisterModel(new(RepTarget),
+		new(RepPolicy),
+		new(RepJob),
+	        new(User),
+		new(Project),
+		new(Role),
+		new(AccessLog))
+}

models/project.go

@@ -21,7 +21,7 @@ import (
 
 // Project holds the details of a project.
 type Project struct {
-	ProjectID       int64     `orm:"column(project_id)" json:"project_id"`
+	ProjectID       int64     `orm:"pk;column(project_id)" json:"project_id"`
 	OwnerID         int       `orm:"column(owner_id)" json:"owner_id"`
 	Name            string    `orm:"column(name)" json:"name"`
 	CreationTime    time.Time `orm:"column(creation_time)" json:"creation_time"`
@@ -37,3 +37,23 @@ type Project struct {
 	Role       int       `json:"current_user_role_id"`
 	RepoCount  int       `json:"repo_count"`
 }
+
+// ProjectSorter holds an array of projects
+type ProjectSorter struct {
+	Projects []Project
+}
+
+// Len returns the length of array in ProjectSorter
+func (ps *ProjectSorter) Len() int {
+	return len(ps.Projects)
+}
+
+// Less defines the comparison rules of project
+func (ps *ProjectSorter) Less(i, j int) bool {
+	return ps.Projects[i].Name < ps.Projects[j].Name
+}
+
+// Swap swaps the position of i and j
+func (ps *ProjectSorter) Swap(i, j int) {
+	ps.Projects[i], ps.Projects[j] = ps.Projects[j], ps.Projects[i]
+}

models/replication_job.go

@@ -0,0 +1,162 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package models
+
+import (
+	"time"
+
+	"github.com/astaxie/beego/validation"
+	"github.com/vmware/harbor/utils"
+)
+
+const (
+	//JobPending ...
+	JobPending string = "pending"
+	//JobRunning ...
+	JobRunning string = "running"
+	//JobError ...
+	JobError string = "error"
+	//JobStopped ...
+	JobStopped string = "stopped"
+	//JobFinished ...
+	JobFinished string = "finished"
+	//JobCanceled ...
+	JobCanceled string = "canceled"
+	//JobRetrying indicate the job needs to be retried, it will be scheduled to the end of job queue by statemachine after an interval.
+	JobRetrying string = "retrying"
+	//JobContinue is the status returned by statehandler to tell statemachine to move to next possible state based on trasition table.
+	JobContinue string = "_continue"
+	//RepOpTransfer represents the operation of a job to transfer repository to a remote registry/harbor instance.
+	RepOpTransfer string = "transfer"
+	//RepOpDelete represents the operation of a job to remove repository from a remote registry/harbor instance.
+	RepOpDelete string = "delete"
+	//UISecretCookie is the cookie name to contain the UI secret
+	UISecretCookie string = "uisecret"
+)
+
+// RepPolicy is the model for a replication policy, which associate to a project and a target (destination)
+type RepPolicy struct {
+	ID          int64  `orm:"column(id)" json:"id"`
+	ProjectID   int64  `orm:"column(project_id)" json:"project_id"`
+	ProjectName string `json:"project_name,omitempty"`
+	TargetID    int64  `orm:"column(target_id)" json:"target_id"`
+	TargetName  string `json:"target_name,omitempty"`
+	Name        string `orm:"column(name)" json:"name"`
+	//	Target       RepTarget `orm:"-" json:"target"`
+	Enabled       int       `orm:"column(enabled)" json:"enabled"`
+	Description   string    `orm:"column(description)" json:"description"`
+	CronStr       string    `orm:"column(cron_str)" json:"cron_str"`
+	StartTime     time.Time `orm:"column(start_time)" json:"start_time"`
+	CreationTime  time.Time `orm:"column(creation_time);auto_now_add" json:"creation_time"`
+	UpdateTime    time.Time `orm:"column(update_time);auto_now" json:"update_time"`
+	ErrorJobCount int       `json:"error_job_count"`
+}
+
+// Valid ...
+func (r *RepPolicy) Valid(v *validation.Validation) {
+	if len(r.Name) == 0 {
+		v.SetError("name", "can not be empty")
+	}
+
+	if len(r.Name) > 256 {
+		v.SetError("name", "max length is 256")
+	}
+
+	if r.ProjectID <= 0 {
+		v.SetError("project_id", "invalid")
+	}
+
+	if r.TargetID <= 0 {
+		v.SetError("target_id", "invalid")
+	}
+
+	if r.Enabled != 0 && r.Enabled != 1 {
+		v.SetError("enabled", "must be 0 or 1")
+	}
+
+	if len(r.CronStr) > 256 {
+		v.SetError("cron_str", "max length is 256")
+	}
+}
+
+// RepJob is the model for a replication job, which is the execution unit on job service, currently it is used to transfer/remove
+// a repository to/from a remote registry instance.
+type RepJob struct {
+	ID         int64    `orm:"column(id)" json:"id"`
+	Status     string   `orm:"column(status)" json:"status"`
+	Repository string   `orm:"column(repository)" json:"repository"`
+	PolicyID   int64    `orm:"column(policy_id)" json:"policy_id"`
+	Operation  string   `orm:"column(operation)" json:"operation"`
+	Tags       string   `orm:"column(tags)" json:"-"`
+	TagList    []string `orm:"-" json:"tags"`
+	//	Policy       RepPolicy `orm:"-" json:"policy"`
+	CreationTime time.Time `orm:"column(creation_time);auto_now_add" json:"creation_time"`
+	UpdateTime   time.Time `orm:"column(update_time);auto_now" json:"update_time"`
+}
+
+// RepTarget is the model for a replication targe, i.e. destination, which wraps the endpoint URL and username/password of a remote registry.
+type RepTarget struct {
+	ID           int64     `orm:"column(id)" json:"id"`
+	URL          string    `orm:"column(url)" json:"endpoint"`
+	Name         string    `orm:"column(name)" json:"name"`
+	Username     string    `orm:"column(username)" json:"username"`
+	Password     string    `orm:"column(password)" json:"password"`
+	Type         int       `orm:"column(target_type)" json:"type"`
+	CreationTime time.Time `orm:"column(creation_time);auto_now_add" json:"creation_time"`
+	UpdateTime   time.Time `orm:"column(update_time);auto_now" json:"update_time"`
+}
+
+// Valid ...
+func (r *RepTarget) Valid(v *validation.Validation) {
+	if len(r.Name) == 0 {
+		v.SetError("name", "can not be empty")
+	}
+
+	if len(r.Name) > 64 {
+		v.SetError("name", "max length is 64")
+	}
+
+	if len(r.URL) == 0 {
+		v.SetError("endpoint", "can not be empty")
+	}
+
+	r.URL = utils.FormatEndpoint(r.URL)
+
+	if len(r.URL) > 64 {
+		v.SetError("endpoint", "max length is 64")
+	}
+
+	// password is encoded using base64, the length of this field
+	// in DB is 64, so the max length in request is 48
+	if len(r.Password) > 48 {
+		v.SetError("password", "max length is 48")
+	}
+}
+
+//TableName is required by by beego orm to map RepTarget to table replication_target
+func (r *RepTarget) TableName() string {
+	return "replication_target"
+}
+
+//TableName is required by by beego orm to map RepJob to table replication_job
+func (r *RepJob) TableName() string {
+	return "replication_job"
+}
+
+//TableName is required by by beego orm to map RepPolicy to table replication_policy
+func (r *RepPolicy) TableName() string {
+	return "replication_policy"
+}

