Bugfix: do not serve freeze/mirror images via the Wave proxy token path

src/main/groovy/io/seqera/wave/core/RouteHandler.groovy

@@ -62,6 +62,12 @@ class RouteHandler {
             if( !request ) {
                 throw new NotFoundException("Unknown Wave container for token '$token'")
             }
+            // freeze and mirror requests publish the image to the target registry and are
+            // meant to be pulled directly from there - they must not be served via the Wave
+            // proxy token path (see also ContainerRequest.durable)
+            if( request.durable() ) {
+                throw new NotFoundException("Wave container for token '$token' is not available via the proxy")
+            }
             // the image name (without tag) must match
             final coords = request.coordinates()
             if( image != coords.image )

src/test/groovy/io/seqera/wave/core/RouteHandlerTest.groovy

@@ -133,4 +133,22 @@ class RouteHandlerTest extends Specification {
 
     }
 
+    @Unroll
+    def 'should reject proxy pull for durable freeze/mirror requests' () {
+        given:
+        def tokenService = Mock(ContainerRequestService)
+
+        when:
+        new RouteHandler(tokenService).parse(REQ_PATH)
+        then:
+        1 * tokenService.getRequest(TOKEN) >> REQUEST
+        and:
+        thrown(NotFoundException)
+
+        where:
+        REQ_PATH                                      | TOKEN | REQUEST
+        '/v2/wt/a1/library/ubuntu/manifests/latest'   | 'a1'  | ContainerRequest.of(containerImage: 'ubuntu:latest', freeze: true)
+        '/v2/wt/b2/library/ubuntu/blobs/latest'       | 'b2'  | ContainerRequest.of(containerImage: 'ubuntu:latest', type: ContainerRequest.Type.Mirror)
+    }
+
 }