fixed issues from opencode agent

internal/api/handlers/oci.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"golang.org/x/crypto/bcrypt"
 	"xorm.io/xorm"
 
 	"github.com/forgeo/forgebucket/internal/domain/oci"
@@ -513,7 +514,7 @@ func newOCIUploadID() string {
 }
 
 func (h *OCIRegistryHandler) basicAuthOCI(r *http.Request) string {
-	u, _, hasAuth := r.BasicAuth()
+	u, pass, hasAuth := r.BasicAuth()
 	if !hasAuth {
 		return ""
 	}
@@ -521,5 +522,8 @@ func (h *OCIRegistryHandler) basicAuthOCI(r *http.Request) string {
 	if found, _ := h.db.Where("username = ?", u).Get(&user); !found {
 		return ""
 	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(pass)); err != nil {
+		return ""
+	}
 	return u
 }

internal/api/router.go

@@ -211,8 +211,8 @@ func New(cfg *config.Config, engine *xorm.Engine, store sessions.Store, bus even
 						})
 					})
 					r.Get("/artifacts/{artifactID}/download", artifactH.Download)
-				r.Get("/artifacts/{artifactID}/signature", artifactH.GetSignature)
-				r.Get("/artifacts/{artifactID}/verify", artifactH.VerifySignature)
+					r.Get("/artifacts/{artifactID}/signature", artifactH.GetSignature)
+					r.Get("/artifacts/{artifactID}/verify", artifactH.VerifySignature)
 					r.Route("/members", func(r chi.Router) {
 						r.Get("/", memberH.List)
 						r.With(csrf).Post("/", memberH.Add)