models/role.go

@@ -26,7 +26,7 @@ const (
 
 // Role holds the details of a role.
 type Role struct {
-	RoleID   int    `orm:"column(role_id)" json:"role_id"`
+	RoleID   int    `orm:"pk;column(role_id)" json:"role_id"`
 	RoleCode string `orm:"column(role_code)" json:"role_code"`
 	Name     string `orm:"column(name)" json:"role_name"`
 

models/toprepo.go

@@ -0,0 +1,23 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package models
+
+// TopRepo holds information about repository that accessed most
+type TopRepo struct {
+	RepoName    string `json:"name"`
+	AccessCount int64  `json:"count"`
+	Creator     string `json:"creator"`
+}

models/user.go

@@ -21,7 +21,7 @@ import (
 
 // User holds the details of a user.
 type User struct {
-	UserID   int    `orm:"column(user_id)" json:"user_id"`
+	UserID   int    `orm:"pk;column(user_id)" json:"user_id"`
 	Username string `orm:"column(username)" json:"username"`
 	Email    string `orm:"column(email)" json:"email"`
 	Password string `orm:"column(password)" json:"password"`
@@ -29,12 +29,13 @@ type User struct {
 	Comment  string `orm:"column(comment)" json:"comment"`
 	Deleted  int    `orm:"column(deleted)" json:"deleted"`
 	Rolename string `json:"role_name"`
-	RoleID   int    `json:"role_id"`
+	//if this field is named as "RoleID", beego orm can not map role_id
+	//to it.
+	Role int `json:"role_id"`
 	//	RoleList     []Role `json:"role_list"`
-	HasAdminRole int    `orm:"column(sysadmin_flag)" json:"has_admin_role"`
-	ResetUUID    string `orm:"column(reset_uuid)" json:"reset_uuid"`
-	Salt         string `orm:"column(salt)"`
-
+	HasAdminRole int       `orm:"column(sysadmin_flag)" json:"has_admin_role"`
+	ResetUUID    string    `orm:"column(reset_uuid)" json:"reset_uuid"`
+	Salt         string    `orm:"column(salt)"`
 	CreationTime time.Time `orm:"creation_time" json:"creation_time"`
 	UpdateTime   time.Time `orm:"update_time" json:"update_time"`
 }

service/cache/cache.go

@@ -13,7 +13,7 @@
    limitations under the License.
 */
 
-package utils
+package cache
 
 import (
 	"os"
@@ -21,17 +21,16 @@ import (
 
 	"github.com/vmware/harbor/utils/log"
 	"github.com/vmware/harbor/utils/registry"
+	"github.com/vmware/harbor/utils/registry/auth"
 
 	"github.com/astaxie/beego/cache"
 )
 
 var (
 	// Cache is the global cache in system.
-	Cache             cache.Cache
-	endpoint          string
-	username          string
-	registryClient    *registry.Registry
-	repositoryClients map[string]*registry.Repository
+	Cache    cache.Cache
+	endpoint string
+	username string
 )
 
 const catalogKey string = "catalog"
@@ -45,23 +44,18 @@ func init() {
 
 	endpoint = os.Getenv("REGISTRY_URL")
 	username = "admin"
-	repositoryClients = make(map[string]*registry.Repository, 10)
 }
 
 // RefreshCatalogCache calls registry's API to get repository list and write it to cache.
 func RefreshCatalogCache() error {
 	log.Debug("refreshing catalog cache...")
 
-	if registryClient == nil {
-		var err error
-		registryClient, err = registry.NewRegistryWithUsername(endpoint, username)
-		if err != nil {
-			log.Errorf("error occurred while initializing registry client used by cache: %v", err)
-			return err
-		}
+	registryClient, err := NewRegistryClient(endpoint, true, username,
+		"registry", "catalog", "*")
+	if err != nil {
+		return err
 	}
 
-	var err error
 	rs, err := registryClient.Catalog()
 	if err != nil {
 		return err
@@ -113,3 +107,38 @@ func GetRepoFromCache() ([]string, error) {
 	}
 	return result.([]string), nil
 }
+
+// NewRegistryClient ...
+func NewRegistryClient(endpoint string, insecure bool, username, scopeType, scopeName string,
+	scopeActions ...string) (*registry.Registry, error) {
+	authorizer := auth.NewUsernameTokenAuthorizer(username, scopeType, scopeName, scopeActions...)
+
+	store, err := auth.NewAuthorizerStore(endpoint, insecure, authorizer)
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := registry.NewRegistryWithModifiers(endpoint, insecure, store)
+	if err != nil {
+		return nil, err
+	}
+	return client, nil
+}
+
+// NewRepositoryClient ...
+func NewRepositoryClient(endpoint string, insecure bool, username, repository, scopeType, scopeName string,
+	scopeActions ...string) (*registry.Repository, error) {
+
+	authorizer := auth.NewUsernameTokenAuthorizer(username, scopeType, scopeName, scopeActions...)
+
+	store, err := auth.NewAuthorizerStore(endpoint, insecure, authorizer)
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := registry.NewRepositoryWithModifiers(repository, endpoint, insecure, store)
+	if err != nil {
+		return nil, err
+	}
+	return client, nil
+}

service/notification.go

@@ -20,9 +20,10 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/vmware/harbor/api"
 	"github.com/vmware/harbor/dao"
 	"github.com/vmware/harbor/models"
-	svc_utils "github.com/vmware/harbor/service/utils"
+	"github.com/vmware/harbor/service/cache"
 	"github.com/vmware/harbor/utils/log"
 
 	"github.com/astaxie/beego"
@@ -38,47 +39,85 @@ const manifestPattern = `^application/vnd.docker.distribution.manifest.v\d\+json
 // Post handles POST request, and records audit log or refreshes cache based on event.
 func (n *NotificationHandler) Post() {
 	var notification models.Notification
-	//log.Info("Notification Handler triggered!\n")
-	//	log.Infof("request body in string: %s", string(n.Ctx.Input.CopyBody()))
 	err := json.Unmarshal(n.Ctx.Input.CopyBody(1<<32), &notification)
 
 	if err != nil {
-		log.Errorf("error while decoding json: %v", err)
+		log.Errorf("failed to decode notification: %v", err)
 		return
 	}
-	var username, action, repo, project, repoTag string
-	var matched bool
-	for _, e := range notification.Events {
-		matched, err = regexp.MatchString(manifestPattern, e.Target.MediaType)
-		if err != nil {
-			log.Errorf("Failed to match the media type against pattern, error: %v", err)
-			matched = false
-		}
-		if matched && strings.HasPrefix(e.Request.UserAgent, "docker") {
-			username = e.Actor.Name
-			action = e.Action
-			repo = e.Target.Repository
-			repoTag = e.Target.Tag
-			log.Debugf("repo tag is : %v ", repoTag)
 
