{"record":{"id":"db104d3ef0f4b6fa","repo":"goharbor/harbor","slug":"not-found-db104d","errorCode":"NOT_FOUND","errorMessage":"repository %q does not match project repository filter","messagePattern":"repository %q does not match project repository filter","errorType":"http","errorClass":"NotFoundError","httpStatus":404,"severity":"error","filePath":"src/server/middleware/repoproxy/proxy.go","lineNumber":284,"sourceCode":"\t}\n\tlog.Debugf(\"repository %q match result: %v (filter: %q, kind: %s)\", repository, matched, filterPattern, filterKind)\n\treturn matched\n}\n\n// checkRepositoryFilter returns a NotFoundError if the project has a proxy_cache_filter_pattern\n// set and the artifact's repository does not match it. It is enforced for both manifest and\n// blob requests so the filter acts as an access boundary rather than a manifest-only convenience,\n// since a client that knows a blob digest out-of-band could otherwise bypass the filter.\nfunc checkRepositoryFilter(p *proModels.Project, art lib.ArtifactInfo) error {\n\tfilterPattern, ok := p.GetMetadata(proModels.ProMetaProxyCacheFilterPattern)\n\tif !ok || filterPattern == \"\" {\n\t\treturn nil\n\t}\n\tfilterKind, _ := p.GetMetadata(proModels.ProMetaProxyCacheFilterKind)\n\tremoteRepo := strings.TrimPrefix(art.Repository, art.ProjectName+\"/\")\n\tif !matchRepositoryFilter(remoteRepo, filterPattern, filterKind) {\n\t\tlog.Debugf(\"blocked proxy cache pull for project %q repository %q: repository does not match filter %q (kind: %s)\", p.Name, remoteRepo, filterPattern, filterKind)\n\t\treturn errors.NotFoundError(fmt.Errorf(\"repository %q does not match project repository filter\", remoteRepo))\n\t}\n\treturn nil\n}\n\n// upstreamRegistryConnectionKey get upstream registry connection key\nfunc upstreamRegistryConnectionKey(art lib.ArtifactInfo) string {\n\tlimitOnProject := os.Getenv(upstreamRegistryLimitOnProject)\n\tif strings.EqualFold(\"true\", limitOnProject) {\n\t\treturn fmt.Sprintf(\"{upstream_registry_connection}:%s\", art.ProjectName)\n\t}\n\treturn fmt.Sprintf(\"{upstream_registry_connection}:%s:%s\", art.Repository, art.Digest)\n}\n\nfunc handleManifest(w http.ResponseWriter, r *http.Request, next http.Handler) error {\n\tctx := r.Context()\n\tart, p, proxyCtl, err := preCheck(ctx, true)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/server/middleware/repoproxy/proxy.go#L266-L302","documentation":"Error \"repository %q does not match project repository filter\" thrown in goharbor/harbor.","triggerScenarios":"Thrown at src/server/middleware/repoproxy/proxy.go:284 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}