Function auth_when_required 

pub async fn auth_when_required(
    __arg0: State<(AppStateData, Accepts)>,
    request: Request,
    next: Next,
) -> Response

Middleware that rejects requests without a login of one of the accepted methods when settings.registry.auth_required is true.

Endpoints for cargo answer with a WWW-Authenticate header. Cargo and other registry clients retry with credentials after a 401, so /config.json is not public even if auth_required is true. See:

• https://github.com/kellnr/kellnr/pull/773#discussion_r2300752458
• https://doc.rust-lang.org/cargo/reference/registry-index.html#sparse-authentication

If both methods are accepted, every failed login is a 401.