-			if strings.Contains(repo, "/") {
-				project = repo[0:strings.LastIndex(repo, "/")]
+	events, err := filterEvents(&notification)
+	if err != nil {
+		log.Errorf("failed to filter events: %v", err)
+		return
+	}
+
+	for _, event := range events {
+		repository := event.Target.Repository
+
+		project := ""
+		if strings.Contains(repository, "/") {
+			project = repository[0:strings.LastIndex(repository, "/")]
+		}
+
+		tag := event.Target.Tag
+		action := event.Action
+
+		user := event.Actor.Name
+		if len(user) == 0 {
+			user = "anonymous"
+		}
+
+		go func() {
+			if err := dao.AccessLog(user, project, repository, tag, action); err != nil {
+				log.Errorf("failed to add access log: %v", err)
 			}
-			if username == "" {
-				username = "anonymous"
-			}
-			go dao.AccessLog(username, project, repo, repoTag, action)
+		}()
+		if action == "push" {
+			go func() {
+				if err := cache.RefreshCatalogCache(); err != nil {
+					log.Errorf("failed to refresh cache: %v", err)
+				}
+			}()
+
+			operation := ""
 			if action == "push" {
-				go func() {
-					err2 := svc_utils.RefreshCatalogCache()
-					if err2 != nil {
-						log.Errorf("Error happens when refreshing cache: %v", err2)
-					}
-				}()
+				operation = models.RepOpTransfer
 			}
+
+			go api.TriggerReplicationByRepository(repository, []string{tag}, operation)
+		}
+	}
+}
+
+func filterEvents(notification *models.Notification) ([]*models.Event, error) {
+	events := []*models.Event{}
+
+	for _, event := range notification.Events {
+		isManifest, err := regexp.MatchString(manifestPattern, event.Target.MediaType)
+		if err != nil {
+			log.Errorf("failed to match the media type against pattern: %v", err)
+			continue
+		}
+
+		if !isManifest {
+			continue
+		}
+
+		//pull and push manifest by docker-client
+		if strings.HasPrefix(event.Request.UserAgent, "docker") && (event.Action == "pull" || event.Action == "push") {
+			events = append(events, &event)
+			continue
+		}
+
+		//push manifest by docker-client or job-service
+		if strings.ToLower(strings.TrimSpace(event.Request.UserAgent)) == "harbor-registry-client" && event.Action == "push" {
+			events = append(events, &event)
+			continue
 		}
 	}
 
+	return events, nil
 }
 
 // Render returns nil as it won't render any template.

service/token/token.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/vmware/harbor/auth"
 	"github.com/vmware/harbor/models"
-	//svc_utils "github.com/vmware/harbor/service/utils"
+	svc_utils "github.com/vmware/harbor/service/utils"
 	"github.com/vmware/harbor/utils/log"
 
 	"github.com/astaxie/beego"
@@ -38,20 +38,27 @@ type Handler struct {
 // checkes the permission agains local DB and generates jwt token.
 func (h *Handler) Get() {
 
+	var username, password string
 	request := h.Ctx.Request
-	log.Infof("request url: %v", request.URL.String())
-	username, password, _ := request.BasicAuth()
-	authenticated := authenticate(username, password)
 	service := h.GetString("service")
 	scopes := h.GetStrings("scope")
-
-	if len(scopes) == 0 && !authenticated {
-		log.Info("login request with invalid credentials")
-		h.CustomAbort(http.StatusUnauthorized, "")
-	}
 	access := GetResourceActions(scopes)
-	for _, a := range access {
-		FilterAccess(username, authenticated, a)
+	log.Infof("request url: %v", request.URL.String())
+
+	if svc_utils.VerifySecret(request) {
+		log.Debugf("Will grant all access as this request is from job service with legal secret.")
+		username = "job-service-user"
+	} else {
+		username, password, _ = request.BasicAuth()
+		authenticated := authenticate(username, password)
+
+		if len(scopes) == 0 && !authenticated {
+			log.Info("login request with invalid credentials")
+			h.CustomAbort(http.StatusUnauthorized, "")
+		}
+		for _, a := range access {
+			FilterAccess(username, authenticated, a)
+		}
 	}
 	h.serveToken(username, service, access)
 }

service/utils/utils.go

@@ -0,0 +1,33 @@
+/*
+   Copyright (c) 2016 VMware, Inc. All Rights Reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package utils contains methods to support security, cache, and webhook functions.
+package utils
+
+import (
+	"github.com/vmware/harbor/utils/log"
+	"net/http"
+	"os"
+)
+
+// VerifySecret verifies the UI_SECRET cookie in a http request.
+func VerifySecret(r *http.Request) bool {
+	secret := os.Getenv("UI_SECRET")
+	c, err := r.Cookie("uisecret")
+	if err != nil {
+		log.Errorf("Failed to get secret cookie, error: %v", err)
+	}
+	return c != nil && c.Value == secret
+}

static/Gruntfile.js

@@ -0,0 +1,59 @@
+/*global module:false*/
+module.exports = function(grunt) {
+
+  'use strict';
+  // Project configuration.
+  grunt.initConfig({
+    // Task configuration.
+    jshint: {
+      options: {
+        browser: true,
+        curly: true,
+        freeze: true,
+        bitwise: true,
+        eqeqeq: true,
+        strict: true,
+        immed: true,
+        latedef: false,
+        newcap: false,
+        smarttabs: true,
+        noarg: true,
+        devel: true,
+        sub: true,
+        undef: true,
+        unused: false,
+        boss: true,
+        eqnull: true,
+        globals: {
+          jQuery: true,
+          angular: true,
+          $: true,
+        }
+      },
+      gruntfile: {
+        src: 'Gruntfile.js'
+      },
+      scripts: {
+        src: ['resources/**/**/*.js']
+      }
+    },
+    watch: {
+      gruntfile: {
+        files: '<%= jshint.gruntfile.src %>',
+        tasks: ['jshint:gruntfile']
+      },
+      scripts: {
+        files: '<%= jshint.scripts.src %>',
+        tasks: ['jshint:scripts']
+      }
+    }
+  });
+
+  // These plugins provide necessary tasks.
+  grunt.loadNpmTasks('grunt-contrib-jshint');
+  grunt.loadNpmTasks('grunt-contrib-watch');
+
+  // Default task.
+  grunt.registerTask('default', ['jshint']);
+
+};

