fix(replication): Normalise CORE_URL comparison in isLocalHarbor

Core stamps the local replication source URL from its own CORE_URL and
jobservice compares the result against its own. A deployment that sets an
explicit default port on only one of the two — http://harbor-core versus
http://harbor-core:80, which the documented SBOM workaround did — made the
raw string compare fail. The secret authorizer was then skipped and the
adapter fell back to basic auth with an empty username, so every private
project failed replication with 401 while public ones still worked through
anonymous pull.

Parse both URLs and compare scheme, host and port with :80 and :443 made
explicit for http and https. If either side fails to parse, or carries no
scheme or host, the exact string compare still decides.

Signed-off-by: Prasanth Baskar <prasanth@8gears.com>

Author: bupd

src/pkg/reg/adapter/harbor/base/adapter.go

@@ -17,6 +17,7 @@ package base
 import (
 	"fmt"
 	"net/http"
+	neturl "net/url"
 	"os"
 	"strconv"
 	"strings"
@@ -317,8 +318,53 @@ type Project struct {
 	RegistryID int64          `json:"registry_id"`
 }
 
+// isLocalHarbor reports whether the given URL points at the Harbor instance
+// this process belongs to.
+//
+// Core and jobservice each read their own CORE_URL. Core stamps the local
+// replication source URL from its value, jobservice compares against its own,
+// and a deployment that sets an explicit default port on only one of them
+// (http://harbor-core vs http://harbor-core:80) made the raw string compare
+// fail. The secret authorizer was then skipped and replication of private
+// projects fell back to basic auth with an empty username, returning 401.
+// Compare the addressable parts instead, treating :80 as the default for http
+// and :443 for https. If either URL fails to parse, the exact compare above
+// stands.
 func isLocalHarbor(url string) bool {
-	return url == os.Getenv("CORE_URL")
+	coreURL := os.Getenv("CORE_URL")
+	if url == coreURL {
+		return true
+	}
+	u, err := neturl.Parse(url)
+	if err != nil {
+		return false
+	}
+	core, err := neturl.Parse(coreURL)
+	if err != nil {
+		return false
+	}
+	// A bare host without a scheme parses into Path, which would make two
+	// unrelated values compare equal on empty scheme and host.
+	if u.Scheme == "" || u.Host == "" || core.Scheme == "" || core.Host == "" {
+		return false
+	}
+	return strings.EqualFold(u.Scheme, core.Scheme) &&
+		strings.EqualFold(hostPort(u), hostPort(core)) &&
+		strings.TrimSuffix(u.Path, "/") == strings.TrimSuffix(core.Path, "/")
+}
+
+// hostPort returns host:port with the scheme's default port made explicit.
+func hostPort(u *neturl.URL) string {
+	port := u.Port()
+	if port == "" {
+		switch strings.ToLower(u.Scheme) {
+		case "http":
+			port = "80"
+		case "https":
+			port = "443"
+		}
+	}
+	return u.Hostname() + ":" + port
 }
 
 // check whether the current process is running inside core

src/pkg/reg/adapter/harbor/base/adapter_test.go

@@ -315,3 +315,41 @@ func TestListProjects(t *testing.T) {
 	require.Equal(t, "p1", projects[0].Name)
 	require.Equal(t, "p2", projects[1].Name)
 }
+
+func TestIsLocalHarbor(t *testing.T) {
+	cases := []struct {
+		name    string
+		coreURL string
+		url     string
+		want    bool
+	}{
+		{"identical", "http://harbor-core", "http://harbor-core", true},
+		// The deployment the defect was found on: core.extraEnv pins
+		// CORE_URL=http://harbor-core:80 for the pre-2.15.5 SBOM workaround
+		// while jobservice keeps the chart's portless value, so jobservice
+		// compares the source URL core stamped against its own.
+		{"core pins the port through extraEnv, jobservice does not", "http://harbor-core", "http://harbor-core:80", true},
+		{"jobservice pins the port through extraEnv, core does not", "http://harbor-core:80", "http://harbor-core", true},
+		{"explicit https default port", "https://harbor-core", "https://harbor-core:443", true},
+		{"trailing slash", "http://harbor-core", "http://harbor-core/", true},
+		{"uppercase host", "http://harbor-core", "http://HARBOR-CORE", true},
+		{"non-default port on both", "http://harbor-core:8080", "http://harbor-core:8080", true},
+		{"different host", "http://harbor-core", "http://other-harbor", false},
+		{"different non-default port", "http://harbor-core:8080", "http://harbor-core:8081", false},
+		{"http default port against non-default", "http://harbor-core", "http://harbor-core:8080", false},
+		{"different scheme", "http://harbor-core", "https://harbor-core", false},
+		{"https default port is not http default port", "https://harbor-core", "http://harbor-core:443", false},
+		{"different path", "http://harbor-core", "http://harbor-core/registry", false},
+		{"unparseable registry URL", "http://harbor-core", "http://[::1", false},
+		{"schemeless registry URL", "http://harbor-core", "harbor-core", false},
+		{"empty CORE_URL against schemeless URL", "", "harbor-core", false},
+		{"empty CORE_URL against absolute URL", "", "http://harbor-core", false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("CORE_URL", tc.coreURL)
+			assert.Equal(t, tc.want, isLocalHarbor(tc.url))
+		})
+	}
+}