fix: harden DynDNS recovery and publish v1.5.1

internal/updateagent/controller.go

@@ -32,10 +32,11 @@ func NewController(runner Runner, logger *slog.Logger) *Controller {
 
 func agentStatus(phase string) updateprotocol.Status {
 	return updateprotocol.Status{
-		Phase:        phase,
-		UpdatedAt:    time.Now().UTC(),
-		AgentVersion: buildinfo.Version,
-		Protocol:     buildinfo.UpdateProtocolVersion,
+		Phase:         phase,
+		AnonymousPull: true,
+		UpdatedAt:     time.Now().UTC(),
+		AgentVersion:  buildinfo.Version,
+		Protocol:      buildinfo.UpdateProtocolVersion,
 	}
 }
 
@@ -69,7 +70,9 @@ func (c *Controller) updateHandler(w http.ResponseWriter, r *http.Request) {
 	request.Version = strings.TrimSpace(request.Version)
 	request.CurrentVersion = strings.TrimSpace(request.CurrentVersion)
 	request.RegistryUsername = strings.TrimSpace(request.RegistryUsername)
-	if !updateprotocol.ValidVersion(request.Version) || !updateprotocol.ValidVersion(request.CurrentVersion) || request.RegistryUsername == "" || len(request.RegistryUsername) > 128 || len(request.RegistryToken) < 8 || len(request.RegistryToken) > 1024 {
+	anonymous := request.RegistryUsername == "" && request.RegistryToken == ""
+	credentialValid := request.RegistryUsername != "" && len(request.RegistryUsername) <= 128 && len(request.RegistryToken) >= 8 && len(request.RegistryToken) <= 1024
+	if !updateprotocol.ValidVersion(request.Version) || !updateprotocol.ValidVersion(request.CurrentVersion) || (!anonymous && !credentialValid) {
 		http.Error(w, "invalid update request", http.StatusBadRequest)
 		return
 	}
@@ -90,7 +93,7 @@ func (c *Controller) begin(version string) bool {
 		return false
 	}
 	now := time.Now().UTC()
-	c.status = updateprotocol.Status{Phase: updateprotocol.PhaseQueued, TargetVersion: version, Message: "Update eingereiht", StartedAt: now, UpdatedAt: now, AgentVersion: buildinfo.Version, Protocol: buildinfo.UpdateProtocolVersion}
+	c.status = updateprotocol.Status{Phase: updateprotocol.PhaseQueued, TargetVersion: version, Message: "Update eingereiht", StartedAt: now, UpdatedAt: now, AgentVersion: buildinfo.Version, Protocol: buildinfo.UpdateProtocolVersion, AnonymousPull: true}
 	return true
 }