static/i18n/locale_de-DE.ini

@@ -1,88 +0,0 @@
-page_title_index = Harbor
-page_title_sign_in = Anmelden - Harbor
-page_title_project = Projekt - Harbor
-page_title_item_details = Details - Harbor
-page_title_registration = Registrieren - Harbor
-page_title_add_user = Benutzer anlegen - Harbor
-page_title_forgot_password = Passwort vergessen - Harbor
-title_forgot_password = Passwort vergessen 
-page_title_reset_password = Passwort zurücksetzen - Harbor
-title_reset_password = Passwort zurücksetzen
-page_title_change_password = Passwort ändern - Harbor
-title_change_password = Passwort ändern
-page_title_search = Suche - Harbor
-sign_in = Anmelden
-sign_up = Registrieren
-add_user = Benutzer anlegen
-log_out = Abmelden
-search_placeholder = Projekte oder Repositories
-change_password = Passwort ändern
-username_email = Benutzername/E-Mail
-password = Passwort
-forgot_password = Passwort vergessen
-welcome = Willkommen
-my_projects = Meine Projekte
-public_projects = Öffentliche Projekte
-admin_options = Admin Optionen
-project_name = Projektname
-creation_time = Erstellungsdatum
-publicity = Öffentlich
-add_project = Projekt hinzufügen
-check_for_publicity = öffentliches Projekt
-button_save = Speichern
-button_cancel = Abbrechen
-button_submit = Absenden
-username = Benutzername
-email = E-Mail
-system_admin = System Admininistrator
-dlg_button_ok = OK
-dlg_button_cancel = Abbrechen
-registration = Registrieren
-username_description = Dies wird Ihr Benutzername sein.
-email_description = Die E-Mail Adresse wird für das Zurücksetzen des Passworts genutzt.
-full_name = Sollständiger Name
-full_name_description = Vor- und Nachname.
-password_description = Mindestens sieben Zeichen bestehend aus einem Kleinbuchstaben, einem Großbuchstaben und einer Zahl
-confirm_password = Passwort bestätigen
-note_to_the_admin = Kommentar
-old_password = Altes Passwort
-new_password = Neues Passwort
-forgot_password_description = Bitte gebe die E-Mail Adresse ein, die du zur Registrierung verwendet hast. Ein Link zur Wiederherstellung wird dir per E-Mail an diese Adresse geschickt.
-
-projects = Projekte
-repositories = Repositories
-search = Suche
-home = Home
-project = Projekt
-owner = Besitzer
-repo = Repositories
-user = Benutzer
-logs = Logs
-repo_name = Repository
-add_members = Benutzer hinzufügen
-operation = Aktion
-advance = erweiterte Suche
-all = Alle
-others = Andere
-start_date = Start Datum
-end_date = End Datum
-timestamp = Zeitstempel
-role = Rolle
-reset_email_hint = Bitte klicke auf diesen Link um dein Passwort zurückzusetzen
-reset_email_subject = Passwort zurücksetzen
-language = Deutsch
-language_en-US = English
-language_zh-CN = 中文
-language_de-DE = Deutsch
-language_ru-RU = Русский
-language_ja-JP = 日本語
-copyright = Copyright
-all_rights_reserved = Alle Rechte vorbehalten.
-index_desc = Project Harbor ist ein zuverlässiger Enterprise-Class Registry Server. Unternehmen können ihren eigenen Registry Server aufsetzen um die Produktivität und Sicherheit zu erhöhen. Project Harbor kann für Entwicklungs- wie auch Produktiv-Umgebungen genutzt werden.
-index_desc_0 = Vorteile:
-index_desc_1 = 1. Sicherheit: Halten Sie ihr geistiges Eigentum innerhalb der Organisation.
-index_desc_2 = 2. Effizienz: Ein privater Registry Server innerhalb des Netzwerks ihrer Organisation kann den Traffic zu öffentlichen Services im Internet signifikant reduzieren.
-index_desc_3 = 3. Zugriffskontrolle: RBAC (Role Based Access Control) wird zur Verfügung gestellt. Benutzerverwaltung kann mit bestehenden Identitätsservices wie AD/LDAP integriert werden.
-index_desc_4 = 4. Audit: Jeglicher Zugriff auf die Registry wird protokolliert und kann für ein Audit verwendet werden.
-index_desc_5 = 5. GUI: Benutzerfreundliche Verwaltung über eine einzige Management-Konsole
-index_title = Ein Enterprise-Class Registry Server

static/i18n/locale_en-US.ini

@@ -1,89 +1,15 @@
-page_title_index = Harbor
-page_title_sign_in = Sign In - Harbor
-page_title_project = Project - Harbor
-page_title_item_details = Details - Harbor
-page_title_registration = Sign Up - Harbor
-page_title_add_user = Add User - Harbor
-page_title_forgot_password = Forgot Password - Harbor
-title_forgot_password = Forgot Password
-page_title_reset_password = Reset Password - Harbor
-title_reset_password = Reset Password
-page_title_change_password = Change Password - Harbor
-title_change_password = Change Password
-page_title_search = Search - Harbor
-sign_in = Sign In
-sign_up = Sign Up
-add_user = Add User
-log_out = Log Out
-search_placeholder = projects or repositories
-change_password = Change Password
-username_email = Username/Email
-password = Password
-forgot_password = Forgot Password
-welcome = Welcome
-my_projects = My Projects
-public_projects = Public Projects
-admin_options = Admin Options
-project_name = Project Name
-creation_time = Creation Time
-publicity = Publicity
-add_project = Add Project
-check_for_publicity = Public project
-button_save = Save
-button_cancel = Cancel
-button_submit = Submit
-username = Username
-email = Email
-system_admin = System Admin
-dlg_button_ok = OK
-dlg_button_cancel = Cancel
-registration = Sign Up
-username_description = This will be your username.
-email_description = The Email address will be used for resetting password.
-full_name = Full Name
-full_name_description = First name & Last name.
-password_description = At least 7 characters with 1 lowercase letter, 1 capital letter and 1 numeric character.
-confirm_password = Confirm Password
-note_to_the_admin = Comments
-old_password = Old Password
-new_password = New Password
-forgot_password_description = Please input the Email used when you signed up, a reset password Email will be sent to you.
-
-projects = Projects
-repositories = Repositories
-search = Search
-home = Home
-project = Project
-owner = Owner
-repo = Repositories
-user = Users
-logs = Logs
-repo_name = Repository Name
-repo_tag = Tag
-add_members = Add Members
-operation = Operation
-advance = Advanced Search
-all = All
-others = Others
-start_date = Start Date
-end_date = End Date
-timestamp = Timestamp
-role = Role
 reset_email_hint = Please click this link to reset your password
-reset_email_subject = Reset your password
-language = English
-language_en-US = English
-language_zh-CN = 中文
-language_de-DE = Deutsch
-language_ru-RU = Русский
-language_ja-JP = 日本語
-copyright = Copyright
-all_rights_reserved = All rights reserved.
-index_desc = Project Harbor is to build an enterprise-class, reliable registry server. Enterprises can set up a private registry server in their own environment to improve productivity as well as security. Project Harbor can be used in both development and production environment.
-index_desc_0 = Key benefits:
-index_desc_1 = 1. Security: Keep their intellectual properties within their organizations.
-index_desc_2 = 2. Efficiency: A private registry server is set up within the organization's network and can reduce significantly the internet traffic to the public service. 
-index_desc_3 = 3. Access Control: RBAC (Role Based Access Control) is provided. User management can be integrated with existing enterprise identity services like AD/LDAP. 
-index_desc_4 = 4. Audit: All access to the registry are logged and can be used for audit purpose.
-index_desc_5 = 5. GUI: User friendly single-pane-of-glass management console.
-index_title = An enterprise-class registry server
+reset_email_subject = Reset your password of Harbor account
+
+page_title_index = Harbor
+page_title_dashboard = Dashboard - Harbor
+page_title_account_setting = Account Settings - Harbor
+page_title_reset_password = Reset Password - Harbor
+page_title_change_password = Change Password - Harbor
+page_title_forgot_password = Forgot Password - Harbor
+page_title_project = Project - Harbor
+page_title_repository = Project Details - Harbor
+page_title_search = Search - Harbor
+page_title_sign_up = Sign Up - Harbor
+page_title_add_new = Add New User - Harbor
+page_title_admin_option = Admin Options - Harbor

