From 2667397df3206966d5601038dd423a43cd787918 Mon Sep 17 00:00:00 2001
From: josmueller <46693545+am9zZWY@users.noreply.github.com>
Date: Thu, 13 Aug 2026 12:13:47 +0000
Subject: [PATCH] fix: switch to instance attributes

Store registry_auth and token_lock per downloader instance instead of
as class attributes so that auth state (bearer token, basic auth) does
not leak between different remotes/registries.
---
 CHANGES/+multiple-registries-auth-state.bugfix | 1 +
 pulp_container/app/downloaders.py              | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)
 create mode 100644 CHANGES/+multiple-registries-auth-state.bugfix

diff --git a/CHANGES/+multiple-registries-auth-state.bugfix b/CHANGES/+multiple-registries-auth-state.bugfix
new file mode 100644
index 000000000..9c6cb6315
--- /dev/null
+++ b/CHANGES/+multiple-registries-auth-state.bugfix
@@ -0,0 +1 @@
+Fixed authentication state (bearer token and basic auth) leaking between remotes by storing it per downloader instance instead of on the downloader class.
diff --git a/pulp_container/app/downloaders.py b/pulp_container/app/downloaders.py
index 907fc0958..5622bc423 100644
--- a/pulp_container/app/downloaders.py
+++ b/pulp_container/app/downloaders.py
@@ -25,14 +25,13 @@ class RegistryAuthHttpDownloader(HttpDownloader):
     Additionally, use custom headers from DeclarativeArtifact.extra_data['headers']
     """
 
-    registry_auth = {"bearer": None, "basic": None}
-    token_lock = asyncio.Lock()
-
     def __init__(self, *args, **kwargs):
         """
         Initialize the downloader.
         """
         self.remote = kwargs.pop("remote")
+        self.registry_auth = {"bearer": None, "basic": None}
+        self.token_lock = asyncio.Lock()
 
         super().__init__(*args, **kwargs)