Token endpoint crashes with NotNullConstraintViolation for clients that omit the account query parameter #70

Summary

The /v2/token endpoint returns a 500 Internal Server Error for registry clients that do not include the non-standard account query parameter in their token request. This breaks container image pulls from Capsules for clients like Cincinnati (OpenShift Update Service).

Root Cause

In container_gateway_api.rb:188, the code that extracts the username from the Basic auth header is gated behind flatpak_client?:

if flatpak_client? && auth_header.raw_header.present?

For non-Flatpak clients that omit the account query parameter, request.params['account'] remains nil. This nil value is passed to insert_token, which calls find_or_create(name: nil) in container_gateway_main.rb:313, violating the NOT NULL constraint on the users table.

Error

2026-09-04T16:09:19 dee59286 [W] Error processing request 'dee59286-ce42-4eb8-b089-2005810635b5: <Sequel::NotNullConstraintViolation>: PG::NotNullViolation: ERROR:  null value in column "name" of relation "users" violates not-null constraint

Steps to Reproduce

1. Install a Capsule with the container gateway enabled (--foreman-proxy-content-enable-docker true)
2. Sync a content view containing container repositories to the Capsule
3. Attempt to pull an image using a client that sends Basic auth credentials but does not include the account query parameter (e.g., Cincinnati, or any spec-compliant client)

Clients like podman and skopeo include account as a convenience and are not affected.

Expected Behavior

The token endpoint should extract the username from the Basic auth header when the account parameter is missing, regardless of client type.

Spec Reference

The account parameter is not defined in the CNCF Distribution token authentication spec. The spec defines only service, offline_token, client_id, and scope as query parameters for the token endpoint.

Proposed Fix

Replace the flatpak_client? guard with a check for a missing account param:

if request.params['account'].nil? && auth_header.raw_header.present?

This extracts the username from the Basic auth header for any client that omits the account parameter, not just Flatpak.