static/i18n/locale_ja-JP.ini

@@ -1,89 +0,0 @@
-page_title_index = Harbor
-page_title_sign_in = ログイン - Harbor
-page_title_project = プロジェクト - Harbor
-page_title_item_details = 詳しい - Harbor
-page_title_registration = 登録 - Harbor
-page_title_add_user = ユーザを追加 - Harbor
-page_title_forgot_password = パスワードを忘れました - Harbor
-title_forgot_password = パスワードを忘れました
-page_title_reset_password = パスワードをリセット - Harbor
-title_reset_password = パスワードをリセット
-page_title_change_password = パスワードを変更 - Harbor
-title_change_password = パスワードを変更
-page_title_search = サーチ - Harbor
-sign_in = ログイン
-sign_up = 登録
-add_user = ユーザを追加
-log_out = ログアウト
-search_placeholder = プロジェクト名またはイメージ名
-change_password = パスワードを変更
-username_email = ユーザ名/メールアドレス
-password = パスワード
-forgot_password = パスワードを忘れました
-welcome = ようこそ
-my_projects = マイプロジェクト
-public_projects = パブリックプロジェクト
-admin_options = 管理者
-project_name = プロジェクト名
-creation_time = 作成日時
-publicity = パブリック
-add_project = プロジェクトを追加
-check_for_publicity = パブリックプロジェクト
-button_save = 保存する
-button_cancel = 取り消しする
-button_submit = 送信する
-username = ユーザ名
-email = メールアドレス
-system_admin = システム管理者
-dlg_button_ok = OK
-dlg_button_cancel = 取り消し
-registration = 登録
-username_description = ログイン際に使うユーザ名を入力してください。
-email_description = メールアドレスはパスワードをリセットする際に使われます。
-full_name = フルネーム
-full_name_description = フルネームを入力してください。
-password_description = パスワード7英数字以上で、少なくとも １小文字、 １大文字と １数字でなければなりません。
-confirm_password = パスワードを確認する
-note_to_the_admin = メモ
-old_password = 現在のパスワード
-new_password = 新しいパスワード
-forgot_password_description = ぱプロジェクトをリセットするメールはこのアドレスに送信します。
-
-projects = プロジェクト
-repositories = リポジトリ
-search = サーチ
-home = ホーム
-project = プロジェクト
-owner = オーナー
-repo = リポジトリ
-user = ユーザ
-logs = ログ
-repo_name = リポジトリ名
-repo_tag = リポジトリタグ
-add_members = メンバーを追加
-operation = 操作
-advance = さらに絞りこみで検索
-all = 全部
-others = その他
-start_date = 開始日
-end_date = 終了日
-timestamp = タイムスタンプ
-role = 役割
-reset_email_hint = このリンクをクリックしてパスワードリセットの処理を続けてください
-reset_email_subject = パスワードをリセットします
-language = 日本語
-language_en-US = English
-language_zh-CN = 中文
-language_de-DE = Deutsch
-language_ru-RU = Русский
-language_ja-JP = 日本語
-copyright = コピーライト
-all_rights_reserved = 無断複写・転載を禁じます
-index_desc = Harborは、信頼性の高いエンタープライズクラスのRegistryサーバです。タープライズユーザはHarborを利用し、プライベートのRegistryサビースを構築し、生産性および安全性を向上させる事ができます。開発環境はもちろん、生産環境にも使用する事ができます。
-index_desc_0 = 主な利点：
-index_desc_1 = 1. セキュリティ： 知的財産権を組織内で確保する。
-index_desc_2 = 2. 効率： プライベートなので、パブリックRegistryサビースにネットワーク通信が減らす。
-index_desc_3 = 3. アクセス制御： ロールベースアクセス制御機能を実装し、更に既存のユーザ管理システム（AD/LDAP）と統合することも可能。
-index_desc_4 = 4. 監査： すべてRegistryサビースへの操作が記録され、検査にに利用できる。
-index_desc_5 = 5. 管理UI: 使いやすい管理UIが搭載する。
-index_title = エンタープライズ Registry サビース

