Make NuGet service index publicly accessible

[KN4CK3R]

Addition to #20734
Fixes #20717

The /index.json endpoint needs to be accessible even if the registry is private. The NuGet client uses this endpoint without authentification.

The old fix only works if the NuGet cli is used with --source <name> but not with --source <url>/index.json.

[silverwind]

So, unauthenticated clients can enumerate NuGet package names? Anything else exposed?

[KN4CK3R]

So, unauthenticated clients can enumerate NuGet package names? Anything else exposed?

No, that would be really bad. The service index exposes the capabilities and endpoints of the NuGet registry. All other requests are authenticated.
The response looks like this:

{
  "version": "3.0.0",
  "resources": [
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/query",
      "@type": "SearchQueryService"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/query",
      "@type": "SearchQueryService/3.0.0-beta"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/query",
      "@type": "SearchQueryService/3.0.0-rc"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/registration",
      "@type": "RegistrationsBaseUrl"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/registration",
      "@type": "RegistrationsBaseUrl/3.0.0-beta"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/registration",
      "@type": "RegistrationsBaseUrl/3.0.0-rc"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/package",
      "@type": "PackageBaseAddress/3.0.0"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget",
      "@type": "PackagePublish/2.0.0"
    },
    {
      "@id": "http://host.docker.internal:3000/api/packages/KN4CK3R/nuget/symbolpackage",
      "@type": "SymbolPackagePublish/4.9.0"
    }
  ]
}

[silverwind]

A test would be nice.

[KN4CK3R]

I already adjusted an existing test for a normal and a private user.

[wxiaoguang]

LGTM, while I think it needs more comments about why there is no permission check for it.

And, maybe someone will worry about "attackers can detect private user names" again, while I think it's acceptable and that's cost of using NuGet package registry.

[KN4CK3R]

And, maybe someone will worry about "attackers can detect private user names" again, while I think it's acceptable and that's cost of using NuGet package registry.

You can detect that with the /users/{user} api too, so I see no difference.

[wxiaoguang]

I agree, so LGTM 😁

[KN4CK3R]

I think that's a definition problem of private. Private like "there is a locked door I know something is behind" or private like "which door?".