## :mag: Summary Two surfaces resolve the same repository twice on every request: the OCI format mount, below its dispatcher, and the management API. In both cases the authorization layer has already performed the lookup to decide whether to admit the request, and the result is discarded rather than published to the code that serves it. Measured at 45b52905d. Each resolve is **two** statements, not one — a `namespaces` lookup by slug and a `repositories` lookup by name — so a duplicated resolve costs four queries where two would do. On the management API only the repository half duplicates; see `## :white_check_mark: What is already settled`. This issue was filed against two duplications on 2026-07-29, the URL path being parsed twice and the repository being resolved twice, across every format mount. The parse half is settled, and the resolve half is settled on the Maven and npm mounts. What remains is the two cases below. The settled part is recorded so a reader does not re-derive it. ## :repeat: Case 1 — the seven OCI per-action handlers The dispatcher reuses the authorization layer's resolution correctly (`DispatchHandler.resolveAndGate`, `internal/format/oci/handler.go:519`), but it delegates the raw request to the per-action handlers, and each of those resolves the route's `<slug>/<repository_name>` pair again: | Site | Route | | --- | --- | | `internal/format/oci/blob.go:279` | blob read | | `internal/format/oci/manifest_read.go:201` | manifest `GET`/`HEAD` | | `internal/format/oci/manifest_push.go:91` | manifest `PUT` | | `internal/format/oci/manifest_delete.go:225` | manifest `DELETE` | | `internal/format/oci/tags.go:210` | tag listing | | `internal/format/oci/referrers.go:222` | referrers | | `internal/format/oci/upload.go:406` | blob upload | `resolveAndGate` is the pattern to copy, and its doc comment carries the reasoning: ```go res, slug, repositoryName, ok := namespace.ResolutionFromContext(r.Context()) if !ok || slug != route.Slug || repositoryName != route.RepositoryName { resolved, err := h.resolver.ResolveRepository(r.Context(), route.Slug, route.RepositoryName) ... } ``` The guard on `slug` and `repositoryName` is load-bearing rather than defensive: `namespace.ResolutionFromContext`'s contract obliges every caller to check the seeded values against the route, because a resolution computed for a different repository would gate a write against the wrong namespace's `suspended_at`. Two comments state that obligation from the other direction, at `internal/format/oci/remote_serve.go:13` and `internal/format/oci/remote_slots.go:30`. Since the same guard would otherwise be copied to seven sites, the candidate shape is one helper in `internal/format/oci` taking the resolver and the parsed route and returning the resolution. Naming is for whoever implements it. ### These handlers are self-contained on purpose Every one of the seven parses the route itself as well as resolving it, and that is deliberate: `internal/format/oci/blob.go:86` and `internal/format/oci/upload.go:160` document the handler as self-contained, and four sites justify the resolve as insurance for being mounted outside the dispatcher — `internal/format/oci/blob.go:289`, `internal/format/oci/manifest_push.go:61`, `internal/format/oci/manifest_delete.go:233` and `internal/format/oci/upload.go:416`, each naming "the dispatcher's `resolveAndGate` choke point". That property is worth keeping and the reuse pattern preserves it. `namespace.ResolutionFromContext` returns `ok=false` when no holder was seeded, which is exactly the standalone-mount case, so the fallback arm runs and the handler resolves as it does today. Those four comments need updating to describe the reuse rather than deleting. ## :repeat: Case 2 — the management API repository row The repository row is read twice per repository-scoped request: | Site | Purpose | | --- | --- | | `internal/managementapi/authorize.go:115` | `enforcer.repos.FindByName(ctx, ns.ID, name)`, to authorize the request | | `internal/managementapi/resolve.go:297` | `findRepositoryForRequest` calling the same finder, to serve it | The authorized row is never published, so the handler fetches it again. The mechanism to copy is in this package already: `resolveSlug` resolves the namespace once and attaches it with `withNamespace` (`internal/managementapi/resolve.go:129`), which is why the namespace half does not duplicate. Publishing the authorized repository row the same way is the shape of the fix, and it needs no new seam. This case differs from case 1 in what it reuses — a `*model.Repositories` row on this package's own context rather than a `namespace.Resolution` on the shared holder — so the two cases are independent changes that can land in either order. ## :no_entry_sign: Ruled out, with reasons Named so the set is not re-derived from a grep on the finders: - **The Maven and npm mounts.