static/i18n/locale_messages.js

@@ -1,457 +0,0 @@
-/*
-    Copyright (c) 2016 VMware, Inc. All Rights Reserved.
-    Licensed under the Apache License, Version 2.0 (the "License");
-    you may not use this file except in compliance with the License.
-    You may obtain a copy of the License at
-        
-        http://www.apache.org/licenses/LICENSE-2.0
-        
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    See the License for the specific language governing permissions and
-    limitations under the License.
-*/
-var global_messages = {
-  "username_is_required" : {
-	 "en-US": "Username is required.",
-	 "zh-CN": "用户名为必填项。",
-	 "ja-JP": "ユーザ名は必須項目です。",
-	 "de-DE": "Benutzername erforderlich.",
-	 "ru-RU": "Требуется ввести имя пользователя."
-  },
-  "username_has_been_taken" : {
-         "en-US": "Username has been taken.",
-	 "zh-CN": "用户名已被占用。",
-	 "ja-JP": "ユーザ名はすでに登録されました。",
-	 "de-DE": "Benutzername bereits vergeben.",
-	 "ru-RU": "Имя пользователя уже используется."
-  },
-  "username_is_too_long" : {
-	 "en-US": "Username is too long. (maximum 20 characters)",
-	 "zh-CN": "用户名长度超出限制。（最长为20个字符）",
-	 "ja-JP": "ユーザ名が長すぎです。（20文字まで）",
-	 "de-DE": "Benutzername ist zu lang. (maximal 20 Zeichen)",
-	 "ru-RU": "Имя пользователя слишком длинное. (максимум 20 символов)"
-  },
-  "username_contains_illegal_chars": {
-	 "en-US": "Username contains illegal character(s).",
-	 "zh-CN": "用户名包含不合法的字符。",
-	 "ja-JP": "ユーザ名に使えない文字が入っています。",
-	 "de-DE": "Benutzername enthält ungültige Zeichen.",
-	 "ru-RU": "Имя пользователя содержит недопустимые символы."
-  },
-  "email_is_required" : {
-	 "en-US": "Email is required.",
-	 "zh-CN": "邮箱为必填项。",
-	 "ja-JP": "メールアドレスが必須です。",
-	 "de-DE": "E-Mail Adresse erforderlich.",
-	 "ru-RU": "Требуется ввести E-mail адрес."
-  },
-  "email_contains_illegal_chars" : {
-	 "en-US": "Email contains illegal character(s).",
-	 "zh-CN": "邮箱包含不合法的字符。",
-	 "ja-JP": "メールアドレスに使えない文字が入っています。",
-	 "de-DE": "E-Mail Adresse enthält ungültige Zeichen.",
-	 "ru-RU": "E-mail адрес содержит недопеустимые символы."
-  },
-  "email_has_been_taken" : {
-	 "en-US": "Email has been taken.",
-	 "zh-CN": "邮箱已被占用。",
-	 "ja-JP": "メールアドレスがすでに使われました。",
-	 "de-DE": "E-Mail Adresse wird bereits verwendet.",
-	 "ru-RU": "Такой E-mail адрес уже используется."
-  },
-  "email_content_illegal" : {
-	 "en-US": "Email format is illegal.",
-	 "zh-CN": "邮箱格式不合法。",
-	 "ja-JP": "メールアドレスフォーマットエラー。",
-	 "de-DE": "Format der E-Mail Adresse ist ungültig.",
-	 "ru-RU": "Недопустимый формат E-mail адреса."
-  },
-  "email_does_not_exist" : {
-	 "en-US": "Email does not exist.",
-	 "zh-CN": "邮箱不存在。",
-	 "ja-JP": "メールアドレスが存在しません。",
-	 "de-DE": "E-Mail Adresse existiert nicht.",
-	 "ru-RU": "E-mail адрес не существует."
-  },
-  "realname_is_required" : {
-	 "en-US": "Full name is required.",
-	 "zh-CN": "全名为必填项。",
-	 "ja-JP": "フルネームが必須です。",
-	 "de-DE": "Vollständiger Name erforderlich.",
-	 "ru-RU": "Требуется ввести полное имя."
-  },
-  "realname_is_too_long" : {
-	 "en-US": "Full name is too long. (maximum 20 characters)",
-	 "zh-CN": "全名长度超出限制。（最长为20个字符）",
-	 "ja-JP": "フルネームは長すぎです。（20文字まで）",
-	 "de-DE": "Vollständiger Name zu lang. (maximal 20 Zeichen)",
-	 "ru-RU": "Полное имя слишком длинное. (максимум 20 символов)"
-  },
-  "realname_contains_illegal_chars" : {
-	 "en-US": "Full name contains illegal character(s).",
-	 "zh-CN": "全名包含不合法的字符。",
-	 "ja-JP": "フルネームに使えない文字が入っています。",
-	 "de-DE": "Vollständiger Name enthält ungültige Zeichen.",
-	 "ru-RU": "Полное имя содержит недопустимые символы." 
-  },
-  "password_is_required" : {
-	 "en-US": "Password is required.",
-	 "zh-CN": "密码为必填项。",
-	 "ja-JP": "パスワードは必須です。",
-	 "de-DE": "Passwort erforderlich.",
-	 "ru-RU": "Требуется ввести пароль."
-  },
-  "password_is_invalid" : {
-	 "en-US": "Password is invalid. At least 7 characters with 1 lowercase letter, 1 capital letter and 1 numeric character.",
-	 "zh-CN": "密码无效。至少输入 7个字符且包含 1个小写字母，1个大写字母和 1个数字。",
-	 "ja-JP": "無効なパスワードです。7英数字以上で、 少なくとも１小文字、１大文字と１数字となります。",
-	 "de-DE": "Passwort ungültig. Mindestens sieben Zeichen bestehend aus einem Kleinbuchstaben, einem Großbuchstaben und einer Zahl",
-	 "ru-RU": "Такой пароль недопустим. Парольл должен содержать Минимум 7 символов, в которых будет присутствовать по меньшей мере 1 буква нижнего регистра, 1 буква верхнего регистра и 1 цифра"
-  },
-  "password_is_too_long" : {
-	 "en-US": "Password is too long. (maximum 20 characters)",
-	 "zh-CN": "密码长度超出限制。（最长为20个字符）",
-	 "ja-JP": "パスワードは長すぎです。（20文字まで）",
-	 "de-DE": "Passwort zu lang. (maximal 20 Zeichen)",
-	 "ru-RU": "Пароль слишком длинный (максимум 20 символов)"
-  },
-  "password_does_not_match" : {
-	 "en-US": "Passwords do not match.",
-	 "zh-CN": "两次密码输入不一致。",
-	 "ja-JP": "確認のパスワードが正しくありません。",
-	 "de-DE": "Passwörter stimmen nicht überein.",
-	 "ru-RU": "Пароли не совпадают."
-  },
-  "comment_is_too_long" : {
-	 "en-US": "Comment is too long. (maximum 20 characters)",
-	 "zh-CN": "备注长度超出限制。（最长为20个字符）",
-	 "ja-JP": "コメントは長すぎです。（20文字まで）",
-	 "de-DE": "Kommentar zu lang. (maximal 20 Zeichen)",
-	 "ru-RU": "Комментарий слишком длинный. (максимум 20 символов)"
-  },
-  "comment_contains_illegal_chars" : {
-	 "en-US":  "Comment contains illegal character(s).",
-	 "zh-CN": "备注包含不合法的字符。",
-	 "ja-JP": "コメントに使えない文字が入っています。",
-	 "de-DE": "Kommentar enthält ungültige Zeichen.",
-	 "ru-RU": "Комментарий содержит недопустимые символы."
-  },
-  "project_name_is_required" : {
-	 "en-US": "Project name is required.",
-	 "zh-CN": "项目名称为必填项。",
-	 "ja-JP": "プロジェクト名は必須です。",
-	 "de-DE": "Projektname erforderlich.",
-	 "ru-RU": "Необходимо ввести название Проекта."
-  },
-  "project_name_is_too_short" : {
-	 "en-US": "Project name is too short. (minimum 4 characters)",
-	 "zh-CN": "项目名称至少要求 4个字符。",
-	 "ja-JP": "プロジェクト名は４文字以上です。",
-	 "de-DE": "Projektname zu kurz. (mindestens 4 Zeichen)",
-	 "ru-RU": "Название проекта слишком короткое. (миниму 4 символа)"
-  },
-  "project_name_is_too_long" : {
-	 "en-US": "Project name is too long. (maximum 30 characters)",
-	 "zh-CN": "项目名称长度超出限制。（最长为30个字符）",
-	 "ja-JP": "プロジェクト名は長すぎです。（30文字まで）",
-	 "de-DE": "Projektname zu lang. (maximal 30 Zeichen)",
-	 "ru-RU": "Название проекта слишком длинное (максимум 30 символов)"
-  },
-  "project_name_contains_illegal_chars" : {
-	 "en-US": "Project name contains illegal character(s).",
-	 "zh-CN": "项目名称包含不合法的字符。",
-	 "ja-JP": "プロジェクト名に使えない文字が入っています。",
-	 "de-DE": "Projektname enthält ungültige Zeichen.",
-	 "ru-RU": "Название проекта содержит недопустимые символы."
-  },
-  "project_exists" : {
-	 "en-US": "Project exists.",
-	 "zh-CN": "项目已存在。",
-	 "ja-JP": "プロジェクトはすでに存在しました。",
-	 "de-DE": "Projekt existiert bereits.",
-	 "ru-RU": "Такой проект уже существует."
-  },
-  "delete_user" : {
-	 "en-US": "Delete User",
-	 "zh-CN": "删除用户",
-	 "ja-JP": "ユーザを削除",
-	 "de-DE": "Benutzer löschen",
-	 "ru-RU": "Удалить пользователя"
-  },	
-  "are_you_sure_to_delete_user" : {
-	 "en-US": "Are you sure to delete ",
-	 "zh-CN": "确认要删除用户 ",
-	 "ja-JP": "ユーザを削除でよろしでしょうか ",
-	 "de-DE": "Sind Sie sich sicher, dass Sie folgenden Benutzer löschen möchten: ",
-	 "ru-RU": "Вы уверены что хотите удалить пользователя? "
-  },
-  "input_your_username_and_password" : {
-	 "en-US": "Please input your username and password.",
-	 "zh-CN": "请输入用户名和密码。",
-	 "ja-JP": "ユーザ名とパスワードを入力してください。",
-	 "de-DE": "Bitte geben Sie ihr Benutzername und Passwort ein.",
-	 "ru-RU": "Введите имя пользователя и пароль."
-  },
-  "check_your_username_or_password" : {
-	 "en-US": "Please check your username or password.",
-	 "zh-CN": "请输入正确的用户名或密码。",
-	 "ja-JP": "正しいユーザ名とパスワードを入力してください。",
-	 "de-DE": "Bitte überprüfen Sie ihren Benutzernamen und Passwort.",
-	 "ru-RU": "Проверьте свои имя пользователя и пароль."
-  },
-  "title_login_failed" : {
-	 "en-US": "Login Failed",
-	 "zh-CN": "登录失败",
-	 "ja-JP": "ログインに失敗しました。",
-	 "de-DE": "Anmeldung fehlgeschlagen",
-	 "ru-RU": "Ошибка входа"
-  },
-  "title_change_password" : {
-	 "en-US": "Change Password",
-	 "zh-CN": "修改密码",
-	 "ja-JP": "パスワードを変更します。",
-	 "de-DE": "Passwort ändern",
-	 "ru-RU": "Сменить пароль"
-  },
-  "change_password_successfully" : {
-	 "en-US": "Password changed successfully.",
-	 "zh-CN": "密码已修改。",
-	 "ja-JP": "パスワードを変更しました。",
-	 "de-DE": "Passwort erfolgreich geändert.",
-	 "ru-RU": "Пароль успешно изменен."
-  },
-  "title_forgot_password" : {
-         "en-US": "Forgot Password",
-	 "zh-CN": "忘记密码",
-	 "ja-JP": "パスワードをリセットします。",
-	 "de-DE": "Passwort vergessen",
-	 "ru-RU": "Забыли пароль?"
-  },
-  "email_has_been_sent" : {
-	 "en-US": "Email for resetting password has been sent.",
-	 "zh-CN": "重置密码邮件已发送。",
-	 "ja-JP": "パスワードをリセットするメールを送信しました。",
-	 "de-DE": "Eine E-Mail mit einem Wiederherstellungslink wurde an Sie gesendet.",
-	 "ru-RU": "На ваш E-mail было выслано письмо с инструкциями по сбросу пароля."
-  },
-  "send_email_failed" : {
-	 "en-US": "Failed to send Email for resetting password.",
-	 "zh-CN": "重置密码邮件发送失败。",
-	 "ja-JP": "パスワードをリセットするメールを送信する際エラーが出ました",
-	 "de-DE": "Fehler beim Senden der Wiederherstellungs-E-Mail.",
-	 "ru-RU": "Ошибка отправки сообщения."
-  },
-  "please_login_first" : {
-	 "en-US": "Please login first.",
-	 "zh-CN": "请先登录。",
-	 "ja-JP": "この先にログインが必要です。",
-	 "de-DE": "Bitte melden Sie sich zuerst an.",
-	 "ru-RU": "Сначала выполните вход в систему."
-  },
-  "old_password_is_not_correct" : {
-	 "en-US": "Old password is not correct.",
-	 "zh-CN": "原密码输入不正确。",
-	 "ja-JP": "現在のパスワードが正しく入力されていません。",
-	 "de-DE": "Altes Passwort ist nicht korrekt.",
-	 "ru-RU": "Старый пароль введен неверно."
-  },
-  "please_input_new_password" : {
-	 "en-US": "Please input new password.",
-	 "zh-CN": "请输入新密码。",
-	 "ja-JP": "あたらしいパスワードを入力してください",
-	 "de-DE": "Bitte geben Sie ihr neues Passwort ein.",
-	 "ru-RU": "Пожалуйста, введите новый пароль."
-  },
-  "invalid_reset_url": {
-	 "en-US": "Invalid URL for resetting password.",
-	 "zh-CN": "无效密码重置链接。",
-	 "ja-JP": "無効なパスワードをリセットするリンク。",
-	 "de-DE": "Ungültige URL zum Passwort wiederherstellen.",
-	 "ru-RU": "Неверный URL для сброса пароля."
-  },
-  "reset_password_successfully" : {
-	 "en-US": "Reset password successfully.",
-	 "zh-CN": "密码重置成功。",
-	 "ja-JP": "パスワードをリセットしました。",
-	 "de-DE": "Passwort erfolgreich wiederhergestellt.",
-	 "ru-RU": "Пароль успешно сброшен."
-  },
-  "internal_error": {
-	 "en-US": "Internal error.",
-	 "zh-CN": "内部错误，请联系系统管理员。",
-	 "ja-JP": "エラーが出ました、管理者に連絡してください。",
-	 "de-DE": "Interner Fehler.",
-	 "ru-RU": "Внутренняя ошибка."
-  },
-  "title_reset_password" : {
-	 "en-US": "Reset Password",
-	 "zh-CN": "重置密码",
-	 "ja-JP": "パスワードをリセットする",
-	 "de-DE": "Passwort zurücksetzen",
-	 "ru-RU": "Сбросить пароль"
-  },
-  "title_sign_up" : {
-	 "en-US": "Sign Up",
-	 "zh-CN": "注册",
-	 "ja-JP": "登録",
-	 "de-DE": "Registrieren",
-	 "ru-RU": "Регистрация"
-  },
-  "title_add_user": {
-         "en-US": "Add User",
-         "zh-CN": "新增用户",
-	 "ja-JP": "ユーザを追加",
-	 "de-DE": "Benutzer hinzufügen",
-	 "ru-RU": "Добавить пользователя"
-  },
-  "registered_successfully": {
-	 "en-US": "Signed up successfully.",
-	 "zh-CN": "注册成功。",
-	 "ja-JP": "登録しました。",
-	 "de-DE": "Erfolgreich registriert.",
-	 "ru-RU": "Регистрация прошла успешно."
-  },
-  "registered_failed" : {
-	 "en-US": "Failed to sign up.",
-	 "zh-CN": "注册失败。",
-	 "ja-JP": "登録でませんでした。",
-	 "de-DE": "Registrierung fehlgeschlagen.",
-	 "ru-RU": "Ошибка регистрации."
-  },
-  "added_user_successfully": {
-         "en-US": "Added user successfully.",
-         "zh-CN": "新增用户成功。",
-	 "ja-JP": "ユーザを追加しました。",
-	 "de-DE": "Benutzer erfolgreich erstellt.",
-	 "ru-RU": "Пользователь успешно добавлен."
-  },
-  "added_user_failed": {
-         "en-US": "Adding user failed.",
-         "zh-CN": "新增用户失败。",
-	 "ja-JP": "ユーザを追加できませんでした。",
-	 "de-DE": "Benutzer erstellen fehlgeschlagen.",
-	 "ru-RU": "Ошибка добавления пользователя."
-  },
-  "projects":  {
-	 "en-US": "Projects",
-	 "zh-CN": "项目",
-	 "ja-JP": "プロジェクト",
-	 "de-DE": "Projekte",
-	 "ru-RU": "Проекты"
-  },
-  "repositories" : {
-	 "en-US": "Repositories",
-	 "zh-CN": "镜像仓库",
-	 "ja-JP": "リポジトリ",
-	 "de-DE": "Repositories",
-	 "ru-RU": "Репозитории"
-  },
-  "no_repo_exists"  : {
-         "en-US": "No repositories found, please use 'docker push' to upload images.",
-	 "zh-CN": "未发现镜像，请用‘docker push’命令上传镜像。",
-	 "ja-JP": "イメージが見つかりませんでした。’docker push’を利用しイメージをアップロードしてください。",
-	 "de-DE": "Keine Repositories gefunden, bitte benutzen Sie 'docker push' um ein Image hochzuladen.",
-	 "ru-RU": "Репозитории не найдены, используйте команду 'docker push' для добавления образов."
-  },
-  "tag" : {
-         "en-US": "Tag",
-	 "zh-CN": "标签", 
-	 "ja-JP": "タグ",
-	 "de-DE": "Tag",
-	 "ru-RU": "Метка"
-  },
-  "pull_command": {
-	 "en-US": "Pull Command",
-	 "zh-CN": "Pull 命令",
-	 "ja-JP": "Pull コマンド",
-	 "de-DE": "Pull Befehl",
-	 "ru-RU": "Команда для скачивания образа"
-  },
-  "image_details" : {
-	 "en-US": "Image Details",
-	 "zh-CN": "镜像详细信息",
-	 "ja-JP": "イメージ詳細",
-	 "de-DE": "Image Details",
-	 "ru-RU": "Информация об образе"
-  },
-  "add_members" : {
-	 "en-US": "Add Member",
-	 "zh-CN": "添加成员",
-	 "ja-JP": "メンバーを追加する",
-	 "de-DE": "Mitglied hinzufügen",
-	 "ru-RU": "Добавить Участника"
-  },
-  "edit_members" : {
-	 "en-US": "Edit Members",
-	 "zh-CN": "编辑成员",
-	 "ja-JP": "メンバーを編集する",
-	 "de-DE": "Mitglieder bearbeiten",
-	 "ru-RU": "Редактировать Участников"
-  },
-  "add_member_failed" : {
-	 "en-US": "Adding Member Failed",
-	 "zh-CN": "添加成员失败",
-	 "ja-JP": "メンバーを追加できません出した",
-	 "de-DE": "Mitglied hinzufügen fehlgeschlagen",
-	 "ru-RU": "Ошибка при добавлении нового участника"
-  },
-  "please_input_username" : {
-	 "en-US": "Please input a username.",
-	 "zh-CN": "请输入用户名。",
-	 "ja-JP": "ユーザ名を入力してください。",
-	 "de-DE": "Bitte geben Sie einen Benutzernamen ein.",
-	 "ru-RU": "Пожалуйста, введите имя пользователя."
-  },
-  "please_assign_a_role_to_user" : {
-	 "en-US": "Please assign a role to the user.",
-	 "zh-CN": "请为用户分配角色。",
-	 "ja-JP": "ユーザーに役割を割り当てるしてください。",
-	 "de-DE": "Bitte weisen Sie dem Benutzer eine Rolle zu.",
-	 "ru-RU": "Пожалуйста, назначьте роль пользователю."
-  },
-  "user_id_exists" : {
-	 "en-US": "User is already a member.",
-	 "zh-CN": "用户已经是成员。",
-	 "ja-JP": "すでにメンバーに登録しました。",
-	 "de-DE": "Benutzer ist bereits Mitglied.",
-	 "ru-RU": "Пользователь уже является участником."
-  },
-  "user_id_does_not_exist" : {
-	 "en-US": "User does not exist.",
-	 "zh-CN": "不存在此用户。",
-	 "ja-JP": "ユーザが見つかりませんでした。",
-	 "de-DE": "Benutzer existiert nicht.",
-	 "ru-RU": "Пользователя с таким именем не существует."
-  },
-  "insufficient_privileges" : {
-	 "en-US": "Insufficient privileges.",
-	 "zh-CN": "权限不足。",
-	 "ja-JP": "権限エラー。",
-	 "de-DE": "Unzureichende Berechtigungen.",
-	 "ru-RU": "Недостаточно прав."
-  },
-  "operation_failed" : {
-	 "en-US": "Operation Failed",
-	 "zh-CN": "操作失败",
-	 "ja-JP": "操作に失敗しました。",
-	 "de-DE": "Befehl fehlgeschlagen",
-	 "ru-RU": "Ошибка при выполнении данной операции"
-  },
-  "button_on" : {
-         "en-US": "On",
-	 "zh-CN": "打开",
-	 "ja-JP": "オン",
-	 "de-DE": "An",
-	 "ru-RU": "Вкл."
-  },
-  "button_off" : {
-         "en-US": "Off",
-	 "zh-CN": "关闭",
-	 "ja-JP": "オフ",
-	 "de-DE": "Aus",
-	 "ru-RU": "Откл."
-  }
-};