** Both resolve once; see `## :white_check_mark: What is already settled`. - `internal/format/oci/upload.go:611`. Resolves `from.slug` and `from.repository` for a cross-repository blob mount, a different repository than the route's, so it is not a duplicate. - `internal/format/oci/handler.go:522`. The dispatcher's fallback arm is the pattern being copied, not a site to change. - `internal/managementapi/detail.go:149`. Re-reads the row after a mutation deliberately, to return the current state. - The six `h.images.FindByName` calls in the OCI handlers (`blob.go:402`, `manifest_read.go:225`, `manifest_push.go:284`, `manifest_delete.go:289`, `referrers.go:276`, `tags.go:251`). These resolve the **image** tier below the repository, which no authorization decision resolves, so they are first lookups rather than second ones. - The `FindBySlug` calls at `cmd/artifact-registry/wire_oci.go:552`, `wire_maven.go:502` and `wire_npm.go:256`. Error-translation adapters injected into the resolvers (`wire_oci.go:103`), so they are the resolver's own lookup, not an extra one. - The repeated **parse** on the OCI mount. It is the same shared function against no dependency, so the cost is a `strings.Split` and a suffix peel, and three executions of one function cannot disagree. ## :white_check_mark: What is already settled **The path is no longer parsed by two implementations.** Each format's grammar lives in one leaf package that both the authorization layer and the dispatcher import: `ociroute` (516816931), `mavenroute` (cff0fb11e) and `npmroute` (b1c4a5e7f). `internal/authz/oci.go`, `internal/authz/maven.go` and `internal/authz/npm.go` consume them, and `internal/format/oci/handler.go:43` forwards to `ociroute.ParseRoute`, declared as a function rather than a `var` so it cannot be reassigned at runtime. The drift class the original description named — one grammar with two implementations, where the authorization side fails closed on a route the dispatcher serves — is closed. **The Maven and npm mounts resolve once.** Each has a composition-root adapter that resolves through the format's own resolver, seeds the format's resolution holder, and narrows the result for the authorization layer: `mavenAuthzResolverAdapter` (`cmd/artifact-registry/wire_maven.go:616`) and `npmAuthzResolverAdapter` (`cmd/artifact-registry/wire_npm.go:665`), with the holders installed at `cmd/artifact-registry/wire_root_dispatcher.go:120` and `:142`. The format side then replays instead of resolving: `internal/format/maven/resolver.go:212` and `internal/format/npm/middleware.go:106`. npm books which arm it took on `gitlab_artifact_registry_npm_resolutions_total{resolution_source}`, so the replay is verifiable in production rather than only by reading the wiring. Maven has no counterpart counter. **The OCI dispatcher tier and the management API namespace half.** The dispatcher reuse landed as 5e67024e5, closing https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/455 for that tier. The management API's namespace reuse is `withNamespace`, described in case 2. ## :white_check_mark: Acceptance criteria 1. Each of the seven OCI sites reads the context resolution, guarded on the route's slug and repository name, and resolves only when the guard fails or no holder is present. 1. A request to each of those routes through the wrapped dispatcher performs exactly one `ResolveRepository`, asserted rather than reasoned about. 1. An OCI handler mounted without the authorization middleware still resolves and still answers identically, so the standalone-mount property its comments protect is covered by a test. 1. The four comments naming the `resolveAndGate` choke point describe the reuse the change leaves in place. 1. A repository-scoped management API request reads the repository row once, asserted the same way. 1. The management API reuse fails closed the way `withNamespace` does: a handler that finds no published row resolves it rather than serving without one. ## :link: Related - https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/154 — the slug-to-namespace resolver being reimplemented per format. Sharing that half would give the two cases here one resolution type to carry, but neither depends on it.