static/i18n/locale_ru-RU.ini

@@ -1,89 +0,0 @@
-page_title_index = Harbor
-page_title_sign_in = Войти - Harbor
-page_title_project = Проект - Harbor
-page_title_item_details = Подробнее - Harbor
-page_title_registration = Регистрация - Harbor
-page_title_add_user = Добавить пользователя - Harbor
-page_title_forgot_password = Забыли пароль - Harbor
-title_forgot_password = Забыли пароль
-page_title_reset_password = Сбросить пароль - Harbor
-title_reset_password = Сбросить пароль
-page_title_change_password = Поменять пароль - Harbor
-title_change_password = Поменять пароль
-page_title_search = Поиск - Harbor
-sign_in = Войти
-sign_up = Регистрация
-add_user = Добавить пользователя
-log_out = Выйти
-search_placeholder = проекты или репозитории
-change_password = Сменить Пароль
-username_email = Логин/Email
-password = Пароль
-forgot_password = Забыли пароль
-welcome = Добро пожаловать
-my_projects = Мои Проекты
-public_projects = Общедоступные Проекты
-admin_options = Административные Настройки
-project_name = Название Проекта
-creation_time = Время Создания
-publicity = Публичность
-add_project = Добавить Проект
-check_for_publicity = Публичный проекта
-button_save = Сохранить
-button_cancel = Отмена
-button_submit = Применить
-username = Имя пользователя
-email = Email
-system_admin = Системный администратор
-dlg_button_ok = OK
-dlg_button_cancel = Отмена
-registration = Регистрация
-username_description = Ваше имя пользователя.
-email_description = Email адрес, который будет использоваться для сброса пароля.
-full_name = Полное Имя
-full_name_description = Имя и Фамилия.
-password_description = Минимум 7 символов, в которых будет присутствовать по меньшей мере 1 буква нижнего регистра, 1 буква верхнего регистра и 1 цифра.
-confirm_password = Подтвердить Пароль
-note_to_the_admin = Комментарии
-old_password = Старый Пароль
-new_password = Новый Пароль
-forgot_password_description = Введите Email, который вы использовали для регистрации, вам будет выслано письмо для сброса пароля.
-
-projects = Проекты
-repositories = Репозитории
-search = Поиск
-home = Домой
-project = Проект
-owner = Владелец
-repo = Репозитории
-user = Пользователи
-logs = Логи 
-repo_name = Имя Репозитория
-repo_tag = Метка
-add_members = Добавить Участников
-operation = Операция
-advance = Расширенный Поиск
-all = Все
-others = Другие
-start_date = Дата Начала
-end_date = Дата Окончания
-timestamp = Временная метка
-role = Роль
-reset_email_hint = Нажмите на ссылку ниже для сброса вашего пароля
-reset_email_subject = Сброс вашего пароля
-language = Русский
-language_en-US = English
-language_zh-CN = 中文
-language_de-DE = Deutsch
-language_ru-RU = Русский
-language_ja-JP = 日本語
-copyright = Copyright
-all_rights_reserved = Все права защищены.
-index_desc = Проект Harbor представляет собой надежный сервер управления docker-образами корпоративного класса. Компании могут использовать данный сервер в своей инфарструктуе для повышения производительности и безопасности . Проект Harbor может использоваться как в среде разработки так и в продуктивной среде.
-index_desc_0 = Основные преимущества данного решения:
-index_desc_1 = 1. Безопасность: Хранение интеллектуальной собственности внутри организации.
-index_desc_2 = 2. Эффективность: сервер хранения docker образов устанавливается в рамках внутренней сети организации, и может значительно сократить расход Интернет траффика 
-index_desc_3 = 3. Управление доступом: реализована модель RBAC (Ролевая модель управление доступом). Управление пользователями может быть интегрировано с существующими корпоративными сервисами идентификациями такими как AD/LDAP. 
-index_desc_4 = 4. Аудит: Любой доступ к хранилищу логируется и может быть использован для последующего анализа.
-index_desc_5 = 5. GUI-интерфейс: удобная, единая консоль управления.
-index_title = Сервер управления docker-образами корпоративного класса